joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402d8570
Capabilities:
Check if file exists
Get hostname

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, r8
mov dword [rbp - 0x41], r9d
mov rdi, rdx
lea r8, [rbp - 0x55]
xor esi, esi
xor edx, edx
mov ecx, r9d
mov dword [rbp - 0x55], esi
mov r14d, r9d
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x51], eax
mov r15d, eax
test ebx, ebx
je 0x1402d863b
cmp eax, 0xea
je 0x1402d863b
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1402d8615
lea rcx, str.The_preliminarily_call_to_GetComputerNameEx___to_get_the_buffer_size_failed._Return_empty_machine_name
mov dword [rbp - 0x59], r15d
mov qword [rbp - 0x49], rcx
lea rdx, [0x14044e636]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000789c
mov rdx, r12
mov rcx, rdi
call fcn.14007d520
lea r8, [rbp - 0x51]
mov dword [rbp - 0x59], esi
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.1402d7ff8
xor al, al
jmp 0x1402d8767
mov edx, dword [rbp - 0x55]
lea rcx, [rbp - 0x39]
call fcn.1400ab794
mov rdx, qword [rbp - 0x39]
lea r8, [rbp - 0x55]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x1402d86cd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov dword [rbp - 0x51], eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1402d86ac
lea rcx, str.The_call_to_GetComputerNameEx___failed._Return_empty_machine_name
mov dword [rbp - 0x59], ebx
mov qword [rbp - 0x49], rcx
lea rdx, [0x14044e636]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000789c
mov rdx, r12
mov rcx, rdi
call fcn.14007d520
lea r8, [rbp - 0x51]
lea rdx, [rbp - 0x55]
lea rcx, [rbp - 0x41]
call fcn.1402d7ff8
jmp 0x1402d875b
mov rdx, qword [rbp - 0x39]
lea rcx, [rbp - 1]
call fcn.14008c350
xor r8d, r8d
lea rcx, [rbp - 0x21]
mov rdx, rax
call fcn.1400763d0
lea rdx, [rbp - 0x21]
mov rcx, rdi
call fcn.14008aed0
lea rcx, [rbp - 0x21]
call fcn.14007a7c0
lea rcx, [rbp - 1]
call fcn.14007a7c0
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1402d8758
cmp qword [rdi + 0x18], 8
mov dword [rbp - 0x59], r14d
jb 0x1402d871f
mov rdi, qword [rdi]
lea rcx, str.Machine_Name_is_extracted_Successfully
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rcx
lea rdx, [0x1404565c4]
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140005ba8
mov sil, 1
lea rcx, [rbp - 0x39]
call fcn.1400f6764
mov al, sil
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140112420
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402d878c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rsi, rcx
mov dword [rbp - 0x45], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp + 0x27]
lea rdx, [rbp - 0x45]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
nop dword [rax + rax]
xor edi, edi
test eax, eax
jne 0x1402d8884
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov dword [rbp - 0x49], eax
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1402d882a
lea rcx, str.Failed_to_read_machine_sid___couldnt_retrieve_computer_name
mov dword [rbp - 0x41], ebx
mov qword [rbp - 1], rcx
lea rdx, [0x14044f770]
lea rcx, [rbp - 0x41]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 1]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000615c
test ebx, ebx
jle 0x1402d8837
movzx ebx, bx
or ebx, 0x80070000
xorps xmm0, xmm0
mov qword [rbp - 0x11], rdi
xorps xmm1, xmm1
mov qword [rbp - 0x29], rdi
lea rcx, [rsi + 0x168]
mov dword [rbp - 9], ebx
lea rdx, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
movdqu xmmword [rbp - 0x39], xmm1
call fcn.1402d7c80
lea rcx, [rbp - 0x21]
call fcn.14007a750
lea rcx, [rbp - 0x39]
call fcn.14007a750
lea rdx, [rbp - 0x49]
call fcn.1402d7f80
xor al, al
jmp 0x1402d891d
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14008c350
lea rdx, [0x1404007c0]
lea rcx, [rbp + 7]
call fcn.140077830
cmp qword [rbp + 0x1f], 8
lea rdx, [rbp + 7]
xorps xmm0, xmm0
mov qword [rbp - 0x29], rdi
cmovae rdx, qword [rbp + 7]
lea r8, [rbp - 0x39]
lea rcx, [rbp + 0x27]
movdqu xmmword [rbp - 0x39], xmm0
call fcn.140262358
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x49], eax
lea rcx, [rbp - 0x21]
mov ebx, eax
call fcn.140077400
lea rcx, [rsi + 0x168]
mov dword [rbp - 9], ebx
lea rdx, [rbp - 0x21]
call fcn.1402d7c80
lea rcx, [rbp - 0x21]
call fcn.14007a750
test ebx, ebx
jns 0x1402d8905
lea rdx, [rbp - 0x49]
call fcn.1402d7f80
jmp 0x1402d8908
mov dil, 1
lea rcx, [rbp - 0x39]
call fcn.14007a750
lea rcx, [rbp + 7]
call fcn.14007a7c0
mov al, dil
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402d894c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x118
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x1402d8a80
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
movzx r9d, word [rbp + 0x76]
movzx r8d, word [rbp + 0x74]
and dword [rsp + 0x4c], 0
mov dword [rbx + 0x1a8], eax
mov al, byte [rbp + 0x7a]
mov byte [rbx + 0x1b4], al
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x1ac], ecx
mov dword [rbx + 0x1b0], edx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
nop dword [rax + rax]
test eax, eax
je 0x1402d8a0a
mov eax, dword [rsp + 0x4c]
mov qword [rbx + 0x1b8], rax
mov al, 1
jmp 0x1402d8af6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x48], eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1402d8a74
mov dword [rsp + 0x40], ebx
lea rcx, str.Failed_getting_OS_product_info
mov qword [rsp + 0x50], rcx
test ebx, ebx
jle 0x1402d8a43
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x30], rcx
lea rdx, [0x140456633]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000794c
lea rdx, [rsp + 0x48]
call fcn.1402d7f08
jmp 0x1402d8af4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x40], eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1402d8aea
mov dword [rsp + 0x48], ebx
lea rcx, str.Failed_getting_OS_version_info
mov qword [rsp + 0x50], rcx
test ebx, ebx
jle 0x1402d8ab9
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x30], rcx
lea rdx, [0x140456633]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000794c
lea rdx, [rsp + 0x40]
call fcn.1402d7cb0
xor al, al
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret
Function at 0x1402d8bc0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rbp + 0xf]
call fcn.14008c350
lea rdx, str.UNKNOWN
lea rcx, [rbp - 0x11]
call fcn.14008c350
lea rdx, str.ReleaseId
lea rcx, [rbp - 0x31]
call fcn.14008c350
lea rax, [rbp - 0x49]
mov qword [rsp + 0x38], 0xffffffff80000002
mov dword [rsp + 0x30], 0x4000000
lea r9, [rbp + 0xf]
lea r8, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0x2f]
call fcn.1400aa6d0
mov rdx, rax
lea rcx, [rbx + 0x188]
call fcn.14008aed0
lea rcx, [rbp + 0x2f]
call fcn.14007a7c0
lea rcx, [rbp - 0x31]
call fcn.14007a7c0
lea rcx, [rbp - 0x11]
call fcn.14007a7c0
lea rcx, [rbp + 0xf]
call fcn.14007a7c0
lea rdx, str.UNKNOWN
lea rcx, [rbx + 0x188]
call fcn.140295378
test eax, eax
je 0x1402d8c90
mov al, 1
jmp 0x1402d8cfe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov dword [rbp - 0x3d], eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1402d8cf3
mov dword [rbp - 0x45], ebx
lea rcx, str.Failed_getting_OS_release_ID
mov qword [rbp - 0x39], rcx
test ebx, ebx
jle 0x1402d8cc6
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rbp - 0x45]
mov dword [rbp - 0x41], ebx
mov qword [rsp + 0x30], rcx
lea rdx, [0x140456633]
lea rcx, [rbp - 0x39]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000794c
lea rdx, [rbp - 0x3d]
call fcn.1402d7e18
xor al, al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rbp
ret
Function at 0x1402d8e50
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp - 8], rax
lea rbx, [rcx + 0x1d0]
mov rsi, rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
lea rdx, [0x1403a9f84]
mov qword [rbp - 0x40], rbx
lea rcx, [rbp - 0x38]
call fcn.14008c350
lea rdx, [rsi + 8]
mov r9d, 3
lea r8, [rbp - 0x38]
call fcn.1402d8570
lea rcx, [rbp - 0x38]
mov dil, al
call fcn.14007a7c0
lea rdx, [0x1403a9f84]
lea rcx, [rbp - 0x38]
call fcn.14008c350
lea rdx, [rsi + 0x28]
mov r9d, 2
lea r8, [rbp - 0x38]
call fcn.1402d8570
lea rcx, [rbp - 0x38]
mov bl, al
call fcn.14007a7c0
mov rcx, rsi
call fcn.1402d8d24
mov r14b, al
mov rcx, rsi
and r14b, bl
and r14b, dil
call fcn.1400aa518
mov rcx, rsi
and r14b, al
call fcn.1402d81e8
lea rdi, [rsi + 0x118]
mov rcx, rsi
mov rdx, rdi
call fcn.1400cd338
mov r15b, al
cmp al, 1
jne 0x1402d84df
mov rdx, rdi
lea rcx, [rbp - 0x38]
lea rbx, [rsi + 0x128]
call fcn.140095930
mov rdx, rax
mov rcx, rbx
call fcn.14008aed0
lea rcx, [rbp - 0x38]
call fcn.14007a7c0
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.14009e99c
mov rdx, rax
lea rcx, [rsi + 0x148]
call fcn.1400bf910
lea rcx, [rbp - 0x38]
call fcn.1400bfa74
mov rcx, rsi
call fcn.1402d878c
and al, r15b
mov rcx, rsi
and r14b, al
call fcn.1402d894c
mov rcx, rsi
and r14b, al
call fcn.1402d8bc0
mov rcx, rsi
and r14b, al
call fcn.1402d8b20
mov bl, al
mov dword [rsi + 0x1c0], 1
lea rcx, [rbp - 0x38]
and bl, r14b
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx ecx, word [rbp - 0x38]
mov word [rsi + 0x1c4], cx
lea rcx, [rbp - 0x40]
call fcn.1400ccc30
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rcx + 8]
jmp 0x1402d83b4
Function at 0x1402dd130
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 3
lea rcx, [rsp + 0x20]
call fcn.1400920a8
nop
movdqa xmm0, xmmword [0x1403a9cf0]
movdqu xmmword [rbp + 0x30], xmm0
xor eax, eax
mov word [rbp + 0x20], ax
mov edx, 0x104
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140091e60
mov rcx, rax
lea rdx, [0x1403a9ce8]
call fcn.140091e60
mov rcx, rax
lea rdx, str.Driversmssecflt.sys
call fcn.140091e60
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14010ff00
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14008aed0
lea rcx, [rbp + 0x40]
call fcn.14007a7c0
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.1400ce428
lea rcx, [rdi + 0x50]
mov rdx, rax
call fcn.1400bf910
lea rcx, [rbp + 0x40]
call fcn.1400bfa74
nop
lea rcx, [rbp + 0x20]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x20]
call fcn.1400fa2f0
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402de9e0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
movzx eax, word [0x1404e6248]
mov rbx, rcx
test ax, ax
jne 0x1402dea2a
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx edx, word [rbp - 0x18]
xor eax, eax
lock cmpxchg word [0x1404e6248], dx
movzx edx, word [0x1404e6248]
test dx, dx
jne 0x1402dea2a
call fcn.14007e73c
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
lea r9, [rbp + 0x30]
lea rax, [rbp + 0x38]
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
nop dword [rax + rax]
test eax, eax
jne 0x1402dea78
call fcn.14007e73c
jmp 0x1402deb68
mov ecx, dword [rbp + 0x2c]
mov eax, dword [rbp + 0x28]
mov r8, qword [rbx + 8]
shl rcx, 0x20
add rcx, rax
test r8, r8
jne 0x1402deab9
mov eax, dword [rbp + 0x30]
mov qword [rbx + 8], rcx
mov ecx, dword [rbp + 0x34]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rbp + 0x38]
mov qword [rbx + 0x10], rcx
mov ecx, dword [rbp + 0x3c]
shl rcx, 0x20
add rcx, rax
mov qword [rbx + 0x18], rcx
jmp 0x1402deb68
cmp rcx, r8
jbe 0x1402deb68
mov eax, dword [rbp + 0x30]
xorps xmm1, xmm1
mov r9d, dword [rbp + 0x34]
mov r10d, dword [rbp + 0x3c]
shl r9, 0x20
add r9, rax
shl r10, 0x20
mov eax, dword [rbp + 0x38]
add r10, rax
mov rdx, r10
sub rdx, qword [rbx + 0x18]
sub rdx, qword [rbx + 0x10]
add rdx, r9
js 0x1402deaf8
cvtsi2sd xmm1, rdx
jmp 0x1402deb0d
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
mov rdx, rcx
xorps xmm0, xmm0
sub rdx, r8
js 0x1402deb1f
cvtsi2sd xmm0, rdx
jmp 0x1402deb34
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
movzx eax, word [0x1404e6248]
divsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov qword [rbx + 8], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x18], r10
mov qword [rbx + 0x10], r9
divsd xmm1, xmm0
mulsd xmm1, qword [0x1403acc08]
call fcn.1402dee64
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret

Function at 0x1402deb80
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 8], rax
jmp fcn.1402de9e0
Function at 0x1402e02f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x1402e0313
mov rcx, qword [rcx]
mov edx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1402e03db
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1402e0370
lea rcx, str.Failed_to_wait_for_SenseCncProxy_to_become_ready
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x78], 0x80004005
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
lea rdx, [0x140456e30]
mov rcx, rax
call fcn.14000789c
and dword [rsp + 0x68], 0
or edx, 0xffffffff
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
lea rdx, [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
call fcn.1402df0c4
nop
mov eax, dword [rsp + 0x68]
lea rdx, [rdi + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x38]
call fcn.1402df41c
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1402e03d4
call fcn.14007e3e0
mov eax, 0x800705b4
jmp 0x1402e03dd
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1402e6280
Capabilities:
Decode data using base64 via winapi

Disassembly:
sub rsp, 0x48
mov rax, qword [r8 + 8]
sub rax, qword [r8]
neg rax
mov eax, dword [rcx + 0x10]
sbb r9, r9
and r9, qword [r8]
cmp qword [rcx + 0x18], 8
jb 0x1402e62a1
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
mov r8d, 1
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdx
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
nop dword [rax + rax]
test eax, eax
setne al
add rsp, 0x48
ret
Function at 0x1402f2960
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rbx, rcx
lea rsi, [rdx + 0x2c]
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.14008c350
nop
lea rcx, [rbp - 0x28]
call fcn.1400ba3b4
mov rdx, qword [rbx]
add rdx, 0x10
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.140086d00
test al, al
je 0x1402f23cf
call fcn.140091ae4
cmp dword [rax], 5
jbe 0x1402f2343
mov qword [rbp - 0x30], rsi
mov ecx, dword [rdi + 8]
mov dword [rbp - 0x40], ecx
lea rcx, str.Process_is_already_running._Terminate_it
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
lea rdx, [0x140458115]
mov rcx, rax
call fcn.140008b90
mov r8d, dword [rdi + 8]
xor edx, edx
mov ecx, 0x100401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x38], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1402f23c5
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
je 0x1402f23c5
cmp dword [rbp - 0x40], 0x103
jne 0x1402f23c5
mov edx, 0x42b
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
test eax, eax
jne 0x1402f23a7
call fcn.14007e73c
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x1402f23c5
call fcn.14007e73c
nop
lea rcx, [rbp - 0x38]
call fcn.1400f0310
nop
lea rcx, [rbp - 0x28]
call fcn.14007a7c0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
add rcx, 8
jmp 0x1402f229c
Function at 0x1402f3460
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0xf], rdx
cmp qword [rcx + 0x18], 8
jb 0x1402f3496
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1402f3567
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x1402f34c5
movzx edi, ax
or edi, 0x80070000
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1402f3515
mov dword [rbp - 9], edi
cmp qword [rbx + 0x18], 8
jb 0x1402f34dc
mov rbx, qword [rbx]
mov qword [rbp + 7], rbx
lea rcx, str.DLP_event_failed_to_remove_temporary_extracted_from_archive_file
mov qword [rbp - 1], rcx
lea rcx, [rbp - 9]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 7]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 1]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044a262]
mov rcx, rax
call fcn.140005ba8
mov edx, edi
lea rcx, [rbp - 1]
call fcn.1401f6aa0
mov rdi, rax
mov rbx, qword [rsi]
lea rdx, str.DeleteFileExtractedFromArchiveHr
lea rcx, [rbp + 0x17]
call fcn.14008c350
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbx + 0xc0]
call fcn.1400a9ccc
mov rcx, rax
mov rdx, rdi
call fcn.14007370c
nop
lea rcx, [rbp + 0x17]
call fcn.14007a7c0
nop
lea rcx, [rbp - 1]
call fcn.14007fb38
nop
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1402f3575
call fcn.14007e3e0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14030d4e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov rbx, rcx
mov r9d, dword [rcx + 0x9c]
xor r14d, r14d
mov edx, dword [rbx + 0x94]
mov esi, dword [rbx + 0x58]
mov ecx, dword [rbx + 0x44]
sub esi, edx
add ecx, 0xfffffefa
sub esi, r9d
add ecx, edi
cmp edx, ecx
jb 0x14030d59f
mov rcx, qword [rbx + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov r8d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], edi
sub dword [rbx + 0x94], edi
sub dword [rbx + 0x84], edi
lea rdx, [rax + r8*2]
lea rdx, [rdx - 2]
movzx ecx, word [rdx]
movzx eax, cx
sub ax, di
cmp ecx, edi
cmovb ax, r14w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x14030d558
mov rax, qword [rbx + 0x60]
mov r8d, edi
lea rdx, [rax + rdi*2]
lea rdx, [rdx - 2]
movzx ecx, word [rdx]
movzx eax, cx
sub ax, di
cmp ecx, edi
cmovb ax, r14w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x14030d580
add esi, edi
mov rcx, qword [rbx]
cmp dword [rcx + 8], r14d
je 0x14030d619
mov edx, dword [rbx + 0x9c]
mov r8d, esi
mov eax, dword [rbx + 0x94]
add rdx, rax
add rdx, qword [rbx + 0x50]
call fcn.14030dbd4
add dword [rbx + 0x9c], eax
mov r9d, dword [rbx + 0x9c]
cmp r9d, 3
jb 0x14030d603
mov eax, dword [rbx + 0x94]
mov rdx, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
cmp r9d, 0x106
jae 0x14030d619
mov rax, qword [rbx]
cmp dword [rax + 8], r14d
jne 0x14030d50d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret