joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d7690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400d770a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400d7700
cmp r11, r10
ja 0x1400d77a3
cmp r10, rdx
ja 0x1400d77b7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400d7702
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400d76e0
jmp 0x1400d7777
ja 0x1400d770a
mov r11, r10
cmp rax, r8
jne 0x1400d76b2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400d777b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400d7750
mov r8, r10
sub ecx, r9d
jns 0x1400d776e
jmp 0x1400d777d
cmp r10, rdx
je 0x1400d7789
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400d777d
xor al, 1
cmp r8, rdx
jne 0x1400d7730
jmp 0x1400d777d
xor eax, eax
jmp 0x1400d777d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400da210
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400da6e0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400da660
ud2

Function at 0x1400d91b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d91fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d91fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d91fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d91fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d91fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d9200
xor al, al
add rsp, 0x28
ret
Function at 0x140002050
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x140007113], 0
je 0x14000206a
test cl, cl
je 0x1400021d8
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400021d1
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400021d1
and dword [rbp + 0x20], eax
and dword [rbp + 0x18], eax
cmp byte [0x140007113], al
mov dword [rbp + 0x28], 4
jne 0x1400020f4
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400020f4
cmp dword [rbp + 0x20], 4
jne 0x1400020f4
cmp dword [rbp + 0x18], eax
setne byte [0x140007111]
cmp byte [0x140007111], 0
je 0x1400021c7
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.bIsSCAcroAppInstalled
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002143
cmp dword [rbp + 0x20], 4
jne 0x140002143
cmp dword [rbp + 0x18], eax
setne byte [0x140007110]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SCAPackageLevel
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002189
mov eax, dword [0x140007008]
cmp dword [rbp + 0x20], 4
cmove eax, dword [rbp + 0x18]
mov dword [0x140007008], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400021c7
cmp dword [rbp + 0x20], 4
jne 0x1400021c7
cmp dword [rbp + 0x18], eax
setne byte [0x140007112]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x140007113], 1
add rsp, 0x40
pop rbp
ret
Function at 0x140006230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r9, [rdx + 8]
movabs rax, 0xcbf29ce484222325
cmp r9, rdx
mov rbx, rcx
mov r8, rax
mov r11, rdx
sbb r10, r10
movabs rdi, 0x100000001b3
not r10
and r10d, 8
cmp rdx, r9
ja 0x140006286
movzx ecx, byte [r11]
inc r11
xor r8, rcx
mov rcx, r11
sub rcx, rdx
imul r8, rdi
cmp rcx, r10
jne 0x14000626d
lea rcx, [r9 + 8]
mov r10, r9
cmp rcx, r9
sbb rdx, rdx
not rdx
and edx, 8
cmp r9, rcx
ja 0x1400062b7
movzx ecx, byte [r10]
inc r10
xor rax, rcx
mov rcx, r10
sub rcx, r9
imul rax, rdi
cmp rcx, rdx
jne 0x14000629e
mov rdi, qword [rsp + 0x10]
xor rax, r8
and rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 8]
ret

Function at 0x140006608
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, qword [rdx]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
xor r9d, r9d
mov r8, rbx
movabs rbp, 0xcbf29ce484222325
movabs r14, 0x100000001b3
lea edx, [rsi + rsi]
shr rdx, 3
lea rdi, [rbx + rdx*8]
cmp rbx, rdi
je 0x140006698
lea r10, [r8 + 8]
mov rax, rbp
cmp r10, r8
mov r11, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r10
ja 0x14000668d
movzx ecx, byte [r11]
inc r11
xor rax, rcx
mov rcx, r11
sub rcx, r8
imul rax, r14
cmp rcx, rdx
jne 0x140006674
xor r9, rax
mov r8, r10
cmp r10, rdi
jne 0x140006659
lea rbx, [rbx + rsi*2]
cmp r8, rbx
je 0x1400066db
xor r11d, r11d
lea r10, [r8 + 2]
cmp r10, r8
mov rax, rbp
sbb rdx, rdx
not rdx
and edx, 2
cmp r8, r10
ja 0x1400066d0
movzx ecx, byte [r11 + r8]
inc r11
xor rax, rcx
imul rax, r14
cmp r11, rdx
jne 0x1400066bc
xor r9, rax
mov r8, r10
cmp r10, rbx
jne 0x1400066a1
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400088ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
lea r8, [rdx + 4]
mov r10, rdx
cmp r8, rdx
mov r9, rdx
mov rbx, rcx
movabs rax, 0xcbf29ce484222325
sbb rdx, rdx
not rdx
and edx, 4
cmp r10, r8
ja 0x140008946
movzx ecx, byte [r10]
movabs r8, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r8
cmp rcx, rdx
jne 0x140008923
mov rcx, qword [rbx + 0x30]
mov r8, qword [rbx + 0x18]
and rcx, rax
mov rdx, qword [rbx + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r10*8], rdx
jne 0x14000896e
mov rcx, rdx
jmp 0x140008976
mov rcx, qword [r8 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14000898d
mov ecx, dword [r9]
cmp dword [rax + 0x10], ecx
je 0x140008988
mov rax, qword [rax]
jmp 0x140008963
mov rcx, rax
jmp 0x140008993
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x140008a0c
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.140009df8
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1400089e1
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140009b94
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000cdc4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000cb08
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000ce1a
mov ecx, 1
call fcn.14000cb08
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xchg edi, eax
jae 0x14002539f
push rcx
in eax, dx
sub dword [rcx], esi
sbb eax, 0xd463f429
and dl, r8b
invalid
ret 0x13ed
Function at 0x140001000
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x72efe97
je 0x140001020
mov eax, 0xc0000001
jmp 0x14000116a
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
xor r8d, r8d
lea rdx, [rsp + 0x24]
mov ecx, 0x42
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x2c], eax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x2c], 0xc0000004
jne 0x14000109d
cmp qword [rsp + 0x30], 0
je 0x14000106b
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0x24]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov ecx, 0x42
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x2c], eax
jmp 0x14000104c
cmp qword [rsp + 0x30], 0
je 0x140001168
mov dword [rsp + 0x28], 0
jmp 0x1400010bd
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp dword [rsp + 0x28], eax
jae 0x140001158
mov eax, dword [rsp + 0x28]
imul rax, rax, 0x18
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
and rax, 0xfffffffffffffffe
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
and rax, 1
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140001153
cmp qword [rsp + 0x40], 0x200000
jne 0x140001153
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0x10], 0x546e6f43
jne 0x140001153
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
call fcn.140002100
xor eax, eax
jmp 0x14000116a
jmp 0x1400010b3
lfence
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
add rsp, 0x58
ret
Function at 0x14000132c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x140004020]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400023c0
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0x240
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
mov edx, 0x80000000
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x14000141a
lfence
mov eax, dword [rsp + 0x60]
jmp 0x1400014f6
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x63
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x14000149b
lfence
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x60]
jmp 0x1400014f6
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1400014e9
lfence
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x60]
jmp 0x1400014f6
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001f10
add rsp, 0x150
pop rdi
ret

Function at 0x1400016d4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x72efe97
je 0x1400016f4
mov eax, 0xc0000001
jmp 0x140001779
mov rax, qword [rsp + 0x40]
cmp dword [rax + 4], 0
jne 0x140001706
mov eax, 0xc0000001
jmp 0x140001779
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 4]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp qword [rsp + 0x20], 0
jne 0x140001735
mov eax, 0xc0000001
jmp 0x140001779
mov rcx, qword [rsp + 0x20]
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001753
mov eax, 0xc0000001
jmp 0x140001779
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call fcn.140002100
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400017cc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0x72efe97
je 0x1400017ec
mov eax, 0xc0000001
jmp 0x140001921
mov rax, qword [rsp + 0x70]
cmp dword [rax + 4], 0
jne 0x140001801
mov eax, 0xc0000001
jmp 0x140001921
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp qword [rsp + 0x20], 0
jne 0x140001833
mov eax, 0xc0000001
jmp 0x140001921
mov rcx, qword [rsp + 0x20]
call fcn.140001928
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
add rax, qword [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.140001bcc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001896
mov eax, 0xc0000001
jmp 0x140001921
mov rax, qword [rsp + 0x28]
and rax, 0xfff
mov ecx, 0x1000
sub rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x50]
mov ecx, eax
call fcn.140001780
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 0x20]
test eax, eax
je 0x1400018fa
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x10]
add rax, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.1400011d0
jmp 0x14000191f
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x10]
add rax, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.140001170
xor eax, eax
add rsp, 0x68
ret
Function at 0x142084db4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142084dbe
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x142084de7
pop rbp
sub rbp, 0x33
sub rbp, 0x2084db4
sub rsp, 0x20
jmp 0x142084e06
mov rax, 0x2084db4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb4622f44
xor byte [rax], dl
inc rax
dec rcx
jne 0x142084e25
jmp 0x142084e3c
or al, 0xcd
lodsd eax, dword [rsi]
iretd
Function at 0x14000263c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002686
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002686
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002686
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002686
cmp dword [rcx + 0x84], 0xe
jbe 0x140002686
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002688
xor al, al
add rsp, 0x28
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x1400714e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400714ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400714fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400714e5
lea eax, [rcx + 1]
jmp 0x14007150b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14007151e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140071504
sub eax, 3
jb 0x14007153e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14007158d
sar eax, 1
movsxd rbp, eax
jb 0x140071574
jmp 0x14007154c
add ebx, ebx
jne 0x14007154a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140071574
inc ecx
add ebx, ebx
jne 0x14007155a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140071574
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14007156d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14007155c
add ecx, 2
jmp 0x140071579
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400714a2
jmp 0x1400714ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x29c00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400715d9
cmp rsi, rcx
jae 0x1400715e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400715c0
cmp al, 0x8f
ja 0x1400715c0
cmp byte [rsi - 2], 0xf
je 0x1400715c6
sub al, 0xe8
cmp al, 1
ja 0x1400715aa
cmp rsi, rcx
jae 0x1400715e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400715b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400715e1
lodsb al, byte [rsi]
jmp 0x1400715c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6f000]
mov eax, dword [rdi]
or eax, eax
je 0x14007164a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x99ef0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400715ee
jns 0x140071623
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14007162d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140071644
mov qword [rbx], rax
add rbx, 8
jmp 0x14007160e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140071684
cmp al, 0xef
ja 0x140071676
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140071656
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140071665
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400716d8
sub rsp, 0xffffffffffffff80
jmp 0x14000c200
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400107d0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140010827
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x140010869
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140010800
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x434
call fcn.14001cfe0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
nop
cmp qword [rsp + 0x48], rdi
je 0x14001087a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140010850
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rdi
ret
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140010869
mov rcx, rdi
cmp eax, 1
je 0x140010895
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400107e0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]