joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100016640
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
lea rsp, [rsp - 0x128]
mov rsi, rcx
mov edi, edx
test edx, edx
jne 0x100016688
mov rbx, rsi
mov rcx, rbx
call fcn.1000077b0
lea rdx, [rsp + 0x20]
mov r8d, 0x105
xor ecx, ecx
call fcn.1000146a0
mov r8d, eax
mov rcx, rbx
lea rdx, [rsp + 0x20]
xor r9d, r9d
call fcn.100008f00
jmp 0x1000166ec
call fcn.100014680
mov rbx, rax
mov rcx, rbx
call fcn.1000165d0
mov r12, rax
mov rcx, r12
call fcn.1000165f0
mov rbx, rax
sub edi, 1
test edi, edi
jge 0x100016690
mov rax, rbx
sub rax, r12
cmp eax, 2
jl 0x1000166d0
cmp byte [r12], 0x22
jne 0x1000166d0
cmp byte [rbx - 1], 0x22
jne 0x1000166d0
add r12, 1
sub rbx, 1
nop dword [rax]
mov rcx, rsi
call fcn.1000077b0
mov rcx, rsi
mov r8, rbx
sub r8, r12
mov rdx, r12
xor r9d, r9d
call fcn.100008f00
nop
lea rsp, [rsp + 0x128]
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100016780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea rsp, [rsp - 0x28]
test rcx, rcx
jne 0x100016791
lea rcx, [0x100053480]
call fcn.100014690
cmp eax, 0xffffffff
je 0x1000167a4
and eax, 0x10
jne 0x1000167a4
mov al, 1
jmp 0x1000167a6
xor al, al
nop
lea rsp, [rsp + 0x28]
ret
Function at 0x10001b820
Capabilities:
Resolve dns

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rsi
mov rbx, rdx
mov qword [rbp - 8], r8
mov rcx, r8
call fcn.100007800
nop
mov rcx, rbx
xor edx, edx
call fcn.100007830
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x10001b85f
lea rcx, [0x100053480]
call sub.wsock32.dll_gethostbyname
test rax, rax
je 0x10001b89f
nop dword [rax]
mov rdi, qword [rax + 0x18]
xor esi, esi
jmp 0x10001b896
mov eax, esi
mov rax, qword [rdi + rax*8]
mov ecx, dword [rax]
call sub.wsock32.dll_inet_ntoa
mov rdx, rax
mov rcx, rbx
xor r8d, r8d
call fcn.1000082a0
add esi, 1
mov eax, esi
cmp qword [rdi + rax*8], 0
jne 0x10001b878
nop
mov rcx, rbp
call fcn.10001b800
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret

Function at 0x10001bd20
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x120]
mov qword [rbp - 0xd0], rbx
mov qword [rbp - 0xc8], rdi
mov qword [rbp - 0xc0], rsi
mov qword [rbp - 0xb8], r12
mov qword [rbp - 0xb0], r13
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r12, r9
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
nop
xor r13, r13
mov dword [rbx + 0x54], 0
lea rcx, [rbp - 0x68]
xor r8d, r8d
mov edx, 0x68
call fcn.1000021a0
mov dword [rbp - 0x68], 0x68
mov dword [rbp - 0x2c], 1
movzx ax, byte [rbx + 0x68]
mov word [rbp - 0x28], ax
lea rcx, [rbp - 0x90]
call fcn.1000077b0
mov qword [rbp - 0xa8], rsi
lea rax, [0x10003f5c8]
mov qword [rbp - 0xa0], rax
mov qword [rbp - 0x98], rdi
lea rdx, [rbp - 0xa8]
xor r9d, r9d
mov r8d, 2
lea rcx, [rbp - 0x90]
call fcn.100007c20
mov rdx, qword [rbp - 0x90]
lea rcx, [rbp - 0x88]
call fcn.1000163f0
mov rdx, qword [rbp - 0x88]
test rdx, rdx
jne 0x10001be0e
lea rdx, [0x100053480]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
xor r9, r9
xor r8, r8
xor ecx, ecx
call fcn.100014670
test eax, eax
je 0x10001be64
mov eax, dword [rbp - 0x70]
mov dword [rbx + 0x54], eax
mov r13, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
call sub.kernel32.dll_CloseHandle
nop
nop
mov rcx, rbp
call fcn.10001bcf0
mov rax, r13
mov rbx, qword [rbp - 0xd0]
mov rdi, qword [rbp - 0xc8]
mov rsi, qword [rbp - 0xc0]
mov r12, qword [rbp - 0xb8]
mov r13, qword [rbp - 0xb0]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000308e0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x100030961
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.10000a0c0
cmp ebx, 1
jle 0x100030950
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.100009c00
jmp 0x10003096c
mov rcx, rsi
mov rdx, r13
call fcn.100007830
nop
mov rcx, rbp
call fcn.1000308c0
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100030e30
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
lea rcx, [0x1000547a0]
xor edx, edx
call fcn.100007830
mov dword [0x1000547e0], 0xffffffff
lea rcx, [0x1000547a8]
xor edx, edx
call fcn.100007830
mov dword [0x1000547e4], 0xffffffff
lea rcx, [0x1000547b0]
xor edx, edx
call fcn.100007830
mov dword [0x1000547e8], 0xffffffff
lea rcx, [0x1000547b8]
xor edx, edx
call fcn.100007830
mov dword [0x1000547ec], 0xffffffff
lea rcx, [0x1000547c0]
xor edx, edx
call fcn.100007830
mov dword [0x1000547f0], 0xffffffff
lea rcx, [0x1000547c8]
xor edx, edx
call fcn.100007830
mov dword [0x1000547f4], 0xffffffff
lea rcx, [0x1000547d0]
xor edx, edx
call fcn.100007830
mov dword [0x1000547f8], 0xffffffff
