joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1412272e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x28]
call fcn.1411bd870
nop
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14122731b
mov eax, dword [rax]
cmp eax, 1
jle 0x141227330
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1411c4db0
mov rdx, qword [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp eax, 0x104
jbe 0x14122738a
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.1411c6d50
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x141227366
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14122737b
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1411c4db0
mov rdx, qword [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp ebx, 2
jb 0x1412273d3
mov rax, qword [rsp + 0x30]
cmp word [rax + 2], 0x3a
jne 0x1412273d3
movzx ecx, word [rax]
call fcn.1411c7e10
mov esi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1412273b6
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x1412273cb
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1411c4db0
mov rax, qword [rsp + 0x30]
mov word [rax], si
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.1411c6d50
movzx r8d, byte [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.141221710
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x141227420
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141227420
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.1411dba10
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1412296f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x14136fbc0]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
mov qword [rsp + 0x28], r8
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0x30], r9
test rax, rax
je 0x14122973e
lock inc dword [rax]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
cmp r9, 2
jne 0x14122975b
cmp word [r8 + 2], 0x3a
jne 0x14122975b
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.1411be750
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.141230530
nop
lea rcx, [rsp + 0x38]
call fcn.1411c8780
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1412297ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x141229795
cmp eax, 0x20
jne 0x1412297ce
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x60], xmm0
movq rax, xmm1
test rax, rax
je 0x1412297b8
lock inc dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.141228800
test al, al
cmovne ebx, dword [rsp + 0x70]
test rdi, rdi
je 0x1412297db
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x1412297e4
xor bl, bl
jmp 0x1412297ea
shr ebx, 4
and bl, 1
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14122981a
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14122981a
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.1411dba10
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x141229842
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141229842
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
movzx eax, bl
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1413164a0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2d0
pop rdi
ret
Function at 0x14122af50
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
call fcn.141221d10
test al, al
je 0x14122afb2
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x1400f0658]
mov qword [rsp + 0x38], rax
lea rdx, [0x14007a7f8]
lea rcx, [rsp + 0x20]
call fcn.1411cd5c0
call fcn.141328508
mov dword [rax], 0x16
xor al, al
jmp 0x14122b0bd
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.141221fc0
nop
xor edi, edi
mov r9d, 1
xor r8d, r8d
movzx edx, di
mov rcx, rax
call fcn.1411c2bc0
mov rbp, rax
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x14122b008
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b008
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
cmp rbp, 0xffffffffffffffff
je 0x14122b04c
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x1400f0658]
mov qword [rsp + 0x38], rax
lea rdx, [0x14007a820]
lea rcx, [rsp + 0x20]
call fcn.1411cd5c0
call fcn.141328508
mov dword [rax], 0x16
xor al, al
jmp 0x14122b0bd
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
setne sil
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14122b09b
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x14122b09b
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
test edi, edi
jne 0x14122b0b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 2
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14122b0d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov r14, rdx
mov rsi, rcx
call fcn.141221d10
test al, al
je 0x14122b138
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0658]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a7f8]
lea rcx, [rbp - 0x28]
call fcn.1411cd5c0
call fcn.141328508
mov dword [rax], 0x16
xor al, al
jmp 0x14122b2e4
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.141221fc0
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1411c2bc0
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14122b18b
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b18b
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1411dba10
cmp r15, 0xffffffffffffffff
je 0x14122b1ce
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0658]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a820]
lea rcx, [rbp - 0x28]
call fcn.1411cd5c0
call fcn.141328508
mov dword [rax], 0x16
xor al, al
jmp 0x14122b2e4
mov rcx, r14
call fcn.141221d10
test al, al
jne 0x14122b0fb
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.141221fc0
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1411c2bc0
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14122b22a
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b22a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1411dba10
cmp r15, 0xffffffffffffffff
jne 0x14122b191
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14122b29e
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b29e
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1411dba10
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14122b2c4
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14122b2c4
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.1411dba10
test ebx, ebx
jne 0x14122b2e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14122b300
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov r14, rdx
mov rsi, rcx
call fcn.141221d10
test al, al
je 0x14122b368
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0658]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a7f8]
lea rcx, [rbp - 0x28]
call fcn.1411cd5c0
call fcn.141328508
mov dword [rax], 0x16
xor al, al
jmp 0x14122b51a
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.141221fc0
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1411c2bc0
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14122b3bb
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b3bb
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1411dba10
cmp r15, 0xffffffffffffffff
je 0x14122b3fe
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0658]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a820]
lea rcx, [rbp - 0x28]
call fcn.1411cd5c0
call fcn.141328508
mov dword [rax], 0x16
xor al, al
jmp 0x14122b51a
mov rcx, r14
call fcn.141221d10
test al, al
jne 0x14122b32b
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.141221fc0
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1411c2bc0
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14122b45a
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b45a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1411dba10
cmp r15, 0xffffffffffffffff
jne 0x14122b3c1
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14122b4d4
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14122b4d4
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1411dba10
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14122b4fa
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14122b4fa
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.1411dba10
test ebx, ebx
jne 0x14122b516
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x14122b600
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.141230530
nop
mov rcx, rax
call fcn.1411c8780
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14122b657
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14122b657
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x14122be50
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rbp, rdx
mov r14, rcx
xor sil, sil
xor edi, edi
call fcn.141221cb0
test al, al
je 0x14122befd
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.141221890
mov rcx, qword [rax + 8]
movzx ecx, word [rcx]
call fcn.1411c7e10
lea ecx, [rax - 0x41]
mov ebx, 1
shl ebx, cl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14122beeb
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14122beeb
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1411dba10
and ebx, edi
setne sil
neg ebx
sbb edi, edi
and edi, 0x14
jmp 0x14122bfd5
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.141221fc0
nop
mov qword [rsp + 0x20], 7
lea rax, [0x14007a880]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1411c7540
test al, al
je 0x14122bfa8
mov rdx, qword [rsp + 0x38]
mov r9d, ebx
mov r8d, 7
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.1411c2bc0
test eax, eax
jle 0x14122bf92
mov rdx, qword [rsp + 0x38]
inc eax
movsxd r8, eax
mov r9d, ebx
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.1411c2bc0
test eax, eax
jle 0x14122bf92
mov rcx, qword [rsp + 0x40]
dec rcx
cdqe
cmp rax, rcx
jne 0x14122bfa8
lea rcx, [rsp + 0x30]
call fcn.14122c220
test al, al
je 0x14122bfa8
mov edi, 0x10
movzx esi, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14122bfd5
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14122bfd5
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1411dba10
test sil, sil
je 0x14122bfff
mov dword [rbp + 0x10], edi
test dil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or ecx, dword [rbp + 4]
bts ecx, 0x16
mov dword [rbp + 4], ecx
or dword [rbp], 0x560000
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x14122c020
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov r12, rcx
xor r13d, r13d
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov dword [rbp - 0x3c], r13d
mov dword [rbp - 0x40], r13d
mov rsi, qword [rbp + 0x50]
mov rcx, r12
call fcn.1411c8780
mov rcx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x38]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov r15d, eax
test eax, eax
je 0x14122c0a3
cmp eax, 0xea
jne 0x14122c1db
mov rdi, qword [rbp - 0x38]
mov r14d, 1
cmp dword [rbp + 0x58], r14d
jb 0x14122c1db
test rbx, rbx
je 0x14122c1ca
cmp dword [rdi + 8], 0
jne 0x14122c1ca
mov r8, 0xffffffffffffffff
mov rdx, qword [rdi]
lea rcx, [rbp - 0x18]
call fcn.1411c24e0
nop
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x28], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov eax, dword [rbp + 0x50]
or eax, 5
mov dword [rbp + 0x50], eax
test al, 2
je 0x14122c138
and dword [rbp + 0x50], 0xfffffffd
test rsi, rsi
je 0x14122c138
mov eax, 0xffffffff
lock xadd dword [rsi], eax
cmp eax, 1
jne 0x14122c138
mov edx, 2
mov r8d, 8
mov rcx, rsi
call fcn.1411dba10
nop
mov eax, dword [rbp + 0x50]
test al, 1
je 0x14122c16f
and dword [rbp + 0x50], 0xfffffffe
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14122c16f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14122c16f
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.1411dba10
nop
lea r8, [rbp - 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1411b52a0
mov rax, qword [rbx]
test rax, rax
je 0x14122c18e
mov ecx, dword [rax]
cmp ecx, 1
jle 0x14122c19f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1411b4d30
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14122c1ca
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14122c1ca
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.1411dba10
add rdi, 0x18
inc r14d
cmp r14d, dword [rbp + 0x58]
jbe 0x14122c0b7
mov rcx, qword [rbp - 0x38]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r15d, 0xea
je 0x14122c057
test r15d, r15d
sete al
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14122cc30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9, rdx
test r8, r8
je 0x14122cc66
mov r9, qword [0x141372a58]
mov rax, qword [0x141374240]
bt rax, 8
jae 0x14122cc66
mov rax, qword [0x141374240]
test al, 0x20
jne 0x14122c8f0
cmp rdx, 8
jbe 0x14122cb80
jmp 0x14122cd10
Function at 0x14122ccd0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
test r8, r8
je 0x14122cd06
nop dword [rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
shl edx, 4
add edx, eax
mov eax, edx
shr edx, 0x17
and edx, 0x1e0
xor edx, eax
and edx, 0xfffffff
sub r8, 1
jne 0x14122cce0
mov eax, edx
ret
Function at 0x1412568a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], r13
mov r14, r9
lea r13, [r8 - 1]
mov qword [rsp + 0x58], r15
mov rbp, r13
mov r15, r8
sar rbp, 1
mov rsi, rdx
mov rbx, rcx
mov r12, rdx
mov r9, rdx
cmp rdx, rbp
jge 0x141256957
nop dword [rax + rax]
lea rdi, [r9 + r9]
lea rcx, [rdi + 2]
shl rcx, 5
add rcx, rbx
lea rdx, [rcx - 0x20]
call fcn.14125a870
shl rsi, 5
movzx r9d, al
xor r9, 1
inc r9
mov rcx, qword [rsi + rbx]
add r9, rdi
mov rdx, r9
shl rdx, 5
add rdx, rbx
mov rax, qword [rdx]
mov qword [rsi + rbx], rax
mov rax, qword [rdx + 8]
mov qword [rdx], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rdx + 8], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [rdx + 0x10], rcx
mov rax, qword [rdx + 0x18]
mov qword [rsi + rbx + 0x18], rax
mov rsi, r9
cmp r9, rbp
jl 0x1412568e0
cmp r9, rbp
jne 0x1412569b1
test r15b, 1
jne 0x1412569b1
shl r15, 5
shl rsi, 5
mov rax, qword [r15 + rbx - 0x20]
mov rcx, qword [rsi + rbx]
mov qword [rsi + rbx], rax
mov rax, qword [r15 + rbx - 0x18]
mov qword [r15 + rbx - 0x20], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [r15 + rbx - 0x10]
mov qword [r15 + rbx - 0x18], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [r15 + rbx - 0x10], rcx
mov rax, qword [r15 + rbx - 8]
mov qword [rsi + rbx + 0x18], rax
mov rsi, r13
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
cmp r12, rsi
jge 0x141256a27
lea rbp, [rsi - 1]
mov rdx, r14
sar rbp, 1
mov rdi, rbp
shl rdi, 5
add rdi, rbx
mov rcx, rdi
call fcn.14125a870
test al, al
je 0x141256a27
mov rax, qword [rdi]
shl rsi, 5
mov rcx, qword [rsi + rbx]
mov qword [rsi + rbx], rax
mov rax, qword [rdi + 8]
mov qword [rdi], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [rdi + 0x10]
mov qword [rdi + 8], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [rdi + 0x10], rcx
mov rax, qword [rdi + 0x18]
mov qword [rsi + rbx + 0x18], rax
mov rsi, rbp
cmp r12, rbp
jl 0x1412569c0
mov rax, qword [r14]
shl rsi, 5
mov rcx, qword [rsi + rbx]
mov qword [rsi + rbx], rax
mov rax, qword [r14 + 8]
mov qword [r14], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [r14 + 0x10]
mov qword [r14 + 8], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [r14 + 0x10], rcx
mov rax, qword [r14 + 0x18]
mov qword [rsi + rbx + 0x18], rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x141267a40
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rax - 0x58], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rax - 0x58], 1
mov qword [rax + 0x18], r12
lea r9, [rax + 0x18]
xor r8d, r8d
mov edx, 0x4000
mov rcx, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x141267b39
mov rsi, 0xffffffffffffffff
mov r8, rsi
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.1411c24e0
nop
mov rbp, qword [rax]
mov r14, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov dword [rsp + 0x20], 9
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141267aff
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141267aff
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1411dba10
mov rcx, qword [rbx]
mov qword [rbx], rbp
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r15
test rcx, rcx
je 0x141267b2b
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x141267b2b
mov edx, 2
mov r8d, 8
call fcn.1411dba10
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp qword [rbx + 0x10], 0
jne 0x141267bb1
mov rax, qword [rdi]
cmp rax, qword [0x1400f05f0]
jne 0x141267b6b
mov rax, qword [rdi + 8]
cmp rax, qword [0x1400f05f8]
jne 0x141267b6b
mov qword [rsp + 0x30], 0x11
lea rax, [0x14007ccd0]
jmp 0x141267b94
mov rax, qword [rdi]
cmp rax, qword [0x1400f0610]
jne 0x141267bb1
mov rax, qword [rdi + 8]
cmp rax, qword [0x1400f0618]
jne 0x141267bb1
mov qword [rsp + 0x30], 0xf
lea rax, [0x14007cce8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1411bdb40
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14126b820
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x2e8]
test rcx, rcx
je 0x14126b853
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14120887a.0]
mov rax, qword [rdi + 0x40]
movzx ecx, byte [rdi + 0x20]
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbx + 0x1b0]
test eax, eax
setne dil
cmp rcx, 0xffffffffffffffff
je 0x14126b8bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x1b0], 0xffffffffffffffff
mov rcx, qword [rbx + 0x1f8]
cmp rcx, 0xffffffffffffffff
je 0x14126b8dd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x1f8], 0xffffffffffffffff
mov rcx, qword [rbx + 0x238]
cmp rcx, 0xffffffffffffffff
je 0x14126b8fb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x238], 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x50
pop rdi
ret