joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180027870
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800278c0
lea r11, [0x1804d2b70]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800278a3
cmp byte [r8], r9b
jne 0x1800278a3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180027890
mov rcx, qword [0x1804e5ad0]
not eax
movsxd rdx, dword [rcx + 0x3e80]
mov r9, qword [rcx + 0x3e88]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180027921
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180027919
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18002791c
mov rdx, r8
test rdx, rdx
jne 0x1800278f0
cmp r9, r10
je 0x180027930
cmp dword [r9], eax
jne 0x180027930
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x180034d30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c10], 0
lea rbx, [rcx + 0x5c18]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180034dd7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180034d8a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800375a0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1800217f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c10]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c20]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1804e5ac8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180034ddf
mov rcx, rbx
call fcn.1800217f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180035260
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1804e5ad0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800352c3
mov qword [rsp], rbx
lea rbx, [0x1804d2b70]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800352a3
cmp byte [r8], r9b
jne 0x1800352a3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180035290
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b88]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1800352f7
mov r10, qword [r10 + 0x5b90]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1800352fe
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1800352e4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x180056a90
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
ret

Function at 0x180056ab0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, rdx
syscall
ret
Function at 0x14000690c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov edi, r8d
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400069c9
cmp bp, word [rdx]
je 0x1400069c9
cmp qword [rcx + 0x40], rbp
je 0x140006945
mov eax, VarDecFix
jmp 0x1400069ce
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], RegisterTypeLib
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x20], edi
mov esi, ebp
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x140006985
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov qword [rbx + 0x40], rbp
jmp 0x1400069c5
cmp edi, 3
jne 0x14000699e
lea r9d, [rdi - 1]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1400069c5
cmp edi, 2
jne 0x1400069c5
lea r9, [rsp + 0x78]
mov word [rsp + 0x68], 0xfeff
mov r8d, edi
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
jmp 0x1400069ce
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000759c
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rbp, qword [rsp + 0xc8]
xor r13d, r13d
mov rsi, rcx
mov dword [rsp + 0x40], r13d
mov rcx, qword [rcx + 0x460]
mov ebx, r13d
mov qword [rsp + 0x48], rbx
mov r12d, r9d
mov dword [rsp + 0x44], r13d
mov r15, r8
mov r14, rdx
test rcx, rcx
je 0x1400075ed
mov edx, 0x1b58
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
mov edi, 0x57
call qword [rsi + 0x490]
test al, al
je 0x1400076c3
test rbp, rbp
je 0x1400076c3
cmp r13w, word [rbp]
je 0x1400076c3
mov rcx, rsi
call fcn.1400069dc
mov edi, eax
test eax, eax
je 0x140007630
cmp eax, 0xb7
jne 0x1400076c3
lea rax, [rsp + 0x48]
mov r9d, r12d
mov qword [rsp + 0x38], rax
mov r8, r15
lea rax, [rsp + 0x40]
mov rdx, r14
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call fcn.140006f28
mov rbx, qword [rsp + 0x48]
mov edi, eax
test eax, eax
jne 0x1400076c3
test rbx, rbx
jne 0x14000767a
lea edi, [rax + 0xe]
jmp 0x1400076c3
mov rcx, rbx
call fcn.14001f234
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x44]
mov rdx, rbx
mov qword [rsp + 0x20], r13
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test byte [rsi + 0x474], 1
mov ebp, eax
je 0x1400076b7
cmp r13w, word [rbx]
je 0x1400076b7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebp, ebp
jne 0x1400076c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x1400076d6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x40], r13
test rbx, rbx
je 0x1400076e3
mov rcx, rbx
call fcn.14001f6dc
mov rcx, qword [rsi + 0x460]
test rcx, rcx
je 0x1400076f5
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007940
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor esi, esi
mov ebx, edx
mov rdi, rcx
cmp si, word [rcx]
je 0x140007a20
call fcn.14001f234
cmp rax, 3
jbe 0x140007a20
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14001d380
lea rax, [0x140048878]
mov r9, rdi
lea r8, [0x140048988]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140007898
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140008178
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140007a1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400079fe
cmp eax, 0x91
jne 0x140007a1c
mov rcx, rdi
call fcn.140008044
test eax, eax
mov ecx, esi
sete cl
test ebx, ebx
je 0x140007a1a
mov ebx, 1
test ecx, ecx
jne 0x140007a1c
mov ebx, esi
mov eax, ebx
jmp 0x140007a22
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140008044
Capabilities:
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x360
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, VarUI4FromDisp
xor ebx, ebx
call fcn.14001d380
mov dword [rsp + 0x20], VarUI4FromDisp
test rdi, rdi
je 0x14000814d
cmp bx, word [rdi]
je 0x14000814d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400080b0
lea eax, [rbx + 0x11]
jmp 0x140008152
cmp dword [rsp + 0x30], 2
mov esi, ebx
mov rcx, rdi
sete sil
call fcn.140007a48
test eax, eax
jne 0x1400080de
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x1400080fd
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140008149
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140008141
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x208
call fcn.14001d380
mov r8d, 0x104
lea rdx, [rsp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rdx, [0x140048888]
lea rcx, [rsp + 0x140]
call fcn.140007f54
test eax, eax
jne 0x140008149
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
jmp 0x140008152
mov eax, 0x57
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008178
Capabilities:
Delete file
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r15d, edx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call fcn.14001d380
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x208
call fcn.14001d380
xor r12d, r12d
test rbx, rbx
je 0x14000833a
cmp r12w, word [rbx]
je 0x14000833a
mov rcx, rbx
call fcn.14001f234
cmp rax, 3
jbe 0x14000833a
mov r14d, 0x104
lea rcx, [rbp + 0x170]
mov edx, r14d
mov r8, rbx
call fcn.140007ad0
lea edx, [r12 + 0x5c]
lea rcx, [rbp + 0x170]
call fcn.14001d5f8
mov rsi, rax
test rax, rax
je 0x14000833a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000833a
lea rcx, [rbp + 0x170]
lea rax, [rsi + 2]
sub rax, rcx
lea ebx, [r12 + 1]
sar rax, 1
sub r14, rax
lea r8, [rsp + 0x4c]
mov rdx, r14
lea rcx, [rsi + 2]
call fcn.140007ad0
test byte [rsp + 0x20], 0x10
je 0x1400082ab
mov eax, 0x2e
cmp ax, word [rsp + 0x4c]
je 0x140008312
test r15d, r15d
je 0x140008312
mov edx, r15d
lea rcx, [rbp + 0x170]
call fcn.140007940
test ebx, ebx
je 0x14000830f
test eax, eax
jmp 0x140008308
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
lea rcx, [rbp + 0x170]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140008312
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xf
je 0x140008312
add eax, 0xfffffffe
cmp eax, 1
jbe 0x140008312
lea rcx, [rbp + 0x170]
call fcn.140008044
test eax, eax
mov ecx, r12d
sete cl
test ebx, ebx
je 0x14000830f
test ecx, ecx
mov ebx, 1
jne 0x140008312
mov ebx, r12d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140008267
test rdi, rdi
je 0x140008336
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x14000833c
xor eax, eax
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140008368
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, 0x5c
mov rbx, rcx
mov edx, edi
call fcn.14001d89c
xor ebp, ebp
mov rsi, rax
test rax, rax
jne 0x1400083b1
xor eax, eax
jmp 0x14000850c
mov edx, edi
mov rcx, rbx
call fcn.14001d5f8
mov rdi, rax
test rax, rax
je 0x1400083aa
cmp rsi, rax
je 0x140008473
mov esi, 0x208
lea rcx, [rsp + 0x20]
mov r8d, esi
xor edx, edx
call fcn.14001d380
sub rdi, rbx
sar rdi, 1
cmp rdi, 0x7ffffffe
jbe 0x1400083f6
mov word [rsp + 0x20], bp
jmp 0x14000843c
lea rax, [rsp + 0x20]
mov r8, rbx
sub r8, rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
lea rax, [rdi - 0x104]
add rax, rdx
je 0x14000842e
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000842e
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000840b
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
add rdi, rdi
cmp rdi, rsi
jae 0x140008535
lea rcx, [rsp + 0x20]
mov word [rsp + rdi + 0x20], bp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140008461
test al, 0x10
jne 0x140008473
lea rcx, [rsp + 0x20]
call fcn.140008368
test eax, eax
jne 0x14000850c
test rbx, rbx
je 0x140008507
mov rcx, rbx
call fcn.14001f234
cmp rax, 3
jbe 0x140008507
mov rcx, rbx
call fcn.14001f234
cmp rax, 3
jbe 0x1400084e7
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call fcn.14001d380
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400084c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400084d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
shr eax, 3
and eax, 2
test eax, eax
jne 0x1400084e7
xor edx, edx
mov rcx, rbx
call fcn.140008178
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140008503
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000850c
mov eax, ebp
jmp 0x14000850c
mov eax, 0x57
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14001ad14
int3
Function at 0x14000853c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x368]
sub rsp, 0x460
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r14d, r14d
mov rbx, rcx
test rcx, rcx
je 0x1400086fa
cmp word [rcx], r14w
je 0x1400086fa
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000859d
test al, 0x10
je 0x14000859d
mov eax, VarDecFix
jmp 0x1400086ff
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14001d380
mov edi, 0x104
lea rdx, [rbp + 0x140]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14001d380
mov edx, 0x5c
mov rcx, rbx
call fcn.14001d89c
test rax, rax
jne 0x1400085f5
mov edx, edi
lea rcx, [rsp + 0x30]
jmp 0x1400086ab
cmp rax, rbx
jne 0x14000869c
movzx eax, word [rbp + 0x140]
mov rcx, rdi
mov word [rsp + 0x30], ax
movzx eax, word [rbp + 0x142]
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x30]
cmp word [rax], r14w
je 0x14000862e
add rax, 2
sub rcx, 1
jne 0x14000861e
mov rax, rcx
neg rax
sbb edx, edx
not edx
and edx, 0x80070057
test rcx, rcx
je 0x14000864b
mov rax, rdi
sub rax, rcx
jmp 0x14000864e
mov rax, r14
test edx, edx
js 0x1400086cd
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
sub rdi, rax
je 0x14000868b
lea rdx, [rax + 0x7ffffefa]
add rdx, rdi
sub rbx, rcx
test rdx, rdx
je 0x14000868b
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14000868b
mov word [rcx], ax
dec rdx
add rcx, 2
sub rdi, 1
jne 0x14000866d
test rdi, rdi
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
jmp 0x1400086cd
cmp word [rbx + 2], 0x3a
lea rcx, [rsp + 0x30]
mov rdx, rdi
je 0x1400086c5
lea r8, [0x140048988]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x140]
call fcn.140007898
jmp 0x1400086cd
mov r8, rbx
call fcn.140007ad0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400086e1
test al, 0x10
jne 0x1400086f6
lea rcx, [rsp + 0x30]
call fcn.140008368
test eax, eax
je 0x1400086f6
mov eax, 0x52
jmp 0x1400086ff
xor eax, eax
jmp 0x1400086ff
mov eax, 0x57
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140008930
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x250
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [rcx + 0x10]
xor ebp, ebp
mov rdi, rcx
test rax, rax
je 0x14000896e
cmp bp, word [rax]
je 0x140008b87
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140008b87
cmp bp, word [rax]
je 0x140008b87
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14001d380
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8023
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140008b87
mov ebx, 0x104
lea r8, str.McAfee_
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140023710
lea r8, str.MCLOGS
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140023710
lea r8, [0x140048980]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140023710
mov rcx, qword [rdi + 0x10]
mov esi, ebp
test rcx, rcx
je 0x140008a1a
call fcn.14001f234
lea rcx, [0x140048980]
mov rsi, rax
call fcn.14001f234
add esi, eax
mov rcx, qword [rdi + 0x18]
call fcn.14001f234
lea rcx, [rsp + 0x30]
lea ebx, [rsi + rax]
call fcn.14001f234
inc eax
add eax, ebx
mov ebx, eax
lea rsi, [rax + rax]
mov rcx, rsi
call fcn.14001f8cc
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x140008a55
mov eax, 0xe
jmp 0x140008b8c
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14001d380
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov rax, qword [rdi + 0x18]
mov rdx, rbx
test rcx, rcx
je 0x140008a93
mov qword [rsp + 0x28], rax
lea r8, str._s_s_s
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 0x38]
call fcn.1400088dc
jmp 0x140008aa8
mov rcx, qword [rdi + 0x38]
lea r8, str._s_s
mov qword [rsp + 0x20], rax
call fcn.1400088dc
mov rcx, qword [rdi + 0x38]
call fcn.14001f234
lea r15, str.log.ini
mov rbx, rax
mov rcx, r15
call fcn.14001f234
lea rcx, [0x140048980]
add ebx, eax
call fcn.14001f234
lea ecx, [rax + 1]
add ecx, ebx
mov ebx, ecx
lea rsi, [rcx + rcx]
mov rcx, rsi
call fcn.14001f8cc
mov qword [rdi + 0x480], rax
test rax, rax
je 0x140008a4b
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14001d380
mov r9, qword [rdi + 0x38]
lea r8, [0x140048988]
mov rcx, qword [rdi + 0x480]
mov edx, ebx
mov qword [rsp + 0x20], r15
call fcn.1400088dc
mov rcx, r15
call fcn.14001f234
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.14001f234
lea ecx, [rax + 1]
add ecx, ebx
mov ebx, ecx
lea rsi, [rcx + rcx]
mov rcx, rsi
call fcn.14001f8cc
mov qword [rdi + 0x478], rax
test rax, rax
je 0x140008a4b
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14001d380
mov rcx, qword [rdi + 0x478]
lea r9, [rsp + 0x30]
lea r8, str._s_s
mov qword [rsp + 0x20], r15
mov edx, ebx
call fcn.1400088dc
xor eax, eax
jmp 0x140008b8c
mov eax, 0x57
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret
Function at 0x140008d14
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r15, qword [rbp + 0x270]
lea rcx, str.D7F77FF8_15D8_4321_8DBF_BDBDE16EE4F0
mov rdi, qword [rbp + 0x278]
mov r14d, r8d
mov rsi, qword [rbp + 0x280]
mov r12, rdx
call fcn.14001f700
mov r8, rax
lea rdx, str.D7F77FF8_15D8_4321_8DBF_BDBDE16EE4F0
mov r9d, 1
lea rcx, [rbp - 0x70]
call fcn.140009668
mov r13d, 0x10
lea rdx, [rdi + 0x14]
mov r8d, r13d
lea rcx, [rbp + 0x1f0]
call fcn.14001cf30
mov r8d, r13d
lea rcx, [rdi + 0x14]
xor edx, edx
call fcn.14001d380
test r12, r12
je 0x140008e7c
cmp r14d, 1
jb 0x140008e7c
and dword [rsp + 0x24], 0
lea rcx, [rsp + 0x20]
and dword [rsp + 0x20], 0
mov r8d, r14d
mov rdx, r12
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.140009864
lea rcx, [rsp + 0x20]
call fcn.14000a174
mov r8d, r13d
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x1e0]
call fcn.14001cf30
mov r8d, r13d
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1f0]
call fcn.14001d530
test eax, eax
jne 0x140008e7c
mov eax, dword [rdi + 8]
cmp r14d, eax
jne 0x140008e7c
cmp dword [rdi], 0x4752434d
jne 0x140008e7c
test rsi, rsi
je 0x140008e78
mov ecx, dword [rsi]
mov dword [rsi], eax
test r15, r15
je 0x140008e78
mov r9d, dword [rdi + 8]
cmp r9d, ecx
jbe 0x140008e5e
mov ebx, 0xea
jmp 0x140008e81
mov r8, r15
lea rcx, [rbp - 0x70]
mov rdx, r12
call fcn.140008bb4
test eax, eax
jne 0x140008e78
mov ebx, 0x1771
jmp 0x140008e81
xor ebx, ebx
jmp 0x140008e81
mov ebx, 0xd
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
je 0x140008e9e
lea rax, [rbp + 0x1ca]
cmp rcx, rax
je 0x140008e9e
call fcn.14001ac04
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x140008ebb
lea rax, [rbp + 0x1cf]
cmp rcx, rax
je 0x140008ebb
call fcn.14001ac04
mov eax, ebx
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14001a5c0
mov rbx, qword [rsp + 0x350]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009584
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rdx
mov rbx, rcx
test rdx, rdx
je 0x14000965a
cmp r8d, 1
jl 0x14000965a
lea r9, [rcx + 1]
xor eax, eax
mov rcx, r9
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x1400095b0
and word [rbx + 0x201], 0
mov r11, r9
mov edi, 0x100
movzx eax, byte [rbx + 0x201]
mov qword [rbx + 0x208], r11
mov cl, byte [rax + r10]
add cl, byte [r11]
add byte [rbx + 0x202], cl
lea rcx, [rbx + 1]
movzx eax, byte [rbx + 0x202]
add rcx, rax
mov qword [rbx + 0x210], rcx
mov al, byte [r11]
mov byte [rbx + 0x218], al
mov al, byte [rcx]
mov byte [r11], al
inc r11
mov al, byte [rbx + 0x218]
mov rcx, qword [rbx + 0x210]
mov byte [rcx], al
movzx eax, byte [rbx + 0x201]
inc eax
cdq
idiv r8d
mov byte [rbx + 0x201], dl
sub rdi, 1
jne 0x1400095ce
lea rcx, [rbx + 0x101]
mov r8d, 0x100
mov rdx, r9
call fcn.14001cf30
and word [rbx + 0x201], di
mov al, 1
mov byte [rbx], 1
jmp 0x14000965c
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret