joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5eff10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x248
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rdx
mov word [rbp + 0x3e], r8w
mov qword [rbp + 0x40], r9
mov rax, qword [rbp + 0x28]
test rax, rax
jne 0x5eff4a
mov eax, 1
mov dword [rbp + 0x48], eax
jmp 0x5f011b
mov rax, qword [rbp + 0x28]
cmp word [rax + 0xa], 0
jne 0x5eff63
mov eax, 2
mov dword [rbp + 0x48], eax
jmp 0x5f011b
xor rax, rax
mov dword [rbp + 0x48], eax
mov rax, qword [rbp + 0x28]
movzx rax, word [rax + 0xa]
mov word [rbp + 0x4c], ax
xor rax, rax
mov word [rbp + 0x4e], ax
mov rdi, qword [rbp + 0x2b0]
lea rcx, [rbp + 0x23c]
mov edx, 4
xor r8, r8
call fcn.00408d50
mov bx, 1
movzx eax, word [rbp + 0x2b8]
sub eax, 1
movzx rcx, word [rbp + 0x4c]
movzx ecx, cx
cdq
idiv ecx
mov r13, rax
add r13w, 1
cmp bx, r13w
ja 0x5f011a
add r13w, 1
lea rcx, [rbp + 0x23c]
call fcn.005efee0
lea rcx, [rbp + 0x1bc]
mov edx, 0x40
xor r8, r8
call fcn.00408d50
mov esi, 1
mov r14d, dword [rbp + 0x2a8]
cmp esi, r14d
jg 0x5f00ba
add r14d, 1
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x30]
movzx r9, word [rbp + 0x3e]
call fcn.005efcf0
cmp esi, 1
jne 0x5f004d
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x40]
movzx r8d, word [rbp + 0x2a0]
call fcn.005efdd0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x23c]
mov r8d, 4
call fcn.005efdd0
jmp 0x5f0066
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x1fc]
movzx r8, word [rbp + 0x4c]
movzx r8d, r8w
call fcn.005efdd0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x1fc]
call fcn.005efe00
xor rax, rax
movzx rcx, word [rbp + 0x4c]
sub cx, 1
cmp ax, cx
ja 0x5f00ad
add cx, 1
movzx rdx, ax
movzx r8, ax
movzx r8, byte [r8 + rbp + 0x1fc]
xor byte [rdx + rbp + 0x1bc], r8b
add ax, 1
cmp ax, cx
jne 0x5f008b
nop
add esi, 1
cmp esi, r14d
jne 0x5f0004
nop
xor rax, rax
movzx rcx, word [rbp + 0x4c]
sub cx, 1
cmp ax, cx
ja 0x5f010b
add cx, 1
movzx rdx, word [rbp + 0x4e]
cmp dx, word [rbp + 0x2b8]
mov word [rbp + 0x4e], dx
jae 0x5f0102
movzx rdx, ax
movzx rdx, byte [rdx + rbp + 0x1bc]
mov byte [rdi], dl
movzx rdx, word [rbp + 0x4e]
add dx, 1
mov word [rbp + 0x4e], dx
add rdi, 1
add ax, 1
cmp ax, cx
jne 0x5f00d0
nop
add bx, 1
cmp bx, r13w
jne 0x5effc9
nop
mov eax, dword [rbp + 0x48]
lea rsp, [rbp + 0x248]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x5f01f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov dword [rbp + 0x2c], 0
mov rax, qword [rbp + 0x48]
movsxd rcx, dword [rbp + 0x2c]
mov ecx, dword [rax + rcx*4]
call fcn.005f0150
mov rcx, qword [rbp + 0x40]
movsxd rdx, dword [rbp + 0x2c]
mov dword [rcx + rdx*4], eax
add dword [rbp + 0x2c], 1
cmp dword [rbp + 0x2c], 0x10
jne 0x5f0207
nop
mov dword [rbp + 0x2c], 0x10
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rbp + 0x2c]
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x2c]
mov eax, dword [rax + rcx*4 - 0xc]
xor eax, dword [rdx + r8*4 - 0x20]
mov rcx, qword [rbp + 0x40]
movsxd rdx, dword [rbp + 0x2c]
xor eax, dword [rcx + rdx*4 - 0x38]
mov rcx, qword [rbp + 0x40]
movsxd rdx, dword [rbp + 0x2c]
xor eax, dword [rcx + rdx*4 - 0x40]
mov dword [rbp + 0x28], eax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rbp + 0x2c]
mov edx, dword [rbp + 0x28]
add edx, edx
mov r8d, dword [rbp + 0x28]
shr r8d, 0x1f
or edx, r8d
mov dword [rax + rcx*4], edx
add dword [rbp + 0x2c], 1
cmp dword [rbp + 0x2c], 0x50
jne 0x5f0234
nop
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x5f44b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp + 0x30], r8d
mov qword [rbp + 0x38], r9
xor rax, rax
mov ecx, dword [rbp + 0x30]
sub ecx, 1
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], ecx
jg 0x5f450a
add ecx, 1
mov rax, qword [rbp + 0x38]
movsxd rdx, dword [rbp + 0xc]
mov r8, qword [rbp + 0x20]
movsxd r9, dword [rbp + 0xc]
mov r10, qword [rbp + 0x28]
movsxd r11, dword [rbp + 0xc]
movzx r8, byte [r8 + r9]
xor r8b, byte [r10 + r11]
mov byte [rax + rdx], r8b
add dword [rbp + 0xc], 1
cmp dword [rbp + 0xc], ecx
jne 0x5f44dc
nop
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x5f8670
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x70], rcx
mov rax, qword [rbp + 0x70]
lea rax, [rax + rbp + 0x60]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rbp + 0x70]
lea rcx, [rcx + rbp + 0x60]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
mov ecx, dword [rcx + 0x48]
shr ecx, 1
movsxd rcx, ecx
mov rax, qword [rax + 0x68]
add rax, rcx
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x70]
lea rax, [rax + rbp + 0x60]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x68]
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x70]
lea rax, [rax + rbp + 0x60]
mov r8, rbp
neg r8
mov rax, qword [rax + r8]
mov r8d, dword [rax + 0x48]
shr r8d, 1
movsxd r8, r8d
call fcn.00406200
add qword [rbp + 0x30], 0x10
xor rax, rax
mov rcx, qword [rbp + 0x70]
lea rcx, [rcx + rbp + 0x60]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
mov ebx, dword [rcx + 0x88]
add ebx, ebx
add ebx, ebx
sub ebx, 5
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], ebx
jg 0x5f87db
add ebx, 1
lea rax, [0x0076bc64]
mov rcx, qword [rbp + 0x30]
mov ecx, dword [rcx]
shr ecx, 8
and ecx, 0xff
movsxd rcx, ecx
mov ecx, dword [rax + rcx*4]
mov edx, 8
call fcn.005f4220
mov esi, eax
lea rax, [0x0076bc64]
mov rcx, qword [rbp + 0x30]
mov ecx, dword [rcx]
shr ecx, 0x10
and ecx, 0xff
movsxd rcx, ecx
mov ecx, dword [rax + rcx*4]
mov edx, 0x10
call fcn.005f4220
mov edi, eax
lea rax, [0x0076bc64]
mov rcx, qword [rbp + 0x30]
mov ecx, dword [rcx]
shr ecx, 0x18
movsxd rcx, ecx
mov ecx, dword [rax + rcx*4]
mov edx, 0x18
call fcn.005f4220
mov rcx, qword [rbp + 0x30]
lea rdx, [0x0076bc64]
mov r8, qword [rbp + 0x30]
mov r8d, dword [r8]
and r8d, 0xff
movsxd r8, r8d
mov edx, dword [rdx + r8*4]
xor edx, esi
xor edx, edi
xor edx, eax
mov dword [rcx], edx
add qword [rbp + 0x30], 4
add dword [rbp + 0x3c], 1
cmp dword [rbp + 0x3c], ebx
jne 0x5f872e
nop
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x5fe0c0
Capabilities:
Move file

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
nop
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x60]
call fcn.0040ff50
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x68]
call fcn.0040ff50
mov rcx, qword [rbp + 0x30]
call fcn.0040feb0
mov rbx, rax
mov rcx, qword [rbp + 0x28]
call fcn.0040feb0
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_MoveFileW
test eax, eax
setne al
mov byte [rbp + 0x27], al
movzx rax, byte [rbp + 0x27]
mov byte [rbp + 0x3f], al
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e160
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x5ff450
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x40], rcx
nop
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x40]
call fcn.0042d510
mov rcx, qword [rbp + 0x40]
call fcn.005ff370
test al, al
je 0x5ff485
mov byte [rbp + 0x2f], 1
jmp 0x5ff49f
mov rcx, qword [rbp + 0x20]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x20]
call fcn.0040e080
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x5ff810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbp
sub rsp, 0x10
mov rbp, rsp
mov dword [rbp + 0x20], ecx
mov qword [rbp + 0x28], rdx
mov dword [rbp + 0x30], r8d
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0xc], eax
xor rax, rax
mov ecx, dword [rbp + 0x30]
sub ecx, 1
mov dword [rbp + 8], eax
cmp dword [rbp + 8], ecx
jg 0x5ff87e
add ecx, 1
mov eax, dword [rbp + 0xc]
shr eax, 8
and eax, 0xffffff
lea rdx, [0x0076d17c]
mov r8, qword [rbp + 0x28]
movsxd r9, dword [rbp + 8]
movzx r8, byte [r8 + r9]
mov r9d, dword [rbp + 0xc]
xor r9d, r8d
and r9d, 0xff
mov r9d, r9d
xor eax, dword [rdx + r9*4]
mov dword [rbp + 0xc], eax
add dword [rbp + 8], 1
cmp dword [rbp + 8], ecx
jne 0x5ff83d
nop
mov eax, dword [rbp + 0xc]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x6126e0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x440
mov rbp, rsp
mov qword [rbp + 0x450], rcx
mov qword [rbp + 0x458], rdx
lea rcx, [rbp + 0x22a]
lea rdx, [0x00612798]
call fcn.0042def0
mov rax, qword [rbp + 0x450]
cmp qword [rax + 0x98], 0
je 0x612739
lea rcx, [rbp + 0x240]
mov rax, qword [rbp + 0x450]
mov rdx, qword [rax + 0x98]
call fcn.0042def0
jmp 0x61274b
mov ecx, 0xff
lea rdx, [rbp + 0x240]
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp + 0x240]
lea rdx, [rbp + 0x22a]
xor r8, r8
lea r9, [rbp + 0x20]
call sub.kernel32.dll_GetTempFileNameW
mov rcx, qword [rbp + 0x458]
lea rdx, [rbp + 0x20]
mov r8d, 0x105
call fcn.0040ffb0
mov rax, qword [rbp + 0x458]
lea rsp, [rbp + 0x440]
pop rbp
ret

Function at 0x61a580
Capabilities:
Hash data with md5

Disassembly:
mov dword [rcx + 0x10], 0
mov dword [rcx + 0x14], 0
xor rax, rax
movsxd rdx, eax
mov byte [rcx + rdx + 0x18], 0
add eax, 1
cmp eax, 0x40
jne 0x61a591
nop
xor rax, rax
movsxd rdx, eax
mov dword [rcx + rdx*4 + 0x58], 0
add eax, 1
cmp eax, 0x10
jne 0x61a5a5
nop
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
ret
Function at 0x61b740
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xf0
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0x118], rdx
mov qword [rbp + 0x120], r8
mov rcx, qword [rbp + 0x118]
call fcn.0040e240
mov rcx, qword [rbp + 0x120]
call fcn.0040e240
nop
xor rax, rax
cmp qword [rbp + 0x120], 0
je 0x61b7c8
mov rax, qword [rbp + 0x120]
mov eax, dword [rax - 4]
cmp eax, 0x40
jle 0x61b7ed
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x120]
call fcn.0061b6f0
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x38]
call fcn.0040e890
lea rcx, [rbp + 0x30]
mov dx, 0x36
mov r8d, 0x40
call fcn.00410bb0
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x30]
xor r8, r8
call fcn.0040f6a0
lea rcx, [rbp + 0x28]
mov dx, 0x5c
mov r8d, 0x40
call fcn.00410bb0
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x28]
xor r8, r8
call fcn.0040f6a0
xor rax, rax
cmp qword [rbp + 0x120], 0
je 0x61b852
mov rax, qword [rbp + 0x120]
mov eax, dword [rax - 4]
mov ebx, 1
mov esi, eax
cmp ebx, esi
jg 0x61b8cc
add esi, 1
lea rcx, [rbp + 0xe8]
call fcn.0040ea00
movsxd rcx, ebx
mov rdx, qword [rbp + 0xe8]
movsxd r8, ebx
mov r9, qword [rbp + 0x120]
movsxd r10, ebx
movzx rdx, byte [rdx + r8 - 1]
xor dl, byte [r9 + r10 - 1]
mov byte [rax + rcx - 1], dl
lea rcx, [rbp + 0xe0]
call fcn.0040ea00
movsxd rcx, ebx
mov rdx, qword [rbp + 0xe0]
movsxd r8, ebx
mov r9, qword [rbp + 0x120]
movsxd r10, ebx
movzx rdx, byte [rdx + r8 - 1]
xor dl, byte [r9 + r10 - 1]
mov byte [rax + rcx - 1], dl
add ebx, 1
cmp ebx, esi
jne 0x61b861
nop
lea rcx, [rbp + 0x40]
call fcn.0061a580
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0xe8]
lea r8, [0x0061a6e0]
call fcn.0061b270
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x118]
lea r8, [0x0061a6e0]
call fcn.0061b270
lea rcx, [rbp + 0xd8]
lea rdx, [rbp + 0x40]
lea r8, [0x0061a6e0]
call fcn.0061b4a0
lea rcx, [rbp + 0x40]
call fcn.0061a580
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0xe0]
lea r8, [0x0061a6e0]
call fcn.0061b270
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0xd8]
lea r8, [0x0061a6e0]
call fcn.0061b270
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x40]
lea r8, [0x0061a6e0]
call fcn.0061b4a0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e160
lea rcx, [rbp + 0x38]
call fcn.0040e0d0
lea rcx, [rbp + 0xd8]
mov edx, 3
call fcn.0040e190
lea rcx, [rbp + 0x118]
mov edx, 2
call fcn.0040e190
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0xf0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x61c810
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xf0
mov rbp, rsp
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x110], rcx
mov rcx, qword [rbp + 0x110]
call fcn.0040e210
nop
xor rax, rax
mov dword [rbp + 0x5c], eax
lea rcx, [rbp + 0xd8]
mov edx, 0x18
xor r8, r8
call fcn.00408d50
lea rcx, [rbp + 0x70]
mov edx, 0x68
xor r8, r8
call fcn.00408d50
mov dword [rbp + 0x70], 0x68
mov dword [rbp + 0xac], 1
mov word [rbp + 0xb0], 0
lea rcx, [rbp + 0x68]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
lea r8, [0x0061c9ec]
call fcn.004102f0
mov rcx, qword [rbp + 0x68]
call fcn.0040feb0
mov rbx, rax
lea rcx, [rbp + 0x60]
mov edx, 3
mov rax, qword [0x00a8ddd0]
mov r8, qword [rax]
lea r9, [0x0061ca0c]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x60]
call fcn.0040feb0
mov rsi, rax
mov rax, qword [0x00a8ddd0]
mov rcx, qword [rax]
call fcn.0040feb0
mov rcx, rbx
mov rdx, rsi
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
setne al
test al, al
jne 0x61c94c
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x5c], eax
jmp 0x61c96d
mov rcx, qword [rbp + 0xd8]
mov edx, 0x1388
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x61c96c
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x5c], eax
jmp 0x61c96d
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040e160
lea rcx, [rbp + 0x110]
call fcn.0040e080
mov eax, dword [rbp + 0x5c]
lea rsp, [rbp + 0xf0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6249d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.0040e210
nop
xor rcx, rcx
movsxd rax, ecx
mov rdx, qword [rbp + 0x20]
mov byte [rdx + rax], 0
add ecx, 1
cmp ecx, 0x10
jne 0x624a14
nop
xor rcx, rcx
movsxd rax, ecx
mov word [rbp + rax*2 + 0x50], 0
add ecx, 1
cmp ecx, 8
jne 0x624a2b
nop
xor rbx, rbx
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x88]
xor r8, r8
call fcn.0040f6a0
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00624800
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x38]
call fcn.00410000
cmp qword [rbp + 0x88], 0
je 0x624b68
jmp 0x624aff
cmp ebx, 7
jg 0x624b68
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x88]
lea r8, [0x00624c10]
call fcn.006238f0
mov rcx, qword [rbp + 0x48]
lea rdx, [0x00624c20]
call fcn.004104f0
test eax, eax
je 0x624b0d
cmp qword [rbp + 0x48], 0
jne 0x624ac8
movsxd rax, ebx
mov word [rbp + rax*2 + 0x50], 0
jmp 0x624afc
lea rcx, [rbp + 0x28]
lea rdx, [0x00624c30]
mov r8, qword [rbp + 0x48]
call fcn.004102f0
mov rcx, qword [rbp + 0x28]
or edx, 0xffffffff
call fcn.0042c020
cmp eax, 0xffff
jg 0x624b68
test eax, eax
jl 0x624b68
movsxd rcx, ebx
mov word [rbp + rcx*2 + 0x50], ax
add ebx, 1
cmp qword [rbp + 0x88], 0
jne 0x624a81
nop
xor rcx, rcx
movsxd rax, ecx
movzx eax, word [rbp + rax*2 + 0x50]
mov r8d, pe_nt_image_headers64
xor edx, edx
div r8d
mov r8, rax
movsxd rax, ecx
movzx eax, word [rbp + rax*2 + 0x50]
mov r9d, pe_nt_image_headers64
xor edx, edx
div r9d
mov rax, rdx
mov edx, ecx
add edx, edx
movsxd rdx, edx
mov r9, qword [rbp + 0x20]
mov byte [r9 + rdx], r8b
mov edx, ecx
add edx, edx
movsxd rdx, edx
mov r8, qword [rbp + 0x20]
mov byte [r8 + rdx + 1], al
add ecx, 1
cmp ecx, 8
jne 0x624b11
nop
nop
lea rcx, [rbp + 0x28]
call fcn.0040e080
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e190
lea rcx, [rbp + 0x48]
call fcn.0040e080
lea rcx, [rbp + 0x88]
call fcn.0040e080
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x63fb60
Capabilities:
Write file on windows

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
mov dword [rbp + 0x98], edx
mov qword [rbp + 0xa0], r8
mov dword [rbp + 0x74], 0
xor rcx, rcx
or edx, 0xffffffff
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [rbp + 0x78], rax
nop
lea rcx, [rbp + 0x50]
mov edx, 0x20
xor r8, r8
call fcn.00408d50
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
mov dword [rbp + 0x4c], 0
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0xa0]
mov r8d, dword [rbp + 0x98]
lea r9, [rbp + 0x4c]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_WriteFile_1
test eax, eax
setne al
test al, al
jne 0x63fc57
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
sub eax, 0x3e5
test eax, eax
jne 0x63fc43
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_ResetEvent
mov rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0x50]
lea r8, [rbp + 0x4c]
or r9d, 0xffffffff
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
setne al
test al, al
jne 0x63fc6a
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x74], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x38]
call fcn.0063fc80
jmp 0x63fc74
mov eax, dword [rbp + 0x48]
mov dword [rbp + 0x74], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x38]
call fcn.0063fc80
jmp 0x63fc74
mov eax, dword [rbp + 0x98]
cmp eax, dword [rbp + 0x4c]
je 0x63fc6a
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x74], eax
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [rbp + 0x74]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x6434d0
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
mov byte [rbp + 0x4f], 0
mov dword [rbp + 0x48], 0
mov rcx, qword [rbp + 0x80]
mov edx, 2
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
cmp dword [rbp + 0x48], 0
je 0x643609
mov qword [rbp + 0x50], 0
mov ecx, dword [rbp + 0x48]
call fcn.00405da0
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x48]
xor r8, r8
call fcn.00408d50
mov rcx, qword [rbp + 0x80]
mov edx, 2
mov r8, qword [rbp + 0x58]
mov r9d, dword [rbp + 0x48]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
setne al
test al, al
jne 0x64357b
xor rcx, rcx
mov rdx, qword [rbp + 0x38]
call fcn.00643620
jmp 0x643609
call fcn.00643420
mov qword [rbp + 0x50], rax
cmp qword [rbp + 0x50], 0
jne 0x643599
xor rcx, rcx
mov rdx, qword [rbp + 0x38]
call fcn.00643620
jmp 0x643609
xor rax, rax
mov rcx, qword [rbp + 0x58]
mov ebx, dword [rcx]
sub ebx, 1
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], ebx
jg 0x6435ee
add ebx, 1
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x58]
movsxd rdx, dword [rbp + 0x44]
add rdx, rdx
mov rdx, qword [rax + rdx*8 + 8]
call sub.advapi32.dll_EqualSid
test eax, eax
setne al
cmp al, 1
jne 0x6435e5
mov byte [rbp + 0x4f], 1
xor rcx, rcx
mov rdx, qword [rbp + 0x38]
call fcn.00643620
jmp 0x643609
add dword [rbp + 0x44], 1
cmp dword [rbp + 0x44], ebx
jne 0x6435b0
nop
nop
mov rcx, qword [rbp + 0x58]
call fcn.00405dd0
cmp qword [rbp + 0x50], 0
je 0x643609
mov rcx, qword [rbp + 0x50]
call sub.advapi32.dll_FreeSid
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x643720
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x48], r8
mov qword [rbp + 0x70], 0
nop
xor rax, rax
mov byte [rbp + 0x47], al
xor rcx, rcx
call sub.kernel32.dll_SetLastError
mov dword [rbp + 0x78], 0
mov dword [rbp + 0x7c], 0
mov rcx, qword [rbp + 0x58]
call fcn.0040feb0
mov rbx, rax
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rcx, rbx
mov rdx, rax
xor r8, r8
lea r9, [rbp + 0x78]
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x30], rax
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x64383e
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
jne 0x64383e
lea rcx, [rbp + 0x70]
mov edx, dword [rbp + 0x7c]
call fcn.00410140
mov ecx, dword [rbp + 0x78]
call fcn.00405da0
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x58]
call fcn.0040feb0
mov rbx, rax
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rsi, rax
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rbx
mov rdx, rsi
mov r8, qword [rbp + 0x48]
mov r8, qword [r8]
lea r9, [rbp + 0x78]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x30], rax
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x643839
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call fcn.00405dd0
mov rax, qword [rbp + 0x48]
mov qword [rax], 0
jmp 0x64383e
mov al, 1
mov byte [rbp + 0x47], al
nop
lea rcx, [rbp + 0x70]
call fcn.0040e080
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0x80]
pop rbx
pop rsi
pop rbp
ret

Function at 0x643930
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x298], rdx
mov rcx, qword [rbp + 0x298]
call fcn.0040e210
nop
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x298]
call fcn.0040e6f0
xor rcx, rcx
xor rdx, rdx
call sub.kernel32.dll_GetLogicalDriveStringsW
mov edi, eax
test edi, edi
je 0x643ae2
lea rcx, [rbp + 0x48]
mov rdx, qword [0x006438f0]
mov r8d, 1
movsxd r9, edi
call fcn.00411ea0
mov ecx, edi
mov rdx, qword [rbp + 0x48]
call sub.kernel32.dll_GetLogicalDriveStringsW
Function at 0x64ccc0
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0040e210
nop
mov rcx, qword [rbp + 0x60]
call fcn.0040e0d0
mov rcx, qword [0x006491e8]
mov dl, 1
call fcn.006497f0
mov qword [rbp + 0x38], rax
nop
mov rax, qword [rbp + 0x38]
mov byte [rax + 0xd8], 0
mov rcx, qword [rbp + 0x38]
add rcx, 0xb8
lea rdx, [0x0064ce2c]
call fcn.0040e6f0
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0064ce50]
mov r8, qword [rbp + 0x68]
call fcn.00649f80
mov rax, qword [rbp + 0x38]
mov rax, qword [rax + 0x60]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
test rax, rax
jne 0x64cd54
xor rcx, rcx
mov rdx, qword [rbp + 0x28]
call fcn.0064cdd0
jmp 0x64cdb0
mov rax, qword [rbp + 0x38]
mov rax, qword [rax + 0x60]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0x60]
mov edx, eax
xor r8, r8
call fcn.0040f5d0
mov rcx, qword [rbp + 0x60]
call fcn.0040ea00
mov rbx, rax
mov rax, qword [rbp + 0x38]
mov rax, qword [rax + 0x60]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0x38]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 8]
mov rdx, rbx
mov r8, rax
call fcn.00406200
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040ae10
nop
lea rcx, [rbp + 0x68]
call fcn.0040e080
mov rax, qword [rbp + 0x60]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret

Function at 0x64ce60
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp + 0x48]
call fcn.0040e240
nop
xor rax, rax
xor rcx, rcx
cmp qword [rbp + 0x48], 0
je 0x64ce8e
mov rcx, qword [rbp + 0x48]
mov ecx, dword [rcx - 4]
mov edx, 1
mov r8d, ecx
mov ecx, edx
cmp ecx, r8d
jg 0x64ceb6
add r8d, 1
mov rdx, qword [rbp + 0x48]
movsxd r9, ecx
xor al, byte [rdx + r9 - 1]
add ecx, 1
cmp ecx, r8d
jne 0x64cea2
nop
mov rcx, qword [rbp + 0x28]
movzx rdx, al
call fcn.0042bdc0
nop
lea rcx, [rbp + 0x48]
call fcn.0040e0d0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x30]
pop rbp
ret