joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007390
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140035030]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov qword [rbp - 0x50], rcx
xor r14d, r14d
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
lea r8d, [r14 + 0x13]
lea rdx, str.pluginUpdateExePath
lea rcx, [rbp - 0x28]
call fcn.140001ae0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140008d60
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140007598
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
lea r8d, [r14 + 0xd]
lea rdx, str.updateExePath
lea rcx, [rbp - 0x28]
call fcn.140001ae0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140008d60
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140007598
lea rcx, [rbp - 0x28]
call fcn.1400069f0
mov rbx, rax
lea rax, [rbp - 0x48]
cmp rax, rbx
je 0x1400074f4
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1400074c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075ce
call fcn.14000bb4c
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140007534
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000752f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075ce
call fcn.14000bb4c
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14000757a
lea rdi, [rcx + 0x11]
mov qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x22
lea rdx, str.WeChatUpdate.exe
call fcn.14000d9d0
mov word [rbx + rdi*2], r14w
jmp 0x140007598
mov qword [rsp + 0x20], 0x11
lea r9, str.WeChatUpdate.exe
mov edx, 0x11
lea rcx, [rbp - 0x48]
call fcn.1400099e0
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x10], xmm1
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000b8a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140011f28
nop
int3
Function at 0x140008920
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x140035030]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.14000e080
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.14000e080
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x38]
lea edx, [rsi + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400089e8
lea rdx, [rsp + 0x260]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1400089e8
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400089f4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140001ae0
lea rdx, [0x1400306d8]
mov rcx, rbx
call fcn.1400090b0
lea rdx, str.WeChat_
mov rcx, rbx
call fcn.1400090b0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008afc
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008a44
mov rdx, qword [rbx]
dec eax
movsxd rcx, eax
lea rdi, [rcx + rcx]
lea rcx, [rdi + rdx]
mov r8d, 1
lea rdx, [0x14002f2f8]
call fcn.140016f6c
test eax, eax
je 0x140008ae4
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008a74
mov rax, qword [rbx]
lea rcx, [rdi + rax]
mov r8d, 1
lea rdx, [0x1400306d0]
call fcn.140016f6c
test eax, eax
je 0x140008ae4
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x140008ac7
lea rdx, [rcx + 1]
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp r8, 8
jb 0x140008ab6
mov rax, qword [rbx]
mov r8d, 0x5c
mov word [rax + rcx*2], r8w
mov word [rax + rdx*2], si
jmp 0x140008ae4
mov qword [rsp + 0x20], 1
lea r9, [0x14002f2f8]
mov edx, 1
mov rcx, rbx
call fcn.1400099e0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008af1
mov rdx, qword [rbx]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rax, rbx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14000b8a0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008b30
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140035030]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
call fcn.140008920
nop
lea rdx, str.All_Users
lea rcx, [rsp + 0x20]
call fcn.1400090b0
lea rdx, str.config_
lea rcx, [rsp + 0x20]
call fcn.1400090b0
lea rdx, str.update.data
lea rcx, [rsp + 0x20]
call fcn.1400090b0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140008bdd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bf3
call fcn.14000bb4c
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b8a0
add rsp, 0x50
pop rbx
ret
call fcn.140011f28
int3
Function at 0x140008d60
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140035030]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
call fcn.140008920
nop
lea rdx, str.All_Users
lea rcx, [rsp + 0x38]
call fcn.1400090b0
lea rdx, str.config_
lea rcx, [rsp + 0x38]
call fcn.1400090b0
lea rdx, str.configEx.ini
lea rcx, [rsp + 0x38]
call fcn.1400090b0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140008e90
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140008e35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fd2
call fcn.14000bb4c
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140008e89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140008e84
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008fd8
mov rcx, r8
call fcn.14000bb4c
xor al, al
jmp 0x140008f9f
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14000e080
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008ec0
mov rdx, qword [rbx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x60]
lea r8, str.Error
lea rcx, str.Update
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140008ef2
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140008f4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fd2
call fcn.14000bb4c
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140008f9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140008f98
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008fd8
mov rcx, r8
call fcn.14000bb4c
mov al, 1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14000b8a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140011f28
nop
call fcn.140011f28
int3

Function at 0x140017770
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140017560
Function at 0x14001c7f4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001c87b
mov rsi, rbx
cmp word [rax], bp
je 0x14001c83a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001c824
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001c820
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140018ee8
mov rdi, rax
test rax, rax
je 0x14001c868
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d9d0
mov rbp, rdi
xor ecx, ecx
call fcn.140018eac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800030b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800030d8
xor eax, eax
lea r8, [0x180002f40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180004800
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180004a20
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180004907
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180004864
mov rax, qword [0x18000e008]
cmp qword [rsp + 0x20], rax
ja 0x180004864
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180004826
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180004893
jmp 0x180004907
cmp dword [rsp + 0x50], 0x10000
jne 0x1800048ea
cmp qword [rsp + 0x48], 0x10000
jb 0x1800048ea
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800048d8
mov rax, qword [rsp + 0x28]
jmp 0x180004909
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180004902
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180004a20
mov qword [rsp + 0x20], rax
jmp 0x180004826
xor eax, eax
add rsp, 0x68
ret

Function at 0x180004910
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180004a60
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180004a13
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000496b
mov rax, qword [0x18000e008]
cmp qword [rsp + 0x20], rax
ja 0x18000496b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000492d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18000499a
jmp 0x180004a13
cmp dword [rsp + 0x50], 0x10000
jne 0x1800049f1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800049f1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800049df
mov rax, qword [rsp + 0x28]
jmp 0x180004a15
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180004a0e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180004a60
mov qword [rsp + 0x20], rax
jmp 0x18000492d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180004ab0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180005040
mov qword [rsp + 0x28], 0
cmp qword [0x18000e388], 0
jne 0x180004af8
cmp qword [0x18000e380], 0
je 0x180004af8
mov rax, qword [0x18000e380]
mov qword [0x18000e388], rax
cmp qword [0x18000e388], 0
je 0x180004b9e
mov rax, qword [0x18000e388]
cmp qword [rax + 0x10], 0
je 0x180004b9e
mov rax, qword [0x18000e388]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180004b9e
mov rax, qword [0x18000e388]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180004b9e
mov rax, qword [0x18000e388]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180004b64
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180004b6b
xor eax, eax
jmp 0x180004d19
mov rax, qword [0x18000e388]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180004d19
mov rax, qword [0x18000e380]
mov qword [0x18000e388], rax
jmp 0x180004bc0
mov rax, qword [0x18000e388]
mov rax, qword [rax + 8]
mov qword [0x18000e388], rax
cmp qword [0x18000e388], 0
je 0x180004c0d
cmp qword [0x18000e388], 0
je 0x180004c0b
mov rax, qword [0x18000e388]
cmp qword [rax + 0x10], 0
je 0x180004c0b
mov rax, qword [0x18000e388]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180004c0b
mov rax, qword [0x18000e388]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180004c0b
jmp 0x180004b3c
jmp 0x180004bae
mov rcx, qword [rsp + 0x60]
call fcn.180006c70
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004d20
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180004d17
mov rax, qword [rsp + 0x48]
mov qword [0x18000e388], rax
mov rax, qword [0x18000e388]
mov dword [rax], 0x52727464
mov rax, qword [0x18000e388]
mov qword [rax + 0x10], 0
mov rax, qword [0x18000e388]
mov rcx, qword [0x18000e380]
mov qword [rax + 8], rcx
mov rax, qword [0x18000e388]
mov qword [0x18000e380], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18000e388]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180004cc8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180004d02
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180004cbe
mov rax, qword [0x18000e388]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180004b3c
xor eax, eax
add rsp, 0x58
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
or dl, ah
in eax, dx
iretd
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and ch, byte [rsp + rdi]
invalid
in eax, 0x2b
jb 0x14003f5fa
push rax
sub byte [rdi + 6], bl
and esi, edx
invalid
push rsp
sal dword [rax], cl
and edi, dword [rdx + rcx*4 + 0x40]
test al, 0xc8
jge 0x14003f5e9
ficomp word [rdi + 0x3d501646]
sbb al, 0x3d
sbb dword [rbp + 0x22fad723], eax
mov dl, 0x50
or eax, 0x5b98e48c
xchg byte [rbp + 0x5d], ch
pop rbp
pop rbp
out dx, eax
cqo
fadd qword [rdi + 0x2f]
jge 0x14003f5fb
jbe 0x14003f5ad
sbb dword [0x174068e1b], ebp
sub byte [rax + 0xf739c30], ch
test dword [rax], esi
nop
xchg dword [rsi], ebp
adc dh, al
cmpsb byte [rsi], byte [rdi]
mov dword [rdx + 5], edx
sub byte [rax - 0x75], dl
xchg esi, eax
mov edi, 0x9519e41
fcmovne st(0), st(5)
cmpsd dword [rsi], dword [rdi]
mov dword es:[rsi - 0x7c], esp
outsd dx, dword [rsi]
pushfq
stosb byte [rdi], al
sahf
adc spl, byte [r9]
int 0x8c
mov esi, 0x37262b92
mov ch, 0x5b
pop rsi
not byte [rsi - 0x33d4b38b]
jne 0x14003f6b4
sub ecx, esp
jne 0x14003f6b4
sub ecx, esp
push rdi
invalid
stosb byte [rdi], al
movabs al, byte [0x484912b426bb8360]
invalid
mov ah, 0x12
invalid
jrcxz 0x14003f67e
add al, 0xcf
or dword [rcx], esp
mov esi, dword [rbx]
xor eax, dword [rcx - 0x41]
pop rbp
invalid
scasb al, byte [rdi]
mov fs, edi
or al, byte [rdi - 0x19028b61]
jne 0x14003f70c
invalid
xor eax, dword [rcx - 0x41]
pop rbp
invalid
cmp eax, 0x67d8887d
adc ecx, dword [rbp + 0x26497fb5]
sal edi, cl
imul dword [rdi - 0x7b]
invalid
outsd dx, dword [rsi]
test dword [rsi], esp
invalid
Function at 0x180001ee4
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov eax, dword [rsp + 0x78]
lea edi, [r9 + 0x1d7]
mov esi, dword [rsp + 0x70]
mov r10d, r9d
mov r11, rdx
xor r10d, 0x1fba
xor esi, 0x25c3
lea edx, [rcx - 0x2f0d]
lea r14d, [rax + 0x1dd]
mov ebp, r8d
cmp edx, eax
jg 0x180002059
mov eax, edi
xor eax, 0x1fe
cmp edx, eax
jg 0x180001fb2
mov rcx, qword [section..data]
cmp dword [rcx + 0x3c], 0x24bd
jbe 0x180001f70
mov ecx, dword [rcx + 0x34]
mov eax, dword [0x1800e808c]
add eax, 0x50ef3
add ecx, eax
add dword [r11 + 0x9c], ecx
mov rcx, qword [section..data]
mov r8d, edx
mov eax, 0xff06b
sub eax, dword [rcx + 0x114]
xor r10d, 0x3857
add dword [r11 + 0x9c], eax
lea ecx, [r14 - 0x145]
xor r8d, 0x2f0d
mov dword [rsp + 0x20], r10d
add edx, 0x2b45
mov r9, r11
call fcn.180001e00
jmp 0x180002059
mov eax, r10d
or eax, 0x2d2f
cmp dword [0x1800e8040], eax
jne 0x180002059
mov rax, qword [section..data]
mov ecx, dword [rax + 0x28]
or ecx, edi
cmp dword [0x1800e812c], ecx
jae 0x180002059
movsxd rax, r10d
movsxd rcx, r14d
or rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r9d, dword [0x1800e8100]
mov r11d, esi
mov ebx, dword [0x1800e804c]
imul ebx, dword [0x1800e8024]
mov edx, dword [0x1800e8128]
mov eax, esi
add edx, edi
or r9, rax
imul r11d, r14d
mov rax, qword [section..data]
imul r10d, edi, 0x70dc6f6
mov dword [rsp + 0x30], ebx
mov r8d, dword [rax + 0xdc]
and r11d, edi
add r8d, dword [0x1800e8150]
imul eax, esi, 0x2a4d
or r8, 0x2181
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
sub eax, 0x3857
movsxd rcx, eax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rsp + 0x50]
lea eax, [rbp - 0x86d]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180004094
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0xa0]
lea edi, [r9 - 0x11a9]
mov r15, qword [rsp + 0x90]
lea r9d, [rcx - 0x1034]
mov r12d, edx
mov esi, r8d
xor r12d, 0x243
xor ebx, 0x3857
xor esi, 0x762
mov dword [rsp + 0xa0], r12d
cmp dword [0x1800e8100], 0x7094
mov ebp, r8d
mov edx, ecx
jae 0x18000410c
add dword [r15], 0x1ccb58
jmp 0x180004125
mov ecx, dword [0x1800e808c]
mov rax, qword [section..data]
sub ecx, dword [0x1800e8050]
mov dword [rax + 0xac], ecx
mov eax, ebp
xor eax, 0x1578
cmp edx, eax
jge 0x180004279
lea eax, [rbx + 0x2f3a]
cmp esi, eax
jg 0x1800041bd
lea eax, [rdx + 0x2d]
xor r9d, 0x3f58
mov dword [rsp + 0x28], eax
lea r13, [0x1800e8010]
lea r8d, [rdi + 0xe56]
mov qword [rsp + 0x20], r13
xor edx, 0xdf
lea ecx, [rbp - 0x76c]
call fcn.18000523c
xor eax, 0x1984
lea r9d, [rbx + 0x3082]
mov dword [rsp + 0x30], r9d
lea r10d, [rsi + 0xe0a]
mov r9, qword [section..data]
mov edx, ebp
xor ebx, 0x2f3a
mov dword [rsp + 0x28], r10d
lea r8d, [rax + 0x3c8]
mov dword [rsp + 0x20], ebx
lea ecx, [rax - 0x31e]
xor edx, 0xcbe
call fcn.1800082d0
jmp 0x180004279
mov rcx, qword [section..data]
mov eax, edi
sub eax, dword [rcx + 0x7c]
mov ebx, dword [rcx + 0x94]
cmp ebx, eax
jae 0x180004279
mov edx, dword [rcx + 0x140]
lea r13, [0x1800e8010]
xor edx, dword [rcx + 0x14]
mov r14d, dword [0x1800e8150]
cmp r14d, edx
ja 0x180004262
mov ebp, r12d
and ebp, edi
add ebp, 0x2fd2
mov eax, dword [0x1800e8018]
lea r9d, [rsi + 0x32c1]
mov ecx, dword [r15 + 0x20]
mov rdx, r13
mov r8d, dword [0x1800e80f0]
add ecx, dword [0x1800e8088]
or r8d, 0x1fba
or ecx, dword [0x1800e808c]
imul eax, edi
mov dword [rsp + 0x28], ebp
xor eax, 0x2b45
mov dword [rsp + 0x20], eax
call fcn.180005a14
mov rcx, qword [section..data]
add r14d, 2
mov edx, dword [rcx + 0x140]
xor edx, dword [rcx + 0x14]
cmp r14d, edx
jbe 0x1800041fe
mov r12d, dword [rsp + 0xa0]
mov eax, edi
add ebx, 4
sub eax, dword [rcx + 0x7c]
cmp ebx, eax
jb 0x1800041e7
mov ebp, dword [rsp + 0x80]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
lea eax, [rbp - 0xd75]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret