joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400194b0
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14001c420
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14001956f
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.14001a880
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
je 0x14001956f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140019543
test rdi, rdi
je 0x14001953f
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400057f0
xor esi, esi
jmp 0x14001956f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
je 0x14001956c
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400057f0
mov rsi, rbx
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x140019cf0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400384b0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140019d34
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140019d93
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140019da2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140019dda
cmp eax, 0x103
je 0x140019de4
test eax, eax
js 0x140019dbf
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140019dda
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140013740
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14000ef10
mov ecx, 7
int 0x29
ud2
Function at 0x140019e50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400384b0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140019e94
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140019efa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140019f31
test eax, eax
js 0x140019f0b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140019f24
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140013740
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14000ef10
mov ecx, 7
int 0x29
ud2

Function at 0x14001bc20
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov dword [rbp - 8], 0xfffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14004c181]
mov ecx, 0x10
adc byte [rax], al
add byte [rax], al
mov edx, 8
call fcn.1400057e0
test rax, rax
je 0x14001bcff
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
add byte [rbp + rcx*4 + 5], cl
invalid
add dword [rax], eax
invalid
mov qword [rbp - 0x18], r14
Function at 0x14002e4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002e53a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002e530
cmp r11, r10
ja 0x14002e5c5
cmp r10, rdx
ja 0x14002e5d7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14002e532
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002e510
jmp 0x14002e5a7
ja 0x14002e53a
mov r11, r10
cmp rax, r8
jne 0x14002e4e2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002e5ab
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002e580
mov r8, r10
sub ecx, r9d
jns 0x14002e59e
jmp 0x14002e5ad
cmp r10, rdx
je 0x14002e5b9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002e5ad
xor al, 1
cmp r8, rdx
jne 0x14002e560
jmp 0x14002e5ad
xor eax, eax
jmp 0x14002e5ad
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140033710
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140033d80
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140033d00
int3

Function at 0x140030c0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140030c56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140030c56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140030c56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140030c56
cmp dword [rcx + 0x84], 0xe
jbe 0x140030c56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140030c58
xor al, al
add rsp, 0x28
ret
Function at 0x140015720
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14001572d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001573d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140015725
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140015755
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140015742
sub eax, 3
jb 0x14001576f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400157a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140015796
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140015794
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140015783
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400156e2
jmp 0x14001572d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2600
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400157f2
cmp rsi, rcx
jae 0x1400157fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400157d9
cmp al, 0x8f
ja 0x1400157d9
cmp byte [rsi - 2], 0xf
je 0x1400157df
sub al, 0xe8
cmp al, 1
ja 0x1400157c3
cmp rsi, rcx
jae 0x1400157fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400157c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400157fa
lodsb al, byte [rsi]
jmp 0x1400157d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x13000]
mov eax, dword [rdi]
or eax, eax
je 0x140015857
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x15000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140015807
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140015851
mov qword [rbx], rax
add rbx, 8
jmp 0x140015827
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140015891
cmp al, 0xef
ja 0x140015883
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140015863
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140015872
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140015910], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140015910
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140015900
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x18000a230
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18018f080]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000a2d0
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18000a2ca
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x44], rax
xor edx, edx
xor eax, eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x18000a2e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x18000a2e4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18011b440
add rsp, 0x68
ret
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18011b440
add rsp, 0x68
ret
Function at 0x18000a310
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x18018f080]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000a369
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18000a370
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000a45a
mov qword [rsp + 0x2a0], rdi
xor edi, edi
nop word [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x18000a3a0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.180013970
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x18000a3c6
mov rax, qword [rbx]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rbx + 0x10]
jne 0x18000a47b
test rdx, rdx
je 0x18000a408
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x18000a47b
add rax, 2
sub rdx, 1
jne 0x18000a3f4
mov edi, dword [rsp + 0x48]
cmp r10, 7
jbe 0x18000a447
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18000a43f
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a4cd
mov rcx, r9
call fcn.18011b8e4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18011b440
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rsi
ret
cmp r10, 7
jbe 0x18000a4b2
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18000a4aa
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a4cd
mov rcx, r9
call fcn.18011b8e4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000a380
jmp 0x18000a447
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x18000a550
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18018f080]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.18000a230
mov rax, qword [0x180196e68]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp byte [rax + 0x19], 0
jne 0x18000a604
nop dword [rax]
lea rbx, [rax + 0x20]
mov rcx, rbx
call fcn.18000a310
mov esi, eax
test eax, eax
je 0x18000a5ef
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x18000a5ef
mov rbp, qword [rbx + 0x28]
mov rbx, qword [rbx + 0x20]
cmp rbx, rbp
je 0x18000a5e6
nop word [rax + rax]
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.180009d20
add rbx, 0x20
cmp rbx, rbp
jne 0x18000a5d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call fcn.180011750
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x19], 0
je 0x18000a590
call fcn.18000a230
mov rax, qword [0x180196ba0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp byte [rax + 0x19], 0
jne 0x18000a740
mov qword [rsp + 0x80], r14
nop word [rax + rax]
xor edx, edx
lea rbx, [rax + 0x20]
xor ecx, ecx
lea r14, [rbx + 0x20]
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x18000a71f
cmp qword [rbx + 0x18], 7
jbe 0x18000a65c
mov rbx, qword [rbx]
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x18000a684
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000a71f
lea rax, [rsp + 0x30]
mov r9d, Ordinal_41
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
test eax, eax
jne 0x18000a6bc
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000a71f
mov esi, dword [rsp + 0x5c]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x18000a71f
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x18000a71f
mov rbp, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, rbp
je 0x18000a716
nop word [rax + rax]
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.180009d20
add rbx, 0x20
cmp rbx, rbp
jne 0x18000a700
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x38]
call fcn.180011750
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x19], 0
je 0x18000a630
mov r14, qword [rsp + 0x80]
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18011b440
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000a770
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rdx, str.C:Program_Files_slack_slack.exe
lea rcx, str.C:Program_Files_slack_app_4.39.90locales_backup_slack.exe
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18000a79f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Arquivo_copiado_com_sucesso_
jmp 0x18000a7ad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Erro_ao_copiar_o_arquivo_
call fcn.180012780
lea rdx, [0x180012950]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
add rsp, 0x28
ret
Function at 0x18000b1c0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18018f080]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.18000af60
call fcn.18000aa40
call fcn.18000af60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, Ordinal_41
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x38], 1
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32EmptyWorkingSet]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18011b440
add rsp, 0x50
pop rbx
ret
Function at 0x18000d0e0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18018f080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r8
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000d15c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18000d171
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18011b440
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18011b440
add rsp, 0x50
pop rbx
ret
Function at 0x18000f980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x18000fb11
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x18000fb11
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x18000fa1b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x18000fb38
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18000fa32
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x18000fa32
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18000fa45
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x18000fa92
mov r9d, eax
cmp eax, 0x800
jae 0x18000fa5f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x18000fa92
cmp eax, 0x10000
jae 0x18000fa79
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x18000fa92
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x18000fb11
add qword [r14], 2
test sil, sil
jne 0x18000fab3
cmp r10d, 3
jae 0x18000fabf
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x18000faee
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x18000fad0
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x18000f9cf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x18000fb1f
Function at 0x180010670
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180010698
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800106be
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800106c0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180010719
test ecx, ecx
jle 0x1800106f9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180010719
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180010719
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180010740
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180010762
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180010778
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180010794
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180010796
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800107d2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18001086e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18001080d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18001084e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18001086e
cmp rbx, rax
ja 0x180010820
test rbx, rbx
je 0x18001086e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret