joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e9f0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x150
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
test rcx, rcx
jne 0x14000ea2d
mov r8d, 0x104
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebp, eax
test eax, eax
jne 0x14000ea48
xor eax, eax
jmp 0x14000ead3
mov qword [rsp + 0x168], rbx
mov rcx, rbp
mov qword [rsp + 0x170], rsi
xor ebx, ebx
call fcn.140011d84
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x14000eab3
lea r9, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x20]
mov dword [rsp + 0x28], ebx
lea rdx, [0x140014c8c]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14000eab3
mov rcx, qword [rsp + 0x20]
mov ebx, dword [rcx + 8]
mov ecx, dword [rcx + 0xc]
shl rbx, 0x20
or rbx, rcx
test rsi, rsi
je 0x14000eac0
mov rcx, rsi
call fcn.140011760
mov rsi, qword [rsp + 0x170]
mov rax, rbx
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400115c0
mov rbp, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
ret

Function at 0x14000ee70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
lea r9, [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x140014a80]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x14000eede
lea r9d, [rbx + 0x10]
xor r8d, r8d
lea rdx, str.SHGetKnownFolderPath_FOLDERID_ProgramData__failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rdi + 0x18], 7
lea rdx, [0x140014bd8]
mov qword [rdi + 0x10], rbx
xor r8d, r8d
mov word [rdi], bx
jmp 0x14000ef0d
mov rdx, qword [rsp + 0x28]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rdx], bx
je 0x14000ef0a
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000ef00
mov r8, rbx
mov rcx, rdi
call fcn.14000cae0
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400115c0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000eff0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea r9, [rsp + 0x28]
xor edi, edi
lea rcx, [0x140014a90]
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x14000f069
lea r9d, [rdi + 0x10]
xor r8d, r8d
lea rdx, str.SHGetKnownFolderPath_FOLDERID_Documents__failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rbx + 0x18], 7
lea rdx, [0x140014bd8]
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov rcx, rbx
mov word [rbx], di
call fcn.14000cae0
jmp 0x14000f137
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp word [rdx], di
jne 0x14000f08b
mov r8, rdi
jmp 0x14000f09a
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], di
jne 0x14000f090
lea rcx, [rsp + 0x30]
call fcn.14000cae0
mov qword [rbx + 0x18], 7
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x10], rdi
mov rcx, rbx
mov word [rbx], di
call fcn.14000cd70
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14000f137
mov rcx, qword [rsp + 0x30]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x14000f0e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x14000f132
test byte [rsp + 0x30], 0x1f
je 0x14000f102
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000f112
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000f122
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14000f12f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140011a78
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400115c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14000f220
Capabilities:
Create directory

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [r11 - 0x48]
call fcn.14000f160
nop
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
xor bpl, bpl
lea rcx, str.shlwapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000f2b6
lea rdx, str.PathFileExistsW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f2a8
mov rcx, rdi
call rax
test al, al
setne bpl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test bpl, bpl
jne 0x14000f2e0
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x14000f2e0
mov rcx, rbx
call fcn.14000eff0
nop
lea rcx, [rsp + 0x30]
call fcn.140005800
jmp 0x14000f382
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
cmp qword [rbx + 0x18], 8
jb 0x14000f2f8
mov rax, qword [rbx]
jmp 0x14000f2fb
mov rax, rbx
mov word [rax], r14w
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000cd70
nop
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14000f382
inc rax
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x14000f336
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x14000f37d
test cl, 0x1f
je 0x14000f34d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000f35d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000f36d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14000f37a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140011a78
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400115c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000f3b0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x430], rax
movzx eax, r8b
lea rdi, str.True
test al, al
lea r8, str.False
mov rbx, rdx
lea rcx, [rsp + 0x230]
cmovne r8, rdi
lea rdx, [0x140015a04]
call fcn.14000f760
lea rax, str..Settings.ini
mov rdx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x230]
mov dword [rsp + 0x20], 0xff
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
lea r8, [rsp + 0x30]
mov edx, eax
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
inc rdx
cmp cx, word [rdi + rdx*2 - 2]
jne 0x14000f459
cmp rdx, 5
jne 0x14000f440
mov al, 1
jmp 0x14000f48b
lea rdx, [rsp + 0x30]
lea r8, str.true
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x14000f489
cmp rax, 5
jne 0x14000f470
mov al, 1
jmp 0x14000f48b
xor al, al
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400115c0
mov rbx, qword [rsp + 0x450]
add rsp, 0x440
pop rdi
ret
Function at 0x14000ff60
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor dil, dil
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x140010029
mov rdx, qword [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000ffac
mov rdx, qword [rdx]
mov r8, qword [rbx + 8]
cmp qword [r8 + 0x18], 8
jb 0x14000ffba
mov r8, qword [r8]
mov rax, qword [rbx + 0x20]
xor r9d, r9d
mov rcx, qword [rbx]
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rdx
xor edx, edx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14001001a
mov rcx, qword [rbx + 0x20]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400115c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
movabs rcx, 0x96fd8b3952d8fc27
movabs rdx, 0x1000
movabs r8, 0x3ed7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
add rdx, rax
add r8, rax
mov r9, rdx
xor qword [rdx], rcx
add rdx, 8
cmp rdx, r8
jb 0x140004034
jmp r9
Function at 0x14002e000
Capabilities:
Encode data using xor

Disassembly:
mov rcx, rdx
and al, 0x5f
mov qword [rax + 0x24], rsp
and byte [rdi + 0x41], dl
push rsi
push r15
sub rsp, 0x20
sbb dword [rcx - 0x74b2fff0], 0x6a
imul rbp, qword [rsp + 0x40], 0x48d08b4d
and cl, ch
mov rdx, qword [rbx]
mov edi, reloc.WS2_32.dll_inet_ntoa
jne 0x14002e093
cmp dword [rdx + 0x120090], 0
jbe 0x14002e093
mov rsi, qword [rdx + 0x50]
movabs byte [0x1c85000162aae8ce], al
add eax, 0x82c93304
or byte [rax - 0x27], cl
sbb byte [rax + 0x2b], r9b
adc byte [rbx + 0x9083], r9b
add byte [rax], ch
cmp ecx, eax
jae 0x14002e093
fmul qword [rbx + 0x50]
push rcx
add byte [rax], al
add al, ch
invalid
fstp xword [rbx - 0x1d]
ror dword [rdi], 0x87
xchg ebx, eax
add byte [rax], al
mov rsi, qword [rbx + 0x58]
mov rax, qword [rsi + 0x16287e8]
add byte [rbp - 0x3fd18a40], al
mov eax, dword [rsi + 0x18]
cmp rax, qword [rsi + 2]
je 0x14002e0a7
add dword [rax], eax
test eax, eax
jne 0x14002e0db
ror byte [rbx + 0x3b481846], 0x46
add dh, byte [rax + rsi*8 + 0x48]
invalid
movsxd rcx, dword [rbx + 0x20]
ror dword gs:[rax - 0x3f], 1
cli
add eax, dword [rcx - 0x12fff81f]
sub byte [rcx - 0x7c3600f9], 0xba
clc
inc ecx
mov eax, edi
sar eax, cl
clc
or byte [rdx + rsi], al
jmp 0x14002e130
sub dword [rsi + 0x3c], 1
jne 0x14002e064
cmp dword [rbx + 0x8ba8], 2
jne 0x14002e125
cmp dword [rbx + 0x24], 0x37
vpsadbw ymm9, ymm9, ymmword [rax]
sbb byte [rdx], cl
je 0x14002e104
test eax, 0xe8604b8b
xor ecx, esp
invalid
push 0x23e8604b
add dword gs:[rdi + 0x44], edx
invalid
mov rdx, rbx
mov rcx, rbp
call 0x1406c2e00
cmp dword [rbx + 0x24], 0xffffffff
mov rbp, qword [rdx + rcx*4 + 0x40]
je 0x14002e1dd
cmp dword [rbx + 0x10], 3
jne 0x14002e14f
cmp dword [rbx + 0x14], 3
ret
cmp dword [rbx + 0x267a8], 2
jne 0x14002e194
test rax, 0xffffffff8b486073
mov esp, 0x161cca2
add byte [rbp + 0x482c75c0], al
mov eax, dword [rsi + 0x18]
cmp rax, qword [rsi + 0x10]
je 0x14002e194
jb 0x14002e1d7
and al, 0x48
mov eax, ecx
sar rax, 3
invalid
cmp dword [rbx + 0x24], 0xffffffff
je 0x14002e1dd
test byte [rbx - 0x79], 4
jne 0x14002e1dd
cmp dword [rbx + 0xa8], 0xffffffc2
ja 0x14002e1dd
mov ah, 0x79
invalid
enter 0xffffffffffffa964, 0
mov ecx, dword [rbx + 0x90]
push rsi
sal dword [rbx + 0x20], 0x48
invalid
sar edi, cl
or byte [rsi + 0x38], sil
mov rbx, qword [rsp - 0x28]
mov rsi, qword [rsp + 0x58]
int1
jae 0x14002e1ae
and byte [rcx + 0x5f], al
pop r14
pop rdi
ret
Function at 0x14005d370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rbp - 6], ch
sar dword [r8 + rcx], 0x44
mov byte [rcx - 5], al
sar r8d, 8
invalid
mov qword [rbp + rax + 8], rbx
pop rsp
insb byte [rdi], dx
and al, 0x84
mov qword [rsp - 0x50], rsi
ja 0x14005d30a
jl 0x14005d3a7
and byte [rcx + 0x54], al
leave
push rbp
sbb edx, dword [rsi + 0x41]
xchg dword [rbx + rcx*4 - 7], ecx
mov r12d, 0x3598
sbb al, byte [r15 + 0x11]
add byte [rax], al
nop dword [rax + rax]
movzx ecx, byte [rdx + 5]
comiss xmm0, dword [rdx - 0x66]
movzx r8d, byte [rdx + 0x6e]
movzx r10d, byte [rdx + 2]
movzx r9d, byte [rdx + 4]
movzx r11d, byte [rdx + 3]
unpcklps xmm6, xmmword [rdx]
movzx edi, byte [rdx + 1]
lea rsp, [rdx + 0x8a25d08]
add r8d, eax
lea eax, [rcx + 1]
imul r14d, eax, 0x195
imul eax, r8d, 0x1e88c
or eax, ecx
loopne 0x14005d3ea
invalid
add r11d, dword [rdi]
shr r14d, 0x13
imul eax, r14d, 0x510
imul eax, esi, 0x510
jbe 0x14005d3a0
out dx, eax
rol dword [rcx - 0x3f], 0xe0
or byte [rbp - 0x5e], al
xor dword [rbp + rcx*4 - 0x29], eax
push rbx
or byte [rax + 0x416d4100], bl
add ch, byte [rcx + 0x67]
push rsp
push 0
add byte [rdx], dl
sub dword [rbx], edx
adc edx, dword [rbx - 0x3b]

