joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1419c6c10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
sub r10, r8
mov r11d, r9d
cmp rdx, 0x20
jb 0x1419c6c93
mov qword [rsp + 0x10], rbx
lea rbx, [r8 + 0x10]
mov qword [rsp], rdi
mov edi, 0x10
sub rdi, r8
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + r10 - 0x10]
add r11, 0x20
movdqu xmm2, xmmword [rbx + r10]
lea rbx, [rbx + 0x20]
movdqa xmm1, xmm0
lea rax, [rdi + rbx]
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqa xmm0, xmm2
psllw xmm0, 8
psrlw xmm2, 8
xorps xmm0, xmm2
movdqu xmmword [rbx - 0x20], xmm0
movdqu xmmword [rbx - 0x30], xmm1
cmp rax, rdx
jbe 0x1419c6c40
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [r11 + 0x10]
cmp rax, rdx
ja 0x1419c6cbc
movdqu xmm0, xmmword [r11 + rcx]
movdqa xmm1, xmm0
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqu xmmword [r11 + r8], xmm1
mov r11, rax
cmp r11, rdx
jae 0x1419c6cea
lea rax, [r11 + r8]
cmp r9, 0x10
jae 0x1419c6cea
movzx ecx, word [r10 + rax]
add r9, 2
ror cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x1419c6cc5
mov rax, rdx
add rsp, 8
ret

Function at 0x1419eec40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r15, rdx
mov rbp, rcx
mov r12, qword [rcx + 0x28]
test r8, r8
js 0x1419eed94
xor ebx, ebx
cmp qword [rcx + 0xa8], rbx
je 0x1419eed06
nop dword [rax + rax]
mov r8, rsi
sub r8, rbx
lea rcx, [rbx + r15]
mov r9, qword [rbp + 0xa8]
mov edx, 1
call fcn.141af3a2c
mov rdi, rax
mov rcx, qword [rbp + 0xa8]
call fcn.141af36cc
test eax, eax
setne r14b
test eax, eax
je 0x1419eecb9
test rdi, rdi
je 0x1419eece6
add rbx, rdi
test eax, eax
jne 0x1419eed48
test rdi, rdi
jne 0x1419eecd8
call fcn.141af3348
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x1419eece0
xor ecx, ecx
cmp rbx, rsi
setl cl
test ecx, ecx
jne 0x1419eec80
jmp 0x1419eed48
mov rcx, qword [rbp + 0xa8]
call fcn.141aefaac
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0xa8]
call fcn.141af3d44
jmp 0x1419eed48
cmp dword [rcx + 0xd0], 0xffffffff
je 0x1419eed5a
nop
mov rax, rsi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r15]
mov ecx, dword [rbp + 0xd0]
call fcn.141af49c4
movsxd rcx, eax
test eax, eax
jle 0x1419eed41
add rbx, rcx
cmp rbx, rsi
jl 0x1419eed10
cmp ecx, 0xffffffff
setne r14b
test r14b, r14b
jne 0x1419eede6
test rbx, rbx
jne 0x1419eede6
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1419d1740
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.1419ec8c0
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1419eede6
mov ecx, ebx
lock xadd dword [rax], ecx
cmp ecx, 1
jmp 0x1419eedcf
mov edx, 0x16
lea rcx, [rsp + 0x20]
call fcn.1419d1740
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.1419ec8c0
nop
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1419eede6
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419eede6
mov r8d, 8
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1419f1cd0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov rbx, rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
setne dil
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1419f1d67
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f1d67
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1419f1d8f
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x1419f1d8f
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.1419a7030
test esi, esi
jne 0x1419f1dad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], 2
mov rcx, qword [rsp + 0x78]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1419f2090
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movzx esi, r8b
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x20], 2
lea rax, [0x14007a0e0]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, 1
lea rdx, [rsp + 0x20]
call fcn.141992b50
mov r14d, 0x5c
test al, al
je 0x1419f2102
mov r8d, 1
movzx edx, r14w
mov rcx, rbx
call fcn.14198c0f0
cmp rax, 3
jle 0x1419f2278
cmp qword [rbx + 0x10], 2
jne 0x1419f2118
mov rax, qword [rbx + 8]
cmp word [rax + 2], 0x3a
je 0x1419f2278
mov rdi, 0xffffffffffffffff
test sil, sil
je 0x1419f217f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1419fb780
nop
lea rcx, [rsp + 0x20]
call fcn.141993d90
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1419f2174
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f2174
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
test esi, esi
je 0x1419f217f
mov al, 1
jmp 0x1419f227a
mov r9d, 1
mov r8, rdi
movzx edx, r14w
mov rcx, rbx
call fcn.14198eb50
nop
cmp eax, 1
jl 0x1419f2278
movsxd r8, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14198ebe0
nop
