joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec5a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x1400ec5b3
cmp dword [0x1401993c8], ecx
jle 0x1400ec5ba
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.1400ec600
test edi, edi
je 0x1400ec5b3
cmp byte [rdi + rsi - 1], 0xa
je 0x1400ec5b3
lea rcx, [0x14015c194]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400ec600

Function at 0x1400ec600
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400ec64e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1400ec68c
cmp rdi, rsi
jae 0x1400ec68c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1400ec647
jmp 0x1400ec644
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a2770
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14010a7d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14010a841
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14010a84b
mov dil, 1
test bl, bl
je 0x14010a82a
cmp byte [rsi + 8], 0
je 0x14010a846
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a2770
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x14010a7fd
mov rcx, qword [rsi]
jmp 0x14010a81f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x14010a873
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14010a878
xor edi, edi
jmp 0x14010a82a
mov rcx, qword [rsi]
jmp 0x14010a860
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x14010a89f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x14010a82a
mov rcx, qword [rsi]
jmp 0x14010a88f
Function at 0x14010abf0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x140158be0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x217
call fcn.140045910
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14004b480
mov al, byte [rsi + 0x17]
test al, al
jns 0x14010ac7c
cmp qword [rsi + 8], 0x103
ja 0x14010ac9a
test al, al
jns 0x14010ac83
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14004b4e0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400a2770
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14010f160
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010f190
cmp rbx, 2
jb 0x14010f278
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x1401646c0]
movdqa xmm7, xmmword [0x1401646d0]
movdqa xmm8, xmmword [0x1401646e0]
movdqa xmm9, xmmword [0x1401646f0]
mov rcx, rsi
call fcn.1401202d0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x14010f1ee
mov rcx, rsi
call fcn.1401207c0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010f24c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x14010f1e4
mov rcx, rsi
call fcn.1401202d0
xor eax, eax
movdqa xmm0, xmmword [0x1401646c0]
movdqa xmm1, xmmword [0x1401646d0]
movdqa xmm2, xmmword [0x1401646e0]
movdqa xmm3, xmmword [0x1401646f0]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x14010f2a2
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010f2fd
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14011c2f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x14011c34f
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011c36b
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x14011c395
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011c3b6
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x14011c3d8
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x14011c3fe
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x14011c3fc
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
and r15d, 1
add r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400a48c0
mov r8, r12
xor r8, r15
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.140118c70
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x14011c43a
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140158be0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov eax, dword [rdi + 0x148]
test eax, eax
jle 0x14011c50b
xor ecx, ecx
xor edx, edx
or rdx, qword [rsi + rcx*8]
inc rcx
cmp rax, rcx
jne 0x14011c4a6
test rdx, rdx
sete dl
test rax, rax
je 0x14011c55c
movsxd rcx, eax
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x14011c4e0
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x14011c4e0
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
mov ecx, eax
test rax, rax
jle 0x14011c52a
xor r8d, r8d
jmp 0x14011c51f
mov dl, 1
jmp 0x14011c4b8
xor r9d, r9d
mov qword [rsp + r8*8 + 0x30], r9
inc r8
cmp rcx, r8
je 0x14011c52a
test dl, dl
jne 0x14011c50f
mov r9, qword [rsp + r8*8 + 0x30]
jmp 0x14011c512
test rcx, rcx
je 0x14011c55c
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x14011c53e
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a2770
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14011d4e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x140158be0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
je 0x14011d548
xor edi, edi
cmp r9, 0x30
ja 0x14011d56a
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x14011d538
mov r8d, 0x30
mov rcx, rsi
call fcn.1400756d0
test eax, eax
je 0x14011d580
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a2770
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x14011d56a
Function at 0x14014c68f
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14014c6ce
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14014c69e
mov dword [rsi], 7
jmp 0x14014c69e
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14009b441
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14014c6aa
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14014c6aa
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x14014c780
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x14014c6a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14014c69e
Function at 0x14000a854
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400ea3e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, 1
mov rdi, qword [0x1400f83c0]
mov rax, qword [0x1400f83c8]
jmp 0x14000a914
test ebx, ebx
js 0x14000aa32
mov rsi, qword [rdi]
test rsi, rsi
je 0x14000a910
and qword [rsp + 0x30], 0
cmp qword [rsi + 0x10], 0
jne 0x14000a8ab
xor ebx, ebx
jmp 0x14000a910
lea r8, [rsp + 0x30]
lea rdx, [0x1400b9b78]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x10]
call qword [case.0x14006f533.0]
mov ebx, eax
test eax, eax
js 0x14000a8f2
mov rax, qword [rsi + 0x20]
add rax, 8
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8d, [r9 - 1]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000a909
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006f533.0]
mov rax, qword [0x1400f83c8]
add rdi, 8
cmp rdi, rax
jb 0x14000a88a
test ebx, ebx
js 0x14000aa32
jne 0x14000aa2b
cmp byte [0x1400f7480], 0
je 0x14000a9d8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400f7470], rax
test rax, rax
je 0x14000a9d1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r9, [0x1400f7420]
lea r8, [0x14000b3d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000a997
mov rcx, qword [0x1400f7470]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x1400f7470], rdi
test rdi, rdi
je 0x14000a9d1
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x14000a9c6
mov rcx, qword [0x1400f7470]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [0x1400f7478]
add edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a9e0
mov ebx, 0x80004005
jmp 0x14000a9e4
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test ebx, ebx
jns 0x14000aa32
xor eax, eax
mov rdi, qword [0x1400f83c0]
mov rcx, qword [0x1400f83c8]
jmp 0x14000aa24
test eax, eax
jne 0x14000aa32
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000aa20
mov rax, qword [rdx + 0x20]
mov edx, dword [rax + 8]
test edx, edx
jne 0x14000aa11
xor eax, eax
jmp 0x14000aa20
mov ecx, edx
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rcx, qword [0x1400f83c8]
add rdi, 8
cmp rdi, rcx
jb 0x14000a9f6
jmp 0x14000aa32
mov byte [0x1400f7480], 0
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009bdf0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14002fd20
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1400ea3e8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
xor r14d, r14d
mov qword [rbp - 0x19], r14
movdqa xmm0, xmmword [0x1400c4730]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], r14w
call fcn.14006c148
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0xc0]
mov qword [rbp + 7], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
lea r8d, [r14 + 8]
lea rdx, [0x1400be9e8]
lea rcx, [rbp + 7]
call fcn.140012ba4
nop
mov qword [rbp - 0x39], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
lea r8d, [r14 + 0x2d]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp - 0x39]
call fcn.140012ba4
nop
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r14b
lea r9, [rbp + 7]
lea r8, [rbp - 0x39]
mov rdx, 0xffffffff80000001
mov rcx, rdi
mov rax, rbx
call qword [case.0x14006f533.0]
mov ebx, eax
lea rcx, [rbp - 0x39]
call fcn.140009ca4
nop
lea rcx, [rbp + 7]
call fcn.140009ca4
test ebx, ebx
js 0x14002fe1b
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
mov r8b, 1
lea rdx, [0x1400be9e8]
call fcn.140068bc4
test al, al
jne 0x14002fe78
mov eax, 2
mov dword [rsi], eax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x165ef449
lea rax, [0x1400be0b8]
mov qword [rsp + 0x20], rax
lea r9, str.OneDriveCOMAPIKFMUtil::CheckOneDriveRunsOnStartup
mov r8d, 0x47
lea rdx, str.D:dbs_shodct1130_230136_1cmdcclientonedriveProductFileCoAuthSharedOneDriveCOMAPIKFMUtil.cpp
lea rcx, [rbp + 7]
call qword [sym.imp.LoggingPlatform.DLL_public:_void___cdecl_StructuredEvent::constructor_char_const____ptr64__int__char_const____ptr64__struct__GUID_const____ptr64__unsigned_int__unsigned_int__unsigned_int__unsigned_int____ptr64]
xor edx, edx
lea rcx, [rbp + 7]
call qword [sym.imp.LoggingPlatform.DLL_void___cdecl_LoggingWriteStructuredEvent_struct_StructuredEvent_const____ptr64__struct_StructuredEventParameter__const___ptr64_]
call qword [sym.imp.LoggingPlatform.DLL_void___cdecl_LoggingRotateIfNeeded_void_]
nop
lea rcx, [rbp - 0x19]
call fcn.140009ca4
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14009bdf0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003ee6c
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400ea3e8]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp qword [r8 + 0x18], 8
mov rdi, r8
mov rsi, rdx
mov rax, r8
jb 0x14003ee96
mov rax, qword [r8]
xor ebx, ebx
mov qword [r8 + 0x10], rbx
mov word [rax], bx
mov rax, qword [rcx]
mov rax, qword [rax + 0x3c0]
call qword [case.0x14006f533.0]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
je 0x14003eede
mov edx, dword [rsp + 0x20]
mov r9, rdi
mov r8, rsi
mov rcx, rax
call fcn.14009d1a8
test al, al
je 0x14003eede
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14009bdf0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rax, r8
mov rcx, rdx
mov rdx, rax
mov r8, r9
jmp 0x14003ee6c
Function at 0x14004344c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1400ea3e8]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r15b, r9b
mov r12b, r8b
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400c11b0]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140015690
cmp qword [rax + 0x18], 8
jb 0x1400434ba
mov rax, qword [rax]
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
lea rcx, [rsp + 0x28]
call fcn.140009ca4
mov rbx, qword [rdi]
mov rsi, qword [rdi + 8]
cmp rbx, rsi
je 0x1400434f9
mov rcx, rbx
call fcn.140009ca4
add rbx, 0x20
cmp rbx, rsi
jne 0x1400434e1
mov rax, qword [rdi]
mov qword [rdi + 8], rax
cmp r14, 0xffffffffffffffff
je 0x140043636
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14004351c
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.140012ba4
nop
mov eax, dword [rsp + 0x70]
shr eax, 4
mov rbx, qword [rsp + 0x60]
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
test al, 1
je 0x1400435cc
lea rcx, [rsp + 0x48]
cmp rbx, 8
setae r9b
cmovae rcx, r11
cmp r10, 1
jne 0x14004358e
mov r8, r10
lea rax, [0x1400c1890]
mov rdx, rax
sub rcx, rax
movzx eax, word [rcx + rdx]
cmp ax, word [rdx]
jne 0x14004358e
add rdx, 2
sub r8, 1
jne 0x140043576
jmp 0x140043616
lea rdx, [rsp + 0x48]
test r9b, r9b
cmovne rdx, r11
cmp r10, 2
jne 0x1400435c5
mov r8, r10
lea rax, [0x1400bf7a0]
mov rcx, rax
sub rdx, rax
movzx eax, word [rdx + rcx]
cmp ax, word [rcx]
jne 0x1400435c5
add rcx, 2
sub r8, 1
jne 0x1400435b0
jmp 0x140043616
test r15b, r15b
jne 0x1400435d1
jmp 0x140043616
test r12b, r12b
je 0x140043616
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x140043605
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
lea rdx, [rsp + 0x48]
cmp rbx, 8
cmovae rdx, r11
mov r8, r10
mov rcx, rax
call fcn.140027e48
add qword [rdi + 8], 0x20
jmp 0x140043616
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, rdi
call fcn.140046760
nop
lea rcx, [rsp + 0x48]
call fcn.140009ca4
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140043505
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14009bdf0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov al, r9b
mov r10, r8
mov r9b, byte [rsp + 0x28]
mov rcx, rdx
mov r8b, al
mov rdx, r10
jmp 0x14004344c
Function at 0x140049620
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
mov r8d, dword [r9]
cmp r8d, 0x270
jne 0x140049690
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140049655
mov r8d, dword [r9]
jmp 0x14004975e
cmp r8d, 0x4e0
jb 0x14004975e
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400496ad
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400496f2
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor r8d, r8d
mov eax, r8d
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
shr ecx, 0xb
lea eax, [r8 + 1]
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, qword [rbx + 0x10]
ja 0x14004963c
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret

Function at 0x14004a830
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400ea3e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x28], r9
mov r10, r8
mov qword [rsp + 0x30], rcx
mov rax, rdx
mov word [rsp + 0x38], cx
mov rcx, rax
mov dword [rsp + 0x20], 5
lea r9, [rsp + 0x30]
mov rdx, r10
lea r8, [0x1400ba7b8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r8d, 5
lea rdx, str.True
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
sete al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009bdf0
add rsp, 0x58
ret