joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024ec0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
xor ebx, ebx
mov dword [rcx + 8], ebx
mov rcx, rdx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rdi + 0x10]
lea r14, [rdi + 0x10]
mov rbp, rax
test rcx, rcx
je 0x140024f10
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140024f03
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], rbx
mov qword [rdi + 0x18], rbx
call qword [sym.imp.ole32.dll_CoUninitialize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140024f2b
mov dword [rdi + 8], eax
mov ebx, 1
jmp 0x140025013
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 3
lea edx, [r9 - 1]
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, 0x80000000
mov esi, eax
add eax, ecx
test ecx, eax
jne 0x140024f84
cmp esi, 0x80010119
je 0x140024f84
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rdi + 8], esi
mov ebx, 1
jmp 0x14002500e
xor edx, edx
mov qword [rsp + 0x78], r15
lea r15, [rdi + 0x18]
lea r9, [0x14007a148]
mov qword [rsp + 0x20], r15
lea rcx, [0x14007a138]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
jns 0x140024fbd
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rdi + 8], esi
jmp 0x140025004
mov rcx, qword [r15]
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rax, qword [rcx]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
call qword [rax + SafeArrayPutElement]
test eax, eax
jns 0x140025009
mov rcx, qword [r15]
mov dword [rdi + 8], eax
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], rbx
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 1
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x140026d60
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push rsi
sub rsp, 0xa70
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0xa60], rax
mov rsi, rcx
movabs rax, 0x5443454e4e4f43
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov edx, 8
call fcn.140041f8c
mov dword [rsp + 0x30], 0x4e20
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, str..pipeddexecnonsecurepipe
lea r8d, [rax + 1]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CallNamedPipeW]
test eax, eax
jne 0x140026ddf
mov eax, 1
jmp 0x140026ec5
mov qword [rsp + 0xa88], rbx
lea r9, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0xa90], rbp
lea rdx, [rsp + 0x260]
mov qword [rsp + 0x20], 0x200
lea rcx, [rsp + 0x48]
call fcn.140041734
lea rdx, str.CONNECTED
xor ebp, ebp
lea rcx, [rsp + 0x260]
call fcn.140035db0
mov rbx, rax
test rax, rax
je 0x140026ee5
lea rax, [rsp + 0x260]
cmp rbx, rax
jne 0x140026ee5
lea rcx, str.CONNECTED
mov qword [rsp + 0xa98], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdx, [0x14008e394]
lea rdi, [rbx + rcx*2]
mov rcx, rdi
call fcn.140035db0
mov rbx, rax
test rax, rax
je 0x140026ede
lea r8, [rsi + 0x14]
mov word [rax], bp
mov r9d, 0x200
lea rdx, [0x14008e398]
mov rcx, rdi
call fcn.140007b00
lea r8, [rsi + 0x10]
lea rcx, [rbx + 2]
lea rdx, [0x14008e3a0]
call fcn.140007b00
mov eax, ebp
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa88]
mov rbp, qword [rsp + 0xa90]
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0xa70
pop rsi
ret
mov eax, 1
jmp 0x140026ead
mov eax, 1
jmp 0x140026eb5
Function at 0x140026ef0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x658
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x640], rax
movsxd rbx, r9d
mov rbp, r8
mov r9, r8
mov qword [rsp + 0x20], rbx
mov rdi, rdx
mov rsi, rcx
mov r8d, 0x200
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.14004bf84
lea r8d, [rbx*2 + 2]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140026f7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_WriteFile_failed._Error_code__ld_n
call fcn.140007aa0
lea eax, [rdi + 1]
jmp 0x14002702d
lea rdx, [0x14008e408]
mov rcx, rbp
call fcn.14003f054
test eax, eax
je 0x140026fb8
lea rdx, [0x14008e418]
mov rcx, rbp
call fcn.140035db0
test rax, rax
jne 0x140026fb8
lea rdx, str.DISCONNECT
mov rcx, rbp
call fcn.140035db0
test rax, rax
je 0x140026fbc
xor eax, eax
jmp 0x14002702d
mov r9d, dword [rsi + 0x10]
lea r8, str._ldOK
mov edx, 0x200
lea rcx, [rsp + 0x240]
call fcn.140001150
xor ecx, ecx
call fcn.140040e78
xor ecx, ecx
mov rbx, rax
call fcn.140040e78
sub rax, rbx
cmp rax, 2
jge 0x14002702b
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x240]
mov rcx, rsi
call fcn.140027620
test eax, eax
je 0x140026fb8
xor ecx, ecx
call fcn.140040e78
sub rax, rbx
cmp rax, 2
jl 0x140027000
mov eax, 1
jmp 0x14002702d
mov eax, edi
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x658
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140027050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa50
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0xa40], rax
xor r15d, r15d
movsxd rsi, r9d
mov dword [rsp + 0x30], r15d
mov edi, r15d
mov r14, r8
mov rbp, rdx
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140035c20
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x1400270d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140027122
mov r8, rsi
mov qword [rsp + 0x20], 0x200
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x38]
call fcn.140041734
mov eax, esi
lea r9, [rsp + 0x240]
sub eax, edi
lea r8, [0x14007a2f0]
movsxd rdx, eax
movsxd rax, edi
lea rcx, [r14 + rax*2]
call fcn.140001150
add edi, eax
test ebx, ebx
je 0x140027090
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.1400303d0
mov rbx, qword [rsp + 0xa80]
add rsp, 0xa50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa50
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0xa40], rax
mov r9d, dword [rcx + 0x10]
lea r8, str._ld_s
mov rsi, rcx
mov qword [rsp + 0x20], rdx
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140001150
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdi, qword [rsi + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x200
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x38]
lea ebx, [rax*2 + 2]
movsxd rax, ebx
mov qword [rsp + 0x20], rax
call fcn.14004bf84
lea r8d, [rbx*2 + 2]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x14002753a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_WriteFile_failed._Error_code__ld_n
call fcn.140007aa0
lea eax, [rdi + 1]
jmp 0x1400275ed
lea rdx, [0x14008e408]
lea rcx, [rsp + 0x40]
call fcn.14003f054
test eax, eax
je 0x14002757b
lea rdx, [0x14008e418]
lea rcx, [rsp + 0x40]
call fcn.140035db0
test rax, rax
jne 0x14002757b
lea rdx, str.DISCONNECT
lea rcx, [rsp + 0x40]
call fcn.140035db0
test rax, rax
je 0x14002757f
xor eax, eax
jmp 0x1400275ed
mov r9d, dword [rsi + 0x10]
lea r8, str._ldOK
mov edx, 0x200
lea rcx, [rsp + 0x640]
call fcn.140001150
xor ecx, ecx
call fcn.140040e78
xor ecx, ecx
mov rbx, rax
call fcn.140040e78
sub rax, rbx
cmp rax, 2
jge 0x1400275eb
nop word [rax + rax]
lea rdx, [rsp + 0x640]
mov rcx, rsi
call fcn.140027620
test eax, eax
je 0x14002757b
xor ecx, ecx
call fcn.140040e78
sub rax, rbx
cmp rax, 2
jl 0x1400275c0
mov eax, 1
jmp 0x1400275ed
mov eax, edi
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.1400303d0
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140027620
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe50
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0xe40], rax
mov rsi, qword [rcx + 8]
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov edi, r14d
mov rbp, rdx
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140035c20
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x1400276a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140027700
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0x200
mov r8d, 0x200
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x38]
call fcn.140041734
mov eax, 0x200
lea rcx, [rsp + 0x240]
sub eax, edi
lea r9, [rsp + 0x640]
movsxd rdx, eax
lea r8, [0x14007a2f0]
movsxd rax, edi
lea rcx, [rcx + rax*2]
call fcn.140001150
add edi, eax
test ebx, ebx
je 0x140027660
cmp dword [rsp + 0x30], r14d
je 0x14002774f
lea rax, [rsp + 0x240]
mov r9, rbp
sub r9, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x140027734
add rax, 2
test ecx, ecx
jne 0x140027720
test edx, edx
je 0x140027756
mov r8, rbp
lea rdx, [rsp + 0x240]
lea rcx, str.Invalid_response_nreceived____s_nexpected____s_n
call fcn.140007aa0
mov eax, 1
jmp 0x140027759
mov eax, r14d
mov rcx, qword [rsp + 0xe40]
xor rcx, rsp
call fcn.1400303d0
lea r11, [rsp + 0xe50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14002ae70
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov r9, rcx
test rcx, rcx
jne 0x14002aec1
cmp dword [0x1400a557c], ecx
jne 0x14002aeb1
lea rcx, [0x1400a5580]
mov dword [0x1400a5580], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [0x1400a557c], 1
mov r9, qword [0x1400a5588]
xor ebx, ebx
mov rdi, qword [0x1400a5590]
mov rcx, qword [0x1400a7130]
lea r8, [0x140066918]
lea rdx, str.TotalOSPhysMemory
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov rcx, qword [0x1400a7130]
lea r8, [0x140066928]
mov r9, rdi
lea rdx, str.MemoryAvailable
mov rax, qword [rcx]
call qword [rax + 0xa8]
test rbx, rbx
je 0x14002af26
mov rcx, qword [0x1400a7130]
lea r8, str._I64u
mov r9, rbx
lea rdx, str.MemoryAllocated
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002e340
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rcx
je 0x14002e484
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
call fcn.14002e550
xor esi, esi
mov ebx, esi
cmp dword [rdi + 0x28], ebx
jbe 0x14002e3b7
nop dword [rax]
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x460
add rcx, qword [rdi + 0x30]
cmp dword [rcx + 0x18], esi
je 0x14002e3b0
cmp dword [rcx + 0x34], 4
je 0x14002e3b0
xor r8d, r8d
mov dword [rcx + 0x30], SafeArrayLock
mov rcx, qword [rcx + 0x28]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
inc ebx
cmp ebx, dword [rdi + 0x28]
jb 0x14002e380
mov ebp, SafeArrayGetLBound
nop dword [rax]
mov ecx, dword [rdi + 0x28]
mov ebx, esi
test ecx, ecx
je 0x14002e3f8
mov rax, qword [rdi + 0x30]
add rax, 0x34
cmp dword [rax - 0x1c], esi
je 0x14002e3dd
cmp dword [rax], 4
je 0x14002e3dd
inc ebx
add rax, 0x460
sub rcx, 1
jne 0x14002e3d1
test ebx, ebx
je 0x14002e3f8
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebp, 1
je 0x14002e401
test ebx, ebx
jne 0x14002e3c0
mov eax, dword [rdi + 0x28]
mov ebx, esi
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x14002e440
nop
mov eax, ebx
imul rcx, rax, 0x460
add rcx, qword [rdi + 0x30]
cmp dword [rcx + 0x18], esi
je 0x14002e437
cmp dword [rcx + 0x34], 4
jne 0x14002e437
mov rcx, qword [rcx + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rdi + 0x28]
inc ebx
cmp ebx, eax
jb 0x14002e410
mov rbx, qword [rsp + 0x38]
test eax, eax
je 0x14002e47f
nop dword [rax]
mov eax, esi
imul rcx, rax, 0x460
add rcx, qword [rdi + 0x30]
cmp dword [rcx + 0x18], 0
je 0x14002e478
cmp dword [rcx + 0x34], 4
je 0x14002e478
mov rcx, qword [rcx + 0x20]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
inc esi
cmp esi, dword [rdi + 0x28]
jb 0x14002e450
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14002e550
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rbx, rcx
lea rax, [rsp + 0x60]
mov rcx, qword [rcx + 0x48]
xor edi, edi
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x14002e6b2
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14002e6ab
lea ecx, [rax + 1]
mov qword [rsp + 0x38], r14
call fcn.140030420
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx + 0x48]
mov rdx, rax
mov r14, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002e6c7
mov eax, dword [rsp + 0x68]
mov rbx, r14
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], r15
lea r15, [rdi - 1]
mov byte [rax + r14], dil
movzx eax, byte [r14]
mov rbp, rbx
test al, al
je 0x14002e629
nop
movzx ecx, al
cmp al, 0xd
je 0x14002e605
movzx eax, byte [rbx + 1]
inc rbx
movzx ecx, al
test al, al
jne 0x14002e5f0
test cl, cl
je 0x14002e629
mov byte [rbx], 0
inc rbx
movzx eax, byte [rbx]
test al, al
je 0x14002e629
cmp al, 0xd
je 0x14002e61e
cmp al, 0xa
jne 0x14002e629
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x14002e616
mov rsi, r15
nop dword [rax]
inc rsi
cmp byte [rsi + rbp], 0
jne 0x14002e630
inc rsi
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140030420
mov r9, rbp
mov qword [rsp + 0x20], r15
mov r8, rsi
lea rcx, [rsp + 0x70]
mov rdx, rax
mov rdi, rax
call fcn.140041734
mov rcx, qword [0x1400a7130]
mov rdx, rdi
mov r8, qword [rcx]
call qword [r8 + 0x50]
mov rcx, rdi
call fcn.1400302b8
movzx eax, byte [rbx]
test al, al
jne 0x14002e5e7
mov rcx, r14
call fcn.1400302b8
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x38]
add rsp, 0x48
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.PeekNamedPipe_error__d
call fcn.14002e4d0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ReadFile_error__d
call fcn.14002e4d0
int3
Function at 0x140038b34
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400389c7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400389c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400389c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400389c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400389c7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400389c7
cmp dword [rcx + 0xf8], 0
je 0x1400389c7
mov ecx, ebx
call fcn.140038a68
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140038858
cmp dword [rbp + 0x20], 0
je 0x140038a14
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140038a1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140038960

Function at 0x14004b6e8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004b6e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004a584
or eax, 0xffffffff
jmp 0x14004b6e2
xor eax, eax
add rsp, 0x28
ret
jmp 0x14004b6c0
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14013d000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x140001010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov dword [rsp + 0x20], 1
movsd xmm0, qword [str.Phenyx2022]
movsd qword [rsp + 0x38], xmm0
movzx eax, word [0x1400184c0]
mov word [rsp + 0x40], ax
movzx eax, byte [0x1400184c2]
mov byte [rsp + 0x42], al
xor eax, eax
xor esi, esi
test r8, r8
je 0x140001107
xor edx, edx
nop dword [rax]
xor ebp, ebp
cmp eax, 0xa
cmovne rbp, rdx
xor r14d, r14d
cmp eax, 0xa
cmovne r14d, eax
movzx eax, byte [rsp + rbp + 0x38]
xor byte [rdi], al
movzx r9d, byte [rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400010ea
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400010df
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400010f2
mov rcx, rbx
call fcn.140002140
lea eax, [r14 + 1]
lea rdx, [rbp + 1]
inc esi
inc rdi
movsxd rcx, esi
cmp rcx, r15
jb 0x1400010a0
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400027a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006624
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400064b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400064b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400064b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400064b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400064b7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400064b7
cmp dword [rcx + 0xf8], 0
je 0x1400064b7
mov ecx, ebx
call fcn.140006558
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140006348
cmp dword [rbp + 0x20], 0
je 0x140006504
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000650c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140006450
Function at 0x140001110
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x48], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x80]
lea rdx, section..text
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x80]
lea rdx, section..text
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x80]
lea rdx, [0x140001040]
mov qword [rcx + rax + 0x70], rdx
mov rax, qword [rsp + 0x80]
lea rcx, [0x140001290]
mov qword [rax + 0x68], rcx
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x28]
add rax, 0x48
mov rcx, rax
call fcn.140001358
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400011e8
mov eax, dword [rsp + 0x40]
jmp 0x14000127f
lea rdx, [0x140002120]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000123d
mov eax, dword [rsp + 0x40]
jmp 0x14000127f
lea rdx, [0x1400020f0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1400018c4
nop
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000127b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [rsp + 0x40]
jmp 0x14000127f
mov eax, dword [rsp + 0x40]
add rsp, 0x70
pop rdi
ret