joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002460
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x2040
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rsi, rcx
lea r14, [rsp + 0x2078]
lea rdi, [rsp + 0x30]
mov ebx, 0x1000
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._PYI__d:_ls_
lea rax, str.WARNING
mov edx, ebx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001da0
xor ebp, ebp
test eax, eax
js 0x1400024ec
movsxd rcx, eax
lea rdi, [rsp + 0x30]
sub ebx, eax
cmovs ebx, ebp
lea rdi, [rdi + rcx*2]
movsxd rbx, ebx
call fcn.140001020
mov qword [rsp + 0x28], r14
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, qword [rax]
or rcx, 1
call fcn.140013320
mov ecx, 2
call fcn.140013730
mov rcx, rax
lea r8, [rsp + 0x30]
lea rdx, [0x140028b40]
call fcn.140001e50
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x2040
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140002560
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2058
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov r14, r8
lea r13, [rsp + 0x20b8]
mov r15d, edx
lea rsi, [rsp + 0x40]
mov rbp, rcx
mov edi, 0x1000
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._PYI__d:ERROR_
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140001da0
xor r12d, r12d
test eax, eax
js 0x1400025e4
movsxd rcx, eax
lea rsi, [rsp + 0x40]
sub edi, eax
cmovs edi, r12d
lea rsi, [rsi + rcx*2]
movsxd rbx, edi
call fcn.140001020
mov qword [rsp + 0x28], r13
mov r9, r14
mov r8, rbx
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rcx, qword [rax]
or rcx, 1
call fcn.140013320
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
test eax, eax
js 0x140002626
movsxd rcx, eax
sub edi, eax
cmovs edi, r12d
lea rsi, [rsi + rcx*2]
movsxd rdx, edi
lea r8, str._ls:
mov r9, rbp
mov rcx, rsi
call fcn.140001da0
test eax, eax
js 0x14000264c
movsxd rcx, eax
sub edi, eax
cmovs edi, r12d
lea rsi, [rsi + rcx*2]
mov qword [rsp + 0x30], r12
mov r9d, 0x400
mov dword [rsp + 0x28], edi
mov r8d, r15d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140002686
movsxd rdx, edi
lea r8, str._FormatMessageW_failed.__n
mov rcx, rsi
call fcn.140001da0
mov ecx, 2
call fcn.140013730
mov rcx, rax
lea r8, [rsp + 0x40]
lea rdx, [0x140028b40]
call fcn.140001e50
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x2058
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007b00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rsi, rdx
xor edi, edi
lea rdx, [0x1400287d4]
call fcn.140003fa0
mov rbx, rax
test rax, rax
je 0x140007b62
lea rdx, [0x1400288cc]
mov rcx, rsi
call fcn.140003fa0
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x140007b6c
call fcn.14000eabc
mov eax, 0xffffffff
jmp 0x140007c01
call fcn.14000eb20
test eax, eax
jne 0x140007bef
nop word [rax + rax]
mov r9, rbx
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000edd8
test rax, rax
je 0x140007bd6
mov r9, rsi
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000f300
test rax, rax
je 0x140007bd1
mov rcx, rsi
call fcn.14000eb4c
test eax, eax
jne 0x140007bd1
mov rcx, rbx
call fcn.14000eb20
test eax, eax
je 0x140007b80
jmp 0x140007bef
mov rcx, rsi
jmp 0x140007be5
mov rcx, rbx
call fcn.14000eb4c
test eax, eax
je 0x140007bef
mov rcx, rbx
call fcn.140015438
mov edi, 0xffffffff
mov rcx, rbx
call fcn.14000eabc
mov rcx, rsi
call fcn.14000eabc
mov eax, edi
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000c7f0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140007c30
Capabilities:
Create directory

Disassembly:
push rdi
push r14
mov eax, 0x3058
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x3030], rax
mov rdi, r8
mov r14, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x140007c60
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140007c71
inc rax
mov qword [rsp + 0x3050], rbx
add rax, rcx
mov qword [rsp + 0x3048], rbp
mov qword [rsp + 0x3040], rsi
cmp rax, 0x1000
jae 0x140007d66
mov r9, rdx
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea r8, str._s_c
lea rcx, [rsp + 0x30]
call fcn.140001ca0
mov edx, 0x5c
movsxd rbp, eax
mov rcx, rdi
call fcn.14000ddf0
mov rbx, rax
test rax, rax
je 0x140007d62
mov esi, 0x1000
sub rsi, rbp
lea rbp, [rsp + rbp + 0x30]
nop
mov r9d, ebx
mov qword [rsp + 0x20], rdi
sub r9d, edi
lea r8, [0x14002b904]
mov rdx, rsi
mov rcx, rbp
call fcn.140001ca0
lea rcx, [rsp + 0x30]
call fcn.140003f40
test eax, eax
jne 0x140007d4c
mov r8d, 0x1000
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x30]
call fcn.1400096a0
mov rdx, qword [r14 + 0x3038]
lea rcx, [rsp + 0x1030]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140007d66
lea rcx, [rbx + 1]
mov edx, 0x5c
call fcn.14000ddf0
mov rbx, rax
test rax, rax
jne 0x140007cf0
xor eax, eax
jmp 0x140007d6b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x3040]
mov rbp, qword [rsp + 0x3048]
mov rbx, qword [rsp + 0x3050]
mov rcx, qword [rsp + 0x3030]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x3058
pop r14
pop rdi
ret
Function at 0x140007da0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rbp, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.14001341c
mov r15, rax
test rax, rax
jne 0x140007de2
mov edx, 0x2000
lea rcx, str.LOADER:_failed_to_allocate_read_buffer___d_bytes___n
call fcn.140001ea0
jmp 0x140007f00
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 2]
call fcn.14000f0a8
test eax, eax
jns 0x140007e05
lea rcx, str.LOADER:_failed_to_seek_to_the_end_of_the_file__n
call fcn.140001ea0
jmp 0x140007f00
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.1400159b8
mov rbx, rax
cmp rax, rbp
jae 0x140007e2b
lea rcx, str.LOADER:_file_is_too_short_to_contain_magic_pattern__n
call fcn.140001ea0
jmp 0x140007efb
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
nop word [rax + rax]
cmp rbx, 0x2000
lea rsi, [rbx - 0x2000]
cmovb rsi, r13
sub rbx, rsi
cmp rbx, rbp
jb 0x140007ef1
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.14000f0a8
test eax, eax
js 0x140007ee2
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000edd8
cmp rax, rbx
jne 0x140007ed6
sub rbx, rbp
add rbx, 1
je 0x140007ebb
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax + rax]
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.14000dfb0
test eax, eax
je 0x140007ecd
dec rdi
sub rbx, 1
jne 0x140007ea0
lea rbx, [rbp - 1]
add rbx, rsi
test rsi, rsi
jne 0x140007e40
jmp 0x140007ef1
lea r13, [rbx - 1]
add r13, rsi
jmp 0x140007ef1
mov rdx, rbx
lea rcx, str.LOADER:_failed_to_read_chunk___zd_bytes___n
jmp 0x140007eec
mov rdx, rsi
lea rcx, str.LOADER:_failed_to_seek_to_the_offset_0x_llX__n
call fcn.140001ea0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140013408
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140008100
Capabilities:
Create directory
Get disk information
Query environment variable

Disassembly:
push rdi
mov eax, 0x4040
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r8d, r8d
xor edx, edx
call fcn.1400096a0
mov rdi, rax
test rax, rax
jne 0x140008146
lea rcx, str.LOADER:_failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.140002160
xor eax, eax
jmp 0x140008321
mov r8d, 0x1000
mov qword [rsp + 0x4058], rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.140013408
test ebx, ebx
jne 0x140008183
lea rcx, str.LOADER:_failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.140002160
xor eax, eax
jmp 0x140008319
lea rcx, [rsp + 0x30]
call fcn.140009510
lea rdx, [rsp + 0x30]
test eax, eax
je 0x140008211
lea rcx, str.LOADER:_expanded_runtime_tmpdir_is_a_drive_root:__ls_n
call fcn.140001f80
cmp word [rsp + 0x34], 0x5c
je 0x1400081d7
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_appending_backslash_to_the_given_drive_root__ls_n
call fcn.140001f80
lea rcx, [rsp + 0x30]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400081c4
mov eax, dword [0x14002bcd4]
mov dword [rcx], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x140008202
mov r8d, eax
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_runtime_tmpdir_points_to_non_existent_drive__ls__type:__d___n
call fcn.140002160
xor eax, eax
jmp 0x140008319
lea rcx, [rsp + 0x30]
call fcn.1400159c8
jmp 0x140008319
mov r8d, 0x1000
xor ecx, ecx
call fcn.140015e70
mov rbx, rax
test rax, rax
jne 0x140008239
lea rcx, str.LOADER:_failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.140002160
xor eax, eax
jmp 0x140008319
mov rdx, rbx
lea rcx, str.LOADER:_absolute_runtime_tmpdir_is__ls_n
call fcn.140001f80
mov edx, 0x5c
mov rcx, rbx
call fcn.14000e078
mov rdi, rax
test rax, rax
je 0x1400082c1
nop dword [rax]
mov r9, rdi
mov qword [rsp + 0x20], rbx
sub r9, rbx
lea r8, str._.s
sar r9, 1
lea rcx, [rsp + 0x2030]
mov edx, 0x1000
call fcn.140001da0
lea rdx, [rsp + 0x2030]
lea rcx, str.LOADER:_creating_runtime_tmpdir_path_component:__ls_n
call fcn.140001f80
xor edx, edx
lea rcx, [rsp + 0x2030]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000e078
mov rdi, rax
test rax, rax
jne 0x140008260
mov rdx, rbx
lea rcx, str.LOADER:_creating_runtime_tmpdir_path:__ls_n
call fcn.140001f80
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140008316
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140008316
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
lea r8, str.LOADER:_failed_to_create_runtime_tmpdir_path__ls__n
mov edx, eax
lea rcx, str.CreateDirectory
call fcn.140002560
mov rcx, rbx
call fcn.140013408
xor eax, eax
jmp 0x140008319
mov rax, rbx
mov rbx, qword [rsp + 0x4058]
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x4040
pop rdi
ret
Function at 0x140008340
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2280
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x2270], rax
mov rbp, rcx
lea r8, [0x14002c1f0]
mov r9, rcx
mov ebx, 0x1000
mov edx, ebx
lea rcx, [rsp + 0x270]
call fcn.140001da0
mov edi, eax
cmp eax, ebx
jge 0x1400084b9
dec edi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
sub ebx, edi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400084b9
nop
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x1400083ef
test ax, ax
je 0x140008489
cmp cx, cx
jne 0x1400083ef
cmp ax, cx
jne 0x1400083ef
cmp word [rsp + 0x50], 0
je 0x140008489
movsxd rax, edi
lea rcx, [rsp + 0x270]
movsxd rdx, ebx
lea r9, [rsp + 0x4c]
lea r8, [0x14002c1fc]
lea rcx, [rcx + rax*2]
call fcn.140001da0
cmp eax, ebx
jge 0x140008489
mov eax, dword [rsp + 0x20]
test al, 0x10
je 0x140008463
bt eax, 0xa
jae 0x140008449
cmp dword [rsp + 0x44], 0xa000000c
jne 0x140008449
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140008489
lea rcx, str.LOADER:_failed_to_remove_directory_symbolic_link:__ls_n
jmp 0x14000847c
lea rcx, [rsp + 0x270]
call fcn.140008340
test eax, eax
jns 0x140008489
lea rcx, str.LOADER:_failed_to_remove_directory:__ls_n
jmp 0x14000847c
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140008489
lea rcx, str.LOADER:_failed_to_remove_file:__ls_n
lea rdx, [rsp + 0x270]
call fcn.140001f80
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400083c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec eax
neg eax
sbb eax, eax
jmp 0x1400084be
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2270]
xor rcx, rsp
call fcn.14000c7f0
lea r11, [rsp + 0x2280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140008650
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x2050
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor r14d, r14d
mov rbp, rcx
cmp qword [rcx + 0x3068], r14
je 0x1400086f6
lea rcx, [0x14002bfb8]
call fcn.140008840
mov rcx, qword [rbp + 0x3068]
mov r14, rax
call fcn.140008100
mov rdi, rax
test rax, rax
je 0x1400086d8
mov rdx, rax
lea rcx, [0x14002bfc0]
call fcn.1400162a8
mov rcx, rdi
mov ebx, eax
call fcn.140013408
test ebx, ebx
je 0x1400086ea
lea rcx, str.LOADER:_failed_to_set_the_TMP_environment_variable._n
call fcn.140002160
mov rcx, r14
call fcn.140013408
mov eax, 0xffffffff
jmp 0x140008815
lea rcx, str.LOADER:_successfully_resolved_the_specified_runtime_tmpdir_n
call fcn.140001f80
lea rdx, [rsp + 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x40]
lea rcx, str.LOADER:_attempting_to_create_temporary_application_directory_under__ls_n
call fcn.140001f80
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._MEI_d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400094b0
xor ebx, ebx
lea esi, [rbx - 1]
nop word [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140016ba0
mov rdx, qword [rbp + 0x3038]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rdi
test eax, eax
jne 0x140008777
call fcn.140013408
inc ebx
cmp ebx, 5
jl 0x140008740
jmp 0x1400087a6
lea rdx, [rbp + 0x2022]
mov r8d, 0x1000
call fcn.140009750
test rax, rax
jne 0x14000879c
lea rcx, str.LOADER:_length_of_teporary_directory_path_exceeds_maximum_path_length__n
call fcn.140002160
jmp 0x14000879e
xor esi, esi
mov rcx, rdi
call fcn.140013408
cmp qword [rbp + 0x3068], 0
je 0x140008813
xor r8d, r8d
lea rcx, [0x14002bfb8]
xor edx, edx
call fcn.1400096a0
test r14, r14
je 0x1400087f9
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov rdi, rax
call fcn.1400096a0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400162a8
mov rcx, rdi
call fcn.140013408
mov rcx, rbx
call fcn.140013408
mov rcx, r14
jmp 0x14000880e
lea rdx, [0x14002bad0]
mov rcx, rax
mov rbx, rax
call fcn.1400162a8
mov rcx, rbx
call fcn.140013408
mov eax, esi
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000c7f0
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140008840
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4038
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x4020], rax
xor r8d, r8d
xor edx, edx
call fcn.1400096a0
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffe
ja 0x1400088d2
mov r8d, 0x1000
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0xffe
ja 0x1400088d2
xor r8d, r8d
lea rcx, [rsp + 0x2020]
xor edx, edx
call fcn.140009750
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x4038
ret
Function at 0x140009030
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rbp
push r12
mov eax, 0x4050
call fcn.14000c9d0
sub rsp, rax
mov rax, qword [0x14003d070]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor ebp, ebp
mov rbx, rcx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov r12, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140009281
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x140009281
lea edx, [rbp + 1]
mov qword [rsp + 0x4040], r15
call fcn.140013400
mov r15, rax
test rax, rax
je 0x140009279
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, r12
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140009271
lea rcx, [rbx + 0x2022]
mov r8d, 0x1000
lea rdx, [rsp + 0x2030]
call fcn.1400096a0
test rax, rax
je 0x140009271
mov qword [rsp + 0x4078], rsi
lea rax, [rsp + 0x2030]
mov qword [rsp + 0x4048], r14
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], bp
jne 0x140009107
mov eax, dword [rsp + 0x20]
lea rcx, str.LOADER:_found__d_loaded_DLLs..._n
shr eax, 3
mov edx, eax
mov qword [rsp + 0x4080], rdi
mov r14d, eax
call fcn.140001f80
test r14, r14
je 0x1400091a8
mov rdi, rbp
mov rsi, r15
nop dword [rax + rax]
mov rdx, qword [r15 + rdi*8]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov rcx, r12
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x140009169
lea rcx, str.LOADER:_could_not_resolve_DLLs_name___skipping__n
call fcn.140001f80
jmp 0x1400091a0
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_loaded_DLL:__ls_n
call fcn.140001f80
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2030]
call fcn.140015a98
test eax, eax
jne 0x1400091a0
mov rax, qword [r15 + rdi*8]
inc ebp
mov qword [rsi], rax
add rsi, 8
inc rdi
cmp rdi, r14
jl 0x140009140
mov edx, ebp
lea rcx, str.LOADER:_found__d_DLL_s__loaded_from_applications_temporary_directory__n
call fcn.140001f80
mov r14, qword [rsp + 0x4048]
movsxd rsi, ebp
test ebp, ebp
jle 0x140009261
mov rdi, r15
nop dword [rax]
mov rdx, qword [rdi]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov rcx, r12
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x1400091f8
lea rcx, str.LOADER:_could_not_resolve_DLLs_name__was_it_unloaded_____skipping__n
call fcn.140001f80
jmp 0x140009253
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_forcing_unload_of__ls_n
call fcn.140001f80
mov rcx, qword [rdi]
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x140009245
nop dword [rax + rax]
cmp ebx, 0x20
jge 0x14000929d
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_forcing_unload_of__ls_n
call fcn.140001f80
mov rcx, qword [rdi]
inc ebx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x140009220
lea rcx, str.LOADER:_DLL_unloaded_after__d_attempt_s___n
mov edx, ebx
call fcn.140001f80
add rdi, 8
sub rsi, 1
jne 0x1400091d0
mov rdi, qword [rsp + 0x4080]
mov rsi, qword [rsp + 0x4078]
mov rcx, r15
call fcn.140013408
mov r15, qword [rsp + 0x4040]
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.14000c7f0
add rsp, 0x4050
pop r12
pop rbp
pop rbx
ret
lea rcx, str.LOADER:_giving_up_after__d_attempts__n
jmp 0x14000924c
Function at 0x140017b3c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140017968
Function at 0x140130ef9
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov byte [rbp + rax - 0x44], r13b
inc rax
cmp rax, 0x43
jmp 0x140130cf8
jb 0x140130ce7
xchg r13, rax
mov r13, rax
xchg r13, rax
mov byte [rsp + rax + 0x68], r13b
jmp 0x140130e6d
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140131001
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
je 0x140130d5f
jne 0x140130d5f
ret
jmp 0x140130f36
mov dword [rbp - 0x50], 0xf6f6f6f6
mov dword [rbp - 0xc], 0x81796f78
mov dword [rbp - 0x4c], 0xf6f6f6f6
mov dword [rbp - 8], 0x71787378
mov word [rbp - 0x48], 0xf6f6
jmp 0x140130ea0
mov dword [rbp - 0x3c], 0x444f5e59
mov dword [rbp - 0x7c], 0xf6f6f6f6
mov dword [rbp - 0x38], 0x71784f2a
mov dword [rbp - 0x78], 0xf6f6f6f6
mov dword [rbp - 0x34], 0x596f7873
mov dword [rbp - 0x74], 0xf6f6f6f6
mov dword [rbp - 0x30], 0x78737881
jmp 0x140130e7f
mov rax, qword gs:[0x60]
mov r11d, dword [rbx + r9 + 0x20]
jne 0x140130d20
cmp edx, 0x8edc47
je 0x14013110a
jmp 0x140131001
inc rax
cmp rax, 0xf
jb 0x140130d05
jmp 0x140130dda
mov dword [rbp - 0x70], 0xf6f6f6f6
mov dword [rbp - 0x2c], 0x7d732a71
mov dword [rbp - 0x6c], 0xf6f6f6f6
mov dword [rbp - 0x28], 0x8179782a
jmp 0x140130f5e
mov dword [rbp - 4], 0x7f7d38
mov byte [rbp - 0x46], 0xf6
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rdx - 0x44]
movzx ecx, byte [rsp + rdx + 0x78]
add cl, al
je 0x140130ecb
jne 0x140130ecb
call rcx
movabs rbx, 0x1c32100000214e9
cmp rcx, rdi
test rbx, rbp
call 0x140130e4e
jmp 0x1401310e4
jb 0x140131065
mov dword [rsp + 0x58], 0xf6f6f6f6
xchg rdx, r13
mov r13, rdx
xchg rdx, r13
mov dword [rsp + 0x68], 0x7371784f
js 0x140130f6d
jae 0x140130ee7
mov byte [rax], 0
invalid
mov dword [rbp - 0x60], 0xf6f6f6f6
mov dword [rbp - 0x1c], 0x792a6f76
mov dword [rbp - 0x5c], 0xf6f6f6f6
mov dword [rbp - 0x18], 0x13141478
jmp 0x140130f7f
xor eax, edx
invalid

Function at 0x140131e46
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
add byte [rax], 0
ret
or byte [rcx], al
add byte [rax], al
mov eax, dword [r15 + 0xa4]
mov dword [rbp + 0x124], eax
rcl edi, 0x5a
mov r13d, 0x8c462755
sub r11d, 0x3a2053df
lea r15d, [rdi + 0xaa71]
jmp 0x140132006
mul r15
int3
mul r8
test edi, 0x36809b09
jmp 0x140131e5a
push r8
rcr r11d, 0x8a
jle 0x140131631
jmp 0x140131dd3
jl 0x1401312b8
rol esi, 0xfd
push rdi
cmp rbp, rdx
inc rbp
jmp 0x140131efe
cmp edi, dword [rdi + 0x5b]
test ebx, 0x10ebc5d9
js 0x140131a70
jmp 0x14013195e
sub r12d, 0x36b71571
ja 0x140131cde
popf
ja 0x140130912
lea r10d, [rcx + 0xae88]
jmp 0x140131942
int3
call rcx
lea ebx, [rcx - 0x7a00]
neg r15
neg rbx
test r8, rdx
jne 0x14013203e
je 0x14013203e
or esi, 0x1920174e
add r8d, 0x56be4ddc
mov esi, 0xee7632a0
xor esi, 0xb30db6c5
lea r10d, [rbp - 0x1fb3]
jmp rcx
jmp 0x140131cde
Function at 0x140132669
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
outsd dx, dword [rsi]
adc edi, edi
inc dword [rcx - 0x3f]
fimul word [rcx + 0x41]
push rdi
jb 0x14013310c
inc r14
xor ebp, 0xd40d8613
jp 0x140131a22
add esi, 0x105d9ff3
jo 0x140132f86
movabs rdx, 0x303629fffffbd7e9
ret
mul edx
jbe 0x140133334
rcr edi, 0x12
ret 0x18
add byte [rax], al
sbb al, 0xe2
adc cl, byte [rdi]
test bh, 0x45
adc al, 0x2a
jae 0x14013318b
jge 0x1401330dc
invalid
xchg dword [rsp - 8], edi
invalid
jo 0x14013332d
div dh
test bh, 0x85
invalid
Function at 0x1400084e0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1230
call fcn.140043620
sub rsp, rax
mov rbp, rcx
lea r8, [rsp + 0x1248]
lea rcx, [rsp + 0x230]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140008587
mov esi, dword [rsp + 0x1248]
xor ebx, ebx
shr esi, 2
test esi, esi
je 0x140008587
nop
mov r8d, dword [rsp + rbx*4 + 0x230]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140008581
mov r9d, 0x104
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140008578
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140048d98
test eax, eax
je 0x1400085a2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jb 0x140008530
xor al, al
lea r11, [rsp + 0x1230]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140008589