joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x30
mov qword [rsp + 8], rcx
lea rax, [rcx + 0x100]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx r10d, byte [rax]
add rcx, 0x101
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
movzx r11d, byte [rax]
mov r9d, 0x8d7e2601
jmp 0x1800011f8
mov eax, dword [rsp + 4]
add eax, 1
movzx r10d, al
mov rax, qword [rsp + 8]
movzx ecx, byte [rax + r10]
mov edx, dword [rsp]
add edx, ecx
movzx r11d, dl
mov rdx, qword [rsp + 8]
movzx esi, byte [rdx + r11]
mov byte [rax + r10], sil
mov byte [rdx + r11], cl
add esi, ecx
movzx eax, sil
mov rcx, qword [rsp + 8]
mov al, byte [rcx + rax]
mov rdx, qword [rsp + 0x10]
add rdx, 1
mov rcx, qword [rsp + 0x10]
mov r8b, byte [rcx]
mov ecx, r8d
not cl
and cl, 0x1a
and r8b, 0xe5
or r8b, cl
mov ecx, eax
not cl
and cl, 0x1a
and al, 0xe5
or al, cl
xor al, r8b
mov rcx, qword [rsp + 0x10]
mov byte [rcx], al
mov r8d, dword [rsp + 0x1c]
lea esi, [r8 - 1]
test r8d, r8d
mov eax, 0xe740fdf5
cmove eax, r9d
mov ecx, 0x9ff99ab6
jmp 0x180001230
mov qword [rsp + 0x10], rdx
mov dword [rsp], r11d
mov dword [rsp + 4], r10d
mov dword [rsp + 0x1c], esi
mov ecx, eax
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x8d7e2601
je 0x18000124e
cmp ecx, 0xe740fdf5
je 0x180001180
cmp ecx, 0x9ff99ab6
jne 0x180001230
jmp 0x18000120f
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov byte [rcx], al
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov byte [rcx], al
add rsp, 0x30
pop rsi
ret
Function at 0x1400024ac
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140002506
mov r11b, 0x23
lea rdi, [0x1400eb130]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x1400024f0
cmp rdx, 2
jb 0x1400024f0
cmp byte [r10], r11b
jne 0x1400024f0
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1400024ce
jmp 0x140002547
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140002547
mov r11b, 0x23
lea rdi, [0x1400eb130]
cmp dl, r11b
jne 0x14000252b
cmp byte [r10], r11b
jne 0x14000252b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x140002519
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140002664
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002685
and qword [r8], 0
lea rdx, [0x1400eaba0]
call fcn.140002558
mov rbx, rax
test rax, rax
je 0x140002766
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000275d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000275d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000275d
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000275d
cmp rdi, 0xffffffffffffffff
je 0x14000275d
mov rax, qword [0x140139c50]
test rax, rax
je 0x140002707
inc dword [rax + 0x3b0]
mov rdx, qword [0x140139c40]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x14000275d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000274a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call fcn.140004940
jmp 0x140002766
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002758
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002768
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1400043bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0x108]
mov r9d, 4
mov rax, qword [rcx + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1400eb130]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x1400043e5
not r8d
mov ecx, r8d
call fcn.1400045dc
mov eax, r8d
add rsp, 0x28
ret
Function at 0x14000e16c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140139c50]
mov r10d, 4
mov dword [rsp + 0x30], ecx
mov r9, qword [rax + 0x1b90]
movsxd rcx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x30]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1400eb130]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14000e1a3
not r8d
lea rdx, [rsp + 0x30]
lea rcx, [r9 + 0x108]
mov dword [rsp + 0x30], r8d
call fcn.14001b9dc
add rsp, 0x28
ret

Function at 0x140012f58
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x140139c50]
cmp byte [rbx + 0x3000], 0
je 0x140013019
cmp qword [rbx + 0x3008], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x3010]
je 0x14001300b
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x140012fc3
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001c4e0
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.140002b7c
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3008]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x140139c48]
movsxd r8, eax
mov rax, qword [rbx + 0x3018]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140013019
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.140002b7c
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x140013660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140139c50]
mov rbx, rcx
and dword [rax + 0x2fbc], 0
test rcx, rcx
je 0x1400136c9
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1400136d4
lea rdx, [0x1400eaba4]
mov rcx, rbx
mov rdi, rax
call fcn.140002558
mov rbx, rax
test rax, rax
je 0x1400136c9
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400342d4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140034305
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140034378
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14003431c
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003431e
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140034372
test ecx, ecx
jle 0x140034352
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x140034372
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140034372
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140034394
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400343b9
xor eax, eax
jmp 0x1400344b4
cmp qword [rcx + 0x68], 0
je 0x1400343cb
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400344b4
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x1400343e2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400343e4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140034414
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov r8, rbp
cmp qword [rsi + 0x80], 0
je 0x1400344ae
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14003444f
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140034488
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x1400344c5
cmp rbp, r15
ja 0x14003445d
mov r8, rbx
test rbx, rbx
je 0x1400344ae
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x1400344b1
Function at 0x140034870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140139010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400348a9
xor eax, eax
jmp 0x1400349bc
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400348d2
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x1400348d2
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1400349bc
cmp qword [rcx + 0x80], 0
je 0x1400349ba
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003490d
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140034931
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x1400349ba
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003497f
sub eax, 1
je 0x14003497f
cmp eax, 2
jne 0x1400349ba
movsx ecx, byte [rbp - 0x30]
jmp 0x14003491a
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400349aa
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1400349ba
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x1400349bc
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140034fb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140139010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003501f
cmp byte [rcx + 0x71], 0
je 0x14003501f
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140035074
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140035039
sub eax, 1
je 0x14003503d
cmp eax, 2
jne 0x140035074
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14003506b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140035074
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140035021
xor al, al
jmp 0x140035021
Function at 0x14004ec1c
Capabilities:
Encode data using xor
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x140131ba0]
xor edx, edx
movdqa xmm1, xmmword [0x1401311c0]
mov eax, 0x35
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x1c], 0x37376274
mov dword [rbp - 0x18], 0x1a7f
movdqu xmmword [rbp - 0x4c], xmm0
movdqa xmm0, xmmword [0x140131900]
movdqu xmmword [rbp - 0x2c], xmm0
movdqu xmmword [rbp - 0x3c], xmm1
test eax, eax
je 0x14004ec78
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x4c], al
inc edx
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14004ec68
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140131910]
xor edx, edx
movdqa xmm1, xmmword [0x140131950]
mov eax, 0x3e
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [str.bNVufoVvmsXtx]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], 0xc8808397
mov dword [rbp - 0x48], 0x89878f8d
mov dword [rbp - 0x44], 0xb8cf8b99
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x23440e
test eax, eax
je 0x14004ece8
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x4c], al
inc edx
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14004ecd8
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140131910]
xor edx, edx
movdqa xmm1, xmmword [0x140131950]
mov eax, 0x3a
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [str.bNQQFsenpy_2x]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], 0xc8808397
mov dword [rbp - 0x48], 0x89878f8d
mov dword [rbp - 0x44], 0xb8cf8b99
movdqa xmmword [rbp - 0x30], xmm1
test eax, eax
je 0x14004ed51
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x4c], al
inc edx
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14004ed41
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x70
pop rbp
ret

Function at 0x14004ed68
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140139010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rdi, rcx
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi], rsi
lea rax, [rsp + 0x30]
mov qword [rdi + 0x10], rsi
or rdx, 0xffffffffffffffff
mov word [rdi], si
inc rdx
cmp word [rax + rdx*2], si
jne 0x14004edc9
mov rcx, rdi
cmp rdx, 7
ja 0x14004edf6
lea rbx, [rdx + rdx]
mov qword [rdi + 0x10], rdx
mov r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], si
jmp 0x14004ee00
lea r9, [rsp + 0x30]
call fcn.140035c50
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400e5988
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140139010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, dword [0x140139cbc]
lea rcx, [rbp - 0x40]
mov ebx, dword [0x140139c58]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea rcx, [rbp - 0x38]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp - 0x18], eax
xor eax, eax
mov dword [rbp - 0x28], ebx
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], eax
mov dword [rbp - 0x24], 0x7a
mov dword [rbp - 0x2c], edi
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__mktime64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__difftime64]
xorps xmm1, xmm1
movsd qword [0x140139cc8], xmm0
comisd xmm1, xmm0
jb 0x1400e5a43
mov r9d, 0x30
lea r8, str.Juba_Softwares
lea rdx, str.Your_Subscription_time_is_over_pls_contact_Support
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400e680c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [rcx]
lea rax, [rcx + 4]
xor r9d, r9d
test edx, edx
je 0x1400e682b
lea edx, [r9 - 0x1b]
xor byte [r9 + rax], dl
inc r9d
mov edx, dword [rcx]
cmp r9d, edx
jb 0x1400e6819
mov ecx, edx
mov byte [rcx + rax], 0
ret

Function at 0x1400e6834
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [rcx]
lea rax, [rcx + 4]
xor r11d, r11d
mov r9, rcx
mov r8d, r11d
test edx, edx
je 0x1400e6861
mov edx, r8d
mov ecx, 0xe5
add ecx, r8d
inc r8d
xor word [rax + rdx*2], cx
mov edx, dword [r9]
cmp r8d, edx
jb 0x1400e6847
mov ecx, edx
mov word [rax + rcx*2], r11w
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14002a9e0]
mov dword [rax], 1
mov rax, qword [0x14002a9f0]
mov dword [rax], 1
mov rax, qword [0x14002aa00]
mov dword [rax], 1
mov rax, qword [0x14002a980]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400035a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1400310a8]
test rcx, rcx
je 0x1400035db
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140003600
mov rcx, qword [0x1400310a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400420e0], 0
jne 0x140003618
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x1400310a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400035ce
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x1400260f0]
mov qword [rsp + 0x20], 0
lea rdi, [0x140042100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400036e4
test al, 0x10
je 0x1400035e4
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x1400035e4
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140003690
jmp 0x1400035e4
Function at 0x14001b8d0
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.14001df30
sub rsp, rax
mov eax, dword [0x1400310a0]
mov rsi, rcx
test eax, eax
je 0x14001b970
xor ebx, ebx
lea rdi, [0x1400400e0]
test eax, eax
jg 0x14001b90c
jmp 0x14001b920
add rbx, 1
cmp dword [0x1400310a0], ebx
jle 0x14001b920
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14001b900
jmp 0x14001b957
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14001b935
cmp word [rsi + 2], 0x3a
je 0x14001b957
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001b9c0
movsxd rbx, dword [0x1400310a0]
cmp ebx, 0x3ff
jle 0x14001b9d8
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.14001b110
test al, al
je 0x14001b9fa
movsxd rbx, dword [0x1400310a0]
mov rcx, rdi
lea rdi, [0x1400400e0]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x1400310a0]
add eax, 1
mov dword [0x1400310a0], eax
jmp 0x14001b8f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001b944
xor eax, eax
jmp 0x14001b95c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x1400310a0], 1
mov rdx, rax
lea rax, [0x1400400e0]
mov qword [rax + rbx*8], rdx
jmp 0x14001b957
mov rcx, rbx
call fcn.1400020b0
nop
nop word cs:[rax + rax]
nop