joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005eb24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18004b8d0
sub rsp, rax
mov rax, qword [0x180087040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18005a578
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18005eb73
mov rax, rbp
jmp 0x18005ec7b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xd7400]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18005fc44
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0xd7400]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18005ec77
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005ec77
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18005fc44
test rax, rax
js 0x18005ec77
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18005ec77
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18005ec69
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18005ec69
cmp byte [rcx], 0xd
jne 0x18005ec4f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18005ec5e
cmp byte [rcx + 1], 0xa
jne 0x18005ec5e
inc rcx
jmp 0x18005ec5e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x87470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18005ec31
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18005ec7b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18004b8a0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18005ee9c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18005eeb2
mov al, 1
jmp 0x18005ef12
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18005eec3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18005ef10
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800674fc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005ef10
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18005ef10
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18005ef10
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18005ef12
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18005efe4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800d7400]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18005f03b
cmp word [rdx], r13w
jne 0x18005f03b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18005f040
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18005f165
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18005f186
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18005f079
mov rdx, r9
mov word [rbx], cx
jmp 0x18005f0a0
cmp r9, r8
jae 0x18005f0b0
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18005f05a
jmp 0x18005f165
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005f15a
cmp dword [rsp + 0x80], esi
je 0x18005f15a
lea r8, [0x1800d7400]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18005f132
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18005f102
mov word [rbx], r13w
jmp 0x18005f162
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18005f10f
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18005f162
cmp word [rsp + 0x70], r13w
jne 0x18005f13f
cmp rbx, r14
je 0x18005f0fc
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18005fc4c
cmp word [rsp + 0x70], r13w
je 0x18005f165
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800d7400]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18005f15f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18005f165
Function at 0x180062df4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180062e24
xor eax, eax
jmp 0x180062ee7
mov rbp, rbx
cmp word [rax], si
je 0x180062e49
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180062e30
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180062e2c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800614dc
movsxd r14, eax
test eax, eax
jne 0x180062e87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180062e1d
mov rcx, r14
call fcn.18005931c
mov rdi, rax
test rax, rax
jne 0x180062ea0
xor ecx, ecx
call fcn.1800592e0
jmp 0x180062e7c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800614dc
test eax, eax
jne 0x180062ed1
mov rcx, rdi
call fcn.1800592e0
jmp 0x180062edb
xor ecx, ecx
call fcn.1800592e0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180066e9c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180058f80
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180066f3d
cmp ebx, dword [rsp + 0x30]
je 0x180066f36
test esi, esi
je 0x180066f36
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180066f11
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180066f1e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180066efb
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180066f22
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180066f3f
mov eax, 1
jmp 0x180066f3f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180069e10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180069e38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180069e38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400011a0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x100
movdqa xmm2, xmmword [0x140002010]
mov rbp, rdx
movdqa xmm3, xmmword [0x140002020]
lea rdx, [rsp + 4]
mov rbx, rcx
movsxd r14, r8d
mov ecx, 8
mov esi, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm2
andps xmm0, xmm3
andps xmm1, xmm3
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx - 0x14], xmm0
packuswb xmm1, xmm1
movd dword [rdx - 0x10], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm3
paddd xmm1, xmm2
packuswb xmm0, xmm0
andps xmm1, xmm3
packuswb xmm0, xmm0
movd dword [rdx - 0xc], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx - 8], xmm1
cmp eax, 0x100
jl 0x1400011f0
xor ecx, ecx
lea r11, [rsp]
mov r9d, ecx
mov r10d, ecx
nop
movzx edi, byte [r11]
mov eax, r10d
cdq
idiv esi
movsxd rax, edx
movzx edx, byte [rax + rbp]
add r9d, edx
add r9d, edi
and r9d, 0x800000ff
jge 0x1400012bd
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rax, r9d
lea rdx, [rsp]
add rdx, rax
inc r10d
movzx eax, byte [rdx]
mov byte [r11], al
inc r11
mov byte [rdx], dil
cmp r10d, 0x100
jl 0x140001290
mov r8d, ecx
mov r11, r14
test r14d, r14d
jle 0x140001357
nop word [rax + rax]
inc ecx
and ecx, 0x800000ff
jge 0x140001304
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rax, ecx
lea r9, [rsp]
add r9, rax
movzx r10d, byte [r9]
add r8d, r10d
and r8d, 0x800000ff
jge 0x14000132b
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rdx, [rsp]
add rdx, rax
movzx eax, byte [rdx]
mov byte [r9], al
mov byte [rdx], r10b
movzx edx, byte [r9]
add rdx, r10
movzx eax, dl
movzx edx, byte [rsp + rax]
xor byte [rbx], dl
inc rbx
sub r11, 1
jne 0x1400012f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140001380
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov edi, ecx
test ecx, ecx
je 0x14000148c
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov r10, qword [rdx + 0x20]
test r10, r10
je 0x14000148c
mov esi, 0x104
nop dword [rax + rax]
movzx eax, word [r10 + 0x48]
test ax, ax
je 0x14000148c
cmp ax, si
jae 0x14000148c
mov r11, qword [r10 + 0x50]
xor r9d, r9d
cmp word [r11], r9w
je 0x140001421
xor ebx, ebx
xor eax, eax
nop dword [rax + rax]
movzx edx, word [rax + r11]
movzx r8d, dl
sub dx, 0x61
cmp dx, 0x19
lea eax, [r8 - 0x20]
movzx ecx, al
cmova ecx, r8d
inc r9d
mov byte [rsp + rbx], cl
mov ebx, r9d
lea rax, [r9 + r9]
cmp word [rax + r11], 0
jne 0x1400013f0
mov byte [rsp + r9], 0
lea rcx, [rsp]
xor eax, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], al
jne 0x140001433
xor r8d, r8d
test rdx, rdx
je 0x140001480
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rsp + r8]
inc r8
add ecx, eax
imul eax, ecx, 0x101
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r8, rdx
jne 0x140001450
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
cmp eax, edi
je 0x1400014a3
mov r10, qword [r10]
test r10, r10
jne 0x1400013c0
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, qword [r10 + 0x20]
jmp 0x14000148e
Function at 0x1400014b0
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xf0
mov ebp, edx
mov r11, rcx
test rcx, rcx
je 0x140001640
test edx, edx
je 0x140001640
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001640
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001640
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp]
xor r10d, r10d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, r11
mov ebx, dword [rax + 0x20]
mov r15d, dword [rax + 0x1c]
add rbx, r11
mov edi, dword [rax + 0x24]
add r15, r11
mov r14d, dword [rax + 0x14]
add rdi, r11
test r14d, r14d
je 0x140001640
nop word [rax + rax]
movzx eax, word [rdi]
mov rdx, 0xffffffffffffffff
mov r9d, dword [rbx]
add r9, r11
mov esi, dword [r15 + rax*4]
add rsi, r11
xor eax, eax
nop dword [rax]
inc rdx
cmp byte [r9 + rdx], al
jne 0x1400015e0
xor r8d, r8d
test rdx, rdx
je 0x140001630
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r9 + r8]
inc r8
add ecx, eax
imul eax, ecx, 0x101
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r8, rdx
jne 0x140001600
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
cmp ebp, eax
je 0x14000165f
inc r10d
add rbx, 4
add rdi, 2
cmp r10d, r14d
jb 0x1400015c0
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, rsi
jmp 0x140001642
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400186f0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140018700]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x14001b008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x140018660]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140013e40
mov rcx, qword [0x140018780]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x1400186e0]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140013c50
mov ebx, dword [0x14001b028]
lea r12d, [rbx + 1]
movsxd r12, r12d
shl r12, 3
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, qword [0x14001b020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub r12, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [rdi + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rsi, [rax + rax + 2]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [rdi + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rbx, r12
jne 0x140001288
add rbx, rbp
mov qword [rbx], 0
mov qword [0x14001b020], rbp
call fcn.140013a50
mov rax, qword [0x140018670]
mov r8, qword [0x14001b018]
mov ecx, dword [0x14001b028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x14001b020]
call fcn.14000ed50
mov ecx, dword [0x14001b00c]
mov dword [0x14001b010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x14001b008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140018700]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.140014bf0
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140018720]
mov rcx, qword [0x140018710]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14001b010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140018740]
mov rcx, qword [0x140018730]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rbx, rax
jmp 0x1400012be
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
sub rsp, 0x28
mov rax, qword [0x140018690]
mov dword [rax], 1
call fcn.140001180
nop
nop
add rsp, 0x28
ret
Function at 0x140001460
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
movabs rdx, 0x27d4eb2f165667c5
mov r10, rcx
lea rcx, [rcx + 0x28]
mov r9d, dword [r10 + 0x48]
mov r8, qword [r10 + 0x18]
mov r11, qword [r10]
add r9, rcx
add rdx, r8
cmp r11, 0x1f
jbe 0x14000153d
mov rbx, qword [r10 + 0x10]
mov rdx, qword [r10 + 8]
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, qword [r10 + 0x20]
mov rsi, rbx
imul rbx, rdi
mov rbp, rdx
rol rdx, 1
rol rsi, 7
imul rbp, rdi
add rdx, rsi
mov rsi, r8
rol rsi, 0xc
imul r8, rdi
add rdx, rsi
mov rsi, rax
rol rbp, 0x1f
rol rsi, 0x12
imul rax, rdi
add rdx, rsi
rol r8, 0x1f
movabs rsi, 0x9e3779b185ebca87
imul rbp, rsi
imul r8, rsi
xor rdx, rbp
mov rbp, rbx
movabs rbx, 0x85ebca77c2b2ae63
imul rdx, rsi
rol rbp, 0x1f
imul rbp, rsi
add rdx, rbx
xor rdx, rbp
imul rdx, rsi
add rdx, rbx
xor r8, rdx
mov rdx, rax
imul r8, rsi
rol rdx, 0x1f
imul rdx, rsi
lea rax, [r8 + rbx]
xor rdx, rax
imul rdx, rsi
add rdx, rbx
lea rsi, [r10 + 0x30]
add rdx, r11
cmp r9, rsi
jb 0x1400015a9
movabs rbx, 0xc2b2ae3d27d4eb4f
mov rcx, rsi
movabs r8, 0x9e3779b185ebca87
movabs r11, 0x85ebca77c2b2ae63
nop word [rax + rax]
mov rax, qword [rcx - 8]
add rcx, 8
imul rax, rbx
rol rax, 0x1f
imul rax, r8
xor rax, rdx
rol rax, 0x1b
imul rax, r8
lea rdx, [rax + r11]
cmp r9, rcx
jae 0x140001570
mov rax, r9
sub rax, r10
lea rcx, [rax - 0x30]
and rcx, 0xfffffffffffffff8
add rcx, rsi
lea r8, [rcx + 4]
cmp r9, r8
jb 0x1400015e7
mov eax, dword [rcx]
movabs rcx, 0x9e3779b185ebca87
imul rax, rcx
mov rcx, r8
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
rol rax, 0x17
imul rax, rdx
movabs rdx, 0x165667b19e3779f9
add rdx, rax
cmp rcx, r9
jae 0x14000161e
movabs r10, 0x27d4eb2f165667c5
movabs r8, 0x9e3779b185ebca87
movzx eax, byte [rcx]
add rcx, 1
imul rax, r10
xor rax, rdx
rol rax, 0xb
imul rax, r8
mov rdx, rax
cmp r9, rcx
jne 0x140001600
mov rax, rdx
shr rax, 0x21
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
imul rax, rdx
mov rdx, rax
shr rdx, 0x1d
xor rax, rdx
movabs rdx, 0x165667b19e3779f9
imul rax, rdx
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140007cc0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov ecx, 2
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop word cs:[rax + rax]
nop

Function at 0x140007ce0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movups xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x140025040]
test rcx, rcx
je 0x140007d1b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007d40
mov rcx, qword [0x140025040]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140026060], 0
jne 0x140007d58
movups xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x140025040]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007d0e
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x140017332]
mov qword [rsp + 0x20], 0
lea rdi, [0x140026080]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movups xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007e24
test al, 0x10
je 0x140007d24
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movups xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007d24
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007dd0
jmp 0x140007d24
Function at 0x14000ec10
Capabilities:
Create directory
Extract resource via kernel32 functions

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140014a20
sub rsp, rax
mov eax, dword [0x14002a080]
mov rsi, rcx
test eax, eax
je 0x14000ecb0
xor ebx, ebx
lea rdi, [0x140028080]
test eax, eax
jg 0x14000ec4c
jmp 0x14000ec60
add rbx, 1
cmp dword [0x14002a080], ebx
jle 0x14000ec60
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000ec40
jmp 0x14000ec97
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp rax, 2
jne 0x14000ec75
cmp word [rsi + 2], 0x3a
je 0x14000ec97
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000ed00
movsxd rbx, dword [0x14002a080]
cmp ebx, 0x3ff
jle 0x14000ed18
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str._HOME_
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.1400075a0
test al, al
je 0x14000ed3a
movsxd rbx, dword [0x14002a080]
mov rcx, rdi
lea rdi, [0x140028080]
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x14002a080]
add eax, 1
mov dword [0x14002a080], eax
jmp 0x14000ec31
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000ec84
xor eax, eax
jmp 0x14000ec9c
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsdup
add dword [0x14002a080], 1
mov rdx, rax
lea rax, [0x140028080]
mov qword [rax + rbx*8], rdx
jmp 0x14000ec97
mov rcx, rbx
call fcn.140007c20
nop
nop word cs:[rax + rax]
nop