joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002720
Capabilities:
Encode data using xor

Disassembly:
add r15, 0xb3
dec rdi
xor rax, rax
or r11, 0x7e
xchg r12, r10
mov rdi, qword [rsp + rax]
pop r11
mov r12, r11
push r12
pop r13
mov r11, r13
push r11
mov r13, 0x7799923
mov r11, r12
mov rsi, 0x7744f77
add r15, r12
xor r13, rsi
dec r15
sub rdi, r13
pop rbx
mov rax, rbx
push rax
mov r12, 0x1bed56c7
shl rsi, 0xd
push rax
pop rbx
mov r11, 0x1be324af
lea rsi, [rsi + 0x58]
cmp r10, rax
xor r12, r11
and r10, rsi
cmp rsi, r10
add r12, rdi
ror r11, 0x39
nop
mov r13, qword [r12]
inc r15
xor rax, 0xbc
mov r11, 0x64fd87d6
addps xmm14, xmm3
xor rbx, 0xc4
mov rsi, 0x64e90fa6
dec rbx
add r12, 0xb6
xor r11, rsi
add r12, 0x16
xchg rbx, r12
add r11, rdi
add r10, r15
mov r10, rsi
mov r15, 0x7b4ec95a
mov r14, rdi
mov rsi, 0x7b4e6df9
xor r14, rbx
xor r15, rsi
nop
add rbx, 0xf
mov rax, 0x82
shl r12, 0x1a
mov rsi, 0x8a
mov rdi, 0x86
add r12, r10
xor rsi, 0xd0
xor rax, rdi
lea rbx, [rbx + 0x42]
shr rsi, 0x21
push r11
rol r14, 0x19
push r15
inc rsi
inc r10
push r13
inc r14
and r10, rbx
sub rsp, 0x20
test rsi, r10
mov rcx, r11
dec rbx
mov rdx, r15
xchg r11, r14
xchg r12, rdi
mov r8, rax
rol rdi, 0x17
lea r9, [rsp]
mov rdi, rsi
call r13
mov rax, rbx
mov rax, VariantTimeToDosDateTime
add rsp, 0x20
addps xmm13, xmm12
shl rdi, 0x12
pop rsi
ror r13, 0x1a
pop rbx
or r14, 0x40
pop r12
dec r13
test rdi, rax
xor rax, rax
add r15, r10
sub r15, 0x2b
lea r13, [r12 + rax]
shr r11, 3
xchg r11, rdi
mov r15b, byte [r13]
xor rdi, r14
xor r15b, 0x69
pop r11
mov r14, r11
push r14
or r10, r11
add r15b, 0x93
rol r14, 0x15
add r14, 0x5a
mov byte [r13], r15b
push r14
pop r11
inc rax
xorps xmm15, xmm14
cmp rax, rbx
mov rdi, 0xf5
mov r14, r10
jne 0x140002890
or r10, 0x72
addps xmm10, xmm1
mov rax, 9
shr r13, 0x2c
and r13, 0xcc
mov r14, 0x29
shr r11, 0x30
shr r10, 0x14
xor rax, r14
dec r10
push r12
nop
xor r10, 0xa3
sub rsp, 0x20
or r15, r13
add r13, r15
mov rcx, r12
cmp r10, r13
mov r13, r10
mov rdx, rbx
rol r15, 0xe
mov r8, rax
mov r15, rbx
and r10, rax
lea r9, [rsp]
sub rbx, r12
test r14, rdi
call rsi
or r14, 0xd3
inc rdi
add rsp, 0x20
xchg r13, r12
cmp r13, rdi
ret
Function at 0x14000ad00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14000addb
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x14000ad4e
cmp rbx, qword [0x140127008]
ja 0x14000ad4e
sub rbx, 0x8000000
jmp 0x14000add2
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000addb
cmp dword [rsp + 0x40], 0x10000
jne 0x14000adb6
cmp qword [rsp + 0x38], 0x10000
jb 0x14000adb6
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000addd
sub rbx, 0x10000
jmp 0x14000add2
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x14000ad30
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14000adf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x14000ae12
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x14000aecd
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x14000ae3e
cmp rbx, qword [0x140127008]
ja 0x14000ae3e
add rbx, 0x8000000
jmp 0x14000aec4
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000aecd
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x14000aea9
cmp rcx, 0x10000
jb 0x14000aea9
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000aecf
add rbx, 0x10000
jmp 0x14000aec4
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x14000aec4
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x14000ae20
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000aee0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x14000af02
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x14000af1e
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x14000af35
cmp byte [rcx + 1], 0x25
jne 0x14000af79
movsxd rax, dword [rcx + 2]
add rcx, 6
jmp 0x14000af41
cmp al, 0xe9
jne 0x14000af79
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
cmp rcx, rbx
jae 0x14000af64
cmp rcx, 0xffffffff80000000
jae 0x14000af5b
lea rsi, [rcx + 0x7ff80000]
jmp 0x14000af79
mov rsi, 0xfffffffffff80000
jmp 0x14000af79
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x14000af79
mov edi, 0x80000
mov rdx, qword [0x14012d2c8]
mov rax, qword [0x14012d2b8]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x14000afa0
test rax, rax
je 0x14000afb7
mov rdx, rax
mov qword [0x14012d2c8], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x14000afb7
cmp rcx, rdi
jb 0x14000afb7
cmp rcx, rsi
jbe 0x14000b0fa
mov qword [0x14012d2c8], rax
mov rdx, rax
test rax, rax
je 0x14000aff2
test rax, rax
je 0x14000afe2
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x14000afe2
cmp rax, rdi
jb 0x14000afe2
cmp rax, rsi
jbe 0x14000b0fa
mov rdx, qword [rdx + 8]
mov qword [0x14012d2c8], rdx
test rdx, rdx
jne 0x14000afcb
movzx eax, bx
movabs rbp, 0xffffffff40000000
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x14000b02b
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.14000ad00
mov rdx, rax
test rax, rax
jne 0x14000b0a8
cmp rbx, rbp
jae 0x14000b04b
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.14000adf0
mov rdx, rax
test rax, rax
jne 0x14000b0a8
cmp rbx, 0x40000000
jbe 0x14000b062
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.14000adf0
mov rdx, rax
test rax, rax
jne 0x14000b0a8
cmp rbx, rbp
jae 0x14000b07e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.14000ad00
mov rdx, rax
test rax, rax
jne 0x14000b0a8
mov rdx, rbx
mov rcx, rdi
call fcn.14000ad00
mov rdx, rax
test rax, rax
jne 0x14000b0a8
mov rdx, rsi
mov rcx, rbx
call fcn.14000adf0
mov rdx, rax
test rax, rax
je 0x14000b131
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x14012d2c8], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x14012d2b8]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x14012d2b8], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x14000b0e2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x14000b131
cmp rax, rsi
ja 0x14000b131
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x1400e8980]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x14000b133
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b3a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x14000b3ce
xor al, al
jmp 0x14000b410
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x14000b3df
xor al, al
jmp 0x14000b410
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x14000b406
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x14000b406
mov al, 1
jmp 0x14000b410
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x14000b8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x14012d2c0], 0
jne 0x14000b987
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x14012d2c0], ecx
jne 0x14000b987
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x14012d2b8]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x14012d2f0], rdi
mov qword [0x14012d2e8], rdi
mov qword [0x14012d2e0], rdi
test rbx, rbx
je 0x14000b970
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000b968
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14000b940
jmp 0x14000b970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x14012d2d8], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x14000bfb0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x14012d2d8]
mov rdi, rcx
test eax, eax
jne 0x14000c04e
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x14000bfda
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, InitCommonControls
mov qword [rsp + 0x30], rbx
call fcn.1400dc988
mov rbx, rax
test rax, rax
jne 0x14000bff6
lea edi, [rax + 8]
jmp 0x14000c014
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14000c032
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call fcn.1400dc980
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x14012d2d8], edi
mov qword [0x14012d2e0], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x14012d2e8]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x14012d2e8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ef20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000ef95
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000ef95
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000ef85
nop
cmp rbx, rcx
jae 0x14000ef95
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000ef70
cmp rbx, rcx
jae 0x14000ef95
cmp word [rbx], 0
je 0x14000ef95
mov rax, rbx
jmp 0x14000ef97
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001c060
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x160
mov rbp, rdx
mov rbx, rcx
xor esi, esi
mov dword [rax + 8], esi
mov edi, 1
mov eax, edi
xchg byte [rcx], al
add rdx, 0x50
call fcn.14001b490
lea rdx, [rbp + 0x10]
cmp qword [rdx + 0x10], rsi
je 0x14001c0b5
cmp qword [rdx + 0x18], 0x10
jb 0x14001c0a8
mov rdx, qword [rdx]
lea rcx, [0x1400eaa80]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor ecx, ecx
call qword [0x1400e8220]
test al, al
je 0x14001c0f6
xor r9d, r9d
mov r8d, 0xa9
lea rdx, str.D:jenkinsworkspaceci.dingding.manual.newDingTalk_Winwin_source_appDingTalkSnippingTool_snipping_tool_application.cpp
lea rcx, [rsp + 0x50]
call qword [0x1400e8218]
nop
mov dword [rsp + 0x170], edi
lea rcx, [rax + 8]
lea rdx, str.SnippingToolApplication::Run__
call fcn.14000f940
jmp 0x14001c0fd
mov edi, dword [rsp + 0x170]
test dil, 1
je 0x14001c10e
lea rcx, [rsp + 0x50]
call qword [0x1400e8210]
mov rdx, rbp
mov rcx, rbx
call fcn.14001b310
call fcn.14001dd20
mov rdx, rbp
mov rcx, rax
call fcn.14001ec30
lea rcx, [rsp + 0x20]
call qword [0x1400e80f0]
nop
mov rcx, rax
call qword [0x1400e80e0]
nop
lea rcx, [rsp + 0x20]
call qword [0x1400e80e8]
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], rsi
test rdi, rdi
je 0x14001c167
mov rcx, rdi
call fcn.14007b150
mov rcx, rdi
call fcn.1400dc980
xor ecx, ecx
call fcn.14009a300
lea rdi, [rbx + 0xd8]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c1b8
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rdi]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14001c1b8
call qword [0x1400e81f8]
mov r8, qword [rsp + 0x168]
mov r9, rax
mov rdx, rdi
mov rcx, qword [rdi]
call qword [0x1400e8180]
mov rcx, qword [rdi]
call qword [0x1400e8190]
mov qword [rdi], rsi
xchg byte [rbx], sil
xor eax, eax
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140020720
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400207d6
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400207a2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400207ba
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400207ba
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x1400207ba
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14012d3a0], 0
jne 0x140020821
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020811
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012d398], rax
mov byte [0x14012d3a0], 1
jmp 0x140020828
mov rax, qword [0x14012d398]
mov byte [0x14012d3a0], 1
jmp 0x140020828
mov rax, qword [0x14012d398]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x1400207ab
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and byte [rdx], dh
jo str.C_l.K.F.H_D_y_y.e_.cd.qC6__kqKc_O.
and byte [r12 + r13*2 + 0x2e], dil
and byte cs:[rax + riz + 0x79], al
and byte [rcx + 0x2e], bh
cmp ebp, dword gs:[rsi]
invalid
Function at 0x140022170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140129718]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400221f5
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400221f5
call fcn.140020640
mov ebx, eax
jmp 0x14002231a
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140022216
call fcn.140020640
jmp 0x140022309
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140022239
call fcn.140020640
jmp 0x140022309
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14002225b
mov ebx, 0x8007000e
jmp 0x14002230b
mov ecx, eax
test eax, eax
je 0x140022290
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140022352
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140022290
lea rcx, [rsp + 0x60]
call fcn.140020490
jmp 0x14002229a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x1400222ad
cmp qword [rsp + 0x60], 0
jne 0x1400222bc
mov ebx, 0x8007000e
jmp 0x14002230b
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400222e6
call fcn.140020640
jmp 0x140022309
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140021c80
mov ebx, eax
test rdi, rdi
je 0x14002231a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140022331
lea rcx, [rsp + 0x60]
call fcn.140020860
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400dc960
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.14000d650
int3
Function at 0x140027650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
cmp byte [rcx + 0x2c], 0
jne 0x14002767f
xor al, al
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r15b, 1
mov byte [rcx + 0x2c], 0
lea rdi, [rcx + 0x30]
mov qword [rsp + 0x98], rdi
mov dl, 0x3b
mov rcx, rdi
call fcn.140051440
mov rcx, rdi
call fcn.1400514e0
mov r12, rax
mov rcx, rdi
call fcn.14001f0b0
mov r13d, eax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r14 + 1]
mov rcx, qword [rbx + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002770f
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x90]
mov r8d, r13d
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140027728
mov dword [rbx + 0x20], r14d
mov rcx, rdi
call fcn.140051400
mov qword [rbx + 0x48], r14
mov rsi, qword [rbx + 0x50]
mov qword [rbx + 0x50], r14
mov edi, 0xffffffff
test rsi, rsi
je 0x140027773
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140027773
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov eax, edi
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x140027773
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbx + 0x58], r14
mov rsi, qword [rbx + 0x60]
mov qword [rbx + 0x60], r14
test rsi, rsi
je 0x1400277ad
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400277ad
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov eax, edi
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x1400277ad
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbx + 0x90], r14
mov rsi, qword [rbx + 0x98]
mov qword [rbx + 0x98], r14
test rsi, rsi
je 0x1400277f0
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400277f0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov eax, edi
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x1400277f0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbx + 0xa0], r14
mov rsi, qword [rbx + 0xa8]
mov qword [rbx + 0xa8], r14
test rsi, rsi
je 0x140027831
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140027831
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx]
lock xadd dword [rsi + 0xc], edi
cmp edi, 1
jne 0x140027831
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
mov word [rbx + 0x1c4], 0x100
movzx eax, r15b
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140029990
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r15
mov rdi, rdx
mov qword [rsp + 0x20], rsi
mov eax, 0x55555556
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
imul r9d
mov ebp, r9d
xor r11d, r11d
mov eax, edx
xor esi, esi
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ebp, eax
test edx, edx
jle 0x140029a7c
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x28], r14
mov r14d, dword [rsp + 0x38]
add r14d, 0xfffffffc
mov ebx, edx
movzx ecx, byte [rdi + 1]
add esi, 4
movzx r9d, byte [rdi]
mov edx, ecx
movzx r10d, byte [rdi + 2]
mov eax, r9d
shr rax, 2
add rdi, 3
shl r9, 4
add r11d, 4
movzx eax, byte [rax + r15]
mov byte [r8], al
mov eax, ecx
shr rax, 4
mov ecx, r10d
or rax, r9
shr rcx, 6
and eax, 0x3f
movzx eax, byte [rax + r15]
mov byte [r8 + 1], al
lea rax, [rdx*4]
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + r15]
mov byte [r8 + 2], al
mov eax, r10d
and eax, 0x3f
movzx eax, byte [rax + r15]
mov byte [r8 + 3], al
add r8, 4
cmp esi, r14d
jle 0x140029a68
mov word [r8], 0xa0d
xor esi, esi
add r8, 2
add r11d, 2
sub rbx, 1
jne 0x1400299e0
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
cmp ebp, 1
jne 0x140029abf
movzx ecx, byte [rdi]
mov eax, ecx
and ecx, 3
shr rax, 2
add rcx, rcx
movzx eax, byte [rax + r15]
movzx ecx, byte [r15 + rcx*8]
mov byte [r8], al
lea eax, [r11 + 4]
mov byte [r8 + 1], cl
mov word [r8 + 2], 0x3d3d
mov byte [r8 + 4], 0
mov rbp, qword [rsp + 0x30]
pop r15
pop rdi
ret
cmp ebp, 2
jne 0x140029b1b
movzx r9d, byte [rdi + 1]
movzx edx, byte [rdi]
mov ecx, edx
mov eax, edx
shr rax, 2
and ecx, 3
shl rcx, 4
movzx eax, byte [rax + r15]
mov byte [r8], al
mov eax, r9d
shr rax, 4
and r9d, 0xf
or rcx, rax
mov word [r8 + 3], 0x3d
shl r9d, 2
movzx eax, byte [rcx + r15]
mov byte [r8 + 1], al
movzx eax, byte [r9 + r15]
mov byte [r8 + 2], al
lea eax, [r11 + 4]
mov rbp, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov rbp, qword [rsp + 0x30]
mov eax, r11d
mov byte [r8], 0
pop r15
pop rdi
ret

Function at 0x140029ec0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, vtable.DataCache::ICacheable.0
mov rdi, rcx
mov qword [rcx], rax
mov rbx, 0xffffffffffffffff
mov rcx, qword [rcx + 0x20]
cmp rcx, rbx
je 0x140029ef1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x20], rbx
mov rdx, qword [rdi + 0x18]
cmp dword [rdx - 0x10], 0
je 0x140029f08
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rdi + 0x18]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140029f1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140029f30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rax, vtable.DataCache::ICacheable.0
mov rbx, rcx
mov qword [rcx], rax
mov rdi, 0xffffffffffffffff
mov rcx, qword [rcx + 0x20]
mov esi, edx
cmp rcx, rdi
je 0x140029f68
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], rdi
mov rax, qword [rbx + 0x18]
cmp dword [rax - 0x10], 0
je 0x140029f7f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rbx + 0x18]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140029f96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, 1
je 0x140029fa4
mov rcx, rbx
call fcn.1400dc980
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret