joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400728b0
Capabilities:
Check if file exists
Move file

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edx, 8
lea rcx, [rsp + 0x68]
call fcn.14000c8b0
lea rcx, [rsp + 0x40]
call fcn.14001da80
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.1400101f0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000fff0
nop
lea rcx, [rsp + 0x40]
call fcn.140010220
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.14000c8b0
lea r8, str.BlueStacks
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.14000fed0
nop
mov edx, 8
lea rcx, [rsp + 0x70]
call fcn.14000c8b0
lea r8, [0x1401d5008]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.14000fed0
nop
lea rcx, [rsp + 0x60]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14007299e
lea rcx, [rsp + 0x70]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x60]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x68]
call fcn.14000ffc0
jmp 0x1400729e9
lea rcx, [rsp + 0x70]
call fcn.140010050
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
call fcn.140010050
mov rcx, qword [rsp + 0x30]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop
lea rcx, [rsp + 0x70]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x60]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x68]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140138320
add rsp, 0x88
ret
Function at 0x140072a00
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push rdi
sub rsp, 0x300
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea r8, [0x1401d5460]
lea rdx, [0x140217a30]
lea rcx, [rsp + 0xc0]
call fcn.140025700
nop
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 8
lea rcx, [rsp + 0xb8]
call fcn.14000c8b0
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xb8]
call fcn.14000fff0
nop
mov edx, 8
lea rcx, [rsp + 0xb0]
call fcn.14000c8b0
lea r8, str.yuanshen_setup_20220315181251.exe
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xb0]
call fcn.14000fed0
nop
lea rcx, [rsp + 0xb0]
call fcn.140010050
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0xc0]
call fcn.1400101f0
mov rcx, qword [rsp + 0x30]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, [rsp + 0xb0]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140072b9b
lea rdx, [0x1401d51b8]
lea rcx, [rsp + 0x70]
call fcn.140009a10
nop
lea rcx, [rsp + 0xb0]
call fcn.140010050
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140023080
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.14001ab50
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call fcn.14001db60
nop
lea rcx, [rsp + 0x90]
call fcn.140009960
nop
lea rcx, [rsp + 0x50]
call fcn.140010220
nop
lea rcx, [rsp + 0x70]
call fcn.140009960
nop
lea rcx, [rsp + 0xb0]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0xb8]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0xc0]
call fcn.140010220
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140138320
add rsp, 0x300
pop rdi
ret
Function at 0x140072be0
Capabilities:
Check if file exists
Persist via run registry key

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.14001e040
mov dword [rsp + 0x20], eax
mov edx, 8
lea rcx, [rsp + 0x48]
call fcn.14000c8b0
lea rcx, [rsp + 0x48]
call fcn.140022b50
nop
cmp dword [rsp + 0x20], 0x40
jne 0x140072c3c
lea rdx, str.C:Program_Files__x86_ByteDancedouyin_traydouyin_tray.exe
lea rcx, [rsp + 0x48]
call fcn.140010d40
jmp 0x140072c4d
lea rdx, str.C:Program_FilesByteDancedouyin_traydouyin_tray.exe
lea rcx, [rsp + 0x48]
call fcn.140010d40
lea rcx, [rsp + 0x48]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140072c73
lea rcx, [rsp + 0x48]
call fcn.14000ffc0
jmp 0x140072db6
mov edx, Ordinal_26
lea rcx, [rsp + 0x60]
call fcn.14000c8b0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140018330
nop
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.14000c8b0
lea rcx, [rsp + 0x50]
call fcn.140022b50
nop
lea rdx, [0x1401d5580]
lea rcx, [rsp + 0x50]
call fcn.140010d40
lea rcx, [rsp + 0x50]
call fcn.140010050
mov r9d, 0xf013f
mov r8, rax
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x60]
call fcn.140018590
test eax, eax
je 0x140072d07
lea rcx, [rsp + 0x50]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x60]
call fcn.140018370
nop
lea rcx, [rsp + 0x48]
call fcn.14000ffc0
jmp 0x140072db6
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.14000c8b0
lea r8, [rsp + 0x48]
lea rdx, [0x1401b50cc]
lea rcx, [rsp + 0x38]
call fcn.140022580
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea r8, str.____start_typeautorun
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.14000fed0
nop
lea rcx, [rsp + 0x38]
call fcn.14000ffc0
lea rcx, [rsp + 0x58]
call fcn.140010050
mov r9d, 1
mov r8, rax
lea rdx, str.douyinTray
lea rcx, [rsp + 0x60]
call fcn.140018930
lea rcx, [rsp + 0x60]
call fcn.140018390
nop
lea rcx, [rsp + 0x58]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x50]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x60]
call fcn.140018370
nop
lea rcx, [rsp + 0x48]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140138320
add rsp, 0x88
ret

Function at 0x140073070
Capabilities:
Delete directory
Delete file
Execute anti-debugging instructions
Move file
Persist via lnk shortcut

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x768
mov qword [rsp + 0x220], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x750], rax
lea rcx, str._rDEB
jmp 0x140240f93
Function at 0x140074020
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
sub rsp, 0x1f8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
lea rcx, [rsp + 0x168]
call fcn.14001a240
nop
lea rcx, [rsp + 0x128]
call fcn.140010250
nop
lea rcx, [rsp + 0x148]
call fcn.140010250
nop
call fcn.140071610
lea r8, [0x1401d60e8]
lea rdx, [0x140217a30]
lea rcx, [rsp + 0xa0]
call fcn.140025700
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x128]
call fcn.140015370
nop
lea rcx, [rsp + 0xa0]
call fcn.140010220
lea rcx, [rsp + 0x128]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140074184
lea rcx, [rsp + 0xe0]
call fcn.140019840
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea r8, [0x1401d6110]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xc0]
call fcn.1400256a0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x148]
call fcn.140015370
nop
lea rcx, [rsp + 0xc0]
call fcn.140010220
nop
lea rcx, [rsp + 0xe0]
call fcn.140010220
lea rcx, [rsp + 0x148]
call fcn.1400101f0
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x128]
call fcn.1400101f0
mov r8d, 1
mov rcx, qword [rsp + 0x78]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r8, str.Windows_security_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x100]
call fcn.140025700
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x128]
call fcn.140015370
nop
lea rcx, [rsp + 0x100]
call fcn.140010220
lea rcx, [rsp + 0x128]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x148]
call fcn.140010220
nop
lea rcx, [rsp + 0x128]
call fcn.140010220
nop
lea rcx, [rsp + 0x168]
call fcn.140010220
jmp 0x14007435a
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.140138320
add rsp, 0x1f8
ret

Function at 0x140074380
Capabilities:
Get common file path
Write file on windows

Disassembly:
push rdi
sub rsp, 0x330
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rcx, [0x1401d6208]
jmp 0x140242626
Function at 0x140074940
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x108
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xd8]
call fcn.14001a240
nop
lea r8, str.Program_FilesOffice2013
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xb8]
call fcn.140025700
nop
lea rcx, [rsp + 0xb8]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400749c7
lea rcx, [rsp + 0xb8]
call fcn.140010220
nop
lea rcx, [rsp + 0xd8]
call fcn.140010220
jmp 0x140074a62
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea rdx, [0x1401b50dc]
mov rcx, qword [rsp + 0x40]
call fcn.140023080
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
call fcn.1400230d0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 0x2bf20
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov r8b, 1
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.1400193e0
nop
lea rcx, [rsp + 0xb8]
call fcn.140010220
nop
lea rcx, [rsp + 0xd8]
call fcn.140010220
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140138320
add rsp, 0x108
ret
Function at 0x140074ef0
Capabilities:
Persist via run registry key

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xd8
mov qword [rsp + 0x68], 0xfffffffffffffffe
lea rcx, [0x1401d6610]
jmp 0x140242e6d

Function at 0x140075120
Capabilities:
Check if file exists
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4b0
mov qword [rsp + 0x150], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
lea rcx, [0x1401d67f8]
jmp 0x1402430a3
Function at 0x14007a660
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2f8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rcx, qword [rsp + 0x300]
call fcn.140010e90
dec eax
mov edx, eax
mov rcx, qword [rsp + 0x300]
call fcn.140037850
movzx eax, ax
cmp eax, 0x5c
je 0x14007a6c1
lea rdx, [0x1401b52a4]
mov rcx, qword [rsp + 0x300]
call fcn.1400229e0
lea r8, [0x1401d8bb0]
mov rdx, qword [rsp + 0x300]
lea rcx, [rsp + 0x40]
call fcn.14000fed0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140022bc0
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
call fcn.14000ffc0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14007a737
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x300]
call fcn.14000ffc0
movzx eax, byte [rsp + 0x20]
jmp 0x14007a851
mov eax, dword [rsp + 0x90]
and eax, 0x10
test eax, eax
je 0x14007a7b7
lea rdx, [0x1401b5294]
lea rcx, [rsp + 0xbc]
call fcn.140146e70
test eax, eax
je 0x14007a7b5
lea rdx, [0x1401d8bcc]
lea rcx, [rsp + 0xbc]
call fcn.140146e70
test eax, eax
je 0x14007a7b5
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0xbc]
mov rdx, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x48]
call fcn.14000fed0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14007a660
jmp 0x14007a7fe
lea r8, [rsp + 0xbc]
mov rdx, qword [rsp + 0x300]
lea rcx, [rsp + 0x70]
call fcn.14000fed0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.140022bc0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x70]
call fcn.14000ffc0
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14007a737
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x300]
call fcn.140022bc0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [rsp + 0x21], 1
mov rcx, qword [rsp + 0x300]
call fcn.14000ffc0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140138320
add rsp, 0x2f8
ret
Function at 0x14007a870
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x2b0]
mov rcx, rax
call fcn.140022b50
nop
mov rax, qword [rsp + 0x2b0]
add rax, 8
mov rcx, rax
call fcn.140022b50
nop
lea rcx, [rsp + 0x58]
call fcn.140009a60
nop
lea rcx, [rsp + 0x58]
call fcn.14007a390
lea rcx, [rsp + 0x58]
call fcn.1400097a0
mov rcx, qword [rsp + 0x2b0]
mov rdx, rax
call fcn.140023e40
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.14000c8b0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.14000fff0
nop
lea rdx, str.Temp
lea rcx, [rsp + 0x50]
call fcn.1400229e0
lea rcx, [rsp + 0x50]
call fcn.140022bc0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x2b0]
mov r8, rax
lea rdx, [0x1401b52b4]
lea rcx, [rsp + 0x40]
call fcn.140022580
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140022a10
nop
lea rcx, [rsp + 0x40]
call fcn.14000ffc0
lea rcx, [rsp + 0x50]
call fcn.140022bc0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14007a9e1
mov rax, qword [rsp + 0x2b0]
add rax, 8
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140022a40
nop
lea rcx, [rsp + 0x50]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x58]
call fcn.140009960
nop
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140138320
add rsp, 0x2a0
pop rdi
ret
Function at 0x14007b660
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov edx, 8
lea rcx, [rsp + 0x88]
call fcn.14000c8b0
lea rcx, [rsp + 0x58]
call fcn.14001a240
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.1400101f0
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.14000fff0
nop
lea rcx, [rsp + 0x58]
call fcn.140010220
mov edx, 8
lea rcx, [rsp + 0x80]
call fcn.14000c8b0
lea r8, str.Windows_securitywlansvc
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x80]
call fcn.14000fed0
nop
lea rcx, [rsp + 0x80]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14007b73a
lea rcx, [rsp + 0x80]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x88]
call fcn.14000ffc0
jmp 0x14007b7a4
mov byte [rsp + 0x78], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.14007b8e0
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x80]
call fcn.140010050
mov byte [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov r8, rcx
xor edx, edx
mov rcx, rax
call fcn.14001ad30
nop
lea rcx, [rsp + 0x80]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x88]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140138320
add rsp, 0xa0
pop rdi
ret
Function at 0x1400884f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax]
xor eax, ecx
and eax, 0xff
cdqe
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx]
shr ecx, 8
mov rdx, qword [rsp + 0x28]
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov rcx, qword [rsp + 0x20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
and eax, 0xff
mov rcx, qword [rsp + 0x20]
add eax, dword [rcx + 4]
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
imul eax, dword [rax + 4], 0x8088405
inc eax
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
shr eax, 0x18
mov dword [rsp], eax
mov rax, qword [rsp + 0x20]
mov ecx, dword [rsp]
mov eax, dword [rax + 8]
xor eax, ecx
and eax, 0xff
cdqe
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 8]
shr ecx, 8
mov rdx, qword [rsp + 0x28]
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 8], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x18
ret
Function at 0x14008b900
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [rsp + 0x98]
shr eax, 0x10
lea r8, [rsp + 0x50]
movzx edx, word [rsp + 0x98]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140138320
add rsp, 0x88
ret

Function at 0x14008b9e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x40]
call fcn.1401524bc
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14008c6b0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1d8
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov qword [0x1402179c0], 0
mov qword [0x1402179b8], 0
lea rcx, [0x140218268]
call fcn.140015600
mov qword [rsp + 0x68], 0
movzx eax, byte [0x1401b219e]
mov byte [rsp + 0xb0], al
lea rax, [rsp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0x10f
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x30], 0
mov r8d, 0xff
mov rdx, qword [rsp + 0x1f0]
lea rcx, [rsp + 0xb0]
call fcn.140151db0
mov eax, 1
imul rax, rax, 0x100
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0x110
jae 0x14008c799
jmp 0x14008c79e
call fcn.140138480
mov rax, qword [rsp + 0x60]
mov byte [rsp + rax + 0xb0], 0
lea rcx, [rsp + 0x70]
call fcn.140084c90
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x1f0]
call fcn.1400897d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14008c825
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
dec qword [rsp + 0x40]
inc qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14008c7e6
mov rax, qword [rsp + 0x40]
lea rcx, str..zip
mov rdi, rax
mov rsi, rcx
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xb0]
call fcn.1400897d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14008c850
mov r8, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1f0]
lea rcx, str.Cannot_open__s_or__s.zip_n
call fcn.140017c00
xor al, al
jmp 0x14008c929
lea rdx, [rsp + 0xb0]
lea rcx, str._s_opened_n
call fcn.140017c00
mov rcx, qword [rsp + 0x30]
call fcn.14008bd30
cmp dword [rsp + 0x50], 1
jne 0x14008c888
mov rcx, qword [rsp + 0x30]
call fcn.14008bd30
mov dword [rsp + 0x38], eax
jmp 0x14008c91d
cmp dword [rsp + 0x54], 1
jne 0x14008c91d
mov rcx, qword [rsp + 0x1f8]
call fcn.140152360
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x58], 0
je 0x14008c8ca
cmp dword [rsp + 0x5c], 0
je 0x14008c8ca
mov rdx, qword [rsp + 0x1f8]
lea rcx, str.Error_changing_into__s__aborting_n
call fcn.140017c00
xor al, al
jmp 0x14008c929
cmp qword [rsp + 0x68], 0
jne 0x14008c8f3
mov r9, qword [rsp + 0x200]
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x30]
call fcn.14008c540
mov dword [rsp + 0x38], eax
jmp 0x14008c91d
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call fcn.14008c630
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call fcn.140089880
mov al, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140138320
add rsp, 0x1d8
pop rdi
pop rsi
ret
Function at 0x140092b20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1008
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140092b6d
cmp dword [rsp + 0x50], 1
jne 0x140092b6d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
add rsp, 0x30
pop rbx
ret

Function at 0x140094eb0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
lea rax, [rcx + rdx]
mov rbp, rax
mov rbx, rcx
sub rbp, rcx
mov esi, 0x1505
cmp rcx, rax
cmova rbp, rdi
test rbp, rbp
je 0x140094743
movzx ecx, byte [rbx]
call fcn.1400a40e0
imul rsi, rsi, 0x21
movsx rcx, al
lea rbx, [rbx + 1]
xor rsi, rcx
inc rdi
cmp rdi, rbp
jb 0x140094724
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
mov rbp, qword [rsp + 0x38]
movabs rax, 0x410410410410411
mul rsi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rsi, rcx
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140094ee6
call fcn.1400a5060
test al, al
jne 0x140094ee6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140095110
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400946f0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14009f780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xab7], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x14009f83e
cmp qword [rcx + 0x268], 0
je 0x14009f7fe
mov qword [rsp + 0x40], rbx
call fcn.14008fbf0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14008feb0
mov rcx, qword [rdi + 0x1e0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x268]
movzx edx, bl
mov rcx, rdi
call fcn.14008feb0
mov rbx, qword [rsp + 0x40]
jmp 0x14009f83e
cmp esi, 2
ja 0x14009f83e
mov r9, qword [rdi + 0x1d8]
lea rax, [0x140180bc0]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.140145e24
mov r9, qword [rdi + 0x1d8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call fcn.140145e24
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400a1d40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
mov rcx, r8
call fcn.1400a1d90
mov r8d, eax
mov rdx, rbx
mov ecx, edi
call fcn.1401591cc
mov rbx, qword [rsp + 0x30]
cdqe
add rsp, 0x20
pop rdi
ret