joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025830
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x140035aa0]
xor ebx, ebx
movdqu xmmword [rbp + 0xf], xmm0
mov ecx, ebx
mov dword [rbp + 0x1f], 0x1003332
nop dword [rax]
lea eax, [rcx + 0x45]
xor byte [rbp + rcx + 0xf], al
inc rcx
cmp rcx, 0x12
jb 0x140025870
mov byte [rbp + 0x22], bl
mov rcx, rbx
mov dword [rbp - 0x19], 0x2423322b
mov dword [rbp - 0x15], 0x202f6425
mov word [rbp - 0x11], 0x21
mov byte [rbp - 0xf], 1
nop
lea eax, [rcx + 0x45]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 9
jb 0x1400258a0
lea rcx, [rbp - 0x19]
mov byte [rbp - 0xf], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x140035a90]
mov rdx, rbx
movdqu xmmword [rbp + 0x27], xmm0
mov rdi, rax
mov word [rbp + 0x37], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0x45]
xor byte [rbp + rdx + 0x27], cl
inc rdx
cmp rdx, 0x10
jb 0x1400258f0
mov byte [rbp + 0x38], bl
mov ecx, 0xbbb
mov dword [rbp - 9], 0xf432f42b
mov dword [rbp - 5], 0xf424f423
mov dword [rbp - 1], 0xf464f425
mov dword [rbp + 3], 0xf420f42f
mov dword [rbp + 7], 0xf421
mov byte [rbp + 0xb], 1
nop
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 9], ax
inc rbx
cmp rbx, 9
jb 0x140025930
lea rcx, [rbp - 9]
mov byte [rbp + 0xb], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rbp + 0x3f]
mov dl, 1
mov rbx, rax
lea ecx, [r8 + 0x13]
call rdi
lea rax, [rbp + 0x43]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc00002b4
call rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14002fac0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140025ad0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
lea rcx, [0x14003c108]
cmp qword [0x14003c120], 7
cmova rcx, qword [0x14003c108]
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
jne 0x140025bfd
lea rcx, [rbp - 0x30]
call fcn.1400224c0
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140023940
lea rcx, [rbp - 0x60]
call fcn.140024770
nop
lea rcx, [rbp - 0x30]
call fcn.140024770
mov dword [rbp - 0x60], 0xf433f404
mov dword [rbp - 0x5c], 0xf420f433
mov dword [rbp - 0x58], 0xf424f42c
mov dword [rbp - 0x54], 0xf425f43f
mov dword [rbp - 0x50], 0xf42ff42e
mov dword [rbp - 0x4c], 0xf439f43b
mov dword [rbp - 0x48], 0xf43cf43e
mov dword [rbp - 0x44], 0xf411f473
mov dword [rbp - 0x40], 0xf424f427
mov dword [rbp - 0x3c], 0xf42af438
xor ebx, ebx
mov word [rbp - 0x38], bx
mov byte [rbp - 0x36], 1
lea rcx, [rbp - 0x60]
call fcn.140022490
mov r10, rax
mov dword [rbp - 0x30], 0xf42ff40b
mov dword [rbp - 0x2c], 0xf42df424
mov dword [rbp - 0x28], 0xf43ef469
mov dword [rbp - 0x24], 0xf435f439
mov dword [rbp - 0x20], 0xf428f46d
mov dword [rbp - 0x1c], 0xf437f42e
mov dword [rbp - 0x18], 0xf43df436
mov dword [rbp - 0x14], 0xf47af427
mov word [rbp - 0x10], bx
mov byte [rbp - 0xe], 1
lea rcx, [rbp - 0x30]
call fcn.140024190
lea r9d, [rbx + 0x10]
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140026320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x8e], 0
je 0x14002634c
xor eax, eax
mov r8d, 0xbbb
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x46
jb 0x140026331
mov byte [rcx + 0x8e], 0
mov rax, rcx
ret
Function at 0x140028b40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x94], 0
je 0x140028b6c
xor eax, eax
mov r8d, 0xbbb
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x49
jb 0x140028b51
mov byte [rcx + 0x94], 0
mov rax, rcx
ret

Function at 0x140028b70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140028b98
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140028b80
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140028ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb2], 0
je 0x140028bcc
xor eax, eax
mov r8d, 0xbbb
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x58
jb 0x140028bb1
mov byte [rcx + 0xb2], 0
mov rax, rcx
ret
Function at 0x14002aab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x7a], 0
je 0x14002aad8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3c
jb 0x14002aac0
mov byte [rcx + 0x7a], 0
mov rax, rcx
ret

Function at 0x14002b270
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x14002b2a1
xor eax, eax
jmp 0x14002b3eb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14002b2de
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14002b2de
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14002b3eb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14002b3e0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14002b325
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002b333
movzx ecx, di
jmp 0x14002b387
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002b3a0
sub eax, 1
je 0x14002b3a0
cmp eax, 2
jne 0x14002b3e0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x14002b3e3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14002b3ce
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x14002b3e0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002fac0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002b850
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14002b878
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14002b89e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002b8a0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14002b8f9
test ecx, ecx
jle 0x14002b8d9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14002b8f9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002b8f9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14002b920
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14002b942
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14002b958
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002b974
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002b976
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002b9b2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14002ba4e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14002b9ed
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14002ba2e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14002ba4e
cmp rbx, rax
ja 0x14002ba00
test rbx, rbx
je 0x14002ba4e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14002beb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002bedd
xor eax, eax
jmp 0x14002c049
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002bf17
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14002bf17
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14002c049
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14002c03c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002bf5a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002bf85
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002c041
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002bff4
sub eax, 1
je 0x14002bff4
cmp eax, 2
jne 0x14002c03c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002c041
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14002c022
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14002c03c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14002c041
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002fac0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14002c720
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14002c7f5
cmp byte [rcx + 0x72], 0
je 0x14002c7f5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14002c7f1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002c7b6
sub eax, 1
je 0x14002c7ba
cmp eax, 2
jne 0x14002c7f1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002fac0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14002c7e8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002c7f1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14002c79e
xor al, al
jmp 0x14002c79e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002fac0
add rsp, 0x60
pop rbx
ret

Function at 0x14002ca60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14002cb33
cmp byte [rcx + 0x71], 0
je 0x14002cb33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002cb2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002caf4
sub eax, 1
je 0x14002caf8
cmp eax, 2
jne 0x14002cb2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002fac0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14002cb26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002cb2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14002cadc
xor al, al
jmp 0x14002cadc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002fac0
add rsp, 0x60
pop rbx
ret
Function at 0x14002f40c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14002f446
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14002f44b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14002f494
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140033820]
cmp byte [rcx + rax], 0
je 0x14002f494
dec r8
sub rdx, 1
jne 0x14002f47a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140030634
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003067e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003067e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003067e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003067e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003067e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140030680
xor al, al
add rsp, 0x28
ret
Function at 0x140027d40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0x58], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [0x1401c1a20]
movaps xmmword [rcx], xmm0
lea rdx, str.GROUP:
call fcn.1401678a0
test rdi, rdi
je 0x140027ef1
mov rcx, rdi
call fcn.14014ea20
lea r15, [rsp + 0x40]
mov rcx, r15
mov rdx, rdi
mov r8, rax
call fcn.14007cf90
lea rdx, str.__NAME:
mov r8d, 8
mov rcx, r15
call fcn.14007cf90
test r14, r14
je 0x140027ef1
mov rcx, r14
call fcn.14014ea20
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, r14
mov r8, rax
call fcn.14007cf90
lea rdx, str.__DURATION:
mov r8d, SafeArrayDestroy
mov rcx, rdi
call fcn.14007cf90
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140027e66
sub rdx, qword [rbx]
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.14007e420
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
js 0x140027e2a
and r8d, 0x7f
jmp 0x140027e34
mov r8, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14007cf90
cmp byte [rsp + 0x3f], 0
jns 0x140027e52
mov rcx, qword [rsp + 0x28]
call fcn.14012c3dc
lea rdx, str.__us_
lea rcx, [rsp + 0x40]
mov r8d, 5
jmp 0x140027e78
lea rdx, str.unknown_unfinished
lea rcx, [rsp + 0x40]
mov r8d, shutdown
call fcn.14007cf90
lea rdx, [0x1401c5d35]
mov r8d, 2
mov rcx, rdi
call fcn.14007cf90
movzx r8d, byte [rsp + 0x57]
test r8b, r8b
jns 0x140027ea9
mov r8d, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
jmp 0x140027ead
and r8d, 0x7f
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x20], 0
mov rdx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [rsp + 0x57], 0
jns 0x140027ed7
mov rcx, qword [rsp + 0x40]
call fcn.14012c3dc
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012cf50
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.string::append_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xafa
call fcn.140168c70
int3
Function at 0x14002b6a0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov rcx, rdx
test r8b, r8b
je fcn.140087db0
jmp fcn.140088060

Function at 0x14002b6d0
Capabilities:
Move file

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp fcn.140188de0

Function at 0x1400362e0
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0x101
lea rbx, [rsp + 0x30]
mov r8d, 0x202
mov rcx, rbx
mov dl, 0xaa
call fcn.14012fee0
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x14003633e
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14007dc90
test edi, edi
setne bl
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14012cf50
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret

Function at 0x140036360
Capabilities:
Get session user name

Disassembly:
mov edx, 2
jmp 0x140036370
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x34]
mov dword [r8], 0
mov ecx, edx
xor edx, edx
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x140036420
lea r14, [rsp + 0x34]
mov r15d, dword [r14]
inc r15d
mov dword [r14], r15d
add r15, r15
mov rcx, r15
call fcn.14012c41c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14012fee0
mov ecx, edi
mov rdx, rbx
mov r8, r14
call sub.Secur32.dll_GetUserNameExW
test al, al
setne dil
je 0x140036419
test rbx, rbx
je 0x140036435
mov rcx, rsi
mov rdx, rbx
call fcn.14007dc90
mov rcx, rbx
call fcn.14012c424
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012cf50
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test rbx, rbx
jne 0x1400363f6
jmp 0x140036431
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1400363a8
xor edi, edi
jmp 0x1400363fe
lea rax, str.string::assign_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xa51
call fcn.140168c70
int3
Function at 0x140036370
Capabilities:
Get session user name

Disassembly:
mov edx, 2
jmp 0x140036370
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x34]
mov dword [r8], 0
mov ecx, edx
xor edx, edx
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x140036420
lea r14, [rsp + 0x34]
mov r15d, dword [r14]
inc r15d
mov dword [r14], r15d
add r15, r15
mov rcx, r15
call fcn.14012c41c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14012fee0
mov ecx, edi
mov rdx, rbx
mov r8, r14
call sub.Secur32.dll_GetUserNameExW
test al, al
setne dil
je 0x140036419
test rbx, rbx
je 0x140036435
mov rcx, rsi
mov rdx, rbx
call fcn.14007dc90
mov rcx, rbx
call fcn.14012c424
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012cf50
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test rbx, rbx
jne 0x1400363f6
jmp 0x140036431
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1400363a8
xor edi, edi
jmp 0x1400363fe
lea rax, str.string::assign_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xa51
call fcn.140168c70
int3