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x100030f78
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.100008350
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.1000296e0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100030f78
lea rcx, [0x100030cd0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100030d80]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.100030e10
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100031600
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x100054820], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x100054660], eax
mov eax, dword [rsp + 0x24]
mov dword [0x100054670], eax
mov eax, dword [rsp + 0x28]
mov dword [0x100054680], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x100054690], eax
lea rdx, [0x1000546a1]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.100001ea0
lea rcx, [rsp + 0x34]
call fcn.100002b00
mov byte [0x1000546a0], al
lea rcx, str.kernel32
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x100054830], rax
test rax, rax
je 0x1000316a8
mov rcx, qword [0x100054830]
lea rdx, str.GetDiskFreeSpaceExA
call sub.kernel32.dll_GetProcAddress
mov qword [0x100054820], rax
nop
cmp dword [0x100054670], 6
jae 0x1000316bc
mov dword [0x10003ce00], 0
nop
cmp dword [0x100054670], 6
jb 0x1000316d8
cmp dword [0x100054680], 1
jb 0x1000316d8
mov dword [0x10003ce10], 2
nop
lea rsp, [rsp + 0xb8]
ret

Function at 0x10003a7a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x30]
mov rbx, rcx
mov si, dx
mov rdi, r8
cmp qword [rbx + 0x18], 0
jne 0x10003a85c
xor r8d, r8d
mov edx, 1
mov ecx, 2
call sub.wsock32.dll_socket
mov qword [rbx + 0x18], rax
mov byte [rbx + 0x20], 0
mov word [rsp + 0x20], 2
movzx ecx, si
call sub.wsock32.dll_htons
mov word [rsp + 0x22], ax
mov rcx, rdi
test rdi, rdi
jne 0x10003a7f9
lea rcx, [0x100053480]
call sub.wsock32.dll_inet_addr
mov dword [rsp + 0x24], eax
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
mov r8d, 0x10
call sub.wsock32.dll_connect
test eax, eax
je 0x10003a82d
mov rcx, qword [rbx + 0x18]
call sub.wsock32.dll_closesocket
mov qword [rbx + 0x18], 0
jmp 0x10003a85c
mov rcx, qword [rbx + 0x18]
mov rdx, qword [0x100054850]
mov r9d, 0x23
mov r8d, 0x400
call sub.wsock32.dll_WSAAsyncSelect
cmp qword [rbx + 0x40], 0
je 0x10003a85c
mov rcx, qword [rbx + 0x48]
mov rdx, rbx
call qword [rbx + 0x40]
nop
nop
lea rsp, [rsp + 0x30]
pop rsi
pop rdi
pop rbx
ret

Function at 0x10003a910
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rdi
push rsi
push r12
lea rsp, [rsp - 0x28]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
jmp 0x10003a964
mov rcx, qword [rbx + 0x18]
mov rdx, rsi
mov r8d, edi
xor r9d, r9d
call sub.wsock32.dll_send
mov r12d, eax
cmp r12d, 0xffffffff
jne 0x10003a955
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x10003a96f
mov byte [rbx + 0x20], 1
jmp 0x10003a964
mov eax, r12d
sub edi, eax
movsxd rax, esi
movsxd rdx, r12d
lea rsi, [rax + rdx]
cmp qword [rbx + 0x18], 0
je 0x10003a96f
test edi, edi
ja 0x10003a928
nop
lea rsp, [rsp + 0x28]
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x140001890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x1400c81d8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword gs:[0x58]
mov rsi, rcx
mov ecx, dword [0x1400cb588]
xor r14d, r14d
mov rbp, rdx
mov edi, 0x10
mov rbx, qword [rax + rcx*8]
mov ecx, 0x28
mov eax, dword [rcx + rbx]
test al, 1
jne 0x140001904
or eax, 1
mov qword [rbx + rdi], r14
mov dword [rcx + rbx], eax
lea rcx, [0x1400a9510]
mov qword [rbx + rdi + 8], r14
mov qword [rbx + rdi + 0x10], r14
call fcn.140088fb4
mov edx, 0x14
lea rcx, [rsp + 0x50]
call fcn.14002cd80
test eax, eax
je 0x14000191e
xor al, al
jmp 0x140001a2d
add rdi, rbx
mov rcx, qword [rdi + 8]
mov rbx, qword [rdi]
mov rax, rcx
sub rax, rbx
cmp rax, 0x100000
jbe 0x140001943
lea rax, [rbx + 0x100000]
mov qword [rdi + 8], rax
jmp 0x14000197b
jae 0x14000197b
mov rax, qword [rdi + 0x10]
sub rax, rbx
cmp rax, 0x100000
jae 0x140001968
lea r8, [rsp + 0x44]
mov edx, 0x100000
mov rcx, rdi
call fcn.1400015f0
jmp 0x14000197b
add rbx, 0x100000
mov rdx, rbx
call fcn.140001710
mov qword [rdi + 8], rbx
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001a13
mov r8d, dword [rdi + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rdi]
mov rcx, rax
mov rdx, qword [rdi]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001a13
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
test eax, eax
je 0x140001a55
mov rdx, qword [rdi]
mov r8d, eax
call fcn.14002d2d0
test eax, eax
jne 0x140001a13
mov r8d, dword [rdi + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rdi]
mov rcx, rbx
mov rdx, qword [rdi]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400019d1
xor dil, dil
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140001a29
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400890e0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r8d, 0x14
mov rdx, rbp
call fcn.14002ca50
test eax, eax
jne 0x140001a13
mov dil, 1
jmp 0x140001a16
Function at 0x140003150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
mov ebx, r8d
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140003189
mov dword [rdi], 0xfffffff4
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
cmp dword [rsp + 0x30], ebx
je 0x1400031a2
mov dword [rdi], 0xfffffff3
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
add qword [0x1400caa68], rbx
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140003380
Capabilities:
Delete registry value
Get common file path
Set registry value

Disassembly:
sub rsp, 0x28
mov cl, 1
call fcn.1400035c0
test al, al
je 0x140003396
mov cl, 1
call fcn.140003f90
xor ecx, ecx
call fcn.1400035c0
test al, al
je 0x1400033ac
xor ecx, ecx
add rsp, 0x28
jmp fcn.140003f90
add rsp, 0x28
ret

Function at 0x140003540
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, r8
mov dword [rsp + 0x68], 4
test r9b, r9b
mov r8d, 0x100
mov eax, 0x200
cmovne eax, r8d
lea r8, [rsp + 0x38]
or eax, 0x20019
mov qword [rsp + 0x20], r8
mov r9d, eax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400035b9
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x1400160e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400c81d8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
cmp rbx, rsi
je 0x1400162c3
xor r14d, r14d
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001612f
mov r8, qword [rbx]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400162b6
lea rcx, [rbp - 0x80]
call fcn.140017a00
test al, al
je 0x1400162b6
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001618b
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x1400162b6
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400161d0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140022570
mov rdi, qword [0x1400cab38]
cmp rdi, qword [0x1400cab40]
je 0x140016225
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400125c0
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x60]
call fcn.1400125c0
nop
add qword [0x1400cab38], 0x40
jmp 0x14001623a
lea r8, [rsp + 0x40]
mov rdx, rdi
lea rcx, [0x1400cab30]
call fcn.140006a40
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140016278
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016273
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400162ea
call fcn.140088f04
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400162b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400162b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400162ea
call fcn.140088f04
add rbx, 0x20
cmp rbx, rsi
jne 0x140016122
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400890e0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14008fc64
int3
Function at 0x140017010
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1400c81d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], rax
mov r9d, 0x220
mov dword [rsp + 0x48], ecx
mov dl, 2
mov dword [rsp + 0x40], ecx
lea r8d, [rcx + 0x20]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0x70]
mov word [rsp + 0x74], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001709f
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14001709f
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 0
setne al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400890e0
add rsp, 0x88
ret
Function at 0x140017a70
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x1400c81d8]
xor rax, rsp
mov qword [rbp + 0x600], rax
mov ebx, 0x104
lea r9, [0x1400cad60]
lea rax, [rbp + 0x1e0]
mov r8d, ebx
sub r9, rax
lea rdx, [rbp + 0x1e0]
mov rsi, rcx
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x140017ae4
movzx eax, word [r9 + rdx]
test ax, ax
je 0x140017ae4
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140017ac1
test r8, r8
lea rax, [rdx - 2]
mov rcx, rbx
cmovne rax, rdx
xor r14d, r14d
mov word [rax], r14w
lea rax, [rbp + 0x1e0]
cmp word [rax], r14w
je 0x140017b10
add rax, 2
sub rcx, 1
jne 0x140017b00
mov rax, rbx
mov edi, 0x7ffffffe
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x140017b73
mov rdx, rbx
lea rcx, [rbp + 0x1e0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140017b64
lea r9, str._bin64bit
mov eax, edi
sub r9, rcx
test rax, rax
je 0x140017b64
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140017b64
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140017b43
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [rbp + 0x1e0]
mov rdx, rbx
lea rax, [rbp + 0x3f0]
sub r8, rax
lea rcx, [rbp + 0x3f0]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140017bc3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140017bc3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140017ba0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rbx
mov word [rax], r14w
lea rax, [rbp + 0x1e0]
nop dword [rax]
cmp word [rax], r14w
je 0x140017bf0
add rax, 2
sub rcx, 1
jne 0x140017be0
mov rax, rbx
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x140017c4d
lea rcx, [rbp + 0x1e0]
lea rcx, [rcx + rax*2]
sub rbx, rax
je 0x140017c3e
lea rdx, str.obs64.exe
sub rdx, rcx
nop dword [rax]
test rdi, rdi
je 0x140017c3e
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140017c3e
mov word [rcx], ax
dec rdi
add rcx, 2
sub rbx, 1
jne 0x140017c20
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140017cd7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp word [rsi], r14w
lea rax, [rbp + 0x1e0]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
cmovne rax, rsi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x20], 0x70
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.1400890e0
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400180e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x10080
call fcn.140089230
sub rsp, rax
mov rax, qword [0x1400c81d8]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov rsi, rdx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x58], rbx
mov rdi, rbx
mov qword [rsp + 0x60], rbx
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rbx
je 0x14001815f
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14001815f
mov al, 1
jmp 0x140018161
xor al, al
test al, al
je 0x14001828a
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400181a6
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400181a6
mov al, 1
jmp 0x1400181a8
xor al, al
test al, al
je 0x1400182a5
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400182c0
mov r8d, dword [rsp + 0x40]
test r8d, r8d
jne 0x14001820b
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400181f4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140018207
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140018266
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x54]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400182db
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x54], eax
je 0x1400181b0
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001824d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140018260
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140018266
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1400890e0
mov rbx, qword [rsp + 0x100b0]
add rsp, 0x10080
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x44]
call fcn.140012830
lea rdx, [0x1400c56a0]
lea rcx, [rsp + 0x44]
call fcn.14008a198
lea rcx, [rsp + 0x48]
call fcn.140012830
lea rdx, [0x1400c56a0]
lea rcx, [rsp + 0x48]
call fcn.14008a198
lea rcx, [rsp + 0x4c]
call fcn.140012830
lea rdx, [0x1400c56a0]
lea rcx, [rsp + 0x4c]
call fcn.14008a198
lea rcx, [rsp + 0x50]
call fcn.140012830
lea rdx, [0x1400c56a0]
lea rcx, [rsp + 0x50]
call fcn.14008a198
int3
Function at 0x140018300
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x140018313
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140018347
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140018347
cmp qword [rbx + 0x18], 8
jb case.default.0x140018340
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 4]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_MoveFileExW]
add rsp, 0x20
pop rbx
ret
invalid
xchg ecx, eax
stosb byte [rdi], al
add eax, dword [rdx]
cmp eax, 0x43
mov ebx, 0xb654ef43
push rdx
jns 0x1401707f1
invalid
push rdi
invalid
out dx, eax
sbb dword [rbx], eax
jl 0x1401707c9
adc edi, dword [rcx]
push rax
or dword fs:[rdi - 6], 0xe
sar dword [rcx], 0xc9
sub al, 0x24
sbb byte [rsi], dl
sbb byte [rbp + riz*2 - 0x5fe4cf0f], bl
int1
xor byte [rbx], bl
invalid
invalid
int1
xor byte [rbx], bl
movabs al, byte [0x3980105a4d650c0e]
cld
dec dword [rax - 0x61]
call qword [rdi - 0x65]
push rax
ror dword [rcx + 0x67], 0x97
xchg edi, eax
xchg edi, eax
invalid
mov ebx, 0x8888aa3
invalid
test dword [rcx + 0x2f3df92], esp
and dword [rcx + 0x20], edx
invalid
invalid