joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002330
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002348
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002350
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002360
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400023ad
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400023a4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400023af
add rax, 0x28
cmp rax, r9
jne 0x140002390
xor eax, eax
ret

Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002440
mov rdx, qword [0x1400097d0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000242e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000242e
cmp word [rax + 0x18], 0x20b
jne 0x14000242e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002440
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002419
add rbx, 0x28
cmp rbx, rdi
je 0x140002440
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002410
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002450
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400097d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002470
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002478
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002470
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400024cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400024c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002470
add rax, 0x28
cmp rax, r9
jne 0x1400024b0
xor eax, eax
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400097d0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400024ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400024f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400024ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140002510
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400097d0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002530
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002538
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002530
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002580
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002577
test rcx, rcx
je 0x140002530
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002568
xor eax, eax
ret

Function at 0x140002590
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400097d0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400025af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400025b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400025d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400097d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400025f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400025f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025f0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400025f0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002644
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002650
add rdx, 0x28
cmp rdx, r9
jne 0x140002630
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002660
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400097d0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002682
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002690
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002682
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002682
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002682
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400026e5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400026f8
add rdx, 0x28
cmp r10, rdx
jne 0x1400026d0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002707
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002717
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400026ee
test ecx, ecx
jg 0x140002700
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140014b38
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140014ba7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014ba7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140014ba7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140014ba7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140014ba7
cmp dword [rcx + 0x84], 0xe
jbe 0x140014ba7
cmp dword [rcx + 0xf8], 0
je 0x140014ba7
mov ecx, ebx
call fcn.140014c58
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140014a3c
nop
cmp dword [rbp + 0x20], 0
je 0x140014bf5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140014c00
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140014b38

Function at 0x140014d34
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140014b38
Function at 0x14001d9bb
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x14001fb61
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jge 0x14001d0c5
jmp 0x140020662
jmp 0x14001dccb
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x14001f23e
Function at 0x1400202c3
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x14001e693
jmp 0x14001d0b8
cmp dword [rsp + 0x30], 0
je 0x140020b87
jmp 0x14001d767
mov eax, 1
jmp 0x14001f80c
cmp qword [rsp + 0x38], 0
je 0x140020258
jmp 0x14001fd1e
mov dword [rsp + 0x28], 1
jmp 0x140022b15
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
je 0x14001e32e
jmp 0x140021834
mov eax, 1
jmp 0x14001f80c
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
jne 0x140020971
jmp 0x140021f2f
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x48]
jmp 0x1400200e3
mov dword [rsp + 0x28], 0
jmp 0x140022b15
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 0x10]
mov dword [rsp + 0x30], eax
jmp 0x14001c080
mov dword [rsp + 0x2c], 1
jmp 0x140022851
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x140020cc7
jmp 0x14001cda7
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x14009c911]
mov dword [rsp + 0x30], eax
jmp 0x14001c080
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
je 0x14001c122
jmp 0x14001d0dc
mov dword [rsp + 0x24], 1
jmp 0x14001c02b
lea rcx, [0x1400c2aa6]
call fcn.140021652
jmp 0x14002248c
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
jne 0x14001fd1e
jmp 0x140020258
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x2c], 0
jmp 0x140022851
mov dword [rsp + 0x24], 0
jmp 0x14001c02b
xor eax, eax
jmp 0x14001f80c
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x14001e393
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
jne 0x14001fd8b
jmp 0x140021f0f
Function at 0x1400219f9
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140020ca3
jmp 0x140022cdd
mov rcx, qword [rsp + 0x70]
call fcn.14002106c
jmp 0x1400201ed
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x140021428
jmp 0x14001d83d
jmp 0x140021e6a
test eax, eax
jne 0x140022cdd
jmp 0x140020642
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14001d722
jmp 0x14001d6c0
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.14001ea7e
jmp 0x14001ea71
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x1400207ec
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x14001c9ab
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x14001fbf0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x140021e6a
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x140020b2a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14001d722
jmp 0x14001d6c0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x14001c9ab
jmp 0x1400207ec
Function at 0x14004f5cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx + 0x38]
lea r15, [rcx + 0x48]
xor r13d, r13d
mov rdi, rcx
or r14d, 0xffffffff
mov esi, dword [rdi + 0x50]
mov r8, r15
mov edx, dword [rdi + 0x8c]
sub esi, edx
mov eax, dword [rdi + 0x94]
sub esi, eax
jne 0x14004f620
test edx, edx
jne 0x14004f62c
test eax, eax
jne 0x14004f62c
mov esi, ebp
jmp 0x14004f6aa
cmp esi, r14d
jne 0x14004f62c
mov esi, 0xfffffffe
jmp 0x14004f6aa
mov ecx, dword [rdi + 0x38]
add ecx, 0xfffffefa
add ecx, ebp
cmp edx, ecx
jb 0x14004f6aa
mov rcx, qword [r8]
mov r8, rbp
lea rdx, [rcx + rbp]
call fcn.14001db10
mov r8d, dword [rdi + 0x6c]
mov rax, qword [rdi + 0x60]
sub dword [rdi + 0x90], ebp
sub dword [rdi + 0x8c], ebp
sub dword [rdi + 0x7c], ebp
lea rdx, [rax + r8*2]
lea rdx, [rdx - 2]
movzx ecx, word [rdx]
movzx eax, cx
sub ax, bp
cmp ecx, ebp
cmovb ax, r13w
mov word [rdx], ax
add r8d, r14d
jne 0x14004f665
mov rax, qword [rdi + 0x58]
mov r8d, ebp
lea rdx, [rax + rbp*2]
lea rdx, [rdx - 2]
movzx ecx, word [rdx]
movzx eax, cx
sub ax, bp
cmp ecx, ebp
cmovb ax, r13w
mov word [rdx], ax
add r8d, r14d
jne 0x14004f68c
add esi, ebp
mov r14, qword [rdi]
mov eax, dword [r14 + 8]
test eax, eax
je 0x14004f777
mov r10d, dword [rdi + 0x8c]
mov r12d, dword [rdi + 0x94]
add r12, r10
add r12, qword [r15]
cmp eax, esi
cmovbe esi, eax
test esi, esi
jne 0x14004f6db
mov esi, r13d
jmp 0x14004f71c
sub eax, esi
mov dword [r14 + 8], eax
mov rax, qword [r14 + 0x28]
cmp dword [rax + 0x2c], r13d
jne 0x14004f6fe
mov rdx, qword [r14]
mov r8d, esi
mov ecx, dword [r14 + 0x4c]
call fcn.140050550
mov dword [r14 + 0x4c], eax
mov rdx, qword [r14]
mov rcx, r12
mov r8d, esi
mov ebx, esi
call fcn.14001db10
add qword [r14], rbx
add dword [r14 + 0xc], esi
mov r10d, dword [rdi + 0x8c]
mov r9d, dword [rdi + 0x94]
add r9d, esi
mov dword [rdi + 0x94], r9d
cmp r9d, 3
jb 0x14004f75b
mov rdx, qword [r15]
mov ecx, dword [rdi + 0x78]
mov eax, r10d
movzx r8d, byte [rax + rdx]
lea eax, [r10 + 1]
mov dword [rdi + 0x68], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rdi + 0x74]
mov dword [rdi + 0x68], r8d
cmp r9d, 0x106
jae 0x14004f777
mov rax, qword [rdi]
mov r14d, 0xffffffff
cmp dword [rax + 8], r13d
jne 0x14004f5f9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a4eac
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400a4ec7
xor eax, eax
jmp 0x1400a4f10
call fcn.1400a86fc
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400a4f0e
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a4f0e
test byte [rcx + 0x1c], 1
je 0x1400a4f0e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c7cf0]
mov edx, 0x28
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400271f4
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a4fc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a5031
call fcn.1400a86fc
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400a502d
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a502d
test byte [rcx + 0x1c], 1
je 0x1400a502d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c7cf0]
mov edx, 0x22
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400271f4
mov eax, ebx
jmp 0x1400a5035
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a5040
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400a509d
call fcn.1400a86fc
mov ebx, eax
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a5099
test byte [rcx + 0x1c], 1
je 0x1400a5099
mov rcx, qword [rcx + 0x10]
mov edx, 0x29
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.1400a60f4
mov eax, ebx
jmp 0x1400a509f
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a50b0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
and qword [rdx], 0
lea rbp, [rcx + 0x28]
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
jne 0x1400a5178
mov rax, qword [rsi + 0x20]
lea r9, [0x1400c043c]
mov r8, qword [rsi + 0x18]
lea rdx, str._ls_ls_ls
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1400a6570
mov ebx, eax
test eax, eax
js 0x1400a51b4
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1400a512d
test rcx, rcx
je 0x1400a5128
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rsi + 0x10], 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400a5152
call fcn.1400a86fc
mov edi, eax
add eax, 0x7ff8fffe
jmp 0x1400a5158
mov qword [rsi + 0x10], rax
xor edi, edi
test rbx, rbx
je 0x1400a5165
mov rcx, rbx
call fcn.14001bf20
mov rbx, rbp
cmp edi, 0x80070012
jne 0x1400a5198
and qword [r14], 0
xor eax, eax
jmp 0x1400a51c9
mov rdx, rbp
mov rbx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400a5196
call fcn.1400a86fc
mov edi, eax
cmp eax, 0x80070012
jmp 0x1400a516e
xor edi, edi
test edi, edi
js 0x1400a51c7
test byte [rsi + 0x280], 2
je 0x1400a51af
test byte [rbp], 0x10
jne 0x1400a50d0
mov qword [r14], rbx
jmp 0x1400a5174
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400a51c3
call fcn.14001bf20
mov eax, ebx
jmp 0x1400a51c9
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1400a584c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400a58ac
call fcn.1400a86fc
mov ebx, eax
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a58a8
test byte [rcx + 0x1c], 1
je 0x1400a58a8
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c7cf0]
mov edx, 0x19
mov r9d, ebx
call fcn.140028a8c
mov eax, ebx
jmp 0x1400a58b6
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400a6034
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x1400a605d
mov eax, 0x80070057
jmp 0x1400a60e3
mov r8d, edx
jmp 0x1400a607d
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x1400a60e1
test eax, eax
je 0x1400a60da
cmp eax, ebx
ja 0x1400a60da
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a6062
call fcn.1400a86fc
mov ebx, eax
test eax, eax
jns 0x1400a60e1
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a60d6
test byte [rcx + 0x1c], 1
je 0x1400a60d6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c7cf0]
mov edx, 0x17
mov r9d, ebx
call fcn.140028a8c
mov eax, ebx
jmp 0x1400a60e3
mov ebx, 0x8000ffff
jmp 0x1400a60a5
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a7b6c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, r9d
mov rdi, rdx
cmp rax, r9
je 0x1400a7b88
mov eax, 0x80070057
jmp 0x1400a7bf5
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r9d
mov r9d, r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x1400a7bf3
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a7bde
test byte [rcx + 0x1c], 1
je 0x1400a7bde
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c7d80]
mov edx, 0x1a
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400271f4
test ebx, ebx
jle 0x1400a7bed
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x1400a7bf3
mov eax, ebx
jmp 0x1400a7bf5
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a9748
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x60
and qword [r11 + 0x10], 0
mov eax, r9d
neg eax
mov byte [rcx], 0
mov rdi, rcx
lea rcx, [r11 + 0x10]
sbb edx, edx
and qword [r11 - 0x48], 0
neg edx
inc edx
call fcn.1400a9b28
mov ebx, eax
test eax, eax
jns 0x1400a9795
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a9791
call fcn.1400451f0
mov eax, ebx
jmp 0x1400a9814
mov rbx, qword [rsp + 0x78]
lea r8, [rsp + 0x88]
and dword [rsp + 0x88], 0
mov rdx, rbx
xor ecx, ecx
mov byte [rdi], 0
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1400a97f6
call fcn.1400a86fc
mov edi, eax
mov rcx, qword [str._bR_r_]
lea rax, str._bR_r_
cmp rcx, rax
je 0x1400a9805
test byte [rcx + 0x1c], 1
je 0x1400a9805
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c7f88]
mov edx, 0x1a
mov r9d, edi
call fcn.140028a8c
jmp 0x1400a9805
cmp dword [rsp + 0x88], 0
setne al
mov byte [rdi], al
xor edi, edi
test rbx, rbx
je 0x1400a9812
mov rcx, rbx
call fcn.1400451f0
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1401317f5
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
xor r10d, 0xf0750284
je 0x140132401
lea esi, [rbx + 0x6e45]
add r9d, 0xc67173d5
inc r14
cmp ebp, 0xb6dd44c6
jmp 0x140132741
jmp rax
in al, dx
invalid
iretd
jno 0x140132045
invalid
test esi, edx
dec rbp
test r11d, 0xc66bd6ba
rol r14d, 0x9e
sub edi, 0x20b46654
movabs r15, 0xd74b9fffffe29e9
pop r10
lea ecx, [rbx - 0x3b6]
push r9
pop rbp
jb 0x1401319a6
jle 0x140131381
ret
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x1c50c293
lea rdx, [r10 + r9*4]
jmp 0x140132880
sub ebp, 0x806769cc
cmp rdx, rcx
div rdx
pop r15
jbe 0x14013242a
lea ecx, [rdx + 0xce77]
jmp 0x1401324a1
add dword [rax], eax
invalid
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14013242d
cmp r8d, 0x3a692056
jmp 0x140132620
mov r10, qword [rax + 0x30]
jmp 0x140132609
dec dword [rax - 1]
invalid
je 0x14013110f
mov r15d, 0x9fe02a66
sub ecx, 0x6e2929f9
lea ebp, [rcx + 0x44de]
lea r9d, [rbp - 0xa07f]
jmp 0x14013279c
je 0x140132626
add byte [rsi - 0x70], ah
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
jmp 0x1401322e5
mul rbx
popfq
cmp r8d, 0x6a1fdfe1
rol edi, 0xe4
test r12, rcx
ret
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
jmp 0x140132637
je 0x1401328d4
test r9d, r9d
jne 0x14013214c
mov rax, qword [rax]
invalid
out 0xfc, eax