mov r8b, 1
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.1419f2090
test al, al
je 0x1419f2249
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1419fb780
nop
lea rcx, [rsp + 0x20]
call fcn.141993d90
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1419f2217
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f2217
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
test esi, esi
je 0x1419f221f
mov bl, 1
jmp 0x1419f224b
mov byte [rsp + 0x98], 0
lea rdx, [rsp + 0x98]
mov rcx, rbx
call fcn.1419f4940
test al, al
je 0x1419f2249
cmp byte [rsp + 0x98], 0
je 0x1419f2249
mov bl, 1
jmp 0x1419f224b
xor bl, bl
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1419f2273
lock xadd dword [rax], edi
cmp edi, 1
jne 0x1419f2273
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x40]
call fcn.1419a7030
movzx eax, bl
jmp 0x1419f227a
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1419f2530
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x28]
call fcn.141988e80
nop
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1419f256b
mov eax, dword [rax]
cmp eax, 1
jle 0x1419f2580
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1419903c0
mov rdx, qword [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp eax, 0x104
jbe 0x1419f25da
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.141992360
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1419f25b6
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x1419f25cb
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1419903c0
mov rdx, qword [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp ebx, 2
jb 0x1419f2623
mov rax, qword [rsp + 0x30]
cmp word [rax + 2], 0x3a
jne 0x1419f2623
movzx ecx, word [rax]
call fcn.141993420
mov esi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1419f2606
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x1419f261b
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1419903c0
mov rax, qword [rsp + 0x30]
mov word [rax], si
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.141992360
movzx r8d, byte [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1419ec960
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1419f2670
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419f2670
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.1419a7030
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1419f4940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x141b3ab80]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
mov qword [rsp + 0x28], r8
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0x30], r9
test rax, rax
je 0x1419f498e
lock inc dword [rax]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
cmp r9, 2
jne 0x1419f49ab
cmp word [r8 + 2], 0x3a
jne 0x1419f49ab
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.141989d60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1419fb780
nop
lea rcx, [rsp + 0x38]
call fcn.141993d90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1419f4a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1419f49e5
cmp eax, 0x20
jne 0x1419f4a1e
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x60], xmm0
movq rax, xmm1
test rax, rax
je 0x1419f4a08
lock inc dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1419f3a50
test al, al
cmovne ebx, dword [rsp + 0x70]
test rdi, rdi
je 0x1419f4a2b
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x1419f4a34
xor bl, bl
jmp 0x1419f4a3a
shr ebx, 4
and bl, 1
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1419f4a6a
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419f4a6a
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.1419a7030
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1419f4a92
lock xadd dword [rax], edi
cmp edi, 1
jne 0x1419f4a92
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
movzx eax, bl
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.141ae2a00
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2d0
pop rdi
ret
Function at 0x1419f61a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
call fcn.1419ecf60
test al, al
je 0x1419f6202
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x1400f03d8]
mov qword [rsp + 0x38], rax
lea rdx, [0x14007a6a8]
lea rcx, [rsp + 0x20]
call fcn.141998bd0
call fcn.141af3348
mov dword [rax], 0x16
xor al, al
jmp 0x1419f630d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1419ed210
nop
xor edi, edi
mov r9d, 1
xor r8d, r8d
movzx edx, di
mov rcx, rax
call fcn.14198e1d0
mov rbp, rax
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1419f6258
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f6258
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
cmp rbp, 0xffffffffffffffff
je 0x1419f629c
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x1400f03d8]
mov qword [rsp + 0x38], rax
lea rdx, [0x14007a6d0]
lea rcx, [rsp + 0x20]
call fcn.141998bd0
call fcn.141af3348
mov dword [rax], 0x16
xor al, al
jmp 0x1419f630d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
setne sil
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1419f62eb
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1419f62eb
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
test edi, edi
jne 0x1419f6309
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 2
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1419f6320
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov r14, rdx
mov rsi, rcx
call fcn.1419ecf60
test al, al
je 0x1419f6388
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f03d8]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a6a8]
lea rcx, [rbp - 0x28]
call fcn.141998bd0
call fcn.141af3348
mov dword [rax], 0x16
xor al, al
jmp 0x1419f6534
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1419ed210
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.14198e1d0
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1419f63db
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f63db
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1419a7030
cmp r15, 0xffffffffffffffff
je 0x1419f641e
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f03d8]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a6d0]
lea rcx, [rbp - 0x28]
call fcn.141998bd0
call fcn.141af3348
mov dword [rax], 0x16
xor al, al
jmp 0x1419f6534
mov rcx, r14
call fcn.1419ecf60
test al, al
jne 0x1419f634b
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1419ed210
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.14198e1d0
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1419f647a
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f647a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1419a7030
cmp r15, 0xffffffffffffffff
jne 0x1419f63e1
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1419f64ee
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f64ee
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1419a7030
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x1419f6514
lock xadd dword [rax], edi
cmp edi, 1
jne 0x1419f6514
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.1419a7030
test ebx, ebx
jne 0x1419f6530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1419f6550
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov r14, rdx
mov rsi, rcx
call fcn.1419ecf60
test al, al
je 0x1419f65b8
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f03d8]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a6a8]
lea rcx, [rbp - 0x28]
call fcn.141998bd0
call fcn.141af3348
mov dword [rax], 0x16
xor al, al
jmp 0x1419f676a
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1419ed210
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.14198e1d0
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1419f660b
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f660b
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1419a7030
cmp r15, 0xffffffffffffffff
je 0x1419f664e
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f03d8]
mov qword [rbp - 0x10], rax
lea rdx, [0x14007a6d0]
lea rcx, [rbp - 0x28]
call fcn.141998bd0
call fcn.141af3348
mov dword [rax], 0x16
xor al, al
jmp 0x1419f676a
mov rcx, r14
call fcn.1419ecf60
test al, al
jne 0x1419f657b
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1419ed210
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.14198e1d0
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1419f66aa
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f66aa
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1419a7030
cmp r15, 0xffffffffffffffff
jne 0x1419f6611
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1419ed210
nop
mov rcx, rax
call fcn.141993d90
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1419f6724
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x1419f6724
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x40]
call fcn.1419a7030
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x1419f674a
lock xadd dword [rax], edi
cmp edi, 1
jne 0x1419f674a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.1419a7030
test ebx, ebx
jne 0x1419f6766
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x1419f6850
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1419fb780
nop
mov rcx, rax
call fcn.141993d90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1419f68a7
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1419f68a7
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1419a7030
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x1419f70a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rbp, rdx
mov r14, rcx
xor sil, sil
xor edi, edi
call fcn.1419ecf00
test al, al
je 0x1419f714d
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1419ecae0
mov rcx, qword [rax + 8]
movzx ecx, word [rcx]
call fcn.141993420
lea ecx, [rax - 0x41]
mov ebx, 1
shl ebx, cl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1419f713b
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419f713b
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1419a7030
and ebx, edi
setne sil
neg ebx
sbb edi, edi
and edi, 0x14
jmp 0x1419f7225
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1419ed210
nop
mov qword [rsp + 0x20], 7
lea rax, [0x14007a730]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.141992b50
test al, al
je 0x1419f71f8
mov rdx, qword [rsp + 0x38]
mov r9d, ebx
mov r8d, 7
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.14198e1d0
test eax, eax
jle 0x1419f71e2
mov rdx, qword [rsp + 0x38]
inc eax
movsxd r8, eax
mov r9d, ebx
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.14198e1d0
test eax, eax
jle 0x1419f71e2
mov rcx, qword [rsp + 0x40]
dec rcx
cdqe
cmp rax, rcx
jne 0x1419f71f8
lea rcx, [rsp + 0x30]
call fcn.1419f7470
test al, al
je 0x1419f71f8
mov edi, 0x10
movzx esi, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1419f7225
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419f7225
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1419a7030
test sil, sil
je 0x1419f724f
mov dword [rbp + 0x10], edi
test dil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or ecx, dword [rbp + 4]
bts ecx, 0x16
mov dword [rbp + 4], ecx
or dword [rbp], 0x560000
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1419f7270
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov r12, rcx
xor r13d, r13d
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov dword [rbp - 0x3c], r13d
mov dword [rbp - 0x40], r13d
mov rsi, qword [rbp + 0x50]
mov rcx, r12
call fcn.141993d90
mov rcx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x38]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov r15d, eax
test eax, eax
je 0x1419f72f3
cmp eax, 0xea
jne 0x1419f742b
mov rdi, qword [rbp - 0x38]
mov r14d, 1
cmp dword [rbp + 0x58], r14d
jb 0x1419f742b
test rbx, rbx
je 0x1419f741a
cmp dword [rdi + 8], 0
jne 0x1419f741a
mov r8, 0xffffffffffffffff
mov rdx, qword [rdi]
lea rcx, [rbp - 0x18]
call fcn.14198daf0
nop
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x28], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov eax, dword [rbp + 0x50]
or eax, 5
mov dword [rbp + 0x50], eax
test al, 2
je 0x1419f7388
and dword [rbp + 0x50], 0xfffffffd
test rsi, rsi
je 0x1419f7388
mov eax, 0xffffffff
lock xadd dword [rsi], eax
cmp eax, 1
jne 0x1419f7388
mov edx, 2
mov r8d, 8
mov rcx, rsi
call fcn.1419a7030
nop
mov eax, dword [rbp + 0x50]
test al, 1
je 0x1419f73bf
and dword [rbp + 0x50], 0xfffffffe
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1419f73bf
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419f73bf
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.1419a7030
nop
lea r8, [rbp - 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.141980880
mov rax, qword [rbx]
test rax, rax
je 0x1419f73de
mov ecx, dword [rax]
cmp ecx, 1
jle 0x1419f73ef
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.141980310
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1419f741a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1419f741a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.1419a7030
add rdi, 0x18
inc r14d
cmp r14d, dword [rbp + 0x58]
jbe 0x1419f7307
mov rcx, qword [rbp - 0x38]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r15d, 0xea
je 0x1419f72a7
test r15d, r15d
sete al
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1419f7e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9, rdx
test r8, r8
je 0x1419f7eb6
mov r9, qword [0x141b3d9d8]
mov rax, qword [0x141b3f1c0]
bt rax, 8
jae 0x1419f7eb6
mov rax, qword [0x141b3f1c0]
test al, 0x20
jne 0x1419f7b40
cmp rdx, 8
jbe 0x1419f7dd0
jmp 0x1419f7f60
Function at 0x1419f7f20
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
test r8, r8
je 0x1419f7f56
nop dword [rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
shl edx, 4
add edx, eax
mov eax, edx
shr edx, 0x17
and edx, 0x1e0
xor edx, eax
and edx, 0xfffffff
sub r8, 1
jne 0x1419f7f30
mov eax, edx
ret