joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800264b8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
lea rdx, [0x18003a0b0]
mov ecx, 0x2d8
mov rdi, r8
call fcn.180030818
test ebx, ebx
jne 0x1800265e4
mov rcx, qword [rsi + 8]
lea eax, [rbx + 8]
mov r8d, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1800265e4
mov ecx, 0x7530
mov qword [rax], rdi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea ebp, [rdi + 1]
test edi, edi
je 0x18002652d
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbx]
mov rcx, qword [rsi + 8]
call fcn.18002865c
mov r8, qword [rbx]
test al, al
je 0x180026589
lea rdx, str.___s_NOT_deleted_with_SecureFileWipe_n
mov ecx, 0x2f8
call fcn.180030818
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, qword [rbx]
test eax, eax
jne 0x18002657b
lea rdx, str.___s_NOT_deleted_with_DeleteFileW_n
mov ecx, 0x300
call fcn.180030818
add edi, ebp
cmp edi, 0x3c
jl 0x18002651e
jmp 0x18002659a
lea rdx, str._s_deleted_with_DeleteFileW_n
mov ecx, 0x2fc
jmp 0x180026595
lea rdx, str._s_deleted_with_SecureFileWipe_n
mov ecx, 0x2f4
call fcn.180030818
mov rcx, qword [rsi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, str.SetEvent___DeleteFlag____n
mov ecx, 0x308
call fcn.180030818
xor eax, eax
lock cmpxchg dword [0x180044078], ebp
je 0x1800265d7
lea rdx, str.InterlockedCompareExchange_Error_n
mov ecx, 0x30b
call fcn.180030818
mov rcx, qword [0x180044028]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 3
add rsp, 0x20
pop rdi
ret
Function at 0x180027f94
Capabilities:
Reference public rsa key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, qword [0x180044070]
mov r12, rcx
mov rbp, r8
mov rcx, rbx
mov rsi, rdx
call fcn.1800289d4
test al, al
jne 0x180027fda
lea rdx, str.Compress_Error_n
mov ecx, 0x629
call fcn.180030818
xor al, al
jmp 0x1800280fe
mov rcx, qword [rbx]
mov edx, 8
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180027fd3
lea rdx, [0x1800389f0]
mov r8d, 0x14
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, [rdi + 0x14]
mov r8d, 0x80
mov rdx, r12
call qword [sym.imp.msvcrt.dll_memcpy]
mov r9, qword [rbx + 0x20]
mov r8d, dword [rbp]
mov rdx, qword [rsi]
and qword [rsp + 0x40], 0
and dword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.18002747c
mov rcx, qword [rbx]
xor edx, edx
mov r8, rdi
test eax, eax
je 0x18002807f
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, str.Error__n
mov ecx, 0x63e
jmp 0x180027fce
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12d, dword [rsp + 0x88]
mov r8, qword [rsi]
mov rcx, qword [rbx]
mov r9d, r12d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsi], rax
test rax, rax
je 0x180027fd3
mov rdi, qword [rsp + 0x40]
mov r8d, r12d
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_memcpy]
mov dword [rbp], r12d
test rdi, rdi
je 0x1800280da
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800280eb
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x64c
call fcn.180030818
lea rdx, [0x18003e810]
mov ecx, 0x64e
call fcn.180030818
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x180028338
Capabilities:
Reference public rsa key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, qword [0x180044070]
mov r12, rcx
mov rsi, r8
mov rcx, qword [rbx]
mov rbp, rdx
mov r8d, 0x94
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x18002837d
xor al, al
jmp 0x1800284bb
lea rdx, [0x1800389f0]
mov r8d, 0x14
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, [rdi + 0x14]
mov r8d, 0x80
mov rdx, r12
call qword [sym.imp.msvcrt.dll_memcpy]
mov r9, qword [rbx + 0x20]
mov r8d, dword [rsi]
mov rdx, qword [rbp]
and qword [rsp + 0x40], 0
and dword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.180027a74
test eax, eax
je 0x18002840b
lea rdx, str.Error__n
mov ecx, 0x709
call fcn.180030818
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180028376
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12d, dword [rsp + 0x88]
mov r8, qword [rbp]
mov rcx, qword [rbx]
mov r9d, r12d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp], rax
test rax, rax
je 0x180028376
mov rdi, qword [rsp + 0x40]
mov r8d, r12d
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_memcpy]
mov dword [rsi], r12d
test rdi, rdi
je 0x18002846f
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180028480
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x718
call fcn.180030818
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.180028bf0
test al, al
jne 0x1800284a8
lea rdx, str.Compress_Error_n
mov ecx, 0x71f
call fcn.180030818
jmp 0x180028376
lea rdx, [0x18003e810]
mov ecx, 0x725
call fcn.180030818
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x180028540
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [r11 - 0x38], 0
mov rax, rdx
mov r13, r9
mov r14, r8
mov r12, rcx
mov ebx, 3
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800285a4
lea eax, [rbx + 4]
jmp 0x18002863c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test eax, eax
jne 0x1800285ba
lea ebx, [rax + 7]
jmp 0x1800285d4
mov rcx, qword [r12]
mov r8, rbp
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800285df
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002863a
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x18002860d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 7
jmp 0x18002862b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, r14
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], r13
call fcn.180027948
mov ebx, eax
mov rcx, qword [r12]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x18002865c
Capabilities:
Delete file
Get common file path
Get file size
Move file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
or dword [rax - 0x34], 0xffffffff
mov rdi, rdx
xor ebx, ebx
mov qword [rax - 0x48], rbx
mov rbp, rcx
mov dword [rax - 0x50], 0x80
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rax - 0x58], 3
mov dword [rax - 0x38], ebx
mov dword [rax - 0x30], 0x55555555
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002880c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, ebx
mov r14d, eax
mov r13d, ebx
test r14d, r14d
je 0x18002871b
mov eax, r12d
lea r15, [rsp + rax*4 + 0x40]
lea r9, [rsp + 0x90]
mov r8d, 4
mov rdx, r15
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180028712
cmp dword [rsp + 0x90], ebx
je 0x1800287f1
add r13d, 4
cmp r13d, r14d
jb 0x1800286e2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
test eax, eax
je 0x1800287fd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1800287fa
inc r12d
cmp r12d, 3
jb 0x1800286d2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r13d, 8
mov rcx, rbp
mov rsi, rax
mov edx, r13d
sub rsi, rdi
sar rsi, 1
inc esi
lea r8d, [rsi + 1]
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x180028803
mov r8d, esi
mov rdx, rdi
mov rcx, rax
add r8, r8
call qword [sym.imp.msvcrt.dll_memcpy]
mov r8d, 0x800
mov edx, r13d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180028803
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor edx, edx
mov rcx, rbp
test eax, eax
jne 0x18002882c
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, r12
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180028803
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
test eax, eax
jne 0x18002885b
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18002880c
mov rdx, rsi
call qword [sym.imp.msvcrt.dll__wrename]
test eax, eax
je 0x18002886d
mov rcx, rdi
jmp 0x180028845
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18002887c
mov bl, 1
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
jmp 0x18002880e
Function at 0x18002a6c8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov edi, dword [rcx + 0x6c]
mov rsi, qword [rcx + 0x38]
mov r12, qword [rcx + 0x28]
mov ebp, dword [rcx + 0x290]
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov r15d, 1
cmp edi, 0x2710
jl 0x18002a7da
lea eax, [rdi + 0x22]
test r15b, al
je 0x18002a712
add eax, r15d
movsxd r8, eax
mov eax, 0x64
mov r9, r12
add r8, qword [rbx + 0x40]
cmp ecx, r15d
cmovl ecx, r15d
cmp ecx, eax
cmovg ecx, eax
mov eax, 0x55555556
dec ecx
imul ecx
lea rax, [rsp + 0x70]
mov rcx, rsi
mov r13d, edx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
shr r13d, 0x1f
mov dword [rsp + 0x20], edi
add r13d, edx
mov rdx, qword [rbx + 0x40]
imul r13d, edi
mov dword [rsp + 0x70], r13d
call fcn.180029f1c
cmp ebp, 3
jl 0x18002a7b6
sub r13d, dword [rsp + 0x70]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov eax, edi
test edi, edi
lea rdx, str._______d_work___d_block__ratio__5.2f_n
mov r9d, edi
movd xmm1, r13d
cmove eax, r15d
add rcx, 0x60
mov r8d, r13d
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
unpcklps xmm1, xmm1
cvtps2pd xmm1, xmm1
movsd qword [rsp + 0x20], xmm1
call qword [sym.imp.msvcrt.dll_fprintf]
cmp dword [rsp + 0x70], 0
jge 0x18002a7f1
cmp ebp, 2
jl 0x18002a7da
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.____too_repetitive__using_fallback_sorting_algorithm_n
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov r9d, edi
mov r8, r12
mov dword [rsp + 0x20], ebp
call fcn.180029044
or dword [rbx + 0x30], 0xffffffff
xor eax, eax
cmp dword [rbx + 0x6c], eax
jle 0x18002a812
cmp dword [rsi], 0
je 0x18002a80f
add eax, r15d
add rsi, 4
cmp eax, dword [rbx + 0x6c]
jl 0x18002a7fc
jmp 0x18002a812
mov dword [rbx + 0x30], eax
cmp dword [rbx + 0x30], 0xffffffff
jne 0x18002a824
mov ecx, 3
call qword [sym.imp.msvcrt.dll_exit]
int3
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18002aa0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dl, byte [rcx + 0x5c]
xor r10d, r10d
mov r8, rcx
cmp dword [rcx + 0x60], r10d
jle 0x18002aa59
mov r9d, dword [rcx + 0x288]
movzx r11d, dl
mov ecx, r9d
mov eax, r9d
lea rbx, [0x180043b30]
shr rcx, 0x18
shl eax, 8
inc r10d
xor rcx, r11
mov r9d, dword [rbx + rcx*4]
xor r9d, eax
mov dword [r8 + 0x288], r9d
cmp r10d, dword [r8 + 0x60]
jl 0x18002aa2b
mov eax, dword [r8 + 0x5c]
mov byte [rax + r8 + 0x80], 1
mov ecx, dword [r8 + 0x60]
dec ecx
je 0x18002aae3
dec ecx
je 0x18002aad4
dec ecx
je 0x18002aac5
movsxd rax, dword [r8 + 0x60]
mov byte [rax + r8 + 0x7c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
mov dl, byte [r8 + 0x60]
inc dword [r8 + 0x6c]
sub dl, 4
jmp 0x18002aae3
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov rbx, qword [rsp + 8]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
ret
Function at 0x18003042c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x92a8]
mov eax, 0x9370
call fcn.180037620
sub rsp, rax
mov r14d, edx
mov r15, rcx
mov edi, 8
lea rdx, [0x1800389e8]
lea rcx, [rsp + 0x30]
mov r8d, edi
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, [rbp + 0x260]
xor edx, edx
mov r8d, 0x9010
call qword [sym.imp.msvcrt.dll_memset]
lea rcx, [rbp + 0x260]
call fcn.180005680
lea r8d, [rdi + 0x10]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x260]
call fcn.180006bd8
mov r11d, r14d
mov ebx, edi
and r11d, 7
je 0x1800304be
sub ebx, r11d
mov rcx, qword [0x1800432f0]
lea r13d, [rbx + r14]
mov edx, edi
lea r8, [r13 + 0x1a]
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1800305b8
mov eax, 0xf18b
sub ax, r13w
xor ecx, ecx
mov word [rdi], ax
lea rax, [0x1800389d0]
mov al, byte [rcx + rax]
inc rcx
xor al, byte [rsp + rcx + 0x37]
mov byte [rdi + rcx + 1], al
cmp rcx, 0x18
jl 0x1800304f2
lea r12, [rdi + 0x1a]
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [sym.imp.msvcrt.dll_memcpy]
test ebx, ebx
je 0x180030535
lea rax, [r13 + rdi + 0x19]
mov ecx, ebx
mov byte [rax], bl
dec rax
dec rcx
jne 0x18003052b
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xd4]
call fcn.180004f54
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x180
call qword [sym.imp.msvcrt.dll_memset]
test sil, 7
jne 0x1800305a6
lea r9, [rsp + 0x30]
lea rcx, [rbp + 0xd0]
mov r8, rsi
mov edx, 1
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.180005554
test eax, eax
jne 0x1800305a6
mov rcx, qword [rbp + 0x92c0]
mov rdx, qword [rbp + 0x92c8]
mov al, 1
mov qword [rcx], rdi
lea ecx, [r13 + 0x1a]
mov dword [rdx], ecx
jmp 0x1800305ba
mov rcx, qword [0x1800432f0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
mov rbx, qword [rsp + 0x93b0]
add rsp, 0x9370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800305d8
Capabilities:
Get common file path
Get file size
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
mov rcx, qword [0x1800432f0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
jne 0x18003060e
call fcn.1800303d8
test al, al
jne 0x18003060e
or eax, 0xffffffff
jmp 0x180030809
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strlen]
mov rcx, qword [0x1800432f0]
mov edi, 0x400
mov ebx, 8
mov r8d, edi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180030606
mov rcx, qword [0x1800432f0]
mov r8d, edi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180030606
lea rcx, str.TEMP
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x180030606
lea rdx, [rsp + 0x88]
mov r9, rsi
mov r8d, 0x1a6b
mov rcx, rbx
mov dword [rsp + 0x88], 0x46447e
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
or rbx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rbx
jne 0x1800306e0
mov rcx, qword [0x1800432f0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
jmp 0x180030809
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x100000
jbe 0x180030731
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1800306d9
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, rbx
je 0x1800306c7
mov rcx, qword [0x1800432f0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rsp + 0x80], 0
and qword [rsp + 0x40], 0
and dword [rsp + 0x78], 0
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strlen]
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rbp
call fcn.18003042c
mov rcx, rdi
test al, al
jne 0x18003079a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800306d9
mov rsi, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x78]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800307db
test rsi, rsi
je 0x1800307d6
mov rcx, qword [0x1800432f0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
jmp 0x18003078f
test rsi, rsi
je 0x1800307f2
mov rcx, qword [0x1800432f0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x80]
test eax, eax
cmove ecx, ebx
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003181c
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
mov rbp, rsp
sub rsp, 0x50
and dword [rbp + 0x40], 0
and dword [rbp + 0x38], 0
mov r12, rdx
mov rdi, rcx
test rdx, rdx
jne 0x180031844
xor eax, eax
jmp 0x1800319b0
lea rax, [rbp + 0x48]
lea r9, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x18003183d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbp + 0x48]
mov r9d, dword [rbp + 0x38]
mov r8d, dword [rbp + 0x40]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._d__d__d__d_n
mov ecx, 0x1c1
mov ebx, eax
call fcn.180030818
cmp ebx, 0x7a
jne 0x18003183d
mov r8d, dword [rbp + 0x40]
lea esi, [rbx - 0x72]
mov rcx, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18003183d
mov r8d, dword [rbp + 0x38]
mov edx, esi
mov rcx, rdi
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rbx
mov rsi, rax
test rax, rax
jne 0x1800318e7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003183d
lea rax, [rbp + 0x48]
lea r9, [rbp + 0x40]
mov rdx, r12
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
xor edx, edx
mov rcx, rdi
test eax, eax
jne 0x180031924
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rsi
jmp 0x1800318d7
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rbp + 0x48], 1
je 0x180031938
mov r8, rbx
jmp 0x1800318d7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x18003199c
lea rdx, str.ConvertSidToStringSidW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180031993
and qword [rbp - 0x10], 0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call rax
test eax, eax
je 0x180031993
mov r8, qword [rbp - 0x10]
lea rdx, [0x18003a400]
mov ecx, 0x1e7
call fcn.180030818
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [0x18003a0b0]
mov ecx, 0x1ef
call fcn.180030818
mov rax, rbx
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18003646c
Capabilities:
Get thread local storage value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x40], 0
mov ebx, edx
mov edx, 1
mov eax, edx
mov rdi, r8
lock cmpxchg dword [rcx + 0x80], edx
jne 0x180036495
xor eax, eax
jmp 0x1800364cc
mov ecx, dword [rcx + 0x7c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180036491
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180036491
cmp dword [rsp + 0x40], ebx
cmovb ebx, dword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800364d8
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
and dword [rsp + 0x60], 0
mov rdi, rcx
mov r15d, 0x200
mov ecx, 1
mov r12, rdx
mov r13d, r15d
mov eax, ecx
lock cmpxchg dword [rdi + 0x80], ecx
jne 0x18003651a
xor eax, eax
jmp 0x1800365bc
mov ecx, dword [rdi + 0x7c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x180036513
mov rcx, qword [rdi + 0x20]
mov r8, r15
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180036513
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, r15d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [rsp + 0x60]
jmp 0x1800365b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1800365e9
mov rcx, qword [rdi + 0x20]
add r13d, r15d
mov r8, rbx
mov r9d, r13d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rbx, rax
test rax, rax
je 0x1800365d3
and qword [rsp + 0x20], 0
mov edx, ebp
lea r9, [rsp + 0x60]
add rdx, rax
mov r8d, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
add ebp, dword [rsp + 0x60]
test eax, eax
je 0x180036565
mov qword [r12], rbx
mov eax, ebp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x17a
lea rdx, str._HeapFree__NULL_n
call fcn.180030818
jmp 0x180036513
test rbx, rbx
je 0x180036602
mov rcx, qword [rdi + 0x20]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180036513
mov ecx, 0x180
jmp 0x1800365d8

Function at 0x18003660c
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov rbx, rcx
je 0x180036646
mov ecx, dword [rcx + 0x7c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180036646
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lock dec dword [rbx + 0x78]
jne 0x180036646
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_SetEvent]
add rsp, 0x20
pop rbx
ret