joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088470
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x1400884b8
xor eax, eax
jmp 0x140088622
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x40], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.14010da60
nop
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x40]
call fcn.1400c9bc0
lea rdi, [rsp + 0x40]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str.ra.dll]
mov dword [rdi - 1], eax
movzx eax, word [0x14022029c]
mov word [rdi + 3], ax
movzx eax, byte [0x14022029e]
mov byte [rdi + 5], al
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov ecx, 0x1395
call fcn.140087140
test eax, eax
jne 0x14008853b
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400d67e0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400885be
lea rdx, str.IAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400885be
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x28]
mov edx, 1
mov ecx, 0x15e3249c
call rsi
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
je 0x1400885be
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rdx, qword [r12 + 0xb0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov ebx, eax
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x28]
xor edx, edx
mov ecx, 0x15e3249c
call rsi
nop
jmp 0x1400885c9
test rdi, rdi
je 0x1400885d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rsp + 0x40], 0
je 0x14008861a
lea rcx, [rsp + 0x40]
call fcn.1400d0090
test eax, eax
je 0x14008861a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140088607
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400d67e0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
call fcn.14010da60
nop
jmp 0x140088620
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140088650
Capabilities:
Delete file
Get common file path
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x290
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, ecx
xor esi, esi
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str._is_d
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_wsprintfA]
mov byte [rsp + 0x60], sil
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call fcn.14010da60
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1400886ec
movzx eax, word [0x1402202c8]
mov word [rsp + 0x60], ax
movzx eax, byte [0x1402202ca]
mov byte [rsp + 0x62], al
lea rcx, [rsp + 0x60]
call fcn.1400c9bc0
lea rdi, [rsp + 0x60]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x170]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140088710
lea rdi, [rsp + 0x60]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [0x1401ebcb8]
mov dword [rdi - 1], eax
movzx eax, byte [0x1401ebcbc]
mov byte [rdi + 3], al
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.140087140
lea rcx, [rsp + 0x60]
call fcn.1400d0090
test eax, eax
je 0x1400887ea
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400887ea
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea ecx, [rax + 1]
mov edi, ecx
call fcn.14010a204
mov rsi, rax
mov qword [rsp + 0x40], rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.14010da60
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rax, rsi
jmp 0x140088800
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14008c860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14008c90f
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.14010c9b0
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x14008c8e0
sub eax, ebx
jmp 0x14008c8e2
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x14008c8d0
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x14008c904
sub eax, ebx
jmp 0x14008c906
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x14008c8f4
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x14008c989
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.14008c480
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x14008c973
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14008c989
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x14008c880
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140094060
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rdi
mov dword [rdx], 0x12345678
mov dword [rdx + 4], 0x23456789
mov dword [rdx + 8], 0x34567890
movzx eax, byte [r8]
mov r10, r8
mov r9, rdx
mov rdi, rcx
test al, al
je 0x140094101
mov r11d, dword [rdx + 4]
mov qword [rsp + 0x10], rbx
mov ebx, 0x34567890
nop word [rax + rax]
mov r8d, dword [r9]
inc r10
mov ecx, r8d
shr r8d, 8
xor rcx, rax
mov rax, qword [rdi + 8]
movzx edx, cl
mov ecx, dword [rax + rdx*4]
xor ecx, r8d
movzx eax, cl
mov dword [r9], ecx
mov ecx, ebx
add r11d, eax
shr ecx, 8
imul r11d, r11d, 0x8088405
inc r11d
mov dword [r9 + 4], r11d
mov eax, r11d
shr eax, 0x18
xor rax, rbx
movzx edx, al
mov rax, qword [rdi + 8]
mov eax, dword [rax + rdx*4]
xor eax, ecx
mov ebx, eax
mov dword [r9 + 8], eax
movzx eax, byte [r10]
test al, al
jne 0x1400940a0
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x140095bb0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov r12, rdx
mov ebx, 1
xor r14d, r14d
mov qword [rax - 0x38], r14
mov dword [rax - 0x40], r14d
mov dword [rax - 0x48], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov dword [r12], 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x140095c8a
mov edi, r14d
mov dword [rsp + 0x80], r14d
mov ecx, 0x1fffe
call fcn.1400854f0
mov rsi, rax
cmp edi, dword [rsp + 0x80]
jne 0x140095c77
mov edi, 0x1fffe
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140095c5d
mov ebx, r14d
mov dword [rsp + 0x40], ebx
jmp 0x140095c77
mov r8d, dword [rsp + 0x80]
mov rdx, rsi
mov ecx, dword [r12]
call fcn.140090280
mov dword [r12], eax
jmp 0x140095c26
mov rcx, rsi
call fcn.140085540
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140095c91
mov ebx, r14d
mov dword [rsp + 0x40], ebx
mov eax, ebx
jmp 0x140095c99
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop r12
ret

Function at 0x140096210
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
lea rax, [r11 + 0x20]
mov rbx, r8
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140096276
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x140096280
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, qword [rsp + 0x4b0]
test r8, r8
mov rdi, r9
mov rbx, rcx
lea r9, [0x14024d112]
lea rcx, [0x1401eb638]
mov rax, r9
cmovne r9, rcx
lea rcx, [rsp + 0x60]
cmovne rax, r8
mov r8, rdx
lea rdx, str._s_s_s
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor r11d, r11d
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r11
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14009635f
test rdi, rdi
je 0x14009634d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
inc eax
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140096361
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x470
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400965d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rsi, r9
mov r12, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x1400966e7
test rdx, rdx
je 0x1400966e7
test r9, r9
je 0x1400966e7
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x40], dil
call fcn.14010da60
lea rdx, [rsp + 0x40]
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x140096640
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400966e7
mov eax, dword [rsp + 0x4a8]
mov dword [rsp + 0x30], edi
dec eax
je 0x140096691
sub eax, 3
je 0x1400966dd
cmp eax, 3
jne 0x14009669c
mov eax, dword [rsp + 0x4a0]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x4a8]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, 1
test eax, eax
cmove edi, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1400966e9
mov dword [rsp + 0x30], 4
jmp 0x14009669c
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400974c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov r13, rdx
or r12, 0xffffffffffffffff
mov qword [rax - 0x60], r12
xor r15d, r15d
mov esi, r15d
mov qword [rax - 0x58], r15
mov r14d, r15d
mov qword [rax - 0x50], r15
test rdx, rdx
je 0x140097733
cmp byte [rdx], sil
je 0x140097733
lea rcx, [0x1402c1dc0]
call fcn.1400a3cb0
nop
lea rdx, [0x1402c1dc0]
lea rcx, [rsp + 0x68]
call fcn.1400a3d50
nop
lea rcx, [rsp + 0x68]
call fcn.1400a45d0
mov r11, rax
test rax, rax
je 0x140097573
mov r8, r13
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140097563
inc rax
test ecx, ecx
jne 0x140097550
test edx, edx
jne 0x140097571
mov rsi, r11
mov qword [rsp + 0x50], r11
jmp 0x140097573
jmp 0x140097531
test rsi, rsi
jne 0x1400976dd
mov ebx, r15d
mov dword [rsp + 0x40], ebx
cmp ebx, 0x32
jge 0x1400975d6
cmp r12, 0xffffffffffffffff
jne 0x1400975e0
test ebx, ebx
jle 0x14009759d
lea ecx, [r12 + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r13
call fcn.140095fd0
mov r12, rax
mov qword [rsp + 0x48], rax
jmp 0x140097583
cmp r12, 0xffffffffffffffff
je 0x1400976dd
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rax + 1]
mov ebx, ecx
call fcn.14010a204
mov r14, rax
mov qword [rsp + 0x58], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14010da60
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xb8]
mov r8d, edi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400976cb
mov ecx, 0x118
call fcn.1400854f0
mov rsi, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x140097679
mov rax, qword [0x1402b9cc8]
mov qword [rsi + 0x108], rax
mov rax, qword [0x1402b9cc8]
mov qword [rsi + 0x110], rax
jmp 0x14009767c
mov rsi, r15
mov qword [rsp + 0x50], rsi
mov r8d, 0x103
mov rdx, r13
mov rcx, rsi
call fcn.14010d5f0
lea rcx, [rsi + 0x108]
mov rdx, r14
call fcn.1400ca6a0
mov rdx, r14
lea rcx, [rsi + 0x110]
call fcn.1400ca6a0
lea rcx, [rsi + 0x110]
call fcn.1400cacc0
mov rdx, rsi
lea rcx, [0x1402c1dc0]
call fcn.1400a3e60
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x68]
call fcn.1400a3d70
nop
jmp 0x1400976f9
test r14, r14
je 0x140097707
mov rcx, r14
call fcn.14010d304
nop
jmp 0x140097713
lea rcx, [0x1402c1dc0]
call fcn.1400a3cd0
cmp r12, 0xffffffffffffffff
je 0x14009772e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x140097735
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140098100
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r13d, edx
mov r12, rcx
xor esi, esi
mov dword [rax - 0x38], esi
or rdi, 0xffffffffffffffff
mov qword [rax - 0x28], rdi
lea rcx, [0x1402c1dc0]
call fcn.1400a3cb0
nop
mov ebx, esi
mov dword [rsp + 0x44], ebx
cmp ebx, 0x32
jge 0x140098193
cmp rdi, 0xffffffffffffffff
jne 0x14009819d
test ebx, ebx
jle 0x14009815b
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call fcn.140095fd0
mov rdi, rax
mov qword [rsp + 0x50], rax
jmp 0x140098143
cmp rdi, 0xffffffffffffffff
je 0x140098235
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, esi
mov dword [rsp + 0x48], ebx
cmp ebx, 0xa
jae 0x14009820d
mov rdx, qword [r12 + 0x108]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x90]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400981fe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, 1
mov dword [rsp + 0x40], esi
jmp 0x14009820d
mov ecx, SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x1400981b0
test r13d, r13d
je 0x14009821b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov rcx, r12
call fcn.1400a8590
xor edx, edx
mov r8d, 0x104
mov rcx, r12
call fcn.14010da60
lea rcx, [r12 + 0x108]
call fcn.1400cba60
lea rcx, [r12 + 0x110]
call fcn.1400cba60
lea rcx, [0x1402c1dc0]
call fcn.1400a41d0
mov rbx, rax
nop
test rbx, rbx
je 0x1400982ba
mov rdx, rbx
lea rcx, [0x1402c1dc0]
call fcn.1400a41e0
mov r13, rax
mov rcx, rbx
call fcn.1400a39b0
test rax, rax
je 0x1400982b5
mov rcx, rbx
call fcn.1400a39b0
cmp r12, rax
jne 0x1400982b5
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1402c1dc0]
call fcn.1400a40a0
jmp 0x1400982ba
mov rbx, r13
jmp 0x140098270
mov qword [rsp + 0x90], r12
test r12, r12
je 0x1400982eb
lea rcx, [r12 + 0x110]
call fcn.1400ca400
nop
lea rcx, [r12 + 0x108]
call fcn.1400ca400
mov rcx, r12
call fcn.140085540
nop
jmp 0x1400982f6
lea rcx, [0x1402c1dc0]
call fcn.1400a3cd0
cmp rdi, 0xffffffffffffffff
je 0x140098311
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400a3bb0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1400a3c31
mov edx, 8
lea r8d, [rdx + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x1400a3c12
lea rcx, str.____DataEvent::_Failed_to_allocate_memory_n_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [rsp + 0x40], 1
lea rdx, [0x1402b3298]
lea rcx, [rsp + 0x40]
call fcn.14010ce2c
int3
mov qword [rax + 8], rbx
mov qword [rsp + 0x50], rax
lea rdx, [0x140226e08]
mov qword [rax], rdx
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
jmp 0x1400a3c77
mov ecx, 0x20
call fcn.1400854f0
test rax, rax
jne 0x1400a3c5a
mov dword [rsp + 0x40], 1
lea rdx, [0x1402b3298]
lea rcx, [rsp + 0x40]
call fcn.14010ce2c
int3
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rdx, [0x140226e08]
mov qword [rax], rdx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a6860
Capabilities:
Delete file
Move file

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r12, rcx
mov qword [rsp + 0x28], rcx
add rcx, 0x278
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor ecx, ecx
call fcn.14010d57c
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.140110e40
mov r9, rax
lea r8, [r12 + 0x6c]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1401148dc
mov edx, 0x2e
lea rcx, [rsp + 0x40]
call fcn.14010db4c
mov rsi, rax
test rax, rax
jne 0x1400a6900
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rsi, [rsp + rcx + 0x3f]
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
inc ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x150]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1400a6920
lea rcx, [rsp + 0x40]
mov rax, rsi
sub rax, rcx
lea rcx, [rsp + rax + 0x150]
mov r8d, ebx
lea rdx, str._02d
call fcn.14010e580
lea rdi, [rsp + 0x150]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x1400a6970
cmp ebx, 0x63
jl 0x1400a69b8
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x150]
lea rcx, [r12 + 0x170]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [r12 + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1400a69d6
lea rcx, [r12 + 0x170]
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x1400a6906
jmp 0x1400a69dd
lea rcx, [r12 + 0x278]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400a6f60
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x278
mov rbp, r9
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x2a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rdx, [0x140227d98]
test rdi, rdi
lea rcx, [rsi + 0x2d8]
mov r8d, 0x10
cmovne rdx, rdi
call fcn.1400c9950
xor eax, eax
lea rdx, [rsp + 0x30]
mov qword [rsi + 0x2e8], rax
mov qword [rsi + 0x2f0], rax
mov qword [rsi + 0x2f8], rax
mov qword [rsi + 0x300], rax
mov qword [rsi + 0x308], rax
mov qword [rsi + 0x310], rax
lea rcx, [rsi + 0x2e8]
mov word [rsi + 0x318], ax
mov dword [rsp + 0x30], 0x32
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400a7022
lea r8d, [rax + 0x10]
lea rdx, [0x140227da0]
lea rcx, [rsi + 0x2e8]
call fcn.1400c9950
call fcn.1400a6640
lea rcx, [rsi + 0x31c]
call fcn.1400d0270
test eax, eax
jne 0x1400a7041
mov dword [rsi + 0x31c], 0xffffffff
test rbx, rbx
jne 0x1400a70cd
lea rdx, [rsi + 0x170]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [rbx + 0x2e]
lea rcx, [rsi + 0x170]
call fcn.14010dc54
test rax, rax
je 0x1400a70a5
mov byte [rax], bl
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsi + 0x170]
repne scasb al, byte [rdi]
mov eax, dword [0x14021fa90]
lea rcx, [rsi + 0x170]
mov dword [rdi - 1], eax
movzx eax, byte [0x14021fa94]
mov byte [rdi + 3], al
call fcn.14011318c
jmp 0x1400a70f1
mov rax, qword [str.default.log]
lea rcx, [rsi + 0x170]
mov qword [rsi + 0x170], rax
mov eax, dword [0x140227f98]
mov dword [rsi + 0x178], eax
call fcn.14011318c
jmp 0x1400a70f1
mov rcx, rsi
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx + 0x16f], al
test al, al
jne 0x1400a70e0
call fcn.1400a6a40
xor edx, edx
lea rcx, [rsi + 0x6c]
mov r8d, 0x104
mov dword [rsi + 0x58], edx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x20], rdx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rdx
mov dword [rsi + 0x5c], 1
mov qword [rsi + 0x2d0], rbp
mov qword [rsi + 0x2c8], 0x500000
mov qword [rsi + 0x60], 1
mov dword [rsi + 0x68], edx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.14010da60