joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047f90
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x230
mov qword [rax - 0x178], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov dword [rsp + 0x20], ecx
lea rdx, str.C:Windowsiassist_
lea rcx, [rsp + 0x28]
call fcn.14000c8e0
nop
lea rdx, str.Host.txt
lea rcx, [rsp + 0x28]
call fcn.14000c4d0
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xd8], rcx
call fcn.14000d260
mov qword [rsp + 0x50], rax
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.hostFileEntries:
lea rcx, [rsp + 0x58]
call fcn.14000c8e0
nop
mov ebx, 0xffffffff
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14005c860
lea rdx, [0x1400a3cc0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
mov qword [rsp + 0x30], rax
lea rdx, str.C:WindowsSystem32Driversetchosts
lea rcx, [rsp + 0x48]
call fcn.14000c8e0
nop
lea rdx, [0x140098d4c]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rdi, rax
mov qword [rsp + 0x38], rax
nop dword [rax]
nop word [rax + rax]
mov r8, rsi
mov edx, 0x12c
lea rcx, [rsp + 0xf0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x1400480ce
mov rdx, rdi
lea rcx, [rsp + 0xf0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
jmp 0x1400480a0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x60], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048120
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x28]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x68], rax
lock xadd dword [rax + 0x10], ebx
sub ebx, 1
jg 0x140048147
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005c370
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005c42f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000ce70
test al, al
jne 0x14005c40b
lea rax, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14005c3f0
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400693e0
add rsp, 0x260
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000df80
int3

Function at 0x14005c440
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005c513
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140060130
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x14005c4c4
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c4ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14005c509
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x14005f300
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x40
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x68], rax
lea rax, [0x14009a114]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x88], rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
jmp 0x14005f39b
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005f3ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0xc0
pop rbx
ret

Function at 0x14005f3d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x30], 0
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14005f4ce
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
test eax, eax
js 0x14005f48b
lea rcx, [rsp + 0x50]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14005f470
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000d350
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14005f4a6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x1400607d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xda0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0xdd0], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0xd90], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x80], rcx
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400609d6
mov rax, qword [rax]
call qword [rax + 0x18]
mov qword [rsp + 0xa0], rax
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140060130
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x48], eax
test eax, eax
jne 0x140060923
mov dword [rsp + 0x30], 0xbb8
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.14005ab10
mov qword [rsp + 0xa8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb0], rdx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x1400608ee
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
mov rdi, 0xffffffffffffffff
jne 0x14006092f
lea rcx, [rsp + 0x1d0]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140060904
mov r8d, eax
lea rdx, [rsp + 0x1d0]
mov rcx, r14
call fcn.14000d350
jmp 0x14006092f
mov rdi, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x50], rbx
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14006095f
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsi]
sub rax, 0x18
mov qword [rsp + 0x58], rax
lock xadd dword [rax + 0x10], edi
sub edi, 1
jg 0x140060983
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, dword [rsp + 0x34]
jmp 0x1400609b2
mov rcx, qword [rsp + 0xd90]
xor rcx, rsp
call fcn.1400693e0
mov rbx, qword [rsp + 0xdd0]
add rsp, 0xda0
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x1400616a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x2c0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400616ec
mov eax, 1
jmp 0x1400618d3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006173d
cmp eax, 2
jne 0x14006172a
lea rcx, str.Key_not_found._n
call fcn.14000dd30
mov eax, 1
jmp 0x1400618d3
lea rcx, str.Error_opening_key._n
call fcn.14000dd30
xor eax, eax
jmp 0x1400618d3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdi, [rsi + rcx*2]
mov qword [rsp + 0x68], rdi
cmp word [rdi - 2], 0x5c
je 0x140061771
mov eax, 0x5c
mov word [rdi], ax
add rdi, 2
mov qword [rsp + 0x68], rdi
xor ebx, ebx
mov word [rdi], bx
jmp 0x140061773
xor ebx, ebx
mov dword [rsp + 0x48], 0x104
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400618a1
nop word [rax + rax]
mov ecx, 0x7ffffffe
mov qword [rsp + 0x80], rcx
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x70], r8
mov edx, 0x208
mov qword [rsp + 0x78], rdx
mov rax, rdi
mov qword [rsp + 0x58], rax
mov r9, rbx
mov qword [rsp + 0x60], rbx
test rdx, rdx
je 0x14006183b
test rcx, rcx
je 0x14006184c
movzx r10d, word [r8]
test r10w, r10w
je 0x14006184c
mov word [rax], r10w
add rax, 2
mov qword [rsp + 0x58], rax
add r8, 2
mov qword [rsp + 0x70], r8
dec rdx
mov qword [rsp + 0x78], rdx
dec rcx
mov qword [rsp + 0x80], rcx
inc r9
mov qword [rsp + 0x60], r9
jmp 0x1400617f4
sub rax, 2
mov qword [rsp + 0x58], rax
dec r9
mov qword [rsp + 0x60], r9
mov word [rax], bx
mov rdx, rsi
mov rcx, r14
call fcn.1400616a0
test eax, eax
je 0x1400618a1
mov dword [rsp + 0x48], 0x104
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400617c0
sub rdi, 2
mov qword [rsp + 0x68], rdi
mov word [rdi], bx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400618cf
mov eax, 1
jmp 0x1400618d3
xor eax, eax
jmp 0x1400618d3
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400693e0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2c0
pop r14
pop rdi
pop rsi
ret
Function at 0x140061c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rdi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov dword [rsp + 0x98], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x140061cac
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0xa0], rax
mov ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
sub ecx, 1
jg 0x140061ca8
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x140061d06
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0xa8], rax
mov ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
sub ecx, 1
jg 0x140061cdb
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
jmp 0x140061d06
add rsp, 0x78
pop rdi
pop rbx
ret
Function at 0x1400626e0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140062746
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140062733
addss xmm0, dword [0x1400a89d8]
mulss xmm0, dword [0x1400a89c8]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si eax, xmm0
jmp 0x14006274d
mov eax, 4
jmp 0x14006274d
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400693e0
add rsp, 0xa8
ret

Function at 0x1400629d0
Capabilities:
Get session user name

Disassembly:
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x2b8], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x24], 0
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140062ab1
mov rax, qword [rax]
call qword [rax + 0x18]
mov qword [rsp + 0x28], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0x101
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.14000c950
mov dword [rsp + 0x24], 1
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x38], rbx
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140062a8b
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
jmp 0x140062a90
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400693e0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x140062ac0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x300
mov qword [rax - 0x278], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x20], 0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xb0], 0x238
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, 0xffffffff
test eax, eax
je 0x140062c18
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x28]
call fcn.14000c950
nop
mov r8, qword [rsi]
mov qword [rsp + 0x98], r8
test r8, r8
je 0x140062cc1
mov rax, qword [rsp + 0x28]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140062b94
add rax, 2
test ecx, ecx
jne 0x140062b80
test edx, edx
je 0x140062be0
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x38], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140062bc0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rsp + 0xb0]
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140062b51
jmp 0x140062c18
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x40], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140062c13
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x20], 0
je 0x140062c50
mov rax, qword [rsi]
sub rax, 0x18
mov qword [rsp + 0x48], rax
lock xadd dword [rax + 0x10], ebx
sub ebx, 1
jg 0x140062c4c
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
jmp 0x140062c9c
mov rax, qword [rsi]
sub rax, 0x18
mov qword [rsp + 0x50], rax
lock xadd dword [rax + 0x10], ebx
sub ebx, 1
jg 0x140062c74
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x140062c9c
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x140065e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor ebp, ebp
mov rax, qword [rsp + 0x50]
mov r12, r9
mov r11, qword [rsp + 0x60]
mov r13, r8
mov r14, rdx
mov qword [rsi], r8
mov qword [r11], rax
mov rax, qword [rsi]
cmp rax, r9
je 0x140065fe4
mov r15, qword [rsp + 0x58]
lea r8d, [rbp + 1]
mov rbx, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rbx, r15
je 0x140065fe4
movzx edx, word [r14]
xor dil, dil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x140065eea
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x14006600a
movzx eax, dx
movzx ecx, cx
shl eax, 0xa
sub ecx, 0xdc00
or eax, ecx
jmp 0x140065f06
mov edx, 0x2800
movzx eax, cx
add cx, dx
cmp cx, r9w
ja 0x140065f06
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140065f19
movzx r9d, al
mov r10d, ebp
mov r8d, ebp
jmp 0x140065f63
mov r9d, eax
cmp eax, 0x800
jae 0x140065f30
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
jmp 0x140065f63
cmp eax, 0x10000
jae 0x140065f4a
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r8d, r10d
jmp 0x140065f63
shr r9d, 0x12
mov r10d, 3
movzx r8d, dil
or r9b, 0xf0
xor r8d, 1
add r8d, r8d
inc r8d
mov rdx, r15
sub rdx, rbx
mov ecx, r8d
cmp rdx, rcx
jl 0x140065fe4
add qword [rsi], 2
test dil, dil
jne 0x140065f83
cmp r10d, 3
jae 0x140065f8f
mov rcx, qword [r11]
mov byte [rcx], r9b
inc qword [r11]
dec r8d
test r8d, r8d
jle 0x140065fc1
lea r9d, [r10 + r10*2]
add r9d, r9d
nop dword [rax + rax]
sub r9d, 6
mov edx, eax
mov ecx, r9d
dec r8d
shr edx, cl
mov rcx, qword [r11]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [r11]
test r8d, r8d
jg 0x140065fa0
mov r8d, 1
test dil, dil
je 0x140065fd1
shr eax, 0xa
jmp 0x140065fd4
mov eax, r8d
mov word [r14], ax
mov rax, qword [rsi]
cmp rax, r12
jne 0x140065ea1
cmp r13, qword [rsi]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x140065fed
Function at 0x140066f00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140066f3b
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x14006707b
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140066f68
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
lea rdx, [rax + r8*2]
cmp rax, rdx
jae 0x140066f68
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void____ptr64]
mov word [rax], di
movzx eax, di
jmp 0x14006707b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140067070
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140066faf
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140066fd9
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
je 0x140067070
movzx esi, di
jmp 0x140067070
lea rax, [rsp + 0x48]
mov word [rsp + 0x40], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x42]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140067070
cmp eax, 1
jle 0x14006702f
cmp eax, 3
jne 0x140067070
movzx ecx, word [rsp + 0x40]
jmp 0x140066fbb
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14006705d
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140067070
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, di
jne 0x140067073
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400693e0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140067fd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140068082
cmp byte [rcx + 0x72], 0
je 0x140068082
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140068043
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140068047
sub eax, 1
je 0x14006804b
sub eax, 2
je 0x140068082
xor al, al
jmp 0x140068084
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140068079
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140068043
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140068084
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400693e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140002670
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400026ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026bc
xor al, al
add rsp, 0x28
ret