joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e030
Capabilities:
Create directory

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x438
mov qword [rsp + 0x420], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x428], rax
mov rcx, qword [rsp + 0x440]
call fcn.14003ce80
movzx eax, al
test eax, eax
je 0x14003e08a
mov rcx, qword [rsp + 0x448]
call fcn.1400010b0
jmp 0x14003e2cb
mov rcx, qword [rsp + 0x440]
call fcn.14003d350
movzx eax, al
test eax, eax
je 0x14003e15e
movzx eax, byte [rsp + 0x450]
test eax, eax
je 0x14003e14c
mov rcx, qword [rsp + 0x440]
call fcn.14003a0f0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x198]
call fcn.14003d780
nop
mov rcx, qword [rsp + 0x448]
call fcn.14003b980
lea r8, [rsp + 0x198]
lea rdx, [0x140055c78]
mov rcx, rax
call fcn.14003bed0
mov qword [rsp + 0x418], rax
mov rcx, qword [rsp + 0x418]
call fcn.140004608
mov byte [rsp + 0x190], al
lea rcx, [rsp + 0x198]
call fcn.14003cdf0
mov al, byte [rsp + 0x190]
jmp 0x14003e2cb
mov rcx, qword [rsp + 0x448]
call fcn.1400010b0
jmp 0x14003e2cb
lea rcx, [rsp + 0x50]
call fcn.14003d9e0
nop
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x440]
call fcn.14003dca0
movzx eax, al
test eax, eax
je 0x14003e1d9
lea rcx, [rsp + 0x50]
call fcn.14003cd20
movzx eax, al
test eax, eax
jne 0x14003e1d9
xor r8d, r8d
mov rdx, qword [rsp + 0x448]
lea rcx, [rsp + 0x50]
call fcn.14003e030
movzx eax, al
test eax, eax
jne 0x14003e1d9
mov rcx, qword [rsp + 0x448]
call fcn.140004608
mov byte [rsp + 0x2d0], al
lea rcx, [rsp + 0x50]
call fcn.14003cdf0
mov al, byte [rsp + 0x2d0]
jmp 0x14003e2cb
mov rcx, qword [rsp + 0x440]
call fcn.14003a0f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14003e28c
mov rcx, qword [rsp + 0x440]
call fcn.14003a0f0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x2d8]
call fcn.14003d780
nop
mov rcx, qword [rsp + 0x448]
call fcn.14003bc30
lea r8, [rsp + 0x2d8]
lea rdx, [0x140055c98]
mov rcx, rax
call fcn.14003bed0
mov rcx, rax
call fcn.140004608
mov byte [rsp + 0x2d1], al
lea rcx, [rsp + 0x2d8]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x50]
call fcn.14003cdf0
mov al, byte [rsp + 0x2d1]
jmp 0x14003e2cb
mov rcx, qword [rsp + 0x440]
call fcn.14003dba0
mov rcx, qword [rsp + 0x440]
call fcn.14003dc00
mov rcx, qword [rsp + 0x448]
call fcn.1400010b0
mov byte [rsp + 0x410], al
lea rcx, [rsp + 0x50]
call fcn.14003cdf0
mov al, byte [rsp + 0x410]
mov rcx, qword [rsp + 0x428]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x438
ret
Function at 0x14003f7a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov qword [rsp + 0x1c8], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx eax, byte [rsp + 0x218]
test eax, eax
jne 0x14003f7fe
call fcn.140039430
mov rcx, rax
call fcn.140039b50
movzx eax, al
test eax, eax
je 0x14003f7fe
jmp 0x14003f950
mov rcx, qword [rsp + 0x1f0]
call fcn.14003d350
movzx eax, al
test eax, eax
jne 0x14003f85e
mov rcx, qword [rsp + 0x1f0]
call fcn.14003cc70
movzx eax, al
test eax, eax
jne 0x14003f85e
mov rcx, qword [rsp + 0x1f0]
call fcn.14003a130
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140033e80
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1400333d0
lea rcx, [rsp + 0x38]
call fcn.140033e30
jmp 0x14003f950
cmp qword [rsp + 0x208], 0
je 0x14003f900
lea rdx, [0x140054fcc]
mov rcx, qword [rsp + 0x208]
sub rcx, rdx
movzx eax, word [rdx]
cmp ax, word [rdx + rcx]
jne 0x14003f895
add rdx, 2
test ax, ax
jne 0x14003f87f
xor eax, eax
jmp 0x14003f89a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14003f900
lea rcx, [rsp + 0x60]
call fcn.14003d9e0
nop
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x1f0]
call fcn.14003dca0
lea r11, [rsp + 0x60]
mov qword [rsp + 0x48], r11
mov rcx, qword [rsp + 0x48]
call fcn.140039f00
movzx eax, al
test eax, eax
je 0x14003f8e4
mov qword [rsp + 0x208], 0
jmp 0x14003f8f6
mov rcx, qword [rsp + 0x48]
call fcn.14003cdb0
mov qword [rsp + 0x208], rax
lea rcx, [rsp + 0x60]
call fcn.14003cdf0
mov rcx, qword [rsp + 0x1f0]
call fcn.14003cdb0
mov rcx, rax
mov eax, dword [rsp + 0x210]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x208]
mov r8, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x1f8]
call fcn.14000a420
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x30]
xor edx, edx
lea rcx, [0x14003e7e0]
call fcn.1400122bc
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x1e8
ret
Function at 0x140043020
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x460
mov qword [rsp + 0x438], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rcx, qword [rsp + 0x470]
call fcn.14003cdd0
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.140033e80
nop
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x470]
call fcn.14003e5d0
movzx eax, al
test eax, eax
jne 0x1400430d7
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x1a0]
call fcn.1400333d0
mov rcx, qword [rsp + 0x478]
call fcn.140004608
mov byte [rsp + 0x1b0], al
lea rcx, [rsp + 0x1a0]
call fcn.140033e30
mov al, byte [rsp + 0x1b0]
jmp 0x140043331
lea rcx, [rsp + 0x60]
call fcn.14003a5d0
nop
lea rdx, [0x140052840]
lea rcx, [rsp + 0x60]
call fcn.14003a880
mov rcx, qword [rsp + 0x470]
add rcx, 0x138
call fcn.14003cdb0
mov rbx, rax
lea rdx, [0x140052488]
lea rcx, [rsp + 0x60]
call fcn.14003a880
mov rdx, rbx
mov rcx, rax
call fcn.14003a880
lea rdx, [0x140052614]
mov rcx, rax
call fcn.14003a880
cmp qword [rsp + 0x480], 0
je 0x140043152
mov rdx, qword [rsp + 0x480]
lea rcx, [rsp + 0x60]
call fcn.14003a880
lea rcx, [rsp + 0x60]
call fcn.14003a130
mov rbx, rax
mov rcx, qword [rsp + 0x470]
call fcn.14003cdd0
mov rcx, rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400432f1
lea rcx, [rsp + 0x1a0]
call fcn.140033470
mov rcx, qword [rsp + 0x470]
add rcx, 0x138
call fcn.14003cdb0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1b8]
call fcn.14003d780
nop
lea rdx, [0x140052850]
lea rcx, [rsp + 0x2f0]
call fcn.14003acc0
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x448], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rsp + 0x448]
call fcn.14003a900
lea rdx, [0x14005248c]
mov rcx, rax
call fcn.14003a880
mov rcx, rax
call fcn.14003a130
mov qword [rsp + 0x430], rax
mov rcx, qword [rsp + 0x478]
call fcn.14003b980
lea r8, [rsp + 0x1b8]
mov rdx, qword [rsp + 0x430]
mov rcx, rax
call fcn.14003bed0
nop
lea rcx, [rsp + 0x2f0]
call fcn.14003a260
nop
lea rcx, [rsp + 0x1b8]
call fcn.14003cdf0
mov rcx, qword [rsp + 0x478]
call fcn.140004608
mov byte [rsp + 0x428], al
lea rcx, [rsp + 0x60]
call fcn.14003a260
nop
lea rcx, [rsp + 0x1a0]
call fcn.140033e30
mov al, byte [rsp + 0x428]
jmp 0x140043331
lea rcx, [rsp + 0x1a0]
call fcn.140033450
mov rcx, qword [rsp + 0x478]
call fcn.1400010b0
mov byte [rsp + 0x429], al
lea rcx, [rsp + 0x60]
call fcn.14003a260
nop
lea rcx, [rsp + 0x1a0]
call fcn.140033e30
mov al, byte [rsp + 0x429]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x460
pop rbx
ret
Function at 0x140043b20
Capabilities:
Set file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x40]
call fcn.14003cdb0
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r9d, dword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140035580
movzx eax, al
test eax, eax
jne 0x140043b7c
mov rcx, qword [rsp + 0x38]
call fcn.140004608
jmp 0x140043b86
mov rcx, qword [rsp + 0x38]
call fcn.1400010b0
add rsp, 0x28
ret
Function at 0x140479a60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140d21200]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140479a80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140479a88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140479a80
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140479ad5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140479acc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140479a80
add rax, 0x28
cmp rax, r9
jne 0x140479ab8
xor eax, eax
ret

Function at 0x140479ae0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140d21200]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140479b00
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140479b08
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140479b00
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140479b90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140d21200]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140479bb0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140479bb8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x180024200
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024228
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024228
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18002a830
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18002a84d
mov eax, 1
cmp edx, eax
jne 0x18002a8a2
mov qword [0x180075668], rcx
add rsp, 0x28
ret
cmp qword [0x180060a70], 0
je 0x18002a89d
cmp qword [0x180060a78], 8
mov qword [rsp + 0x20], rbx
lea rbx, [0x180060a60]
mov rcx, rbx
cmovae rcx, qword [0x180060a60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x180060a78], 8
cmovae rbx, qword [0x180060a60]
xor eax, eax
mov qword [0x180060a70], rax
mov word [rbx], ax
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
Function at 0x140001190
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x1400011c3
mov ecx, 0xc0000005
jmp 0x140001282
mov ecx, 0x8664
cmp word [rax + 4], cx
jne 0x1400011d6
mov ecx, dword [rax + 0x88]
jmp 0x1400011e8
mov ecx, 0x14c
cmp word [rax + 4], cx
jne 0x14000127d
mov ecx, dword [rax + 0x78]
mov r8d, ecx
xor r9d, r9d
mov r14d, dword [r8 + rbx + 0x20]
mov edi, dword [r8 + rbx + 0x24]
add r14, rbx
mov ecx, dword [r8 + rbx + 0x18]
add rdi, rbx
dec ecx
lea r10d, [rcx + r9]
shr r10d, 1
mov edx, dword [r14 + r10*4]
add rdx, rbx
cmp rbp, rdx
je 0x140001257
test rbp, rbp
je 0x14000124e
test rdx, rdx
je 0x140001248
mov rax, rbp
sub rax, rdx
movsx r11d, byte [rax + rdx]
movsx esi, byte [rdx]
inc rdx
test r11b, r11b
je 0x14000123d
cmp r11b, sil
je 0x140001228
mov edx, r11d
sub edx, esi
js 0x14000124e
test edx, edx
jle 0x140001257
lea r9d, [r10 + 1]
jmp 0x140001252
lea ecx, [r10 - 1]
cmp ecx, r9d
jae 0x140001205
cmp ecx, r9d
jb 0x140001288
movzx eax, word [rdi + r10*2]
cmp eax, dword [r8 + rbx + 0x14]
jae 0x140001288
mov eax, dword [r8 + rbx + 0x1c]
movzx ecx, word [rdi + r10*2]
add rax, rbx
mov eax, dword [rax + rcx*4]
add rax, rbx
jmp 0x14000128a
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400018c4
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x20
mov r8d, 0x1000
mov edx, 8
mov dword [rsp + 0x30], r8d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400019af
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140001977
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0x80000005
jne 0x140001985
cmp dword [rbx], 0
jne 0x140001989
jmp 0x140001993
test eax, eax
js 0x14000198e
mov rax, rbx
jmp 0x1400019b1
test rbx, rbx
je 0x1400019af
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400019b8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov esi, ecx
mov rax, qword gs:[0x30]
mov edi, 0x1000
mov r8d, edi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001a90
jmp 0x140001a4c
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, edi
cmp edi, 0x20000000
ja 0x140001a90
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140001a04
test eax, eax
js 0x140001a6f
mov rax, rbx
jmp 0x140001a92
test rbx, rbx
je 0x140001a90
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001ca8
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 9], 0
mov r14, r9
mov rsi, r8
mov rdx, rcx
test r8, r8
jne 0x140001ce3
mov eax, 0xc00000f2
jmp 0x140001e43
test rdx, rdx
je 0x140001e3e
xor eax, eax
lea rdi, [rbp - 1]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
lea rcx, [rbp - 1]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp + 0x17], 0
lea rax, [rbp - 1]
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], 0x30
mov edx, 1
mov dword [rbp + 0x27], 0x40
lea rcx, [rbp - 9]
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
test eax, eax
js 0x140001e43
and dword [rbp + 0x77], 0
jmp 0x140001dcf
mov rcx, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rbp + 0x6f]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001e2b
mov r8d, dword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp - 9]
mov r9b, 1
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
test eax, eax
js 0x140001e0f
mov rdx, r14
mov rcx, rbx
call rsi
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x140001e0b
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0x6f]
and dword [rbp + 0x6f], 0
mov r9b, 1
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0x77]
xor edx, edx
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
cmp eax, 0xc0000023
je 0x140001d48
jmp 0x140001e2b
xor edi, edi
jmp 0x140001e2b
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140001e3a
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x140001e43
mov eax, 0xc00000f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140002020
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ecx, ecx
call fcn.140001fd8
mov sil, 1
lea rdi, [rbx + 2]
mov r12d, 4
lea r13, str.cw
mov rdx, rbx
mov r9, r12
mov rcx, rdx
mov r8, r12
movzx eax, byte [rcx]
mov al, byte [rax + r13]
mov byte [rcx], al
add rcx, r12
sub r8, 1
jne 0x14000206f
inc rdx
sub r9, 1
jne 0x140002069
mov al, byte [rbx + 5]
mov r14, rdi
mov cl, byte [rbx + 1]
mov r15, r12
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [rdi]
mov byte [rdi], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
mov r11b, byte [r14 - 2]
mov r8b, byte [r14 - 1]
mov dl, r11b
mov r9b, byte [r14 + 1]
xor dl, r8b
xor r9b, byte [r14]
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
mov r10b, r9b
imul ecx, eax, 0x1b
xor r10b, r11b
xor r10b, r8b
xor cl, dl
mov dl, r8b
xor dl, byte [r14]
xor cl, r11b
xor r11b, byte [r14 + 1]
xor cl, r10b
mov byte [r14 - 2], cl
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
mov al, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r10b
mov byte [r14 - 1], cl
imul ecx, eax, 0x1b
mov al, r11b
shr al, 7
add r11b, r11b
movzx eax, al
xor cl, r9b
xor cl, byte [r14]
xor cl, r10b
mov byte [r14], cl
imul ecx, eax, 0x1b
xor cl, r11b
xor cl, byte [r14 + 1]
xor cl, r10b
mov byte [r14 + 1], cl
add r14, r12
sub r15, 1
jne 0x1400020d6
mov r8, rbp
mov rdx, rbx
mov cl, sil
call fcn.140001fd8
inc sil
cmp sil, 0xa
jb 0x140002063
mov rdx, rbx
mov r8, r12
mov rcx, rdx
mov r9, r12
movzx eax, byte [rcx]
mov al, byte [rax + r13]
mov byte [rcx], al
add rcx, r12
sub r9, 1
jne 0x14000219c
inc rdx
sub r8, 1
jne 0x140002196
mov dl, byte [rbx + 6]
mov r8, rbp
mov al, byte [rbx + 5]
mov cl, byte [rbx + 1]
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [rdi]
mov byte [rdi], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], dl
mov dl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 7], dl
mov rdx, rbx
mov byte [rbx + 0xa], cl
mov cl, 0xa
mov byte [rbx + 0xb], al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140001fd8
Function at 0x14000300c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov rbx, r8
and qword [rbp + 0x30], rdi
mov rsi, rdx
mov rax, rcx
test r8, r8
je 0x140003037
and dword [r8], edi
xor ecx, ecx
and dword [rbp + 0x38], ecx
mov qword [rbp + 0x28], rcx
test rsi, rsi
je 0x14000308d
and qword [rbp - 8], rcx
lea r8d, [rcx + 3]
mov rcx, rsi
mov qword [rbp - 0x18], 0xa
lea r9, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x140003089
mov rdx, qword [rbp - 0x20]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
cmovns edi, dword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400030b4
test edi, edi
je 0x1400030b4
mov al, byte [rbp + 0x40]
lea r8, [rbp + 0x30]
mov edx, edi
mov byte [rsp + 0x20], al
call fcn.1400030c4
test rbx, rbx
je 0x1400030b6
mov ecx, dword [rbp + 0x30]
mov dword [rbx], ecx
jmp 0x1400030b6
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400030c4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x20], r9d
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov r15, rcx
lea rdi, [rbp - 0x11]
xor eax, eax
xor ebx, ebx
and qword [r8], rbx
mov rsi, rdx
mov r12, r8
mov r8, rsi
lea edx, [rbx + 0x18]
mov ecx, edx
rep stosb byte [rdi], al
mov ecx, edx
lea rdi, [rbp - 0x31]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x41]
lea ecx, [rbx + 0x10]
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
lea edx, [rbx + 8]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
test rax, rax
je 0x140003276
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.14002c130
lea r15d, [rbx + 1]
test esi, esi
je 0x140003167
mov eax, 0xf62e6ce0
mov edx, esi
mov rcx, r14
xor byte [rcx], al
add rcx, r15
rol eax, 1
add edx, 0xffffffff
jne 0x14000315b
and dword [rbp - 0x21], ebx
lea r9, [rbp - 0x41]
movsd xmm1, qword [rbp - 0x21]
lea r8, [rbp + 0xf]
mov qword [rbp - 0x31], r14
lea rdx, [rbp - 0x31]
mov qword [rbp - 0x29], rsi
mov rcx, r15
movups xmm0, xmmword [rbp - 0x31]
movsd qword [rbp + 0x1f], xmm1
movsd xmm1, qword [rbp - 1]
movaps xmmword [rbp + 0xf], xmm0
movups xmm0, xmmword [rbp - 0x11]
movsd qword [rbp - 0x21], xmm1
movaps xmmword [rbp - 0x31], xmm0
call qword [sym.imp.msdelta.dll_ApplyDeltaB]
test eax, eax
je 0x140003246
mov rdi, qword [rbp - 0x39]
mov rsi, qword [rbp - 0x41]
cmp byte [rbp + 0x7f], bl
je 0x1400031f5
and dword [rbp + 0x6f], ebx
lea r9, [rbp + 0x77]
and dword [rbp + 0x77], ebx
lea r8, [rbp + 0x6f]
mov edx, edi
mov rcx, rsi
call fcn.14001068c
test al, al
jne 0x140003201
mov r9d, dword [rbp + 0x77]
lea rdx, [0x140039c00]
mov r8d, dword [rbp + 0x6f]
mov ecx, r15d
call fcn.140011458
jmp 0x14000323a
lea rcx, str.___Checksum_verification_skipped_r_n
call fcn.140002fb8
mov rax, qword gs:[0x30]
mov r8, rdi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000323a
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14002c130
mov qword [r12], rdi
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.msdelta.dll_DeltaFree]
jmp 0x14000325a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_decompressing_resource
call fcn.1400123ac
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x90]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret