joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140001380
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rdi, rsp
movabs rcx, 0x28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov byte [rsp + 0x48], 0x10
mov byte [rsp + 0x49], 0x2e
mov byte [rsp + 0x4a], 0x21
mov byte [rsp + 0x4b], 0xf
mov byte [rsp + 0x4c], 0x1d
mov byte [rsp + 0x4d], 0x33
mov byte [rsp + 0x4e], 0x37
mov byte [rsp + 0x4f], 0
mov byte [rsp + 0x50], 0x37
mov byte [rsp + 0x51], 0xc
mov byte [rsp + 0x52], 0x29
mov byte [rsp + 0x53], 0x15
mov byte [rsp + 0x54], 0x2a
mov byte [rsp + 0x55], 0x36
mov byte [rsp + 0x56], 0x1c
mov byte [rsp + 0x57], 0x22
mov byte [rsp + 0x58], 0x34
mov byte [rsp + 0x59], 0x3b
mov byte [rsp + 0x5a], 0
mov eax, 0x47
mov word [rsp + 0x78], ax
mov eax, 0x45
mov word [rsp + 0x7a], ax
mov eax, 0x54
mov word [rsp + 0x7c], ax
xor eax, eax
mov word [rsp + 0x7e], ax
mov byte [rsp + 0x38], 1
lea rax, str.GGOGi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 9
mov r8d, 8
mov edx, 7
xor ecx, ecx
call fcn.14000100f
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xb0]
call rax
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14001ad30]
call fcn.1400023b0
mov rax, rdi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140002390
add rsp, 0xa0
pop rdi
ret
Function at 0x140001500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140001500
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rdi, rsp
movabs rcx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x48], 0x2e
mov byte [rsp + 0x49], 0x1f
mov byte [rsp + 0x4a], 0x1a
mov byte [rsp + 0x4b], 0xa
mov byte [rsp + 0x4c], 0xd
mov byte [rsp + 0x4d], 0xd
mov byte [rsp + 0x4e], 6
mov byte [rsp + 0x4f], 0x27
mov byte [rsp + 0x50], 0x27
mov byte [rsp + 0x51], 0x17
mov byte [rsp + 0x52], 0x1d
mov byte [rsp + 0x53], 0x24
mov byte [rsp + 0x54], 0x11
mov byte [rsp + 0x55], 0x33
mov byte [rsp + 0x56], 0xc
mov byte [rsp + 0x57], 0x1c
mov byte [rsp + 0x58], 5
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x5a], 0
mov eax, 0x75
mov word [rsp + 0x78], ax
mov eax, 0x6d
mov word [rsp + 0x7a], ax
mov eax, 0x6f
mov word [rsp + 0x7c], ax
mov eax, 0x50
mov word [rsp + 0x7e], ax
mov eax, 0x51
mov word [rsp + 0x80], ax
mov eax, 0x4f
mov word [rsp + 0x82], ax
mov eax, 0x75
mov word [rsp + 0x84], ax
mov eax, 0x68
mov word [rsp + 0x86], ax
mov eax, 0x78
mov word [rsp + 0x88], ax
mov eax, 0x64
mov word [rsp + 0x8a], ax
xor eax, eax
mov word [rsp + 0x8c], ax
mov byte [rsp + 0x38], 1
lea rax, str.yvtBy
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 0xb
mov edx, 0xa
xor ecx, ecx
call fcn.14000100f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call rax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14001ade0]
call fcn.1400023b0
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140002390
add rsp, 0xb0
pop rdi
ret
Function at 0x1400016c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400016c0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rdi, rsp
movabs rcx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x48], 0x33
mov byte [rsp + 0x49], 0x33
mov byte [rsp + 0x4a], 0x14
mov byte [rsp + 0x4b], 0x3b
mov byte [rsp + 0x4c], 0x27
mov byte [rsp + 0x4d], 0x10
mov byte [rsp + 0x4e], 0x2a
mov byte [rsp + 0x4f], 0x28
mov byte [rsp + 0x50], 0x16
mov byte [rsp + 0x51], 0x30
mov byte [rsp + 0x52], 1
mov byte [rsp + 0x53], 0x33
mov byte [rsp + 0x54], 0xc
mov byte [rsp + 0x55], 0x16
mov byte [rsp + 0x56], 1
mov byte [rsp + 0x57], 1
mov byte [rsp + 0x58], 0x29
mov byte [rsp + 0x59], 0xa
mov byte [rsp + 0x5a], 0x1c
mov byte [rsp + 0x5b], 0x3d
mov byte [rsp + 0x5c], 0x17
mov byte [rsp + 0x5d], 0x3f
mov byte [rsp + 0x5e], 0
mov byte [rsp + 0x38], 1
lea rax, str.dZzsS
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x17
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf
mov r8d, 0xe
mov edx, 0xd
xor ecx, ecx
call fcn.14000100f
xor edx, edx
mov rcx, qword [rsp + 0x90]
call rax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14001ae40]
call fcn.1400023b0
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140002390
add rsp, 0x80
pop rdi
ret
Function at 0x1400017f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400017f0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rdi, rsp
movabs rcx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x48], 0x23
mov byte [rsp + 0x49], 0x11
mov byte [rsp + 0x4a], 0x19
mov byte [rsp + 0x4b], 0x21
mov byte [rsp + 0x4c], 0x30
mov byte [rsp + 0x4d], 0
mov byte [rsp + 0x4e], 8
mov byte [rsp + 0x4f], 0x25
mov byte [rsp + 0x50], 0xc
mov byte [rsp + 0x51], 0x25
mov byte [rsp + 0x52], 0x10
mov byte [rsp + 0x53], 0x3c
mov byte [rsp + 0x54], 0x16
mov byte [rsp + 0x55], 0x1d
mov byte [rsp + 0x56], 0x25
mov byte [rsp + 0x57], 0
mov byte [rsp + 0x78], 0x22
mov byte [rsp + 0x79], 0x2e
mov byte [rsp + 0x7a], 0x14
mov byte [rsp + 0x7b], 0x31
mov byte [rsp + 0x7c], 0x38
mov byte [rsp + 0x7d], 1
mov byte [rsp + 0x7e], 0x37
mov byte [rsp + 0x7f], 0x39
mov byte [rsp + 0x80], 0x15
mov byte [rsp + 0x81], 0x23
mov byte [rsp + 0x82], 6
mov byte [rsp + 0x83], 0x22
mov byte [rsp + 0x84], 0x32
mov byte [rsp + 0x85], 0x18
mov byte [rsp + 0x86], 0x22
