joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003ef40
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1401740a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x14017aa30], eax
jg 0x14003f0ed
mov rcx, qword [0x14017aa38]
cmp rcx, 2
jl 0x14003f0c6
movsxd rax, dword [rbx + 0x30]
sub rax, rcx
sub rax, 1
js 0x14003f0c6
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x38]
call fcn.14003df00
mov rdi, rax
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x38]
call fcn.14003e820
nop
mov r9, rdi
mov r8, rax
lea rcx, [rsp + 0x40]
call fcn.14003fb30
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003f01a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f015
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f122
call fcn.1400f5c2c
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14003f071
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f06c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f128
call fcn.1400f5c2c
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003f0c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f0c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f0e7
call fcn.1400f5c2c
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400f5be0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
call fcn.1400fcb20
int3
lea rcx, [0x14017aa30]
call fcn.1400f5e00
cmp dword [0x14017aa30], 0xffffffff
jne 0x14003ef82
mov rax, qword [rbx + 0x20]
mov qword [0x14017aa38], rax
lea rcx, [0x14017aa30]
call fcn.1400f5da0
jmp 0x14003ef82
call fcn.1400fcb20
nop
call fcn.1400fcb20
int3
Function at 0x1400501a0
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400501bb
xor eax, eax
add rsp, 0x28
pop rdi
pop rbx
ret
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x20], rsi
mov qword [rcx + 0x50], rbp
xor eax, eax
mov dword [rcx + 0x58], ebp
mov qword [rcx + 0x48], rbp
movups xmmword [rcx + 8], xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
mov dword [rcx + 0x38], eax
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400501f8
call fcn.140101bf8
mov qword [rbx + 0x40], rbp
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x14005028e
mov ecx, esi
call fcn.14010867c
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14005028e
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14005028e
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x50], ebp
lea rdx, [0x140144784]
mov qword [rsp + 0x58], rbp
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14005028e
mov rax, qword [rsp + 0x58]
movups xmm0, xmmword [rax]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x28], xmm0
mov eax, dword [rax + 0x30]
mov dword [rbx + 0x38], eax
mov eax, ebp
cmp dword [rbx + 8], 0xfeef04bd
sete al
mov dword [rbx + 0x58], eax
mov rsi, qword [rsp + 0x20]
cmp dword [rbx + 0x58], ebp
je 0x1400502d9
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x48], ebp
lea rdx, str.VarFileInfoTranslation
mov qword [rsp + 0x50], rbp
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400502d3
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x48], rax
mov eax, dword [rsp + 0x48]
shr eax, 2
mov dword [rbx + 0x54], eax
cmp qword [rbx + 0x48], rbp
jne 0x14005030a
mov qword [rbx + 0x50], rbp
xorps xmm0, xmm0
mov dword [rbx + 0x58], ebp
xor eax, eax
mov qword [rbx + 0x48], rbp
movups xmmword [rbx + 8], xmm0
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
mov dword [rbx + 0x38], eax
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14005030a
call fcn.140101bf8
mov qword [rbx + 0x40], rbp
mov eax, dword [rbx + 0x58]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140058080
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.1400f67a0
sub rsp, rax
mov r14d, edx
mov r15, rcx
mov rsi, qword [rbp + 0x1418]
xor r12d, r12d
mov word [rbp + 0x3c0], r12w
mov byte [rbp - 0x40], r12b
mov rbx, qword [rbp + 0x1420]
mov ecx, dword [rbx]
mov dword [rsp + 0x28], ecx
mov eax, dword [rbx + 4]
mov dword [rsp + 0x2c], eax
call fcn.1400022c0
mov edi, eax
mov dword [rsp + 0x20], 3
mov ecx, r12d
mov eax, 8
cmp dword [rbx + 8], 1
cmove ecx, eax
mov dword [rsp + 0x24], ecx
mov ecx, 1
lock xadd dword [0x14017b028], ecx
inc ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x38], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, str.D:Bamboohomexml_data_build_dirCST_DLIN_SOURCES_srccst_commonwil_resource.h
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], r15
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
mov rax, qword [0x14017ab38]
test rax, rax
je 0x140058170
call rax
mov qword [rbp - 0x60], rax
jmp 0x140058174
mov qword [rbp - 0x60], r12
mov rax, qword [0x14017ab50]
test rax, rax
je 0x140058187
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab48]
test rax, rax
je 0x1400581a4
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab40]
test rax, rax
je 0x1400581b7
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab00]
test rax, rax
je 0x1400581d1
test byte [rsp + 0x24], 2
jne 0x1400581d1
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r12d
jl 0x1400581ee
mov dword [rsp + 0x28], 0x8000ffff
mov ecx, 0x8000ffff
call fcn.1400024d0
mov dword [rsp + 0x2c], eax
cmp byte [0x14017ab79], r12b
jne 0x14005821c
mov rax, qword [0x14017ab80]
test rax, rax
je 0x14005820b
call rax
movzx r12d, al
jmp 0x140058217
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
je 0x140058223
test byte [rsp + 0x24], 2
je 0x140058246
mov rax, qword [0x14017ab88]
test rax, rax
je 0x14005829c
cmp byte [0x14017ab68], 0
jne 0x14005829c
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14005829c
mov rax, qword [0x14017ab88]
test rax, rax
je 0x14005826f
cmp byte [0x14017ab68], 0
jne 0x14005826f
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x14005828f
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140001ed0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x1400582ac
cmp byte [0x14017ab78], 0
je 0x1400582bb
mov rax, qword [0x14017ab30]
test rax, rax
je 0x1400582bb
call rax
nop
lea rcx, [rsp + 0x20]
call fcn.140053f30
int3
Function at 0x1400582d0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400585f0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.1400f67a0
sub rsp, rax
mov rax, qword [0x1401740a0]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov esi, edx
mov r14, rcx
mov rdi, qword [rbp + 0x1428]
xor r15d, r15d
mov word [rbp + 0x3c0], r15w
mov byte [rbp - 0x40], r15b
mov r8, qword [rbp + 0x1430]
mov ecx, dword [r8]
mov dword [rsp + 0x28], ecx
mov eax, dword [r8 + 4]
mov dword [rsp + 0x2c], eax
call fcn.140053ae0
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov ecx, r15d
mov eax, 8
cmp dword [r8 + 8], edx
cmove ecx, eax
mov dword [rsp + 0x24], ecx
lock xadd dword [0x14017b028], edx
inc edx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, [0x140148ed0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], r14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
mov rax, qword [0x14017ab38]
test rax, rax
je 0x1400586e7
call rax
mov qword [rbp - 0x60], rax
jmp 0x1400586eb
mov qword [rbp - 0x60], r15
mov rax, qword [0x14017ab50]
test rax, rax
je 0x1400586fe
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab48]
test rax, rax
je 0x14005871b
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab40]
test rax, rax
je 0x14005872e
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab00]
test rax, rax
je 0x140058748
test byte [rsp + 0x24], 2
jne 0x140058748
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r15d
jge 0x140058858
cmp byte [0x14017ab79], r15b
jne 0x140058781
mov rax, qword [0x14017ab80]
test rax, rax
je 0x140058770
call rax
movzx r15d, al
jmp 0x14005877c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r15b
test r15d, r15d
je 0x140058788
test byte [rsp + 0x24], 2
je 0x1400587ab
mov rax, qword [0x14017ab88]
test rax, rax
je 0x140058801
cmp byte [0x14017ab68], 0
jne 0x140058801
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x140058801
mov rax, qword [0x14017ab88]
test rax, rax
je 0x1400587d4
cmp byte [0x14017ab68], 0
jne 0x1400587d4
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x1400587f4
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140001ed0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x140058811
cmp byte [0x14017ab78], 0
je 0x140058820
mov rax, qword [0x14017ab30]
test rax, rax
je 0x140058820
call rax
nop
test byte [rsp + 0x24], 1
jne 0x14005884d
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.1400f5be0
mov rbx, qword [rsp + 0x1510]
add rsp, 0x14d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x20]
call fcn.140053f30
nop
call fcn.140054180
nop
int3
Function at 0x1400585f0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400585f0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.1400f67a0
sub rsp, rax
mov rax, qword [0x1401740a0]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov esi, edx
mov r14, rcx
mov rdi, qword [rbp + 0x1428]
xor r15d, r15d
mov word [rbp + 0x3c0], r15w
mov byte [rbp - 0x40], r15b
mov r8, qword [rbp + 0x1430]
mov ecx, dword [r8]
mov dword [rsp + 0x28], ecx
mov eax, dword [r8 + 4]
mov dword [rsp + 0x2c], eax
call fcn.140053ae0
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov ecx, r15d
mov eax, 8
cmp dword [r8 + 8], edx
cmove ecx, eax
mov dword [rsp + 0x24], ecx
lock xadd dword [0x14017b028], edx
inc edx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, [0x140148ed0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], r14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
mov rax, qword [0x14017ab38]
test rax, rax
je 0x1400586e7
call rax
mov qword [rbp - 0x60], rax
jmp 0x1400586eb
mov qword [rbp - 0x60], r15
mov rax, qword [0x14017ab50]
test rax, rax
je 0x1400586fe
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab48]
test rax, rax
je 0x14005871b
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab40]
test rax, rax
je 0x14005872e
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14017ab00]
test rax, rax
je 0x140058748
test byte [rsp + 0x24], 2
jne 0x140058748
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r15d
jge 0x140058858
cmp byte [0x14017ab79], r15b
jne 0x140058781
mov rax, qword [0x14017ab80]
test rax, rax
je 0x140058770
call rax
movzx r15d, al
jmp 0x14005877c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r15b
test r15d, r15d
je 0x140058788
test byte [rsp + 0x24], 2
je 0x1400587ab
mov rax, qword [0x14017ab88]
test rax, rax
je 0x140058801
cmp byte [0x14017ab68], 0
jne 0x140058801
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x140058801
mov rax, qword [0x14017ab88]
test rax, rax
je 0x1400587d4
cmp byte [0x14017ab68], 0
jne 0x1400587d4
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x1400587f4
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140001ed0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x140058811
cmp byte [0x14017ab78], 0
je 0x140058820
mov rax, qword [0x14017ab30]
test rax, rax
je 0x140058820
call rax
nop
test byte [rsp + 0x24], 1
jne 0x14005884d
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.1400f5be0
mov rbx, qword [rsp + 0x1510]
add rsp, 0x14d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x20]
call fcn.140053f30
nop
call fcn.140054180
nop
int3
Function at 0x140076d60
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov qword [rsp + 0x88], rcx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], r15d
add rcx, 0x38
xor edx, edx
mov r8d, 0x1a48
call fcn.1400f8720
mov dword [r14 + 0x1a80], r15d
lea rcx, [r14 + 0x1a88]
xor edx, edx
mov r8d, 0x1a48
call fcn.1400f8720
lea rdi, [r14 + 0x3500]
mov qword [r14 + 0x34d0], rdi
mov qword [r14 + 0x34d8], rbp
lea rbx, [r14 + 0x34e0]
mov qword [rsp + 0x90], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x50]
call fcn.1400f5c3c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [r14 + 0x34f0]
mov qword [rsp + 0x90], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x50]
call fcn.1400f5c3c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], rbp
mov qword [rdi + 0x48], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [rdi], eax
mov qword [r14 + 0x3550], rsi
mov qword [r14 + 0x3558], rbp
mov qword [r14 + 0x3560], r15
mov qword [r14 + 0x3568], 0xffffffffffffffff
mov qword [r14 + 0x3570], 0xffffffffffffffff
mov qword [r14 + 0x3578], 0xffffffffffffffff
mov qword [r14 + 0x3580], r15
mov qword [r14 + 0x3588], r15
mov qword [r14 + 0x3598], r15
mov qword [r14 + 0x35a0], 7
mov word [r14 + 0x3588], r15w
mov qword [r14 + 0x35a8], r15
mov word [r14 + 0x35b0], r15w
mov qword [r14 + 0x35b4], r15
mov qword [r14 + 0x35bc], r15
mov qword [r14 + 0x35c8], r15
mov qword [r14 + 0x35d0], r15
mov qword [r14 + 0x35d8], r15
mov qword [r14 + 0x35e0], r15
mov qword [r14 + 0x35e8], r15
mov qword [r14 + 0x35f0], r15
mov qword [r14 + 0x35f8], r15
mov qword [r14 + 0x3600], r15
mov qword [r14 + 0x3608], r15
mov qword [r14 + 0x3610], r15
mov qword [r14 + 0x3618], r15
mov qword [r14 + 0x3620], r15
mov qword [r14 + 0x3628], r15
mov qword [r14 + 0x3630], r15
mov qword [r14 + 0x3638], r15
mov qword [r14 + 0x3640], r15
mov qword [r14 + 0x3648], r15
mov qword [r14 + 0x3650], r15
mov qword [r14 + 0x3658], r15
mov qword [r14 + 0x3660], r15
mov qword [r14 + 0x3668], r15
mov qword [r14 + 0x3670], r15
mov qword [r14 + 0x3678], r15
mov qword [r14 + 0x3680], r15
mov qword [r14 + 0x3688], r15
mov qword [r14 + 0x3690], r15
lea rcx, [r14 + 0x3698]
call fcn.14008faf0
mov qword [r14 + 0x36e0], r15
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008b870
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401740a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14008b8a1
xor eax, eax
jmp 0x14008b9ef
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14008b8de
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14008b8de
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14008b9ef
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14008b9e4
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14008b925
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14008b94e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14010babc
cmp ax, di
je 0x14008b9e4
movzx edi, si
jmp 0x14008b9e4
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14008b9a4
sub eax, 1
je 0x14008b9a4
cmp eax, 2
jne 0x14008b9e4
movzx ecx, word [rsp + 0x40]
jmp 0x14008b931
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14008b9d1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140101e5c
cmp rbp, rax
jne 0x14008b9e4
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x14008b9e7
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400f5be0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008bba0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401740a0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14008bc74
cmp byte [rcx + 0x72], 0
je 0x14008bc74
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14008bc70
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14008bc36
sub eax, 1
je 0x14008bc3a
cmp eax, 2
jne 0x14008bc70
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f5be0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14008bc67
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140101e5c
cmp rdi, rax
jne 0x14008bc70
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14008bc1e
xor al, al
jmp 0x14008bc1e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f5be0
add rsp, 0x60
pop rbx
ret
Function at 0x140095460
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400954bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400954bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400954a7
mov eax, 0x80004005
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jle 0x1400954cc
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a0ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r12
push r13
push r15
mov r10d, dword [r9]
xor r12d, r12d
and r10d, 7
mov r13, r9
mov edi, r8d
mov r15, rcx
mov r11d, r12d
cmp rdx, 5
jae 0x1400a101e
xor eax, eax
pop r15
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x28], rbx
add edi, 5
mov qword [rsp + 0x30], rbp
lea rbx, [rdx - 4]
mov qword [rsp + 0x38], rsi
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x40], r14
add rbx, r15
mov r14d, dword [rsp + 0x48]
lea r9, [0x140000000]
nop
lea r8, [r11 + r15]
cmp r8, rbx
jae 0x1400a1072
nop dword [rax]
movzx eax, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x1400a1072
inc r8
cmp r8, rbx
jb 0x1400a1060
mov r11, r8
sub r11, r15
mov rax, r11
sub rax, rbp
cmp r8, rbx
jae 0x1400a1197
cmp rax, 3
jbe 0x1400a10af
mov r10d, r12d
movzx ecx, byte [r8 + 4]
mov rbp, r11
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x1400a10f4
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1400a1050
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x1400a1090
cmp byte [r10 + r9 + 0x147a18], r12b
je 0x1400a10de
movzx eax, byte [r10 + r9 + 0x147a40]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + 4]
inc al
test al, 0xfe
jne 0x1400a1090
and r10d, 3
mov rbp, r11
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1400a1050
movzx eax, byte [r8 + 3]
lea rsi, [r9 + 0x147a40]
mov edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [r8 + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r8 + 1]
shl edx, 8
or edx, eax
mov eax, r10d
add rsi, rax
test r14d, r14d
je 0x1400a112e
lea eax, [r11 + rdx]
add eax, edi
jmp 0x1400a1135
mov eax, edx
sub eax, r11d
sub eax, edi
test r10d, r10d
je 0x1400a116a
movzx r9d, byte [rsi]
mov ecx, 0x18
shl r9d, 3
mov edx, eax
sub ecx, r9d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x1400a116a
mov ecx, 0x20
mov edx, 1
sub ecx, r9d
shl edx, cl
dec edx
xor edx, eax
jmp 0x1400a1121
mov ecx, eax
mov byte [r8 + 1], al
shr ecx, 0x18
and cl, 1
neg cl
mov byte [r8 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r8 + 3], cl
mov ecx, eax
shr ecx, 8
mov byte [r8 + 2], cl
add r11, 5
jmp 0x1400a1048
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
cmp rax, 3
ja 0x1400a11be
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
mov r12d, r10d
mov dword [r13], r12d
mov rax, r11
pop r15
pop r13
pop r12
pop rdi
ret