joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011857
Capabilities:
Get geographical location

Disassembly:
jmp 0x140024b80
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140024bbd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140011cee
add rsp, 0x58
ret

Function at 0x1400118cf
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002b450
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002b470
xor al, al
jmp 0x14002b4f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002b483
xor al, al
jmp 0x14002b4f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002b4ad
xor al, al
jmp 0x14002b4f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002b4c1
xor al, al
jmp 0x14002b4f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002b4d3
xor al, al
jmp 0x14002b4f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002b4ef
xor al, al
jmp 0x14002b4f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011c49
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x140016960
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14004407a]
call fcn.140011d02
mov rax, qword [rbp + 0x160]
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0
jmp 0x1400169a4
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x168]
sub rcx, 6
cmp rax, rcx
ja 0x140016a59
mov byte [rbp + 0x44], 1
mov dword [rbp + 0x64], 0
jmp 0x1400169d0
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
movsxd rax, dword [rbp + 0x64]
cmp rax, 6
jae 0x140016a39
movsxd rax, dword [rbp + 0x64]
mov rdx, rax
mov rcx, qword [rbp + 0x170]
call fcn.140011b63
movzx eax, byte [rax]
cmp eax, 0xcc
je 0x140016a37
mov eax, dword [rbp + 0x64]
mov ecx, dword [rbp + 0x24]
add ecx, eax
mov eax, ecx
cdqe
mov rcx, qword [rbp + 8]
movzx eax, byte [rcx + rax]
mov dword [rbp + 0x134], eax
movsxd rcx, dword [rbp + 0x64]
mov rdx, rcx
mov rcx, qword [rbp + 0x170]
call fcn.140011b63
movzx eax, byte [rax]
mov ecx, dword [rbp + 0x134]
cmp ecx, eax
je 0x140016a37
mov byte [rbp + 0x44], 0
jmp 0x140016a39
jmp 0x1400169c8
movzx eax, byte [rbp + 0x44]
test eax, eax
je 0x140016a54
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x160]
add rcx, rax
mov rax, rcx
jmp 0x140016a5b
jmp 0x14001699c
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140011cd0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001ab10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x14003b040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x140044076]
call fcn.140011d02
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14001ab76
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001ab7d
mov al, 1
jmp 0x14001aced
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14001139d
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14001139d
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140011a19
movzx eax, al
test eax, eax
je 0x14001abe0
xor al, al
jmp 0x14001aced
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14001ac53
cmp dword [rbp + 0x160], 1
je 0x14001ac5e
cmp dword [rbp + 0x160], 3
je 0x14001acdc
jmp 0x14001aceb
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001acae
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001acae
xor al, al
jmp 0x14001aced
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001acc9
mov dword [rbp + 0x154], 1
jmp 0x14001acd3
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001aced
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001aced
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140033e20]
call fcn.140011aa0
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14001162c
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140011dc5
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x140016810
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14004407a]
call fcn.140011d02
mov rax, qword [rbp + 0x160]
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0
jmp 0x140016854
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x168]
sub rcx, 3
cmp rax, rcx
ja 0x140016909
mov byte [rbp + 0x44], 1
mov dword [rbp + 0x64], 0
jmp 0x140016880
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
movsxd rax, dword [rbp + 0x64]
cmp rax, 3
jae 0x1400168e9
movsxd rax, dword [rbp + 0x64]
mov rdx, rax
mov rcx, qword [rbp + 0x170]
call fcn.140011569
movzx eax, byte [rax]
cmp eax, 0xcc
je 0x1400168e7
mov eax, dword [rbp + 0x64]
mov ecx, dword [rbp + 0x24]
add ecx, eax
mov eax, ecx
cdqe
mov rcx, qword [rbp + 8]
movzx eax, byte [rcx + rax]
mov dword [rbp + 0x134], eax
movsxd rcx, dword [rbp + 0x64]
mov rdx, rcx
mov rcx, qword [rbp + 0x170]
call fcn.140011569
movzx eax, byte [rax]
mov ecx, dword [rbp + 0x134]
cmp ecx, eax
je 0x1400168e7
mov byte [rbp + 0x44], 0
jmp 0x1400168e9
jmp 0x140016878
movzx eax, byte [rbp + 0x44]
test eax, eax
je 0x140016904
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x160]
add rcx, rax
mov rax, rcx
jmp 0x14001690b
jmp 0x14001684c
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140011e56
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400228e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x1400442ec]
call fcn.140011d02
mov rax, qword [rbp + 0x180]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x28], rax
xor eax, eax
mov word [rbp + 0x44], ax
jmp 0x140022940
movzx eax, word [rbp + 0x44]
inc ax
mov word [rbp + 0x44], ax
movzx eax, word [rbp + 0x44]
mov rcx, qword [rbp + 8]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140022a12
movzx eax, word [rbp + 0x44]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov rdx, qword [rbp + 0x190]
mov rcx, rax
call fcn.140011e74
test eax, eax
jne 0x140022a0d
movzx eax, word [rbp + 0x44]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rbp + 0x180]
add rax, qword [rcx]
mov qword [rbp + 0x68], rax
movzx eax, word [rbp + 0x44]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 8]
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x188]
mov ecx, dword [rbp + 0x84]
mov dword [rax + 8], ecx
movzx eax, word [rbp + 0x44]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x14]
mov rcx, qword [rbp + 0x188]
mov qword [rcx + 0x10], rax
movzx eax, word [rbp + 0x44]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rbp + 0x28]
mov eax, dword [rdx + rax + 0x10]
mov dword [rcx + 0x18], eax
mov rax, qword [rbp + 0x188]
jmp 0x140022a52
jmp 0x140022935
mov rax, qword [rbp + 0x188]
mov qword [rax], 0
mov rax, qword [rbp + 0x188]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x188]
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x188]
mov dword [rax + 0x18], 0
mov rax, qword [rbp + 0x188]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400010c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1400010e6
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0x12345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x140001111
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x14000110a
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x14000378f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa0
mov rcx, 0
mov rdx, 0xa699
mov r8, 0x1000
lea r9, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400037e0
mov rbx, rax
call 0x1400037c3
nop
pop rsi
mov r9, rax
add rsi, 0x58d2b
mov rcx, 0xa699
mov r8, rcx
lea rax, [rsi]
mov dl, byte [rax]
mov byte [rbx], dl
add rsi, 1
add rbx, 1
add rax, 1
dec r8
jne 0x1400037dc
call r9
mov ecx, 1
ret

Function at 0x140006480
Capabilities:
Get session user name

Disassembly:
mov eax, 0x1048
call fcn.140041400
sub rsp, rax
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
lea rdx, [rsp + 0x28]
or ecx, 0xffffffff
mov qword [rsp + 0x28], 0
call fcn.14003ec66
test eax, eax
je 0x14000650a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14000650a
lea rdx, [rsp + 0x20]
lea rcx, [0x14005c7f0]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.140006120
call fcn.140006340
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140028300
add rsp, 0x1048
ret
lea rdx, [0x140049370]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.ImpersonateLoggedOnUser_failed
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, str..hookapi.cpp
lea rdx, [rsp + 0x30]
mov r9d, 0x116
xor ecx, ecx
call sym.gddaemon64.exe_HLogErrW
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140028300
add rsp, 0x1048
ret
Function at 0x140007d60
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbp
sub rsp, 0x450
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rbp, [r11 + 0x10]
mov r8, rcx
lea rcx, [rsp + 0x20]
mov r9, rbp
mov edx, 0x400
call fcn.14002f668
cmp eax, 0x400
jge 0x140007dd9
test eax, eax
js 0x140007dc1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x140007e49
mov r8, qword [rsp + 0x460]
mov r9, rbp
xor edx, edx
xor ecx, ecx
call fcn.14002f668
test eax, eax
js 0x140007e49
mov qword [rsp + 0x448], rbx
mov qword [rsp + 0x440], rsi
lea esi, [rax + 1]
movsxd rbx, esi
mov qword [rsp + 0x438], rdi
mov rcx, rbx
call fcn.1400276c4
mov r8, qword [rsp + 0x460]
mov r9, rbp
mov rcx, rax
mov rdx, rbx
mov rdi, rax
call fcn.14002f668
mov rbx, qword [rsp + 0x448]
test eax, eax
js 0x140007e31
cmp eax, esi
jge 0x140007e31
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.140028a84
mov rdi, qword [rsp + 0x438]
mov rsi, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140028300
add rsp, 0x450
pop rbp
ret
Function at 0x140007e70
Capabilities:
Create thread

Disassembly:
mov eax, 0x1078
call fcn.140041400
sub rsp, rax
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x1060], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.9456E1CD_8432_4372_844A_E3A179F6D72264
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x140007ed3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140028300
add rsp, 0x1078
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 5
sete cl
test ecx, ecx
je 0x140007eff
xor eax, eax
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140028300
add rsp, 0x1078
ret
lea r9, str.9456E1CD_8432_4372_844A_E3A179F6D72264
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
call fcn.14000c050
call fcn.140006560
call fcn.14001d2f0
test eax, eax
jne 0x140007f63
lea rdx, [0x140049370]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400495b8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, str..main.cpp
lea rdx, [rsp + 0x60]
mov r9d, 0x3a
xor ecx, ecx
call sym.gddaemon64.exe_HLogErrW
call fcn.140020060
test eax, eax
jne 0x140007f9b
lea rdx, [0x140049370]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400495e8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, 0x3f
jmp 0x140008084
cmp qword [0x14005ccd8], 0
jne 0x14000805a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r8, [0x140023c30]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov qword [0x14005ccd8], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14005ca78]
mov ecx, eax
call fcn.140009c10
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140007ca0
lea rcx, [0x14005aeb8]
or r9, 0xffffffffffffffff
mov rdx, rax
xor r8d, r8d
call fcn.140005520
cmp qword [rsp + 0x50], 8
jb 0x140008036
mov rcx, qword [rsp + 0x38]
call fcn.1400285b0
call fcn.140026f30
test eax, eax
je 0x14000804d
lea rcx, str.gddaemon_PrintMonitor__d
mov edx, eax
call fcn.140007d60
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008036
lea rdx, [0x140049370]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140049600]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, 0x45
lea r8, str..main.cpp
lea rdx, [rsp + 0x60]
xor ecx, ecx
call sym.gddaemon64.exe_HLogErrW
mov eax, 1
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140028300
add rsp, 0x1078
ret
Function at 0x140008f50
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x6c0
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov qword [rsp + 0x20], r9
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x140008f93
test r8, r8
je 0x140008f93
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x140008f9a
xor eax, eax
jmp 0x140009093
lea rcx, [rsp + 0x490]
mov rdx, rbx
mov qword [rsp + 0x6b8], rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14004b8d4]
lea rcx, [rsp + 0x490]
call qword [0x1400464b0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140008feb
xor eax, eax
jmp 0x14000908b
mov ebx, 1
lea rdx, [0x14004b8d8]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400090c1
lea rdx, [0x14004b8dc]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400090c1
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x280]
call qword [0x1400464b0]
mov r11d, dword [rsp + 0x30]
cmp r11d, 0xffffffff
je 0x1400090c1
test r11b, 0x10
je 0x1400090ae
test edi, edi
je 0x1400090c1
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x280]
mov r8, rsi
mov edx, edi
call fcn.140008f50
cmp eax, 2
jne 0x1400090c1
mov ebx, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rbp, qword [rsp + 0x6b8]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140028300
add rsp, 0x6c0
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x280]
call rsi
test eax, eax
je 0x14000907b
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140008ff0
jmp 0x140009080
Function at 0x140009240
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, rcx
test rcx, rcx
je 0x140009337
mov ecx, 0x28
mov qword [rsp + 0x50], rbx
call fcn.140028e14
mov rbx, rax
test rax, rax
je 0x14000932c
xor eax, eax
xor r9d, r9d
mov edx, 0x80000000
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x30], rax
mov qword [rbx + 0x18], rax
lea r8d, [rax + 1]
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov qword [rbx + 0x20], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140009329
lea rdx, [rbx + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140009329
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140009329
mov eax, 0x400000
cmp rcx, rax
jg 0x1400092db
mov eax, ecx
mov rcx, qword [rbx]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], 0
mov dword [rbx + 0x20], eax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov qword [rbx + 8], rax
test rax, rax
je 0x140009329
mov eax, dword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x140009340
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call qword [0x140046510]
mov r11d, 0xae7c901b
xor r9d, r9d
lea r10, [0x14005aa90]
nop
movzx ecx, byte [rsp + r9 + 0x20]
movzx eax, r11b
shr r11d, 8
xor rcx, rax
add r9, 4
mov edx, dword [r10 + rcx*4]
movzx ecx, byte [rsp + r9 + 0x1d]
xor edx, r11d
movzx eax, dl
shr edx, 8
xor rcx, rax
mov r8d, dword [r10 + rcx*4]
movzx ecx, byte [rsp + r9 + 0x1e]
xor r8d, edx
movzx eax, r8b
shr r8d, 8
xor rcx, rax
mov edx, dword [r10 + rcx*4]
movzx ecx, byte [rsp + r9 + 0x1f]
xor edx, r8d
movzx eax, dl
shr edx, 8
xor rcx, rax
mov r11d, dword [r10 + rcx*4]
xor r11d, edx
cmp r9, 0x10
jl 0x140009370
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140028300
add rsp, 0x48
ret
Function at 0x1400093f0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x490
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor ebx, ebx
mov rsi, rcx
test rcx, rcx
je 0x140009599
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x270]
mov dword [rsp + 0x58], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400095a4
mov ecx, 0x1000
mov qword [rsp + 0x4a8], rdi
mov dword [rsp + 0x40], 0x1000
call fcn.140028e14
mov rdi, rax
test rax, rax
je 0x14000956e
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], bx
call fcn.14002ea20
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x270]
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14000952c
cmp dword [rsp + 0x40], 0x1000
jbe 0x140009566
mov rcx, rdi
call fcn.140028dd4
mov ecx, dword [rsp + 0x40]
call fcn.140028e14
mov rdi, rax
test rax, rax
je 0x14000956e
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x270]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 0x104
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x140009566
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x50], rbx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x140009566
mov rdx, qword [rsp + 0x50]
mov r8d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 1
mov rcx, rdi
call fcn.140028dd4
mov rdi, qword [rsp + 0x4a8]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140028300
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rsi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x140009578

Function at 0x140009640
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
test rcx, rcx
je 0x1400096c4
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x1400096c4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400096c4
mov qword [rsp + 0x30], rsi
lea rsi, [rcx + rax]
lea edx, [rbx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400096b2
cmp dword [rsi], 0x4550
jne 0x1400096b2
test rdi, rdi
je 0x14000969d
mov eax, 0xf0
cmp word [rsi + 0x14], ax
sete bl
mov dword [rdi], ebx
mov eax, 1
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, ebx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret