joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14032e2fc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1406d9ec0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14032e353
cmp word [rdx], r13w
jne 0x14032e353
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14032e358
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14032e47d
mov r11d, reloc.WS2_32.dll_listen
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14032e49e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14032e391
mov rdx, r9
mov word [rbx], cx
jmp 0x14032e3b8
cmp r9, r8
jae 0x14032e3c8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14032e372
jmp 0x14032e47d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14032e472
cmp dword [rsp + 0x80], esi
je 0x14032e472
lea r8, [0x1406d9ec0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14032e44a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14032e41a
mov word [rbx], r13w
jmp 0x14032e47a
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14032e427
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14032e47a
cmp word [rsp + 0x70], r13w
jne 0x14032e457
cmp rbx, r14
je 0x14032e414
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14032502c
cmp word [rsp + 0x70], r13w
je 0x14032e47d
mov ecx, reloc.WS2_32.dll_listen
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1406d9ec0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14032e477
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14032e47d
Function at 0x14033130c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140331322
mov al, 1
jmp 0x140331382
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140331333
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140331380
mov ecx, dword [rcx + 0x18]
nop
call fcn.140338abc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140331380
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140331380
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140331380
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140331382
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140338d70
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140338d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14031e518
or eax, 0xffffffff
jmp 0x140338d92
xor eax, eax
add rsp, 0x28
ret
Function at 0x14033b668
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14033b698
xor eax, eax
jmp 0x14033b75b
mov rbp, rbx
cmp word [rax], si
je 0x14033b6bd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14033b6a4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14033b6a0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140336058
movsxd r14, eax
test eax, eax
jne 0x14033b6fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14033b691
mov rcx, r14
call fcn.140332ee0
mov rdi, rax
test rax, rax
jne 0x14033b714
xor ecx, ecx
call fcn.1403318b4
jmp 0x14033b6f0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140336058
test eax, eax
jne 0x14033b745
mov rcx, rdi
call fcn.1403318b4
jmp 0x14033b74f
xor ecx, ecx
call fcn.1403318b4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14033b778
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14033b7ff
mov rsi, rbx
cmp word [rax], bp
je 0x14033b7be
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14033b7a8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14033b7a4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140332ee0
mov rdi, rax
test rax, rax
je 0x14033b7ec
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140349370
mov rbp, rdi
xor ecx, ecx
call fcn.1403318b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14033e64c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140330db8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14033e6ed
cmp ebx, dword [rsp + 0x30]
je 0x14033e6e6
test esi, esi
je 0x14033e6e6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14033e6c1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14033e6ce
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14033e6ab
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14033e6d2
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14033e6ef
mov eax, 1
jmp 0x14033e6ef
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14033eb34
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14032502c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14032502c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14033ec84
cmp rax, 0xffffffffffffffff
je 0x14033ec84
xor edi, edi
test rbp, rbp
jle 0x14033ec2f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140331bfc
mov rbx, rax
test rax, rax
jne 0x14033ebbc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14033ec25
mov edx, 0x8000
mov ecx, r14d
call fcn.140327e10
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14032f6b4
cmp eax, 0xffffffff
je 0x14033ec05
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14033ebcc
mov edx, r15d
mov ecx, r14d
call fcn.140327e10
jmp 0x14033ec25
cmp byte [rsi + 0x38], dil
je 0x14033ec1c
cmp dword [rsi + 0x34], 5
jne 0x14033ec1c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14033ec25
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1403318b4
jmp 0x14033ec98
jns 0x14033ec98
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14032502c
cmp rax, 0xffffffffffffffff
jne 0x14033ec50
cmp byte [rsi + 0x30], dil
je 0x14033ec98
mov edi, dword [rsi + 0x2c]
jmp 0x14033ec98
mov ecx, r14d
call fcn.140338abc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14033ec98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x14033ec98
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14033ec91
mov eax, dword [rsi + 0x2c]
jmp 0x14033ec96
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14032502c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140340e7c
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1404985c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140340ec6
call fcn.14031e584
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.14031e5a4
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14030e83c
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402fea30
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140340ed1
lea eax, [rbx + 1]
jmp 0x140340eb3
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140340eb1
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140340eb3
Function at 0x140341ad8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140318ce0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140341b62
cmp byte [rbp - 0x21], r15b
je 0x140341b5d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140341b98
call fcn.140332044
test eax, eax
jne 0x140341b84
cmp byte [rbp - 0x21], r15b
je 0x140341b7c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140341b98
cmp byte [rbp - 0x21], r15b
je 0x140341b95
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14031c308
test eax, eax
jne 0x140341c38
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140318ce0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140341bd7
cmp byte [rbp - 0x21], r15b
je 0x140341c0c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140341c0c
call fcn.140332044
test eax, eax
jne 0x140341bf8
cmp byte [rbp - 0x21], r15b
je 0x140341bf1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140341c0c
cmp byte [rbp - 0x21], r15b
je 0x140341c09
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14031c308
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140341c38
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140341c3b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140341c49
mov rcx, rdi
call fcn.1403318b4
cmp byte [rbp + 0x3f], r15b
je 0x140341c58
mov rcx, qword [rbp + 0x27]
call fcn.1403318b4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140344bb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140344bd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140344bd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180027d40
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x68
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov edx, 0x83
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18008d6d0
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, 0xe4
xor ecx, ecx
call fcn.18003f9d0
mov rcx, qword [rsp + 0x48]
mov edx, 0x4d
mov ebx, dword [rax + 0x28]
cmp edx, 0x4d
cmove rcx, rdi
dec edx
cmp edx, 0x4b
ja 0x180027da0
mov qword [rsp + 0x48], rcx
lea rdx, str.dummy
lea rcx, [rsp + 0x84]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x50], rcx
lea r9, [rsp + 0x40]
movsxd rcx, dword [rsp + 0x80]
lea r8, [rsp + 0x50]
shl rcx, 4
add rcx, rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x30], rdx
mov edx, 0x11c
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.18003c680
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str._3d:
mov rcx, rax
call fcn.1800ba9c0
mov rbx, qword [rsp + 0x48]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rbx
mov ecx, PathYetAnotherMakeUniqueName
mov r8, rax
call fcn.18000d120
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1800418d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
imul esi, r8d, 0x25c
mov edi, r8d
mov r14, rcx
mov ebx, r8d
cmp r8d, esi
ja 0x18004191a
nop word [rax + rax]
cmp ebx, 3
je 0x18004194a
cmp ebx, 0x24
je 0x180041935
cmp ebx, 0x1c8
je 0x18004191a
cmp ebx, 0x1560
jne 0x18004194f
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
movsxd rcx, dword [r14]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x18004195d
mov qword [rsp + 0x20], rax
jmp 0x18004194f
mov byte [rsp + 0x20], 1
imul eax, edi, 0x97
add ebx, eax
cmp ebx, esi
jbe 0x180041900
jmp 0x18004191a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [r14]
lea rdx, str.vim.fault.MethodDisabled
mov rcx, rax
call fcn.1800ba9c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180043700
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea edi, [rdx - 7]
mov rsi, r8
mov r15, rcx
cmp edx, edi
jbe case.0x180043743.0
mov r14, qword [rsp + 0x68]
lea ebx, [rdx - 0x67]
lea rbp, [0x180000000]
cmp ebx, 0x11
ja case.0x180043743.4
mov ecx, dword [rbp + rbx*4 + 0x437bc]
add rcx, rbp
jmp rcx
mov qword [rsp + 0x68], r14
jmp case.0x180043743.4
mov qword [r14], rsi
jmp case.0x180043743.4
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], 8
mov edx, 0xa0
xor ecx, ecx
call fcn.18002c380
mov r14, rax
jmp case.0x180043743.4
mov edx, dword [r15]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec ebx
lea eax, [rbx + 0x67]
cmp eax, edi
ja 0x180043734
jmp case.0x180043743.0
mov rax, qword [rsi + 0x10]
jmp 0x1800437a3
mov dword [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180062cf0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x180106b38]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea r15d, [r9 + 0x1f4]
mov ebp, r9d
mov r14, rdx
cmp r9d, r15d
jae 0x180062ea8
mov esi, dword [rsp + 0x40]
xor r12d, r12d
nop dword [rax + rax]
mov eax, ebp
sub eax, 0x2a
je 0x180062e79
sub eax, 0x19
je 0x180062d70
sub eax, 7
je 0x180062e73
sub eax, 9
je 0x180062e79
cmp eax, 0x54
je 0x180062ea8
jmp 0x180062e65
mov rdi, r12
test r14, r14
jne 0x180062d88
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180062e60
mov ecx, 0x360
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180062da9
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180062e60
mov ebx, 0x24
nop
mov eax, ebx
sub eax, 0x24
je 0x180062e1b
cmp eax, 1
jne 0x180062e55
cmp esi, 0xffffffff
je 0x180062e0d
test sil, 0x10
je 0x180062e0d
lea rax, [rsp + 0x60]
sub rax, 2
cmp word [rax + 2], r12w
lea rax, [rax + 2]
jne 0x180062dd4
mov ecx, dword [0x1800efd1c]
lea rdx, [rdi + 8]
mov dword [rax], ecx
movzx ecx, word [0x1800efd20]
mov word [rax + 4], cx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rdi], rax
mov byte [rdi + 0x258], r12b
jmp 0x180062e55
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, r12
jmp 0x180062e55
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], 0x104
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov ecx, 0xd6
call fcn.18005fea0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
inc ebx
cmp ebx, 0x26
jb 0x180062db0
mov qword [rsp + 0x40], rdi
add ebp, 0x64
cmp ebp, r15d
jb 0x180062d40
jmp 0x180062ea8
mov rax, qword [r14 + 0x18]
jmp 0x180062ead
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xb5
call fcn.18004e110
mov eax, dword [rax]
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800bfc40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180074df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
imul eax, r9d, 0x743
mov r13d, r9d
mov rsi, rdx
mov r12, rcx
mov ebx, r9d
mov dword [rsp + 0x48], eax
cmp r9d, eax
ja 0x180074f7b
mov r14, qword [rsp + 0xd0]
lea r9, [0x180106c60]
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x50]
xor ecx, ecx
cmp ebx, 0x5340
ja 0x180074fbb
je 0x180074f98
cmp ebx, 0xf9
ja 0x180074f63
je 0x180074f5b
mov eax, ebx
sub eax, 0x32
je 0x180074edb
sub eax, 4
je 0x180074eb2
cmp eax, 0x5e
jne 0x180075046
xor r8d, r8d
mov dword [rsp + 0xc8], 8
lea rdx, [rsp + 0xc8]
lea ecx, [rax + 0x41]
call fcn.180038440
mov r8, qword [rsp + 0xc0]
lea r9, [0x180106c60]
mov r15, rax
jmp 0x180075046
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0xc0]
lea r9, [0x180106c60]
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x50], ecx
jmp 0x180075046
mov rax, qword [rsi + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
lea r8d, [r9 + 0x66]
call fcn.18004a1a0
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
mov rdi, rax
mov dword [rsp + 0x28], 0xa8
lea rax, [rsp + 0xc8]
mov byte [rsp + 0x40], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8, rsi
mov byte [rsp + 0xc8], 1
mov rcx, r12
call fcn.18007f7d0
mov rcx, qword [rsi + 0x38]
lea r9, [0x180106c60]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rcx + 8]
mov qword [rdx + 8], rdi
jmp 0x180075046
mov rbp, r12
jmp 0x180075046
cmp ebx, 0x128
je 0x18007505e
cmp ebx, 0x1e60
jne 0x180075046
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rsi], 0
je 0x180075046
cmp dword [r12], 0x1c
je 0x180075092
cmp dword [r14], 1
jne 0x1800750a0
jmp 0x180075046
cmp ebx, 0x11727
ja 0x18007502b
je 0x180074f7b
cmp ebx, 0x8c10
je 0x180074ff6
cmp ebx, 0xa5ec
je 0x180074fee
cmp ebx, 0xf898
jne 0x180075046
mov qword [r15 + 0x10], r12
mov eax, dword [r14]
mov dword [r15 + 0xc], eax
mov qword [r15 + 0x18], r8
jmp 0x180075046
mov eax, dword [rsi]
mov dword [r15 + 8], eax
jmp 0x180075046
cmp qword [r14], 0
jbe 0x180075023
nop dword [rax]
movzx eax, byte [rbp]
inc rbp
mov edx, dword [rsi]
xor rax, rdx
movzx ecx, al
shr edx, 8
mov eax, dword [r9 + rcx*4]
xor eax, edx
mov dword [rsi], eax
dec qword [r14]
cmp qword [r14], 0
ja 0x180075000
mov eax, dword [rsi]
mov dword [rsp + 0x50], eax
jmp 0x180075046
cmp ebx, 0x14b44
je 0x180075041
cmp ebx, 0x19df0
je 0x180074f7b
jmp 0x180075046
mov qword [rsp + 0x50], r15
imul eax, r13d, 0x8f
add ebx, eax
cmp ebx, dword [rsp + 0x48]
ja 0x180074f7b
jmp 0x180074e42
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x20], 0xb5
call fcn.18004e110
mov eax, dword [rax]
mov byte [rsp + 0x50], al
jmp 0x180074f7b
mov edx, 6
lea ecx, [rdx + 2]
call fcn.180027d40
int3
mov edx, 6
lea ecx, [rdx + 3]
call fcn.180027d40
int3