joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070bc
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x40719c
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403290
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret

Function at 0x4071f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rbp, r9
mov rsi, r8
mov r12b, dl
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
shl ebx, 2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
xor r13d, edi
xor edi, edi
lea r15d, [rdi + 1]
mov ebx, edi
mov rdx, r14
mov rcx, rsi
call fcn.00403290
cmp r12b, dil
je 0x4072cc
mov r9d, r13d
mov r8, rdi
mov r10d, 8
mov edx, r9d
shr r9d, 4
and edx, 0xf
cmp edx, 0xa
lea ecx, [rdx + 0x30]
lea eax, [rdx + 0x37]
cmovb ax, cx
mov word [rsp + r8*2 + 0x20], ax
add r8, r15
sub r10, r15
jne 0x407259
cmp rbp, rdi
mov word [rsp + r8*2 + 0x20], di
je 0x4072af
mov eax, dword [rsi + 8]
cmp dword [rsi + 0xc], eax
jne 0x407299
mov rcx, rsi
call fcn.00402f2c
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov word [rcx + rdx*2], 0x2e
add edx, r15d
mov word [rcx + rdx*2], di
mov dword [rsi + 8], edx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004033f0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 2
cmove eax, r15d
add r13d, eax
cmp rbp, rdi
mov r12b, r15b
je 0x4072e3
lea rdx, [0x0044dad8]
mov rcx, rsi
call fcn.004033f0
mov rcx, qword [rsi]
int3
Function at 0x408ac4
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x408b14
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [r12]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x408b10
mov rcx, qword [rsi]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x408aec
mov dword [r12 + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x408c08
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x408b55
add rcx, rcx
call fcn.00402130
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x408bfe
cmp eax, edi
ja 0x408bfe
lea rcx, [rsp + 0x28]
call fcn.00403150
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x408bdf
mov rbp, rbx
cmp word [rbp], 0
jne 0x408bd5
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.00403290
lea r13d, [rdi + 1]
mov ecx, 0x10
call fcn.00402130
mov qword [rsp + 0x88], rax
test rax, rax
je 0x408bc8
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.00403208
jmp 0x408bca
xor eax, eax
mov rdx, rax
mov rcx, r12
call fcn.004010c8
inc edi
add rbp, 2
cmp edi, esi
jb 0x408b89
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
mov rcx, rbx
call sub.msvcrt.dll_free
mov al, dil
jmp 0x408c08
mov rcx, rbx
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x408cac
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x408ccb
cmp byte [rcx + 9], 0
je 0x408ccb
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x408cff
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x408cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408cee
xor al, al
jmp 0x408d01
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x408d84
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x408dc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x0046809c]
cmp r8d, eax
cmova r8d, eax
jmp fcn.00408d84

Function at 0x408e80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x0046809c]
mov rcx, qword [rcx]
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret
Function at 0x408f28
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.00408d08
xor ebx, ebx
cmp al, bl
je 0x408f50
cmp qword [rsp + 0x50], rdi
je 0x408f54
xor al, al
jmp 0x408f62
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40a210
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403290
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov r11, rsp
sub rsp, 0x40
mov rax, qword [r8]
mov dword [r8 + 8], 0
mov rsi, rcx
mov word [rax], 0
mov rcx, qword [rcx]
lea rax, [r11 + 0x30]
mov rbx, r8
mov qword [r11 - 0x18], rax
lea r9, [r11 - 0x10]
xor r8d, r8d
mov qword [r11 - 0x20], 0
mov rdi, rdx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x70], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b62f
cmp eax, 0xea
jne 0x40b6a5
mov edx, dword [rsp + 0x70]
cmp edx, dword [rbx + 0xc]
mov dword [rsp + 0x78], edx
jbe 0x40b644
mov rcx, rbx
call fcn.00402ea4
mov rax, qword [rbx]
lea rcx, [rsp + 0x78]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rbx]
cmp ecx, dword [rsp + 0x78]
cmova ecx, dword [rsp + 0x78]
mov dword [rsp + 0x70], ecx
shr rcx, 1
mov word [rdx + rcx*2], 0
xor ecx, ecx
cmp word [rdx], cx
je 0x40b6a2
add rdx, 2
inc ecx
cmp word [rdx], 0
jne 0x40b696
mov dword [rbx + 8], ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b724
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
movabs rax, 0x100000000
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
mov qword [rcx], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40b766
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x4184c8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r13d, edx
xor edx, edx
mov rbp, r8
mov r14, rcx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x20]
mov rsi, r9
call fcn.0044b780
xor ebx, ebx
test rbp, rbp
je 0x418595
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
test rdi, rdi
je 0x418524
test bl, bl
jne 0x418524
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test eax, eax
jne 0x418597
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov r11, qword [r12]
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call qword [r11 + 0x20]
mov r11, qword [r12]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [r11 + 0x28]
mov r11, qword [r12]
mov rcx, r12
call qword [r11 + 0x30]
cmp eax, 0x40
ja 0x4185a6
xor ecx, ecx
test eax, eax
je 0x418580
lea r8d, [rax - 1]
lea rdx, [rsp + 0x20]
shr r8d, 2
inc r8d
xor ecx, dword [rdx]
add rdx, 4
dec r8
jne 0x418575
test rsi, rsi
je 0x418589
cmp ecx, dword [rsi]
jne 0x4185a6
inc rbx
cmp rbx, rbp
jb 0x41850e
xor eax, eax
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x418597

Function at 0x4185b0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x418743
mov eax, edx
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
dec rax
jne 0x4185ba
mov eax, ecx
ret
Function at 0x4187d4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov r10, rcx
je 0x41881e
mov r11, rcx
mov ebx, edx
mov r9d, dword [r8]
mov ecx, dword [r8 + 4]
movzx eax, r9w
shr r9d, 0x10
imul eax, eax, 0x9069
add eax, r9d
mov dword [r8], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
mov dword [r8 + 4], eax
mov byte [r11], al
inc r11
dec rbx
jne 0x4187e6
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.00418798
Function at 0x42776c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov edx, dword [rcx + 0x20]
mov rax, qword [rcx + 0x18]
mov rbp, rcx
dec edx
mov rsi, qword [rax + rdx*8]
lea rdx, str.CreateDecoder
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.CreateEncoder
mov qword [rsi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.GetMethodProperty
mov qword [rsi + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
cmp rax, rbx
mov qword [rsi + 0x20], rax
je 0x42789f
mov rcx, qword [rsi]
lea rdx, str.GetNumberOfMethods
mov dword [rsp + 0xc0], 1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x427801
lea rcx, [rsp + 0xc0]
call rax
cmp eax, ebx
jne 0x4278ff
cmp dword [rsp + 0xc0], ebx
mov edi, ebx
jbe 0x42789f
mov eax, dword [rbp + 0x20]
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x3c]
dec eax
mov r8d, 3
mov edx, edi
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call fcn.00426d3c
cmp eax, ebx
jne 0x4278ff
mov rcx, qword [rsi + 0x20]
lea rax, [rsp + 0x39]
lea r9, [rsp + 0x4c]
mov r8d, 2
mov edx, edi
mov qword [rsp + 0x20], rax
call fcn.00426d3c
cmp eax, ebx
jne 0x4278ff
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r8d, 0x2c
call fcn.0044b480
lea rcx, [rbp + 0x50]
lea rdx, [rsp + 0x60]
call fcn.0042746c
inc edi
cmp edi, dword [rsp + 0xc0]
jb 0x427810
mov rcx, qword [rsi]
lea rdx, str.GetHashers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x4278fd
lea rcx, [rsi + 0x40]
call rax
cmp eax, ebx
jne 0x4278ff
mov rcx, qword [rsi + 0x40]
cmp rcx, rbx
je 0x4278fd
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, ebx
mov edi, eax
jbe 0x4278fd
mov ecx, dword [rbp + 0x20]
mov dword [rsp + 0xc4], ebx
dec ecx
mov dword [rsp + 0xc0], ecx
mov rdx, qword [rsp + 0xc0]
lea rcx, [rbp + 0x60]
int3
xor eax, eax
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x44b5fd
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x44b61b
je 0x44b626
call 0x44b675
mov bl, 0xc7
lahf
pop rsi
jne 0x44b606
call 0x44b61e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x44b606
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x44b654
je 0x44b692
invalid
je 0x44b6a3
jne 0x44b606
lea rax, [0x0044b52c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
clc
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x0044728d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x44b744
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
invalid
invalid
Function at 0x44b670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x44b61b
je 0x44b626
call 0x44b675
mov bl, 0xc7
lahf
pop rsi
jne 0x44b606
call 0x44b61e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x44b606
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x44b654
je 0x44b692
invalid
je 0x44b6a3
jne 0x44b606
lea rax, [0x0044b52c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
clc
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x0044728d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x44b744
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
invalid
invalid
Function at 0x44b675
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x44b61b
je 0x44b626
call 0x44b675
mov bl, 0xc7
lahf
pop rsi
jne 0x44b606
call 0x44b61e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x44b606
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x44b654
je 0x44b692
invalid
je 0x44b6a3
jne 0x44b606
lea rax, [0x0044b52c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
clc
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x0044728d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x44b744
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
invalid
invalid
Function at 0x44b693
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x44b61b
je 0x44b626
call 0x44b675
mov bl, 0xc7
lahf
pop rsi
jne 0x44b606
call 0x44b61e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x44b606
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x44b654
je 0x44b692
invalid
je 0x44b6a3
jne 0x44b606
lea rax, [0x0044b52c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
clc
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x0044728d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x44b744
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
invalid
invalid
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140123e40]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140123e50]
mov dword [rax], 1
mov rax, qword [0x140123e60]
mov dword [rax], 1
mov rax, qword [0x140123d90]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140123e30]
mov dword [0x14013500c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140123f30]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140123f10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140123d70]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140123e90]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rdi
xor eax, eax
lock cmpxchg qword [rbx], rsi
jne 0x1400011b0
mov rsi, qword [0x140123ea0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140135008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x140123dd0]
mov rax, qword [rax]
test rax, rax
je 0x14000121f
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140123e80]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140135028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140135020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140135020], rbp
call dbg.__main
mov rax, qword [0x140123e10]
mov r8, qword [0x140135018]
mov ecx, dword [0x140135028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140135020]
call sym.main
mov ecx, dword [0x14013500c]
mov dword [0x140135010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140135008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140123ea0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011dd
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011fc
mov rdx, qword [0x140123ee0]
mov rcx, qword [0x140123ed0]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001204
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001204
call sym._cexit
mov eax, dword [0x140135010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140123f00]
mov rcx, qword [0x140123ef0]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f1
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop