joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140104a20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
inc dword [rcx + 0x40]
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x40], rsi
mov esi, edx
mov rbx, rcx
test rax, rax
jne 0x140104a51
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x30], rax
mov qword [rsp + 0x48], rdi
cmp esi, 0xffffffff
jne 0x140104a94
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x30]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbx + 0x38]
test r11d, r11d
jne 0x140104a60
inc dword [rbx + 0x3c]
lea edi, [r11 + 1]
jmp 0x140104b1e
mov rcx, rbx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x30]
mov edx, esi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
mov rcx, rbx
test eax, eax
sete dil
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [rbx + 0x38]
test ecx, ecx
je 0x140104b11
nop
test edi, edi
je 0x140104b19
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, esi
ja 0x140104b4a
mov rcx, qword [rbx + 0x30]
mov edx, esi
sub edx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
mov rcx, rbx
test eax, eax
sete dil
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbx + 0x38]
test r11d, r11d
jne 0x140104ad0
inc dword [rbx + 0x3c]
mov edi, 1
mov rbp, qword [rsp + 0x30]
dec dword [rbx + 0x40]
mov rsi, qword [rsp + 0x40]
mov ecx, dword [rbx + 0x40]
jne 0x140104b3d
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x140104b19
Function at 0x14010b69c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1402c2d68]
test rcx, rcx
jne 0x14010b5eb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x14010b5e4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14010b616
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x14010b5e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x1402c2d68], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x14010b689
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14010b639
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x1402c2d68]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x14010b666
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x14010b689
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1402c2d68]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x14010b66d
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x14010b570

Function at 0x140111cc8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140111b38
Function at 0x14011a0a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1402ba4e0]
jne 0x14010d18a
rol rcx, 0x10
test cx, 0xffff
jne 0x14010d186
repz ret
ror rcx, 0x10
jmp 0x14011a000
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1402c3590]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1402c3688]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14011a085
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1402c3590]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14011a0a7
mov rax, qword [rsp + 0x88]
mov qword [0x1402c3688], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1402c3628], rax
mov rax, qword [0x1402c3688]
mov qword [0x1402c3500], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1402c3610], rax
mov dword [0x1402c34f0], 0xc0000409
mov dword [0x1402c34f4], 1
mov rax, qword [0x1402ba4e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1402ba4e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1402c3588], eax
mov ecx, 1
call fcn.14013574c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140241a48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1402c3588], 0
jne 0x14011a12e
mov ecx, 1
call fcn.14013574c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14012e61c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140117598
xor ebx, ebx
cmp qword [0x1402c3ed8], rbx
mov rdi, rax
jne 0x14012e72f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14012e806
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14012e806
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1402c3ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1402c3ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1402c3ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1402c3ef8], rax
test rax, rax
je 0x14012e726
lea rdx, [0x140242180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1402c3ef0], rax
jmp 0x14012e736
mov rax, qword [0x1402c3ef0]
jmp 0x14012e73d
mov rax, qword [0x1402c3ef0]
mov r11, qword [0x1402c3ef8]
cmp rax, rdi
je 0x14012e7a4
cmp r11, rdi
je 0x14012e7a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1402c3ef8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14012e7a4
test rax, rax
je 0x14012e7a4
call rsi
test rax, rax
je 0x14012e79e
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14012e79e
test byte [rsp + 0x40], 1
jne 0x14012e7a4
bts ebp, 0x15
jmp 0x14012e7e4
mov rcx, qword [0x1402c3ee0]
cmp rcx, rdi
je 0x14012e7e4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14012e7e4
call rax
mov rbx, rax
test rax, rax
je 0x14012e7e4
mov rcx, qword [0x1402c3ee8]
cmp rcx, rdi
je 0x14012e7e4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14012e7e4
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1402c3ed8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14012e806
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14012e808
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140142054
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x38]
mov rdi, rcx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x140142160
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov esi, 0x104
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x140142151
cmp dword [rsp + 0x30], 2
mov byte [rsp + 0x143], bl
jne 0x140142115
lea rcx, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
cmp eax, 0x103
setbe bl
jmp 0x140142151
lea rdx, [rsp + 0x40]
mov ecx, ebx
sub rdx, rdi
lea rax, [rsi + 0x7ffffefa]
cmp rax, rbx
je 0x14014213d
mov al, byte [rdx + rdi]
cmp al, bl
je 0x14014213d
mov byte [rdi], al
inc rdi
sub rsi, 1
jne 0x14014211f
cmp rsi, rbx
jne 0x14014214a
dec rdi
mov ecx, 0x8007007a
cmp ecx, ebx
mov byte [rdi], bl
setge bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140142162
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14014dc00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x14014dc41
cmp byte [rdx], r10b
je 0x14014dc39
inc rbx
cmp byte [rbx], r10b
jne 0x14014dc31
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x14014dd6d
mov qword [rsp + 0x40], r14
lea r14, [0x1402454a0]
nop dword [rax]
mov r9d, edi
cmp edi, 2
jge 0x14014dc6c
xor r9d, 1
test rbp, rbp
je 0x14014dcc5
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x14014dcb0
nop dword [rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x14014dcb0
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x14014dc90
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x14014dd41
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x14014dd1a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x14014dd0f
nop dword [rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x14014dcf0
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x14014dd1c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.1401449e0
test rax, rax
je 0x14014dd3e
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x14014dd4c
jmp 0x14014dd41
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x14014dc60
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x14014dd54
Function at 0x14014dd80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x14014ddb8
cmp byte [rdx], r9b
je 0x14014ddb0
inc rbx
cmp byte [rbx], r9b
jne 0x14014dda8
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x14014dedc
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x1402454a0]
nop dword [rax]
mov eax, edi
cmp edi, 2
jge 0x14014ddea
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x14014de45
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x14014de30
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x14014de30
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x14014de10
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x14014deb1
cmp qword [r10 + 0x30], 0
je 0x14014de8a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x14014de7f
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x14014de60
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x14014de8c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.1401449e0
test rax, rax
je 0x14014deae
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x14014debc
jmp 0x14014deb1
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x14014dde0
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x14014dec9

Function at 0x14014f360
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x14014f37f
cmp byte [rdx], 0
je 0x14014f378
inc rax
cmp byte [rax], 0
jne 0x14014f370
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.140144b20
Function at 0x140154830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x140154864
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1402c43a8]
test rax, rax
je 0x140154872
call rax
shl ebx, 4
mov ecx, ebx
call fcn.140153e00
mov rcx, qword [0x1402c43b0]
mov rbx, rax
test rcx, rcx
je 0x14015488d
call rcx
test rbx, rbx
je 0x140154857
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.140143410
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x1402bc338]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call fcn.14010da60
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x1401549a3
mov qword [rsp + 0x30], rbp
lea rbp, [0x1402454a0]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x14015491e
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140154900
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x140154976
mov eax, dword [r9]
test eax, eax
je 0x14015493e
mov rcx, qword [r9 + 8]
jmp 0x140154941
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x140154976
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x14015496c
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x140154992
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x140154992
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x14015498a
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x1401548f0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1401549c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x1402454a0]
test r10d, r10d
je 0x140154a29
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x140154a1f
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x140154a00
xor edx, edx
div r10d
mov r13d, edx
jmp 0x140154a2c
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.1401449e0
mov r11, rax
test rax, rax
je 0x140154ace
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x140154abe
mov rax, qword [rax + 8]
test rax, rax
je 0x140154a68
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x140154a6f
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x140154a7f
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140154aa1
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x140154a9f
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.140143410
dec dword [rbx + 4]
jne 0x140154ac6
mov rcx, rbx
call fcn.140144840
mov rax, rdi
jmp 0x140154b96
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x140154b96
test r12, r12
je 0x140154b94
mov ecx, 0x28
call fcn.140153e00
mov rdi, rax
test rax, rax
jne 0x140154af1
mov rax, r12
jmp 0x140154b96
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x140154b54
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x140154b54
add edx, edx
mov rcx, rbx
call fcn.140154830
test eax, eax
je 0x140154b54
xor eax, eax
test esi, esi
jle 0x140154b4d
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x140154b30
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140154b74
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.140144970
jmp 0x140154b94
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140154b88
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x14015aba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14015acfe
test rdx, rdx
je 0x14015acfe
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x14015ac6b
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x14015ac6b
xor cl, dl
test cl, 0x10
jne 0x14015ac6b
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x14015ac6b
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.14015aba0
test eax, eax
jne 0x14015ac6b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.14015aba0
test eax, eax
jne 0x14015ac6b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.14014d890
test eax, eax
jne 0x14015ac6b
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x14015ac6b
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x14015ac6b
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x14015ac7b
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x14015ac6b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x14015acb7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x14015acb7
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14015acb7
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x14015ac6b
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14015ac6b
call fcn.140143a20
test eax, eax
je 0x14015acb7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x14015acdd
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x14015acf1
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x14015ac6b
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x140160d50
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, dword [rcx + 0x38]
mov rax, rdx
test ecx, ecx
je 0x140160d72
lea rax, [rcx + rdx - 1]
cqo
idiv rcx
imul rax, rcx
mov rdx, rax
mov rcx, rbx
call fcn.140160ad0
test eax, eax
je 0x140160da1
mov r8, qword [rbx + 0x30]
lea rdx, str.winTruncate1
mov r9d, 0x7e4b
mov ecx, 0x60a
add rsp, 0x20
pop rbx
jmp fcn.140160a00
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140160dd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbx + 0x30]
lea rdx, str.winTruncate2
mov r9d, 0x7e4e
mov ecx, 0x60a
mov dword [rbx + 0x1c], eax
add rsp, 0x20
pop rbx
jmp fcn.140160a00
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140161650
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r12d, r12d
mov r13, rdx
mov ebx, r12d
mov edi, r12d
call fcn.140144bc0
mov rcx, r13
test eax, eax
je 0x14016168a
call fcn.140144c30
mov rbp, rax
jmp 0x1401616ae
call fcn.140144c30
mov rsi, rax
test rax, rax
je 0x14016176e
mov rcx, rax
call fcn.140144e10
mov rcx, rsi
mov rbp, rax
call fcn.14010cdec
test rbp, rbp
je 0x14016176e
call fcn.140144bc0
test eax, eax
je 0x140161700
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1401616e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x14016173a
inc ebx
cmp ebx, 5
jge 0x14016173a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401616c0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140161726
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x14016173a
inc ebx
cmp ebx, 5
jge 0x14016173a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140161700
mov rcx, rbp
call fcn.14010cdec
cmp esi, 0xffffffff
jne 0x14016174c
cmp edi, 2
je 0x140161769
lea rdx, str.winDelete
mov r9d, 0x83f7
mov r8, r13
mov ecx, 0xa0a
call fcn.140160a00
mov r12d, eax
mov eax, r12d
jmp 0x140161773
mov eax, 7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret