joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x1400120aa
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140012199
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x50], 0
jle 0x140012141
cmp qword [rsp + 0x28], 0
jle 0x140012141
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x50], rax
jge 0x1400120ea
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140002ba0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x140012189
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140012189
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
add rsp, 0x30
pop rdi
ret
Function at 0x140014c90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
lea rdi, [rsp + 0x30]
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xf0]
cmp qword [rax + 0x68], 0
je 0x140014ce7
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140014cee
mov al, 1
jmp 0x140014e88
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0xa8], rax
call fcn.1400145a0
mov dword [rsp + 0xb0], eax
mov edx, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0xa8]
mov dword [rsp + 0xb4], eax
call fcn.1400145a0
mov dword [rsp + 0xb8], eax
mov edx, dword [rsp + 0xb4]
mov ecx, dword [rsp + 0xb8]
call fcn.140016050
movzx eax, al
test eax, eax
je 0x140014d5b
xor al, al
jmp 0x140014e88
mov qword [rsp + 0x30], 0x20
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0xf0]
add rcx, 0x74
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x48]
mov rdx, rcx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xc8], 0
je 0x140014ddd
cmp dword [rsp + 0xc8], 1
je 0x140014de9
cmp dword [rsp + 0xc8], 3
je 0x140014e76
jmp 0x140014e86
mov rax, qword [rsp + 0xf0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
jbe 0x140014e44
mov rax, qword [rsp + 0xf0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x98]
mov edx, 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rsp + 0x98], rax
je 0x140014e44
xor al, al
jmp 0x140014e88
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140014e61
mov dword [rsp + 0xcc], 1
jmp 0x140014e6c
mov dword [rsp + 0xcc], 0
movzx eax, byte [rsp + 0xcc]
jmp 0x140014e88
mov rax, qword [rsp + 0xf0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140014e88
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401bd4e0]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140061a30
add rsp, 0xe0
pop rdi
ret

Function at 0x140041980
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x1400419a9
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1400419f3
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14004199e
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140062980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140062460
movzx eax, al
test eax, eax
jne 0x1400629a0
mov ecx, 7
call fcn.140063610
nop
mov byte [rsp + 0x20], 0
call fcn.140062290
mov byte [rsp + 0x21], al
cmp dword [0x1401e7690], 1
jne 0x1400629c4
mov ecx, 7
call fcn.140063610
nop
jmp 0x140062a1c
cmp dword [0x1401e7690], 0
jne 0x140062a17
mov dword [0x1401e7690], 1
lea rdx, [0x14018fbb8]
lea rcx, [0x14018fba0]
call sub.ucrtbased.dll__initterm_e
test eax, eax
je 0x1400629f8
mov eax, 0xff
jmp 0x140062b21
lea rdx, [0x14018fb98]
lea rcx, [0x14018fb38]
call sub.ucrtbased.dll__initterm
mov dword [0x1401e7690], 2
jmp 0x140062a1c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140062650
call fcn.140063c40
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140062a79
mov rcx, qword [rsp + 0x30]
call fcn.1400625c0
movzx eax, al
test eax, eax
je 0x140062a79
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14018fb10]
nop
call fcn.140063c50
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140062aad
mov rcx, qword [rsp + 0x38]
call fcn.1400625c0
movzx eax, al
test eax, eax
je 0x140062aad
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call sub.ucrtbased.dll__register_thread_local_exe_atexit_callback
nop
call fcn.140062b30
mov dword [rsp + 0x28], eax
call fcn.140063830
movzx eax, al
test eax, eax
jne 0x140062acc
mov ecx, dword [rsp + 0x28]
call sub.ucrtbased.dll_exit
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140062adb
call sub.ucrtbased.dll__cexit
nop
xor edx, edx
mov cl, 1
call fcn.140062680
mov eax, dword [rsp + 0x28]
jmp 0x140062b21
add rsp, 0x68
ret

Function at 0x140063ee0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140063f1d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140063e80
add rsp, 0x58
ret
Function at 0x140101a90
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1c], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.1400f7ef0
cmp dword [rsp + 0x60], 0
jne 0x140101b12
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.1400f7ef0
nop
add rsp, 0x40
pop rdi
ret
Function at 0x14016c750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.1401717a0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14016c791
mov eax, 7
jmp 0x14016c86a
movzx eax, byte [0x1401dd784]
test eax, eax
je 0x14016c7aa
mov ecx, 0xc8
call fcn.14016b670
test eax, eax
je 0x14016c7c0
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VCRUNTIME140D.dll_memset]
nop
jmp 0x14016c82f
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x14016c880]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x14016c82f
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VCRUNTIME140D.dll_memset]
nop
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x14016c85b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1401778c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x210
lea rdi, [rsp + 0x20]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x220]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140177922
xor al, al
jmp 0x140177aa6
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140177945
xor al, al
jmp 0x140177aa6
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140177a99
lea rax, [0x1401e7740]
mov qword [rsp + 0x178], rax
mov rcx, qword [rsp + 0x178]
call fcn.1400024c0
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x178]
call fcn.1400024a0
mov qword [rsp + 0x188], rax
jmp 0x1401779ac
mov rax, qword [rsp + 0x180]
add rax, 0x28
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x188]
cmp qword [rsp + 0x180], rax
je 0x140177a94
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x198]
call fcn.1400027c0
nop
lea rcx, [rsp + 0x1f9]
call fcn.140177840
mov r8, rax
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x1c8]
call fcn.140003070
mov rcx, rax
call fcn.140002630
mov rdx, rax
lea rcx, [rsp + 0x6c]
call qword [sym.imp.ucrtbased.dll_strcmp]
test eax, eax
jne 0x140177a24
mov dword [rsp + 0x1fc], 1
jmp 0x140177a2f
mov dword [rsp + 0x1fc], 0
movzx eax, byte [rsp + 0x1fc]
mov byte [rsp + 0x1f8], al
lea rcx, [rsp + 0x1c8]
call fcn.140002650
movzx eax, byte [rsp + 0x1f8]
test eax, eax
je 0x140177a81
mov rax, qword [rsp + 0x220]
mov byte [rax], 1
mov byte [rsp + 0x1fa], 1
lea rcx, [rsp + 0x198]
call fcn.140002650
movzx eax, byte [rsp + 0x1fa]
jmp 0x140177aa6
lea rcx, [rsp + 0x198]
call fcn.140002650
nop
jmp 0x140177998
jmp 0x140177945
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401ac720]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x210
pop rdi
ret
Function at 0x1401782f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x28], 0x3a
mov byte [rsp + 0x29], 0x43
mov byte [rsp + 0x2a], 0x25
mov byte [rsp + 0x2b], 0x2e
mov byte [rsp + 0x2c], 0x10
mov byte [rsp + 0x2d], 0x17
mov byte [rsp + 0x2e], 0x1d
mov byte [rsp + 0x2f], 0x16
mov byte [rsp + 0x30], 0xe
mov byte [rsp + 0x31], 0xa
mov byte [rsp + 0x32], 0x25
mov byte [rsp + 0x33], 0x2a
mov byte [rsp + 0x34], 0
mov byte [rsp + 0x35], 0xa
mov byte [rsp + 0x36], 0xd
mov byte [rsp + 0x37], 0x1c
mov byte [rsp + 0x38], 0x14
mov byte [rsp + 0x39], 0x4a
mov byte [rsp + 0x3a], 0x4b
mov byte [rsp + 0x3b], 0x25
mov byte [rsp + 0x3c], 0x79
lea rcx, [rsp + 0x28]
call fcn.140009390
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401acc60]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x60
pop rdi
ret

Function at 0x140179360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x28], 0x2f
mov byte [rsp + 0x29], 0x3b
mov byte [rsp + 0x2a], 0x16
mov byte [rsp + 0x2b], 1
mov byte [rsp + 0x2c], 0x3d
mov byte [rsp + 0x2d], 0x10
mov byte [rsp + 0x2e], 0xa
mov byte [rsp + 0x2f], 9
mov byte [rsp + 0x30], 0x3d
mov byte [rsp + 0x31], 0x4a
mov byte [rsp + 0x32], 0x3d
mov byte [rsp + 0x33], 0x79
lea rcx, [rsp + 0x28]
call fcn.1400093d0
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401ad360]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x60
pop rdi
ret

Function at 0x140179760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x28], 0x2f
mov byte [rsp + 0x29], 0x30
mov byte [rsp + 0x2a], 0x3d
mov byte [rsp + 0x2b], 0x26
mov byte [rsp + 0x2c], 0x41
mov byte [rsp + 0x2d], 0x49
mov byte [rsp + 0x2e], 0x3c
mov byte [rsp + 0x2f], 0x3c
mov byte [rsp + 0x30], 0x79
lea rcx, [rsp + 0x28]
call fcn.1400092d0
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401ad600]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x60
pop rdi
ret
Function at 0x140180800
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x20]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call fcn.14005b500
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140002760
mov rdx, rax
lea rcx, [0x1401e7d88]
call fcn.140014520
lea rcx, [rsp + 0x20]
call fcn.140002650
nop
lea rdx, str..txt
lea rcx, [0x1401e7d88]
call fcn.14000a3d0
nop
call fcn.14005b500
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002760
mov rdx, rax
lea rcx, [0x1401e7d60]
call fcn.140014520
lea rcx, [rsp + 0x48]
call fcn.140002650
nop
lea rdx, str..ps1
lea rcx, [0x1401e7d60]
call fcn.14000a3d0
mov dword [rsp + 0x78], 0x18
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x80], 0
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [0x1401e7d58]
lea rcx, [0x1401e7d50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1401808fa
xor al, al
jmp 0x140180919
xor r8d, r8d
mov edx, 1
mov rcx, qword [0x1401e7d50]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140180917
xor al, al
jmp 0x140180919
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401af990]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140061a30
add rsp, 0xb0
pop rdi
ret
Function at 0x1401826c0
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [rsp + 0x20]
call fcn.1401825f0
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
jne 0x1401826ed
xor al, al
jmp 0x1401826ef
mov al, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140183370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x28], 0x2d
mov byte [rsp + 0x29], 0x32
mov byte [rsp + 0x2a], 0x2a
mov byte [rsp + 0x2b], 0x38
mov byte [rsp + 0x2c], 0x2f
mov byte [rsp + 0x2d], 0x2e
mov byte [rsp + 0x2e], 0x35
mov byte [rsp + 0x2f], 0x38
mov byte [rsp + 0x30], 0x31
mov byte [rsp + 0x31], 0x31
mov byte [rsp + 0x32], 0x7d
mov byte [rsp + 0x33], 0x70
mov byte [rsp + 0x34], 0x18
mov byte [rsp + 0x35], 0x25
mov byte [rsp + 0x36], 0x38
mov byte [rsp + 0x37], 0x3e
mov byte [rsp + 0x38], 0x28
mov byte [rsp + 0x39], 0x29
mov byte [rsp + 0x3a], 0x34
mov byte [rsp + 0x3b], 0x32
mov byte [rsp + 0x3c], 0x33
mov byte [rsp + 0x3d], 0xd
mov byte [rsp + 0x3e], 0x32
mov byte [rsp + 0x3f], 0x31
mov byte [rsp + 0x40], 0x34
mov byte [rsp + 0x41], 0x3e
mov byte [rsp + 0x42], 0x24
mov byte [rsp + 0x43], 0x7d
mov byte [rsp + 0x44], 0x1f
mov byte [rsp + 0x45], 0x24
mov byte [rsp + 0x46], 0x2d
mov byte [rsp + 0x47], 0x3c
mov byte [rsp + 0x48], 0x2e
mov byte [rsp + 0x49], 0x2e
mov byte [rsp + 0x4a], 0x7d
mov byte [rsp + 0x4b], 0x73
mov byte [rsp + 0x4c], 0x72
mov byte [rsp + 0x4d], 0x5d
lea rcx, [rsp + 0x28]
call fcn.1400601f0
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b09c0]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x70
pop rdi
ret
Function at 0x1401841d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x28], 0x7f
mov byte [rsp + 0x29], 0x66
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0xd
mov byte [rsp + 0x2c], 0x3c
mov byte [rsp + 0x2d], 0x29
mov byte [rsp + 0x2e], 0x35
mov byte [rsp + 0x2f], 0x60
mov byte [rsp + 0x30], 0x7f
mov byte [rsp + 0x31], 0x73
mov byte [rsp + 0x32], 1
mov byte [rsp + 0x33], 0x5d
lea rcx, [rsp + 0x28]
call fcn.1400602b0
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b0ae0]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x60
pop rdi
ret

Function at 0x140184280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x28], 0xf
mov byte [rsp + 0x29], 0x18
mov byte [rsp + 0x2a], 0xd
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x1c
mov byte [rsp + 0x2d], 0x1e
mov byte [rsp + 0x2e], 0x18
mov byte [rsp + 0x2f], 0x7d
mov byte [rsp + 0x30], 0xa
mov byte [rsp + 0x31], 0x14
mov byte [rsp + 0x32], 9
mov byte [rsp + 0x33], 0x15
mov byte [rsp + 0x34], 0x7d
mov byte [rsp + 0x35], 8
mov byte [rsp + 0x36], 0xf
mov byte [rsp + 0x37], 0x7d
mov byte [rsp + 0x38], 0x12
mov byte [rsp + 0x39], 0xa
mov byte [rsp + 0x3a], 0x13
mov byte [rsp + 0x3b], 0x7d
mov byte [rsp + 0x3c], 0xa
mov byte [rsp + 0x3d], 0x18
mov byte [rsp + 0x3e], 0x1f
mov byte [rsp + 0x3f], 0x15
mov byte [rsp + 0x40], 0x12
mov byte [rsp + 0x41], 0x12
mov byte [rsp + 0x42], 0x16
mov byte [rsp + 0x43], 0x7c
mov byte [rsp + 0x44], 0x5d
lea rcx, [rsp + 0x28]
call fcn.1400602f0
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b0b40]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x70
pop rdi
ret
Function at 0x140184740
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rdi
sub rsp, 0x2e0
lea rdi, [rsp + 0x30]
mov ecx, 0xac
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
xor eax, eax
test eax, eax
je 0x140184777
jmp 0x1401848d2
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
nop
lea rcx, [rsp + 0x2d0]
call fcn.1401832e0
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.140002760
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x168]
call fcn.14000a3d0
nop
lea rcx, [rsp + 0x2d1]
call fcn.140183250
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.14000a3d0
nop
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140184801
mov dword [rsp + 0x2d4], 1
jmp 0x14018480c
mov dword [rsp + 0x2d4], 0
cmp dword [rsp + 0x2d4], 0
je 0x140184829
lea rcx, [rsp + 0x168]
call fcn.140002650
nop
jmp 0x1401848d2
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x140184859
lea rcx, [rsp + 0x168]
call fcn.140002650
nop
jmp 0x1401848d2
lea rcx, [rsp + 0x2d2]
call fcn.1401831c0
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140184891
lea rcx, [rsp + 0x168]
call fcn.140002650
nop
jmp 0x1401848d2
lea rcx, [rsp + 0x168]
call fcn.140002630
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [rsp + 0x1b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x168]
call fcn.140002650
nop
mov rcx, rsp
lea rdx, [0x1401b0d80]
call fcn.140185b40
nop
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x2e0
pop rdi
ret

Function at 0x140184910
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x80
cmp qword [0x1401e7d50], 0
je 0x140184931
mov rcx, qword [0x1401e7d50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [0x1401e7d58], 0
je 0x140184949
mov rcx, qword [0x1401e7d58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
test eax, eax
je 0x140184954
jmp 0x1401849d4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401e7d88]
mov rcx, qword [rsp + 0x48]
call fcn.1400027c0
mov rcx, rax
call fcn.140185290
movzx eax, al
test eax, eax
je 0x140184994
lea rcx, [0x1401e7d88]
call fcn.140002630
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
lea rdx, [0x1401e7d60]
mov rcx, qword [rsp + 0x78]
call fcn.1400027c0
mov rcx, rax
call fcn.140185290
movzx eax, al
test eax, eax
je 0x1401849d4
lea rcx, [0x1401e7d60]
call fcn.140002630
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
nop
add rsp, 0x80
pop rdi
ret