joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ced4
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dl, 1
add rsp, 0x20
pop rbp
jmp 0x14008ced4
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
mov rbp, rsp
push rdi
push r12
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x1400c8590]
xor rax, rsp
mov qword [rbp - 0x30], rax
mov r15b, dl
mov rdi, rcx
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008d08c
test al, 0x10
je 0x14008d08c
xor r12d, r12d
test rdi, rdi
jne 0x14008d052
mov ebx, r12d
lea rcx, [rsp + 0x70]
mov r8, rdi
mov edx, 0x10a
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
mov eax, 0x5c
cmp word [rsp + rbx*2 + 0x6e], ax
je 0x14008cf56
mov word [rsp + rbx*2 + 0x70], ax
add rbx, rsi
lea rdi, [rbx + rbx]
lea r14, [rsp + 0x70]
lea r8, [0x14010b170]
add r14, rdi
mov edx, 4
mov rcx, r14
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
lea rbx, [rbx*2 + 8]
cmp rbx, 0x214
jae 0x14008d0be
xor edx, edx
lea rcx, [rsp + 0x38]
mov word [rsp + rbx + 0x70], r12w
lea r8d, [rdx + 0x30]
call sub.MSVCR100.dll_memset
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov eax, 0x614
mov qword [rsp + 0x30], r12
mov word [rsp + 0x50], ax
mov dword [rsp + 0x38], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x14008cffa
mov dword [rsp + 0x28], eax
xor edx, edx
lea rax, [rsp + 0x70]
lea r9, str.Recursively_deleting_the_converter_output_directory__ls_failed__err___d
lea r8d, [rdx + 0x14]
mov ecx, 0x20660e
mov qword [rsp + 0x20], rax
call fcn.140056e9c
mov sil, r12b
test r15b, r15b
je 0x14008d04d
cmp rdi, 0x214
jae 0x14008d0b6
lea rcx, [rsp + 0x70]
mov word [r14], r12w
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14008d04d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea r9, str.Removing_the_converter_output_directory__ls_failed__err___d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
lea r8d, [rdx + 0x14]
mov ecx, 0x20660f
mov qword [rsp + 0x20], rax
call fcn.140056e9c
mov sil, r12b
mov al, sil
jmp 0x14008d08e
mov r14d, 0x105
mov rcx, rdi
mov edx, r14d
call qword [sym.imp.MSVCR100.dll_wcsnlen]
mov rbx, rax
cmp rax, r14
jne 0x14008cf2f
xor edx, edx
lea r9, str.Path_is_too_long:__s
mov ecx, 0x20660d
lea r8d, [rdx + 0x14]
mov qword [rsp + 0x20], rdi
call fcn.140056e9c
xor al, al
mov rcx, qword [rbp - 0x30]
xor rcx, rsp
call fcn.1400056f0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor ecx, ecx
call fcn.140005dc4
int3
xor ecx, ecx
call fcn.140005dc4
int3
Function at 0x14008d148
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 1
mov rbx, rcx
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x14008d1b1
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14008d1b1
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008d1b1
cmp word [rax + 2], si
je 0x14008d1b1
cmp dword [rax + 0x28], 0xfeef04bd
jne 0x14008d1b1
add rax, 0x30
jmp 0x14008d1b8
lea rax, [0x14010b2d8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret

Function at 0x14008de88
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
push rbp
mov rbp, rsp
push rbx
sub rsp, 0x88
mov rax, qword [0x1400c8590]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
lea rax, [r11 - 0x30]
mov word [rsp + 0x74], 0x500
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [r11 - 0x78], r9d
mov r9d, r8d
mov r8d, edx
mov dl, cl
lea rcx, [r11 - 0x28]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14008df16
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], ebx
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400056f0
add rsp, 0x88
pop rbx
pop rbp
ret
Function at 0x14008dfa0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400c8590]
xor rax, rsp
mov qword [rbp - 0x20], rax
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov rsi, rcx
test rcx, rcx
jne 0x14008e005
mov ecx, 0x15b3c8
call fcn.14002cdf4
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008dffe
and qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14008e187
cmp dword [0x14017d0f0], 0
je 0x14008e020
mov eax, dword [0x140178fb0]
mov dword [rcx], eax
mov eax, 1
jmp 0x14008e187
and dword [rcx], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14008e051
mov ecx, 0x15b3c9
call fcn.14002cdf4
xor ebx, ebx
jmp 0x14008e16f
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
lea rax, [rsp + 0x30]
lea ebx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008e07d
mov ecx, 0x15b3ca
jmp 0x14008e045
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14008e08f
mov ecx, 0x15b3cb
jmp 0x14008e045
mov ecx, dword [rsp + 0x30]
xor edx, edx
call fcn.14002d1f4
mov rdi, rax
test rax, rax
jne 0x14008e0a9
mov ecx, 0x15b3cc
jmp 0x14008e045
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14008e0dd
mov ecx, 0x15b3cd
call fcn.14002cdf4
xor ebx, ebx
jmp 0x14008e167
xor edx, edx
lea rcx, [rsp + 0x51]
mov byte [rsp + 0x50], 0
lea r8d, [rdx + 0x43]
call sub.MSVCR100.dll_memset
xor edx, edx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea ecx, [rdx + 0xb]
mov dword [rsp + 0x40], 0x44
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x14008e11a
mov ecx, 0x15b3ce
jmp 0x14008e0d1
xor r15d, r15d
lea ebx, [r15 + 1]
cmp dword [rdi], r15d
jbe 0x14008e159
lea r14, [rdi + 8]
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14008e149
mov rdx, qword [r14]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14008e157
add r15d, ebx
add r14, 0x10
cmp r15d, dword [rdi]
jae 0x14008e159
jmp 0x14008e12a
mov dword [rsi], ebx
mov dword [0x14017d0f0], ebx
mov eax, dword [rsi]
mov dword [0x140178fb0], eax
mov rcx, rdi
call fcn.14002d25c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008e185
and qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400056f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14008efac
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
push r14
push r15
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp edx, 0x104
jge 0x14008efda
call fcn.14002d1b0
int3
xor r14d, r14d
mov word [rcx], r14w
call fcn.14008d0c8
test eax, eax
je 0x14008f00d
mov rdx, rdi
mov ecx, esi
call fcn.14000b878
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov edx, esi
mov rcx, rdi
call fcn.14008f100
test eax, eax
jne 0x14008f01f
xor eax, eax
jmp 0x14008eff4
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x14008f023
test ebx, ebx
jg 0x14008f03d
mov ecx, 0x14428f
call fcn.14002cdf4
jmp 0x14008f01b
movsxd rax, ebx
mov r15d, 0x5c
cmp word [rdi + rax*2 - 2], r15w
je 0x14008f059
cmp ebx, esi
je 0x14008f01b
mov word [rdi + rax*2], r15w
inc ebx
lea eax, [rbx + 0xc]
cmp eax, ebx
jl 0x14008f0f7
movsxd rcx, eax
mov eax, 0x80000000
mov edx, 0xffffffff
inc rcx
add rax, rcx
cmp rax, rdx
ja 0x14008f0f0
cmp ecx, esi
jg 0x14008f01b
mov rax, qword [str.Content.MSO]
movsxd rcx, ebx
mov qword [rdi + rcx*2], rax
mov rax, qword [0x14010b388]
mov qword [rdi + rcx*2 + 8], rax
mov rax, qword [0x14010b390]
mov qword [rdi + rcx*2 + 0x10], rax
mov rcx, rdi
call fcn.14008cda0
test eax, eax
jne 0x14008f0dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rdi
call fcn.14008a2d0
mov rcx, rdi
or eax, 2
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [rbx + 0xb]
mov eax, 1
movsxd rdx, ecx
mov dword [rdi + rdx*2], r15d
jmp 0x14008eff4
call qword [sym.imp.MSVCR100.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.MSVCR100.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14008f100
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov r8d, edx
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [str._bI_r_]
call fcn.14000bdd8
test eax, eax
je 0x14008f130
mov rcx, rbx
call fcn.14008cda0
jmp 0x14008f142
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
lea r8d, [r9 + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rbp
ret
Function at 0x14008f5e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x20
and dword [r9], 0
mov r14, r9
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14008f646
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008f646
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14008f646
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rbp
ret

Function at 0x1400909b8
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
push r12
push r13
push r14
push r15
sub rsp, 0x60
and dword [r11 + 8], 0
cmp dword [rcx + 0x3c], 0
mov edi, r9d
mov r12, r8
mov r14, rdx
mov r15, rcx
je 0x140090a40
cmp edi, 0x40000
jb 0x140090a40
mov rcx, qword [rcx + 0x30]
and qword [r11 - 0x58], 0
and qword [r11 - 0x48], 0
lea rax, fcn.14005f464
mov qword [r11 - 0x40], r8
lea r9, [r11 - 0x58]
mov qword [r11 - 0x50], rax
mov rax, qword [rbp + 0x38]
mov r8d, edi
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x50]
mov qword [r11 - 0x68], rax
call fcn.140091110
mov rdx, qword [rbp + 0x30]
mov ecx, dword [rsp + 0x30]
mov ebx, eax
add dword [rdx], ecx
jmp 0x140090b17
mov r13, qword [rbp + 0x38]
mov ecx, 0x10000
mov esi, ecx
cmp edi, ecx
cmovb esi, edi
and qword [rsp + 0x50], 0
mov rax, r14
shr rax, 0x20
cmp qword [r13 + 8], 0
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x4c], eax
je 0x140090a79
mov rcx, r13
call fcn.14008f7c8
mov ebx, eax
jmp 0x140090a7b
xor ebx, ebx
test ebx, ebx
js 0x140090b17
mov rcx, qword [r15 + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rbp + 0x10]
mov r8d, esi
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [r15 + 0x3c], 0
je 0x140090ad1
test eax, eax
jne 0x140090aed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140090ad5
mov rcx, qword [r15 + 0x30]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x38]
mov r9b, 1
call fcn.14008b2a0
movzx eax, al
test eax, eax
jne 0x140090aed
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x140090b17
mov ecx, dword [rbp + 0x10]
mov rax, qword [rbp + 0x30]
add dword [rax], ecx
add r14, rcx
add r12, rcx
sub edi, ecx
je 0x140090b17
cmp esi, ecx
jne 0x140090b12
mov eax, 0x10000
mov esi, eax
cmp edi, eax
jmp 0x140090a4d
mov ebx, 0x8000ffff
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140090b38
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov esi, r9d
mov rdi, rdx
mov r14, rcx
call fcn.140090d78
mov rdx, qword [rbp + 0x38]
lea rcx, [rsp + 0x50]
mov r15, rax
xor r13d, r13d
call fcn.140090e18
mov rax, qword [rbp + 0x30]
mov r8d, 0x10000
lea edx, [r13 + 1]
cmp esi, r8d
mov qword [rsp + 0x78], rax
mov r12d, r8d
cmovb r12d, esi
and dword [rbp - 0x38], r13d
test esi, esi
mov eax, esi
cmove eax, edx
lea rdx, [rsi + rdi]
mov qword [rbp - 0x40], rax
lea rax, [r15 + 0x10000]
mov qword [rbp + 0x18], rdx
cmp rdx, rax
jbe 0x140090bf0
cmp qword [rsp + 0x58], r13
je 0x140090bd2
lea rcx, [rsp + 0x50]
call fcn.14008f7c8
mov rdx, qword [rbp + 0x18]
mov ebx, eax
jmp 0x140090bd4
xor ebx, ebx
test ebx, ebx
js 0x140090cee
mov r8, qword [rbp + 0x38]
lea rcx, [r14 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
setns r13b
and qword [rsp + 0x48], 0
mov rax, rdi
mov dword [rsp + 0x40], edi
shr rax, 0x20
cmp qword [rsp + 0x58], 0
mov dword [rsp + 0x44], eax
je 0x140090c1b
lea rcx, [rsp + 0x50]
call fcn.14008f7c8
mov ebx, eax
jmp 0x140090c1d
xor ebx, ebx
test ebx, ebx
js 0x140090cd7
mov rdx, qword [rbp + 0x20]
mov rcx, qword [r14 + 0x30]
lea rax, [rsp + 0x30]
lea r9, [rbp + 0x28]
mov r8d, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [r14 + 0x3c], 0
je 0x140090c74
test eax, eax
jne 0x140090c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140090c78
mov rcx, qword [r14 + 0x30]
lea r8, [rbp + 0x28]
lea rdx, [rsp + 0x30]
mov r9b, 1
call fcn.14008b2a0
movzx eax, al
test eax, eax
jne 0x140090c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x140090cd7
mov ecx, dword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
add dword [rax], ecx
add qword [rbp + 0x20], rcx
add rdi, rcx
sub esi, ecx
cmp r15, rdi
mov rax, rdi
cmova rax, r15
mov r15, rax
cmp r12d, ecx
jne 0x140090cd2
xor ebx, ebx
test esi, esi
je 0x140090ccd
mov eax, 0x10000
mov r12d, eax
cmp esi, eax
cmovb r12d, esi
jmp 0x140090bf0
xor r13d, r13d
jmp 0x140090cd7
mov ebx, 0x80004005
test r13d, r13d
je 0x140090cee
lea rcx, [r14 + 0x10]
xor r8d, r8d
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x140090cf2
mov qword [r14 + 0x78], r15
mov rcx, qword [rsp + 0x58]
lea rax, [0x140100368]
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140090d14
and qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b5ccc
Capabilities:
Delete file
Get common file path

Disassembly:
push rbp
mov rbp, rsp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x248
mov rax, qword [0x1400c8590]
xor rax, rsp
mov qword [rbp - 0x40], rax
xor r12d, r12d
mov rbx, r9
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
cmp dword [rbp + 0x30], r12d
jg 0x1400b5d09
xor eax, eax
jmp 0x1400b5d9e
cmp rbx, rcx
je 0x1400b5d12
mov word [r9], r12w
cmp dword [rbp + 0x30], 0x104
jl 0x1400b5d23
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1400b5d9e
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call sub.MSVCR100.dll_memset
lea r9, [rsp + 0x20]
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, eax
test eax, eax
je 0x1400b5d9c
or r9, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov rcx, r9
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400b5d61
cmp ecx, dword [rbp + 0x30]
jl 0x1400b5d8a
mov ecx, 0x2072c1
call fcn.14002cdf4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400b5d02
movsxd rdx, dword [rbp + 0x30]
lea r8, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsncpy_s]
mov eax, esi
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.1400056f0
add rsp, 0x248
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x140001800
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
and qword [r11 - 0x18], 0
lea rax, str.SNMPTRAP
and qword [r11 - 0x10], 0
xor r9d, r9d
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rax, [0x1400010e0]
xor ecx, ecx
mov qword [r11 - 0x20], rax
lea ebx, [r9 + 1]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140004638], rax
test rax, rax
jne 0x140001861
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
int3
xor edx, edx
lea rcx, [0x140004680]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140004698], rax
test rax, rax
jne 0x1400018a5
mov rcx, qword [0x140004638]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rcx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov rcx, qword [0x140004638]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140004698]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1400023a0
Capabilities:
Access peb ldr_data

Disassembly:
push rcx
push r11
push r13
sub rcx, rcx
add rcx, 0x60
mov r11, qword gs:[rcx]
push r10
mov rcx, r11
add rcx, 0x10
mov r10, qword [rcx]
add r11, 0x18
mov r13, qword [r11]
mov rcx, r13
add rcx, 0x10
mov r11, qword [rcx]
push r12
mov r13, r11
add r13, 0x30
mov rcx, qword [r13]
cmp rcx, 0
je 0x140002413
mov r13, qword [r11 + 0x60]
mov r12, qword [r13]
and r12d, 0xdf00df
mov r13, qword [r13 + 0xc]
shl r13d, 8
add r13d, r12d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x14000241b
mov r13, qword [r11]
mov r11, r13
jmp 0x1400023cf
mov r11d, dword [rcx + 0x3c]
add r11, rcx
add r11, 0x10
mov r13d, dword [r11 + 0x78]
add r13, rcx
push rbx
mov r12d, dword [r13 + 0x20]
add r12, rcx
mov ebx, dword [r12]
add rbx, rcx
mov r11d, dword [rbx + 0xb]
sub r11d, 0x746365
test r11d, r11d
test ebx, ebx
jne 0x140002451
jmp 0x14000245f
inc r12
inc r12
inc r12
inc r12
jmp 0x140002435
mov r11d, dword [r13 + 0x20]
sub r12, r11
sub r12, rcx
shr r12d, 1
mov r11d, dword [r13 + 0x24]
add r11, r12
add r11, rcx
mov r12d, dword [r11]
mov r11d, dword [r13 + 0x1c]
and r12d, 0xffff
shl r12d, 2
add r11, rcx
add r11, r12
mov r12d, dword [r11]
mov r11d, 0x6a000
add r12, rcx
push rcx
add r11, r10
push r10
push r11
push rbx
Function at 0x140003a60
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003a94
cmp word [rcx], 0x5a4d
jne 0x140003a94
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003a94
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a94
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400039a0
test eax, eax
jne 0x140003ab0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003a10
test rax, rax
je 0x140003aa5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004259
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004160
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004100
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140009ec0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140009ee3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140009ee3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140009f91
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140573bb0]
mov r8, rcx
mov rcx, r9
call fcn.140009ec0
test eax, eax
je 0x140009fbd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140009ee4
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
call fcn.1400aeee8
xor r10d, r10d
test eax, eax
js 0x14000122f
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x14000108c
lea rdx, [rbx + 8]
lea rdx, [rdx + r9*4]
lea r8, [rbx + 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov eax, dword [rdx - 8]
sub r9, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
lea r8, [r8 + 0x10]
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
lea rdx, [rdx - 0x10]
mov ecx, dword [r8 - 0xc]
mov dword [r8 - 0xc], eax
mov dword [rdx + 0x14], ecx
cmp r10, r9
jl 0x14000103d
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x14000122d
lea r10, [rbx + 2]
lea rdi, [0x140000000]
lea r10, [r10 + 0x10]
inc r11d
mov r8d, dword [r10 - 2]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0xcc0a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0xcb8a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0xcb4a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
xor r9d, dword [rdi + rcx*4 + 0xcbca0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 + 3]
mov r8d, dword [rdi + rdx*4 + 0xcc0a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0xcb8a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0xcbca0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xcb4a0]
movzx edx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 + 7]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0xcc0a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0xcb8a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0xcbca0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xcb4a0]
movzx edx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 + 0xb]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0xcc0a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, byte [r10 + 0xc]
xor r8d, dword [rdi + rcx*4 + 0xcb8a0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xcbca0]
movzx ecx, byte [rdi + rax*4 + 0xcc4a0]
xor r8d, dword [rdi + rcx*4 + 0xcb4a0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400010a6
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret