joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e070
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov r14, rdx
mov rsi, rcx
call fcn.140074c90
test al, al
je 0x14007e0d8
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140285bf8]
mov qword [rbp - 0x10], rax
lea rdx, [0x140214b58]
lea rcx, [rbp - 0x28]
call fcn.140022730
call fcn.140179abc
mov dword [rax], 0x16
xor al, al
jmp 0x14007e284
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.140074f40
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.140017e00
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14007e12b
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007e12b
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.140030bb0
cmp r15, 0xffffffffffffffff
je 0x14007e16e
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140285bf8]
mov qword [rbp - 0x10], rax
lea rdx, [0x140214b80]
lea rcx, [rbp - 0x28]
call fcn.140022730
call fcn.140179abc
mov dword [rax], 0x16
xor al, al
jmp 0x14007e284
mov rcx, r14
call fcn.140074c90
test al, al
jne 0x14007e09b
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140074f40
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.140017e00
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14007e1ca
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007e1ca
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.140030bb0
cmp r15, 0xffffffffffffffff
jne 0x14007e131
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14007e23e
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007e23e
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.140030bb0
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14007e264
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14007e264
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.140030bb0
test ebx, ebx
jne 0x14007e280
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14007e2a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov r14, rdx
mov rsi, rcx
call fcn.140074c90
test al, al
je 0x14007e308
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140285bf8]
mov qword [rbp - 0x10], rax
lea rdx, [0x140214b58]
lea rcx, [rbp - 0x28]
call fcn.140022730
call fcn.140179abc
mov dword [rax], 0x16
xor al, al
jmp 0x14007e4ba
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.140074f40
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.140017e00
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14007e35b
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007e35b
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.140030bb0
cmp r15, 0xffffffffffffffff
je 0x14007e39e
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140285bf8]
mov qword [rbp - 0x10], rax
lea rdx, [0x140214b80]
lea rcx, [rbp - 0x28]
call fcn.140022730
call fcn.140179abc
mov dword [rax], 0x16
xor al, al
jmp 0x14007e4ba
mov rcx, r14
call fcn.140074c90
test al, al
jne 0x14007e2cb
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140074f40
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.140017e00
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14007e3fa
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007e3fa
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.140030bb0
cmp r15, 0xffffffffffffffff
jne 0x14007e361
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14007e474
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007e474
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.140030bb0
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14007e49a
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14007e49a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.140030bb0
test ebx, ebx
jne 0x14007e4b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x14007e5a0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140083520
nop
mov rcx, rax
call fcn.14001d9a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14007e5f7
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14007e5f7
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x14007edf0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rbp, rdx
mov r14, rcx
xor sil, sil
xor edi, edi
call fcn.140074c30
test al, al
je 0x14007ee9d
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140074810
mov rcx, qword [rax + 8]
movzx ecx, word [rcx]
call fcn.14001d030
lea ecx, [rax - 0x41]
mov ebx, 1
shl ebx, cl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007ee8b
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14007ee8b
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
and ebx, edi
setne sil
neg ebx
sbb edi, edi
and edi, 0x14
jmp 0x14007ef75
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140074f40
nop
mov qword [rsp + 0x20], 7
lea rax, [0x140214be0]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14001c760
test al, al
je 0x14007ef48
mov rdx, qword [rsp + 0x38]
mov r9d, ebx
mov r8d, 7
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.140017e00
test eax, eax
jle 0x14007ef32
mov rdx, qword [rsp + 0x38]
inc eax
movsxd r8, eax
mov r9d, ebx
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.140017e00
test eax, eax
jle 0x14007ef32
mov rcx, qword [rsp + 0x40]
dec rcx
cdqe
cmp rax, rcx
jne 0x14007ef48
lea rcx, [rsp + 0x30]
call fcn.14007f1c0
test al, al
je 0x14007ef48
mov edi, 0x10
movzx esi, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007ef75
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14007ef75
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
test sil, sil
je 0x14007ef9f
mov dword [rbp + 0x10], edi
test dil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or ecx, dword [rbp + 4]
bts ecx, 0x16
mov dword [rbp + 4], ecx
or dword [rbp], 0x560000
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x14007efc0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov r12, rcx
xor r13d, r13d
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov dword [rbp - 0x3c], r13d
mov dword [rbp - 0x40], r13d
mov rsi, qword [rbp + 0x50]
mov rcx, r12
call fcn.14001d9a0
mov rcx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x38]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov r15d, eax
test eax, eax
je 0x14007f043
cmp eax, 0xea
jne 0x14007f17b
mov rdi, qword [rbp - 0x38]
mov r14d, 1
cmp dword [rbp + 0x58], r14d
jb 0x14007f17b
test rbx, rbx
je 0x14007f16a
cmp dword [rdi + 8], 0
jne 0x14007f16a
mov r8, 0xffffffffffffffff
mov rdx, qword [rdi]
lea rcx, [rbp - 0x18]
call fcn.140017720
nop
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x28], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov eax, dword [rbp + 0x50]
or eax, 5
mov dword [rbp + 0x50], eax
test al, 2
je 0x14007f0d8
and dword [rbp + 0x50], 0xfffffffd
test rsi, rsi
je 0x14007f0d8
mov eax, 0xffffffff
lock xadd dword [rsi], eax
cmp eax, 1
jne 0x14007f0d8
mov edx, 2
mov r8d, 8
mov rcx, rsi
call fcn.140030bb0
nop
mov eax, dword [rbp + 0x50]
test al, 1
je 0x14007f10f
and dword [rbp + 0x50], 0xfffffffe
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14007f10f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14007f10f
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.140030bb0
nop
lea r8, [rbp - 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.14000ad10
mov rax, qword [rbx]
test rax, rax
je 0x14007f12e
mov ecx, dword [rax]
cmp ecx, 1
jle 0x14007f13f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000a560
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14007f16a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14007f16a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.140030bb0
add rdi, 0x18
inc r14d
cmp r14d, dword [rbp + 0x58]
jbe 0x14007f057
mov rcx, qword [rbp - 0x38]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r15d, 0xea
je 0x14007eff7
test r15d, r15d
sete al
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007fbd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9, rdx
test r8, r8
je 0x14007fc06
mov r9, qword [0x1419a49a0]
mov rax, qword [0x1419a6180]
bt rax, 8
jae 0x14007fc06
mov rax, qword [0x1419a6180]
test al, 0x20
jne 0x14007f890
cmp rdx, 8
jbe 0x14007fb20
jmp 0x14007fcb0
Function at 0x14007fc70
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
test r8, r8
je 0x14007fca6
nop dword [rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
shl edx, 4
add edx, eax
mov eax, edx
shr edx, 0x17
and edx, 0x1e0
xor edx, eax
and edx, 0xfffffff
sub r8, 1
jne 0x14007fc80
mov eax, edx
ret
Function at 0x140083f10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0xd4], 1
je 0x140076949
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a0d2d.0]
mov dword [rbx + 0xd4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140083f10
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x28]
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
jne 0x140083fff
cmp dword [rsi + 0xd0], 0xffffffff
jne 0x140084089
cmp qword [rsi + 0xb0], 0xffffffffffffffff
je 0x140084080
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140083fbd
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140083fb5
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140083f70
mov rax, rbx
jmp 0x140084097
test rbx, rbx
jne 0x140083fb5
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140063d80
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1400745f0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140084080
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jmp 0x140084069
call fcn.14017c3f8
mov ecx, eax
call fcn.14017c27c
cmp rax, 0xffffffffffffffff
je 0x140084089
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x140084089
mov rcx, qword [rsi + 0xa8]
call fcn.140179c68
test eax, eax
je 0x140084089
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140063f20
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1400745f0
nop
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140084080
mov ecx, 0xffffffff
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x140084080
mov r8d, 8
mov edx, 2
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
mov rax, 0xffffffffffffffff
jmp 0x140084097
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140076970
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400842c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x70], 0xfdffffff
cmp dword [rbx + 0xd4], 2
je 0x140077520
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a0d2d.0]
mov dword [rbx + 0xd4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400842c0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x28]
cmp qword [rcx + 0xa8], 0
jne 0x1400843c6
cmp dword [rcx + 0xd0], 0xffffffff
jne 0x1400843c6
cmp qword [rcx + 0xb0], 0xffffffffffffffff
je 0x1400843bd
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008436a
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140084365
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140084320
mov rax, rbx
jmp 0x1400843cb
test rbx, rbx
jne 0x140084365
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140063d80
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call fcn.1400745f0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400843bd
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400843bd
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
mov rax, 0xffffffffffffffff
jmp 0x1400843cb
call fcn.140077540
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140084b50
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
mov rdi, qword [rax + 0xb0]
cmp rdi, 0xffffffffffffffff
jne 0x140084cba
cmp dword [rax + 0xd0], edi
jne 0x140084c8b
cmp qword [rax + 0xa8], 0
jne 0x140084c8b
lea rdi, [rax + 0x30]
mov rcx, rdi
call fcn.140074c90
test al, al
jne 0x140084d22
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140074810
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140022ac0
nop
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140084bf8
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140084bf8
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
mov edx, 3
lea rcx, [rsp + 0x20]
call fcn.140023990
test al, al
je 0x140084c7c
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140024800
movzx esi, al
test al, al
jne 0x140084c69
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.140038640
nop
mov r8, rax
mov edx, 0xc
mov rcx, rbx
call fcn.1400745f0
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140084c69
lock xadd dword [rax], edi
cmp edi, 1
jne 0x140084c69
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x48]
call fcn.140030bb0
nop
lea rcx, [rsp + 0x20]
call fcn.140022ba0
movzx eax, sil
jmp 0x140084d24
lea rcx, [rsp + 0x20]
call fcn.140022ba0
jmp 0x140084d22
cmp rdi, 0xffffffffffffffff
jne 0x140084cba
mov rcx, qword [rax + 0xa8]
test rcx, rcx
je 0x140084ca4
call fcn.14017c3f8
jmp 0x140084caa
mov eax, dword [rax + 0xd0]
mov ecx, eax
call fcn.14017c27c
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140084d22
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x1400a0d2d.0]
mov rbp, rax
mov rax, qword [rbx]
mov rdx, rsi
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400a0d2d.0]
test al, al
je 0x140084d0f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140084d0f
mov rax, qword [rbx]
cmp rbp, rsi
cmovl rsi, rbp
mov rdx, rsi
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400a0d2d.0]
mov al, 1
jmp 0x140084d24
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400a0d2d.0]
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400ab570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], r13
mov r14, r9
lea r13, [r8 - 1]
mov qword [rsp + 0x58], r15
mov rbp, r13
mov r15, r8
sar rbp, 1
mov rsi, rdx
mov rbx, rcx
mov r12, rdx
mov r9, rdx
cmp rdx, rbp
jge 0x1400ab627
nop dword [rax + rax]
lea rdi, [r9 + r9]
lea rcx, [rdi + 2]
shl rcx, 5
add rcx, rbx
lea rdx, [rcx - 0x20]
call fcn.1400af7f0
shl rsi, 5
movzx r9d, al
xor r9, 1
inc r9
mov rcx, qword [rsi + rbx]
add r9, rdi
mov rdx, r9
shl rdx, 5
add rdx, rbx
mov rax, qword [rdx]
mov qword [rsi + rbx], rax
mov rax, qword [rdx + 8]
mov qword [rdx], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rdx + 8], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [rdx + 0x10], rcx
mov rax, qword [rdx + 0x18]
mov qword [rsi + rbx + 0x18], rax
mov rsi, r9
cmp r9, rbp
jl 0x1400ab5b0
cmp r9, rbp
jne 0x1400ab681
test r15b, 1
jne 0x1400ab681
shl r15, 5
shl rsi, 5
mov rax, qword [r15 + rbx - 0x20]
mov rcx, qword [rsi + rbx]
mov qword [rsi + rbx], rax
mov rax, qword [r15 + rbx - 0x18]
mov qword [r15 + rbx - 0x20], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [r15 + rbx - 0x10]
mov qword [r15 + rbx - 0x18], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [r15 + rbx - 0x10], rcx
mov rax, qword [r15 + rbx - 8]
mov qword [rsi + rbx + 0x18], rax
mov rsi, r13
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
cmp r12, rsi
jge 0x1400ab6f7
lea rbp, [rsi - 1]
mov rdx, r14
sar rbp, 1
mov rdi, rbp
shl rdi, 5
add rdi, rbx
mov rcx, rdi
call fcn.1400af7f0
test al, al
je 0x1400ab6f7
mov rax, qword [rdi]
shl rsi, 5
mov rcx, qword [rsi + rbx]
mov qword [rsi + rbx], rax
mov rax, qword [rdi + 8]
mov qword [rdi], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [rdi + 0x10]
mov qword [rdi + 8], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [rdi + 0x10], rcx
mov rax, qword [rdi + 0x18]
mov qword [rsi + rbx + 0x18], rax
mov rsi, rbp
cmp r12, rbp
jl 0x1400ab690
mov rax, qword [r14]
shl rsi, 5
mov rcx, qword [rsi + rbx]
mov qword [rsi + rbx], rax
mov rax, qword [r14 + 8]
mov qword [r14], rcx
mov rcx, qword [rsi + rbx + 8]
mov qword [rsi + rbx + 8], rax
mov rax, qword [r14 + 0x10]
mov qword [r14 + 8], rcx
mov rcx, qword [rsi + rbx + 0x10]
mov qword [rsi + rbx + 0x10], rax
mov qword [r14 + 0x10], rcx
mov rax, qword [r14 + 0x18]
mov qword [rsi + rbx + 0x18], rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bc160
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rax - 0x58], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rax - 0x58], 1
mov qword [rax + 0x18], r12
lea r9, [rax + 0x18]
xor r8d, r8d
mov edx, 0x4000
mov rcx, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1400bc259
mov rsi, 0xffffffffffffffff
mov r8, rsi
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140017720
nop
mov rbp, qword [rax]
mov r14, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov dword [rsp + 0x20], 9
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400bc21f
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400bc21f
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
mov rcx, qword [rbx]
mov qword [rbx], rbp
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r15
test rcx, rcx
je 0x1400bc24b
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x1400bc24b
mov edx, 2
mov r8d, 8
call fcn.140030bb0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp qword [rbx + 0x10], 0
jne 0x1400bc2d1
mov rax, qword [rdi]
cmp rax, qword [0x140285b90]
jne 0x1400bc28b
mov rax, qword [rdi + 8]
cmp rax, qword [0x140285b98]
jne 0x1400bc28b
mov qword [rsp + 0x30], 0x11
lea rax, [0x140217030]
jmp 0x1400bc2b4
mov rax, qword [rdi]
cmp rax, qword [0x140285bb0]
jne 0x1400bc2d1
mov rax, qword [rdi + 8]
cmp rax, qword [0x140285bb8]
jne 0x1400bc2d1
mov qword [rsp + 0x30], 0xf
lea rax, [0x140217048]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140012c30
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400bf4e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x300]
test rcx, rcx
je 0x1400bf513
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400a0d2d.0]
mov rax, qword [rdi + 0x40]
movzx ecx, byte [rdi + 0x20]
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbx + 0x1e8]
test eax, eax
setne dil
cmp rcx, 0xffffffffffffffff
je 0x1400bf57f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x1e8], 0xffffffffffffffff
mov rcx, qword [rbx + 0x230]
cmp rcx, 0xffffffffffffffff
je 0x1400bf59d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x230], 0xffffffffffffffff
mov rcx, qword [rbx + 0x270]
cmp rcx, 0xffffffffffffffff
je 0x1400bf5bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x270], 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x50
pop rdi
ret