Function at 0x140060c90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4cb
call fcn.14006f100
mov rbx, qword [rax - 0x38b79fdc]
add eax, 0x12fe54
add byte [rdx + 0x78], ch
add byte [rax - 0x75], cl
and al, 0x50
out 0xd, eax
sub eax, 0xbbcf
add rsp, 0x68
ret
sbb byte [rbx], bl
outsd dx, dword [rsi]
or byte [rdi + 0x48], dl
sub esp, 0x20
push rdi
mov rdx, rsi
call fcn.1400605a0
adc dword [rbx], esi
fisttp dword [rbp + rcx*4 + 0x15]
jno 0x140060c4a
or al, bl
test rbx, r11
je 0x1400641bb
mov r9d, 0x28
fimul dword [rbx - 0x6c4b6ea]
cmovb r9, rdi
test r9, r9
vmwrite rdx, qword [rbx + 0x49000900]
cmp ecx, 0x20
jb 0x140060cf3
lea rdx, [r10 - 1]
jno 0x140060d29
push rdx
dec dword [rax + 0x71]
dec qword [r9 + 0x31]
dec dword [rcx + 0x31]
ror dword [rcx + 3], 1
leave
cmp r10, rcx
jl 0x140060cef
cmp rcx, qword [rdi - 0x7225aed0]
shl eax, 0x8b
ror dword [rcx - 0x26], cl
loopne 0x140060cd9
fimul dword [rbp - 0x2c741f3f]
mov edx, ebx
invalid
xchg esi, eax
sub edx, edx
movhps qword [rax], xmm0
invalid
adc dword [eax], edx
pxor xmm1, xmm0
invalid
test dword [rcx - 0x3600f58c], ecx

Function at 0x14006cd48
Capabilities:
Encode data using xor

Disassembly:
mov cl, bl
call fcn.1400836c8
mov bh, byte [rsi + 0x13ebe8]
invalid
push rbx
and byte [rbx - 0x74b7df14], al
cmp eax, 0xed12b3
sbb byte [rbx + 0x48ca8bd9], cl
xor edx, dword [0x1400dfee0]
and ecx, 0x3f
jbe 0x14006cd31
cmp rdx, 0x54
jne 0x14006cd77
mov rcx, rbx
call 0x140713498
jmp 0x14006cde4
mov rdx, rbx
lea rcx, [0x1400dfeb5]
call fcn.140088e0c
add dword [rax], eax
sbb byte [r8 - 0x77], r9b

Function at 0x14007ca00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x29
mov ecx, reloc.WS2_32.dll_socket
call qword [0xe90952a0]
test eax, eax
je 0x14007ca1a
mov ecx, 0x30
int 0x29
mov r8d, 1
Function at 0x140085cb8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsi + 5], rax
or byte [rdi + 0x48], dl
sub esp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rsp, qword [rcx + 0x90]
test rcx, rcx
je 0x140085d00
call sym.imp.KERNEL32.dll_ReadFile
jno 0x140085ceb
invalid
add eax, 0x4d84d0
cmp rcx, rax
invalid
Function at 0x1800011f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
xor eax, eax
lea rdi, [rbp - 0x70]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rdi, [rsp + 0x70]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x68
call fcn.180001110
xor eax, eax
lea rdi, [rbp]
mov ecx, 0x20a
lea rdx, str._systemroot__system32_
rep stosb byte [rdi], al
lea rdi, [rsp + 0x60]
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp]
lea r9, [rbp + 0x630]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0x2080000
mov dword [rbp + 0x630], ebx
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1800012b8
cmp eax, 0xc0000023
je 0x1800012b8
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x1800013ae
mov eax, dword [rbp + 0x630]
shr eax, 1
dec eax
cmp eax, 0x102
ja 0x1800013ae
xor eax, eax
lea rdi, [rbp + 0x210]
mov ecx, 0x410
rep stosb byte [rdi], al
movzx ecx, word [rbp]
lea rdx, [rbp + 0x210]
test cx, cx
je 0x180001314
lea rdi, [rbp]
lea rax, [rbp + 0x210]
sub rdi, rax
nop dword [rax + rax]
movzx eax, word [rdi + rdx + 2]
mov word [rdx], cx
add rdx, 2
movzx ecx, ax
test ax, ax
jne 0x180001300
mov word [rdx], bx
lea rax, [rbp + 0x210]
cmp word [rbp + 0x210], bx
je 0x180001330
add rax, 2
cmp word [rax], bx
jne 0x180001327
lea rdi, str.cmd.exe
mov edx, 0x63
sub rdi, rax
nop
movzx ecx, word [rdi + rax + 2]
lea rax, [rax + 2]
movzx edx, cx
test cx, cx
jne 0x180001340
lea rax, [rsp + 0x70]
lea rdx, str.boom1_cccNfBQbWYTzdSZ6Nmjlh8q0wpYQ2MGfYuOEz8RjPcH7oOrYvcYVLVfCn7chF4t4zRube13G_2B4Lf1F7zISWWol6Jl13oY4sLgMYJuvcOODWIegz3RkzBlldgXDvC_2F94vJSiUq3DqKi4Yk09ZrL4GMd6ssrXwlW_2F68UQVx7Ph4Y0wwVyPbtoSC19QH0ErC59zLgIQjdz14nOKNy1SKwDp4jKt3Vq2pQUT8ndNRrqrRwjgCjmvyGTqwu_2FQ_2F5H8XNrAPdmE
lea rcx, str.C:UsersIsabelAppDataLocalTemp627.exe
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [0x180004210]
test eax, eax
je 0x1800013ae
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800106c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800106f0
xor eax, eax
jmp 0x1800107b3
mov rbp, rbx
cmp word [rax], si
je 0x180010715
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800106fc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800106f8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800105e0
movsxd r14, eax
test eax, eax
jne 0x180010753
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800106e9
mov rcx, r14
call fcn.18000d048
mov rdi, rax
test rax, rax
jne 0x18001076c
xor ecx, ecx
call fcn.18000d00c
jmp 0x180010748
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800105e0
test eax, eax
jne 0x18001079d
mov rcx, rdi
call fcn.18000d00c
jmp 0x1800107a7
xor ecx, ecx
call fcn.18000d00c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800179d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800179f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800179f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002580
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400025a1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400025ce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400025d0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002629
test ecx, ecx
jle 0x140002609
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002629
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002629
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al