joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014608
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140014794
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
and dword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea r14d, [r9 + 1]
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14001468f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140014794
mov ecx, dword [rsp + 0x30]
call fcn.140020e1c
mov r9d, dword [rsp + 0x30]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400146cc
mov rcx, rbx
call fcn.14001e6d8
jmp 0x140014794
mov r8, qword [rbx]
lea rdx, [rbp - 0x40]
mov ecx, 0x44
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rcx, rbx
call fcn.14001e6d8
and qword [rbp - 0x80], 0
lea rax, [rbp - 0x40]
and dword [rsp + 0x7c], 0
lea r9, [rsp + 0x38]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
xor r8d, r8d
mov dword [rsp + 0x60], 0x11060000
mov ecx, r14d
mov dword [rsp + 0x64], r14d
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x68], 3
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140014794
mov edx, r14d
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140014784
mov r8, qword [rsp + 0x38]
lea rcx, [rbp - 0x70]
xor r9d, r9d
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140014784
and dword [rsp + 0x58], 0
lea rax, [rbp - 0x70]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov dword [rsp + 0x48], 0x18
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140014794
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140019520
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400147bc
Capabilities:
Delete file

Disassembly:
push rbx
mov eax, 0x1080
call fcn.140019560
sub rsp, rax
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rsp + 0x1070], rax
xor ebx, ebx
cmp word [0x140062232], bx
je 0x140014886
lea rcx, [0x140062232]
call fcn.140004338
mov rdx, qword [str.RarSFX]
lea r8d, [rbx + 6]
mov rcx, rax
call fcn.1400094b4
test eax, eax
jne 0x140014886
lea rcx, [0x140061230]
call fcn.1400142bc
mov r8d, 0x800
lea rdx, [0x140062232]
lea rcx, [rsp + 0x60]
call fcn.140007d74
lea rcx, [rsp + 0x60]
call fcn.14001e418
lea rax, [rax*2 + 2]
cmp rax, 0x1002
jae 0x14001489f
xor edx, edx
mov word [rsp + rax + 0x60], bx
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14001a580
lea eax, [rbx + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.140019520
add rsp, 0x1080
pop rbx
ret
call fcn.1400196e4
int3

Function at 0x140014928
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
mov rdi, r8
cmp qword [0x14003e7d0], rbp
mov rbx, rdx
mov rsi, rcx
jne 0x14001499b
lea r9d, [rbp + 0x64]
mov ecx, 0x400
lea r8, [rsp + 0xa0]
lea edx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [rsp + 0xa0]
mov word [0x140071978], ax
lea rax, [0x140071978]
mov qword [0x14003e7d0], rax
mov word [0x14007197a], bp
mov r8d, 0x32
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140007bb8
lea r9, [0x14003e7b8]
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov word [rbx], bp
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov word [rbx + rdi*2 - 2], bp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140019520
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1f60]
mov eax, 0x2060
call fcn.140019560
sub rsp, rax
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rbp + 0x1f50], rax
xor esi, esi
mov rdi, rdx
cmp byte [0x140063238], sil
mov rbx, rcx
je 0x140014bf9
mov r8d, 0x800
lea rdx, [rbp + 0xf50]
call fcn.140016410
lea rax, [rsp + 0x38]
xor r8d, r8d
lea r9d, [rsi + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWinRAR_SFX
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014bf9
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xf50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014bee
mov eax, dword [rsp + 0x30]
shr eax, 1
mov edx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x7ff
cmp edx, eax
cmovb eax, edx
add rax, rax
cmp rax, 0x1000
jae 0x140014c1b
mov r8, rdi
mov word [rsp + rax + 0x50], si
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140007d74
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1f50]
xor rcx, rsp
call fcn.140019520
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2060
pop rdi
pop rsi
pop rbp
ret
call fcn.1400196e4
int3

Function at 0x140014d14
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x2030
call fcn.140019560
sub rsp, rax
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rsp + 0x2020], rax
xor r14d, r14d
mov rbx, rcx
mov rcx, qword [rsp + 0x2080]
mov rsi, r8
test r9, r9
je 0x140014d53
mov byte [r9], r14b
test rcx, rcx
je 0x140014d5b
mov byte [rcx], r14b
test rbx, rbx
je 0x140014e10
movzx eax, word [rbx]
test ax, ax
je 0x140014e10
movsxd rbp, dword [rsp + 0x2088]
mov rdi, r14
mov r8d, r14d
add rbx, 2
cmp ax, 0x3d
jne 0x140014da0
test rsi, rsi
je 0x140014dac
test rdi, rdi
jne 0x140014dac
test r9, r9
je 0x140014d9b
mov byte [r9], 1
mov rdi, rdx
jmp 0x140014dbb
cmp ax, 0xd
je 0x140014dcd
cmp ax, 0xa
je 0x140014dd1
mov word [rdx], ax
add rdx, 2
lea eax, [rbp - 2]
cmp r8d, eax
jge 0x140014dc8
movzx eax, word [rbx]
inc r8d
test ax, ax
jne 0x140014d7e
jmp 0x140014dd1
mov byte [rcx], 1
jmp 0x140014dd1
add rbx, 2
mov word [rdx], r14w
test rsi, rsi
je 0x140014e0b
mov word [rsi], r14w
test rdi, rdi
je 0x140014e0b
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140007d74
mov word [rdi], r14w
mov rax, rbx
jmp 0x140014e12
xor eax, eax
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140019520
add rsp, 0x2030
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014e30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
xor ecx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x140014e9c
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x58]
cmp eax, 1
mov rdx, qword [rsp + 0x50]
sete bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x14002e478]
jmp 0x140014e9f
mov word [rdi], cx
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140017b38
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [0x140061228], 0
mov edx, 1
mov rbx, rcx
mov byte [0x140059de9], 1
mov byte [0x140059dea], 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.1400011e4
cmp qword [0x140071958], 0
jne 0x140017b83
cmp byte [0x140059dfb], 0
je 0x140017b8c
cmp dword [0x140059dec], 0
jne 0x140017ba1
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x140017c44
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1070
call fcn.140019560
sub rsp, rax
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rsp + 0x1060], rax
xor edi, edi
mov rbx, rcx
cmp byte [0x140063238], dil
je 0x140017d1c
cmp word [0x14006323a], di
je 0x140017d1c
mov r8d, 0x800
lea rdx, [rsp + 0x60]
lea rcx, [0x14006323a]
call fcn.140016410
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareWinRAR_SFX
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140017d1c
mov rcx, rbx
call fcn.14001e418
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140019520
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1070
pop rdi
ret

Function at 0x140017d40
Capabilities:
Set environment variable

Disassembly:
push rbx
mov eax, 0x2030
call fcn.140019560
sub rsp, rax
mov rax, qword [0x14003e858]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140007a30
mov rbx, rax
test rax, rax
je 0x140017db4
movzx ecx, word [rax]
jmp 0x140017d9b
add rbx, 2
movzx ecx, word [rbx]
call fcn.140007b58
test al, al
jne 0x140017d94
mov rdx, rbx
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140019520
add rsp, 0x2030
pop rbx
ret
Function at 0x140018db0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140018e28
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140018e28
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140018e28
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140018e1c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140018e3a
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140018e0a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140018e2a

Function at 0x14001a188
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a1d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a1d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a1d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a1d2
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a1d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a1d4
xor al, al
add rsp, 0x28
ret

Function at 0x140022da0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140022b04
Function at 0x14077c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14077c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14077c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077c06f
add dl, dl
jne 0x14077c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077c0f6
xor eax, eax
add dl, dl
jne 0x14077c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077c1ad
add dl, dl
jne 0x14077c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14077c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077c07e
mov eax, 1
add dl, dl
jne 0x14077c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077c0fb
sub eax, ebx
mov ebx, 1
jne 0x14077c14c
mov ecx, 1
add dl, dl
jne 0x14077c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14077c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077c15d
cmp eax, 0x7d00
jae 0x14077c19b
cmp eax, 0x500
jb 0x14077c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077c07e
cmp eax, 0x7f
ja 0x14077c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14077c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140c7a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c7a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c7a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c7a06f
add dl, dl
jne 0x140c7a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c7a0f6
xor eax, eax
add dl, dl
jne 0x140c7a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c7a1ad
add dl, dl
jne 0x140c7a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c7a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c7a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c7a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c7a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c7a07e
mov eax, 1
add dl, dl
jne 0x140c7a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c7a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c7a0fb
sub eax, ebx
mov ebx, 1
jne 0x140c7a14c
mov ecx, 1
add dl, dl
jne 0x140c7a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c7a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c7a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c7a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c7a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c7a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c7a15d
cmp eax, 0x7d00
jae 0x140c7a19b
cmp eax, 0x500
jb 0x140c7a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c7a07e
cmp eax, 0x7f
ja 0x140c7a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c7a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c7a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c7a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001c20
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140041250]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r9
mov rbx, r8
mov r15, rcx
mov r12, qword [rbp + 0x80]
mov r13, qword [rbp + 0x88]
mov r14, qword [rbp + 0x90]
mov qword [rsp + 0x50], 7
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x38], ax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140003d40
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov byte [rbp - 8], 0
xor edi, edi
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x70], 0x67452301
mov dword [rbp - 0x6c], 0xefcdab89
mov dword [rbp - 0x68], 0x98badcfe
mov dword [rbp - 0x64], 0x10325476
mov r8, qword [rsp + 0x48]
lea r8, [r8 + r8 + 2]
lea rcx, [rbp - 0x70]
call fcn.140004210
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140004d50
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [0x1400312d8]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [0x1400312d8]
cmp qword [rsp + 0x78], 0x10
jb 0x140001df8
mov rcx, qword [rsp + 0x60]
call fcn.14001c290
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x60], dil
cmp qword [rsp + 0x50], 8
jb 0x140001e1d
mov rcx, qword [rsp + 0x38]
call fcn.14001c290
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14001c270
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400023e0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0x690
mov rax, qword [0x140041250]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rcx, [rsp + 0x52]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], bp
call fcn.14001dcf0
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], bp
call fcn.14001dcf0
lea rcx, str.Shell32.dll
call qword [0x1400310b0]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [0x1400310b8]
test rax, rax
je 0x1400024c1
lea r9d, [rbp + 1]
lea r8d, [rbp + 7]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call rax
test eax, eax
je 0x1400024c1
lea r9, str.GFIRestart64.exe
lea r8, [rsp + 0x50]
lea rdx, str._s_s
lea rcx, [rsp + 0x260]
call qword [0x140031560]
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x260]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [0x1400310c0]
cmp rax, 0xffffffffffffffff
je 0x1400024c1
lea eax, [rbp + 1]
jmp 0x1400025e2
mov qword [rsp + 0x6a0], rbx
lea rcx, str.ADVAPI32.dll
mov qword [rsp + 0x6a8], rsi
mov qword [rsp + 0x6b0], rdi
call qword [0x1400310b0]
lea rdx, str.RegQueryValueExW
mov rcx, rax
mov rbx, rax
call qword [0x1400310b8]
lea rdx, str.RegOpenKeyExW
mov rcx, rbx
mov rsi, rax
call qword [0x1400310b8]
lea rdx, str.RegCloseKey
mov rcx, rbx
mov rdi, rax
call qword [0x1400310b8]
mov rbx, rax
test rsi, rsi
je 0x1400025c8
test rdi, rdi
je 0x1400025c8
test rax, rax
je 0x1400025c8
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
jne 0x1400025c8
lea rcx, [rsp + 0x472]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x470], bp
call fcn.14001dcf0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.GFIRestart64.exe
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x208
call rsi
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400025c6
call rbx
mov eax, 1
jmp 0x1400025ca
call rbx
xor eax, eax
mov rsi, qword [rsp + 0x6a8]
mov rbx, qword [rsp + 0x6a0]
mov rdi, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.14001c270
add rsp, 0x690
pop rbp
ret