mov byte [rsp + 0x87], 0x11
mov byte [rsp + 0x88], 0x2b
mov byte [rsp + 0x89], 0x1f
mov byte [rsp + 0x8a], 0
mov byte [rsp + 0x38], 1
lea rax, str.txwiD
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x12
mov r8d, 0x11
mov edx, 0x10
xor ecx, ecx
call fcn.14000100f
mov r11, rax
mov rax, qword [rsp + 0xc0]
mov qword [rax], r11
mov byte [rsp + 0x38], 1
lea rax, [0x14001ab30]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x13
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x15
mov r8d, 0x14
mov edx, 0x13
xor ecx, ecx
call fcn.14000100f
mov r11, rax
mov rax, qword [rsp + 0xc0]
mov qword [rax + 8], r11
mov rcx, rsp
lea rdx, [0x14001aee0]
call fcn.1400023b0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140002390
add rsp, 0xb0
pop rdi
ret
Function at 0x140002be3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1400023aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400023a6
repz ret
ror rcx, 0x10
jmp 0x140002b3c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140022580]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140022678]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002bc1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140022580]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140002be3
mov rax, qword [rsp + 0x88]
mov qword [0x140022678], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140022618], rax
mov rax, qword [0x140022678]
mov qword [0x1400224f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140022600], rax
mov dword [0x1400224e0], 0xc0000409
mov dword [0x1400224e4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140021008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140022578], eax
mov ecx, 1
call fcn.140004e20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001b358]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140022578], 0
jne 0x140002c6a
mov ecx, 1
call fcn.140004e20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003864
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400056a0
nop
cmp dword [0x140022aa8], 1
je 0x140003810
mov dword [0x140022aa4], 1
mov byte [0x140022aa0], r12b
test ebx, ebx
jne 0x1400037fc
mov rcx, qword [0x1400235b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400037e9
mov rcx, qword [0x1400235a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140003788
call fcn.140004930
cmp qword [rdi], rax
jne 0x140003788
jmp 0x14000376e
cmp rdi, rsi
jb 0x1400037e9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140004930
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400235b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400235a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400037c7
cmp r13, rax
je 0x1400037e7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000376e
lea rdx, [0x14001a778]
lea rcx, [0x14001a668]
call fcn.140003528
lea rdx, [0x14001a998]
lea rcx, [0x14001a888]
call fcn.140003528
nop
test r12d, r12d
je 0x14000381f
mov ecx, 8
call fcn.140005580
test r12d, r12d
jne 0x14000384a
mov dword [0x140022aa8], 1
lea ecx, [r12 + 8]
call fcn.140005580
mov ecx, r15d
call fcn.1400034bc
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400036d8

Function at 0x140003870
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400036d8
Function at 0x1400068a8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140004930
xor ebx, ebx
mov rdi, rax
cmp qword [0x140023188], rbx
jne 0x1400069ae
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140006a83
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006a83
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140023188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140023190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140023198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400231a8], rax
test rax, rax
je 0x1400069a5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400231a0], rax
jmp 0x1400069b5
mov rax, qword [0x1400231a0]
jmp 0x1400069bc
mov rax, qword [0x1400231a0]
mov r11, qword [0x1400231a8]
cmp rax, rdi
je 0x140006a24
cmp r11, rdi
je 0x140006a24
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400231a8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140006a24
test rax, rax
je 0x140006a24
call rsi
test rax, rax
je 0x140006a1e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140006a1e
test byte [rsp + 0x38], 1
jne 0x140006a24
bts ebp, 0x15
jmp 0x140006a62
mov rcx, qword [0x140023190]
cmp rcx, rdi
je 0x140006a62
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140006a62
call rax
mov rbx, rax
test rax, rax
je 0x140006a62
mov rcx, qword [0x140023198]
cmp rcx, rdi
je 0x140006a62
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140006a62
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140023188]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140006a83
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140006a85
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140003080
Capabilities:
Copy file
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov rdi, rcx
jbe 0x1400030bb
mov rdx, qword [rdx]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x1400030da
cmp eax, 0x50
je 0x1400030da
cmp eax, 0xb7
jne 0x14000323e
lea r8, [0x1400097d0]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140005620
cmp qword [rsp + 0x78], 7
lea r8, [rsp + 0x60]
mov edx, 0x104
lea rcx, [rbp + 0x190]
cmova r8, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
cmp qword [rbx + 0x18], 7
jbe 0x14000311b
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rbp - 0x80]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
cmp rcx, 0x20a
jae 0x14000325f
xor ebx, ebx
mov word [rbp + rcx + 0x190], bx
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
cmp rcx, 0x20a
jae 0x14000325f
lea rax, [rbp - 0x80]
mov word [rbp + rcx - 0x80], bx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
lea rax, [rbp + 0x190]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov eax, 0x614
mov qword [rsp + 0x30], 2
mov word [rsp + 0x48], ax
movdqu xmmword [rsp + 0x4a], xmm0
mov dword [rsp + 0x5a], ebx
mov word [rsp + 0x5e], bx
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rdx, qword [rsp + 0x78]
test eax, eax
sete bl
cmp rdx, 7
jbe 0x140003217
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003212
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003212
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007518
movzx eax, bl
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140007220
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x28
call fcn.1400074dc
lea rdx, [0x14000bf98]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call fcn.140007348
int3
Function at 0x140003850
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x42
lea rdx, str.C:Usersgw14florencejakeAppDataRoamingMicrosoftWindowsThemes
lea rcx, [rsp + 0x30]
call fcn.140005f80
nop
lea rcx, [rsp + 0x30]
call fcn.140003460
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400038d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007518
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x42
lea rdx, str.C:Usersgw14florencejakeAppDataRoamingMicrosoftWindowsThemes
lea rcx, [rsp + 0x30]
call fcn.140005f80
nop
lea r8, str.:.jOS_System_data_school_computeruser_appdata_roamingwallpaper
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005620
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140003080
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140003963
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000395e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000395e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007518
movdqa xmm0, xmmword [0x14000a0c0]
movdqu xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov word [rsp + 0x50], bx
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400039bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007518
mov dword [rsp + 0x28], 9
mov qword [rsp + 0x20], rbx
lea r9, str._f__im_explorer.exe
lea r8, str.taskkill
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], 9
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.explorer.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x70
pop rbx
ret
Function at 0x140004340
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140004368
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000438e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004390
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400043e9
test ecx, ecx
jle 0x1400043c9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400043e9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400043e9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140004410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140004432
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140004448
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140004464
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004466
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400044a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000453e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400044dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000451e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000453e
cmp rbx, rax
ja 0x1400044f0
test rbx, rbx
je 0x14000453e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400049a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400049cd
xor eax, eax
jmp 0x140004b39
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140004a07
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140004a07
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140004b39
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140004b2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140004a4a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140004a75
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140004b31
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004ae4
sub eax, 1
je 0x140004ae4
cmp eax, 2
jne 0x140004b2c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140004b31
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140004b12
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140004b2c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140004b31
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140007220
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret