joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b79a0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x1400e8200]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x1400e8210]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x1400e8220]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x1400b7b75
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x1400b7a9d
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x1400b7a40
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x1400b7afe
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x1400b7ac0
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x1400b7a00
test r9, r9
jne 0x1400b79f0
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x1400b7bc1
test r9, r9
je 0x1400b7b98
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x1400b7b80
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b7c30
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x1400b7c4e
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x1400b7e8f
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x1400e8600]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x1400e85e0]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x1400e85c0]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x1400b7ddf
cmp r9, 0x20
jb 0x1400b7db3
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x1400b7d2a
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x1400b7d0a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x1400b7cf0
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x1400b7cc0
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x1400b7ca6
jmp 0x1400b7e6d
test ecx, ecx
mov ecx, eax
je 0x1400b7dcc
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.1400b79a0
jmp 0x1400b7e6d
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.1400b6ec0
jmp 0x1400b7e6d
test ecx, ecx
je 0x1400b7e1e
test r9, r9
je 0x1400b7e08
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x1400b7df0
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x1400b7e58
test r9, r9
je 0x1400b7e44
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x1400b7e30
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x1400bb400
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400bb484
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400f6750]
cmp byte [rcx + rax], 0
je 0x1400bb484
dec r8
sub rdx, 1
jne 0x1400bb46a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400bbb6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400bb49c
mov ebx, eax
test eax, eax
jne 0x1400bbb9c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400bbbf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400bbbef
test al, 0x10
je 0x1400bbbef
bt eax, 0xa
jae 0x1400bbbe8
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400bbc10
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400bbbe4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400bbc08
test edi, edi
jne 0x1400bbbef
and dword [rsp + 0x3c], 0
jmp 0x1400bbbf4
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1400ab5c4
int3
Function at 0x1400c32a0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14009f058
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14009f058
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400c33f0
cmp rax, 0xffffffffffffffff
je 0x1400c33f0
xor edi, edi
test rbp, rbp
jle 0x1400c339b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14009cf4c
mov rbx, rax
test rax, rax
jne 0x1400c3328
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400c3391
mov edx, 0x8000
mov ecx, r14d
call fcn.1400bde8c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14009c5d4
cmp eax, 0xffffffff
je 0x1400c3371
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400c3338
mov edx, r15d
mov ecx, r14d
call fcn.1400bde8c
jmp 0x1400c3391
cmp byte [rsi + 0x38], dil
je 0x1400c3388
cmp dword [rsi + 0x34], 5
jne 0x1400c3388
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
cmp byte [rsi + 0x30], dil
je 0x1400c3391
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14009c8e4
jmp 0x1400c3404
jns 0x1400c3404
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14009f058
cmp rax, 0xffffffffffffffff
jne 0x1400c33bc
cmp byte [rsi + 0x30], dil
je 0x1400c3404
mov edi, dword [rsi + 0x2c]
jmp 0x1400c3404
mov ecx, r14d
call fcn.1400a4f7c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400c3404
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
jmp 0x1400c3404
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400c33fd
mov eax, dword [rsi + 0x2c]
jmp 0x1400c3402
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14009f058
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400c34e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c3508
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400c3508
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001520
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0xc8
cmp qword [rcx + 0x18], 7
jbe 0x14000153a
mov rcx, qword [rcx]
call fcn.140056a4c
test eax, eax
mov byte [rbx + 0x60], 1
sete al
mov byte [rbx + 0x61], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000afd0
mov ecx, dword [rbx + 0x58]
add rsp, 0x20
pop rbx
jmp fcn.140021770

Function at 0x140004850
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x60], 0
mov rbx, rcx
jne 0x140004886
mov rcx, qword [rcx + 0xf0]
test rcx, rcx
je 0x140004873
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [rbx + 0x58]
mov word [rbx + 0x60], 1
add rsp, 0x20
pop rbx
jmp fcn.140021770
add rsp, 0x20
pop rbx
ret
Function at 0x140006c00
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname
Terminate process
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x60], 0
mov rbx, rcx
jne 0x140006c45
mov rcx, qword [rcx + 0xd0]
xor edx, edx
test rcx, rcx
je 0x140006c29
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0xc8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [rbx + 0x58]
mov dl, 1
add rsp, 0x20
pop rbx
jmp fcn.140021f00
add rsp, 0x20
pop rbx
ret

Function at 0x140006d40
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14002da40
nop
mov r8d, dword [rdi + 0xd0]
mov rdx, qword [rdi + 0xc8]
mov rcx, qword [rax]
call fcn.140012500
nop
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x140006dac
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140006dac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140006dac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rdi + 0xc8]
call fcn.14004fdb0
xor eax, eax
mov qword [rdi + 0xc8], rax
mov dword [rdi + 0xd0], eax
mov word [rdi + 0x60], 0x101
mov ecx, dword [rdi + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140021770

Function at 0x140008220
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call fcn.14002f2b0
mov rbx, qword [0x140094038]
lea rdx, [0x140094038]
lea rcx, [0x140094038]
mov r8, qword [rbx + 8]
call fcn.140008170
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [0x140094040], 0
mov ecx, dword [rdi + 0x58]
mov word [rdi + 0x60], 0x101
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140021770
Function at 0x140008860
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0xc8]
mov rdi, rcx
cmp ebx, dword [0x140094030]
jne 0x140008882
xor ecx, ecx
call fcn.14002f2b0
mov r9, qword [0x140094038]
mov rdx, r9
mov rax, qword [r9 + 8]
movzx r10d, byte [rax + 0x19]
test r10b, r10b
jne 0x1400088b7
mov rcx, rax
nop dword [rax]
cmp dword [rcx + 0x20], ebx
jae 0x1400088ab
mov rcx, qword [rcx + 0x10]
jmp 0x1400088b1
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400088a0
cmp byte [rdx + 0x19], 0
jne 0x140008932
cmp ebx, dword [rdx + 0x20]
jb 0x140008932
mov rcx, rax
mov r8, r9
test r10b, r10b
jne 0x1400088f6
nop dword [rax]
mov edx, dword [rcx + 0x20]
cmp edx, ebx
jae 0x1400088dd
mov rcx, qword [rcx + 0x10]
jmp 0x1400088f0
cmp byte [r8 + 0x19], 0
je 0x1400088ea
cmp ebx, edx
cmovb r8, rcx
mov r9, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400088d0
cmp byte [r8 + 0x19], 0
jne 0x140008900
mov rax, qword [r8]
cmp byte [rax + 0x19], 0
jne 0x14000891d
cmp ebx, dword [rax + 0x20]
jae 0x140008913
mov r8, rax
mov rax, qword [rax]
jmp 0x140008917
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x140008906
mov rdx, r9
lea rcx, [0x140094038]
call fcn.140008280
mov byte [rdi + 0x61], 1
jmp 0x140008946
mov byte [rdi + 0x61], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.14000afd0
mov ecx, dword [rdi + 0x58]
mov byte [rdi + 0x60], 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140021770

Function at 0x140008fd0
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0xc8]
call fcn.14002f2b0
mov ecx, dword [rbx + 0x58]
mov byte [rbx + 0x61], al
mov byte [rbx + 0x60], 1
add rsp, 0x20
pop rbx
jmp fcn.140021770
Function at 0x14000ac10
Capabilities:
Check for unmoving mouse cursor
Get disk size
Get hostname

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov ecx, 0x68
call fcn.14004fd74
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000ac5f
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rax + 0x60], rcx
mov rcx, rax
call fcn.1400090d0
mov rbx, rax
jmp 0x14000ac61
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x78], rax
lea rbp, vtable._SECQNHU_H::UQSZXDHNN.0
test rax, rax
je 0x14000ac9c
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rbp
mov qword [rax + 0x10], rbx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
call fcn.140007070
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000acf3
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000acf3
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000acf3
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
mov ecx, 0x68
call fcn.14004fd74
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000ad34
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rax + 0x60], rcx
mov rcx, rax
call fcn.1400090d0
mov rbx, rax
jmp 0x14000ad36
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000ad6d
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rbp
mov qword [rax + 0x10], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
lea rcx, [rdi + 0xa0]
lea rdx, [rsp + 0x30]
call fcn.140007070
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000adc0
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000adc0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14000adc0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi + 0x68]
mov dword [rax + 0x60], 0x400000
mov rcx, qword [rdi + 0xb0]
call fcn.140042240
test al, al
jne 0x14000adf3
mov word [rdi + 0x60], 1
mov ecx, dword [rdi + 0x58]
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140021770
mov rcx, qword [rdi + 0xb0]
call fcn.140041e60
test al, al
je 0x14000ae1b
mov word [rdi + 0x60], 0x101
mov ecx, dword [rdi + 0x58]
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140021770
mov rcx, qword [rdi + 0xb0]
call fcn.140041e50
mov dword [rdi + 0x5c], eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000b3a0
Capabilities:
Check for unmoving mouse cursor
Create thread
Get disk size
Get hostname

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 0x60], 0
mov rbx, rcx
jne 0x14000b3fe
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x14000b3fe
cmp dword [rbx + 0x64], 0
je 0x14000b3e6
xor eax, eax
lea r8, [0x14000b410]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret
call fcn.140042370
mov ecx, dword [rbx + 0x58]
mov word [rbx + 0x60], 1
add rsp, 0x30
pop rbx
jmp fcn.140021770
add rsp, 0x30
pop rbx
ret
Function at 0x140038680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x1400940e8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400386b8
nop word [rax + rax]
cmp qword [rax + 0x20], rbx
jae 0x1400386ac
mov rax, qword [rax + 0x10]
jmp 0x1400386b2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400386a0
cmp byte [rcx + 0x19], 0
jne 0x1400386e3
cmp rbx, qword [rcx + 0x20]
jb 0x1400386e3
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
lea rcx, [0x1400940e8]
call fcn.140038580
mov rax, qword [rax]
add rsp, 0x20
pop rbx
ret
movzx eax, byte [rbx + 4]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
xor esi, esi
mov edx, esi
mov qword [rsp + 0x48], rdi
lea rdi, [rbx + 4]
cmp byte [rbx], al
je 0x140038732
mov r8, rdi
nop word [rax + rax]
inc edx
lea r8, [r8 + 1]
mov eax, edx
and eax, 0x80000003
jge 0x140038726
dec eax
or eax, 0xfffffffc
inc eax
movsxd rcx, eax
movzx eax, byte [r8]
cmp byte [rcx + rbx], al
jne 0x140038710
movsxd rcx, edx
inc rcx
call fcn.14004ff80
movzx ecx, byte [rbx]
mov rbp, rax
movzx edx, byte [rdi]
cmp cl, dl
je 0x14003877a
mov r8, rax
sub r8, rdi
inc esi
lea rdi, [rdi + 1]
xor cl, dl
mov eax, esi
mov byte [rdi + r8 - 1], cl
and eax, 0x80000003
jge 0x14003876d
dec eax
or eax, 0xfffffffc
inc eax
movzx edx, byte [rdi]
cdqe
movzx ecx, byte [rax + rbx]
cmp cl, dl
jne 0x140038750
movsxd rax, esi
lea rdx, [rsp + 0x30]
lea rcx, [0x1400940e8]
mov qword [rsp + 0x30], rbx
mov byte [rax + rbp], 0
call fcn.140038580
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rax], rbp
mov rax, rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400387c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x1400940e8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400387f8
nop word [rax + rax]
cmp qword [rax + 0x20], rbx
jae 0x1400387ec
mov rax, qword [rax + 0x10]
jmp 0x1400387f2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400387e0
cmp byte [rcx + 0x19], 0
jne 0x140038823
cmp rbx, qword [rcx + 0x20]
jb 0x140038823
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
lea rcx, [0x1400940e8]
call fcn.140038580
mov rax, qword [rax]
add rsp, 0x20
pop rbx
ret
movzx eax, word [rbx + 8]
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov edx, ebp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
cmp word [rbx], ax
je 0x140038873
lea r8, [rbx + 8]
nop dword [rax]
nop word [rax + rax]
inc edx
lea r8, [r8 + 2]
mov eax, edx
and eax, 0x80000003
jge 0x140038866
dec eax
or eax, 0xfffffffc
inc eax
movsxd rcx, eax
movzx eax, word [r8]
cmp word [rbx + rcx*2], ax
jne 0x140038850
movsxd rcx, edx
mov eax, 2
inc rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14004ff80
movzx ecx, word [rbx]
mov rdi, rax
movzx r9d, word [rbx + 8]
mov r10d, ebp
cmp cx, r9w
je 0x1400388e6
mov r8, rbp
mov rdx, rbp
nop
inc r10d
lea r8, [r8 + 1]
xor cx, r9w
mov eax, r10d
mov word [rdx + rdi], cx
and eax, 0x80000003
jge 0x1400388d0
dec eax
or eax, 0xfffffffc
inc eax
cdqe
lea rdx, [r8 + r8]
movzx r9d, word [rdx + rbx + 8]
movzx ecx, word [rbx + rax*2]
cmp cx, r9w
jne 0x1400388b0
movsxd rax, r10d
lea rdx, [rsp + 0x30]
lea rcx, [0x1400940e8]
mov qword [rsp + 0x30], rbx
mov word [rdi + rax*2], bp
call fcn.140038580
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov qword [rax], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbx
ret
Function at 0x14003e300
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140092100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea r9, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmove ecx, ebx
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004fe50
add rsp, 0x40
pop rbx
ret

Function at 0x14003e370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140092100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
lea r9, [rsp + 0x30]
mov ebx, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003e3bd
cmp dword [rsp + 0x30], ebx
jne 0x14003e3bd
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
jmp 0x14003e3bf
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004fe50
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140040df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r8, [0x14007b5b8]
mov rcx, qword [0x140094100]
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140040eb5
mov rcx, qword [0x140094100]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140040eb5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140040eb5
mov rcx, qword [0x140094100]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov dword [rdi], ecx
shr rcx, 1
call fcn.14004ff80
mov ecx, dword [rdi]
xor r10d, r10d
test ecx, ecx
je 0x140040ea1
lea ecx, [r10 + 1]
mov r9d, r10d
movzx r8d, byte [rcx + rbx]
movzx ecx, byte [rbx + r10]
sub r8b, 0x41
dec cl
shr r9, 1
shl cl, 4
add r10d, 2
or r8b, cl
mov byte [r9 + rax], r8b
mov ecx, dword [rdi]
cmp r10d, ecx
jb 0x140040e72
shr ecx, 1
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret