joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400024d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x14006575c], 2
mov rbx, rcx
mov rdi, rdx
lea rcx, [0x140063120]
jne 0x140002549
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140065800]
mov r8d, 0x200
mov rdx, rdi
call fcn.140016120
cmp byte [0x140065a00], 0
jne case.default.0x140002542
xor r9d, r9d
mov r8d, 0xc8
mov rcx, rbx
lea edx, [r9 + 2]
mov byte [0x140065a00], 1
call qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [0x140063120]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x140065a00], 0
je 0x14000256d
mov edx, 2
mov rcx, rbx
mov byte [0x140065a00], 0
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [0x140063120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, rdi
mov edx, 0x69
mov rcx, rbx
call fcn.140023970
lea rcx, str._s_r_n
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140026850
or al, 0x54
sahf
jp 0x1400af33f
invalid
jge 0x1400af3af
invalid
cld
add eax, 0x8042966c
push rcx
ret 0x6c2b
Function at 0x14000ea18
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 0x18], 0
and dword [rcx + 0x14], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov dword [rcx + 0x5c], edx
ret
Function at 0x1800265a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x18002679d
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x180026602
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x180026612
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xd4]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x18002663f
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, 0x37
mov rcx, rdi
call fcn.180078790
jmp 0x18002666d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x61
mov r9, qword [r9 + 0x68]
call fcn.1800cad70
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x1800266b1
mov edx, 5
mov rcx, rdi
call fcn.180078800
test eax, eax
jne 0x180026789
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x78
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x5b
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x79
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x74
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x18002677d
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x18002677d
mov dword [rbx + rax*4 + 0xd4], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800265e0
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180036910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xad
jne 0x180036929
movzx eax, byte [rdx + 2]
cmp al, 0xae
jne 0x180036933
mov rax, qword [rdx + 0x20]
jmp 0x180036943
cmp al, 0x88
jne 0x180036ac7
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x180036ac7
mov dword [r8], 0
cmp byte [rdx], 0x88
jne 0x18003696a
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1800a1e00
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x180036ab2
mov qword [rsp + 0x80], rbx
lea rcx, [0x1800da7c0]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.1800379b0]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x180036a20
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x180036a10
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18010ebb0
cmp word [rsp + 0x44], 0
je 0x180036a20
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1800aa8d0
jmp 0x180036a60
mov rsi, qword [rdi]
test rbx, rbx
je 0x180036a3c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.180036da0
mov rbx, rax
cmp byte [rsi + 0x61], 0
jne 0x180036a50
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1800a8e70
test rbx, rbx
je 0x180036a60
mov rdx, rbx
mov rcx, rsi
call fcn.1800ac450
inc ebp
lea rcx, [0x1800da7c0]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x1800369d0
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1800abde0
Function at 0x18006c040
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x98]
xorps xmm0, xmm0
mov rdi, rcx
xor r13d, r13d
mov rcx, qword [rsp + 0x90]
mov r15d, r9d
and r15d, 8
mov ebp, r9d
movups xmmword [rbx + 8], xmm0
mov r14d, 1
mov r12d, r13d
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
mov qword [rbx], rcx
mov rsi, qword [rdi + 0x60]
test rsi, rsi
jne 0x18006c0e4
mov rdx, qword [rdi]
lea rcx, str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1801004e0
mov r8, rax
lea rdx, [rdi + 0x60]
mov rcx, rdi
call fcn.180063d60
mov rcx, qword [rsp + 0x90]
mov rsi, qword [rdi + 0x60]
cmp dword [rdi + 0x34], r12d
jne 0x18006c24b
movsxd r8, dword [rcx]
mov edx, r14d
mov rcx, rsi
call fcn.1800fc770
mov r9d, dword [rsp + 0x80]
mov edx, 2
mov r8, qword [rsp + 0x78]
mov rcx, rsi
mov qword [rsp + 0x20], r13
call fcn.1800fc610
mov rcx, rsi
call fcn.180101220
cmp eax, 0x64
jne 0x18006c13f
xor edx, edx
mov rcx, rsi
call fcn.1800fdc50
movsxd r12, eax
mov r14, r12
sar r14, 1
and r12d, 1
mov rcx, rsi
call fcn.180100c70
mov edx, 2
mov dword [rdi + 0x34], eax
mov rcx, rsi
call fcn.18010bb30
test eax, eax
jne 0x18006c16d
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18006c16d
call qword [0x180147120]
mov rax, qword [rsp + 0x90]
mov rdx, rbx
mov rcx, rdi
mov eax, dword [rax + 4]
cmp r14d, eax
cmovge eax, r14d
cmovge r13d, r12d
dec eax
mov dword [rbx + 0xc], eax
call fcn.18006b5e0
cmp qword [rbx + 0x10], 0
je 0x18006c1b8
mov eax, dword [rsp + 0x80]
mov r8, rbx
mov r9, qword [rsp + 0x78]
mov edx, r15d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.180065e60
cmp dword [rdi + 0x34], 0
jne 0x18006c21b
test r15d, r15d
jne 0x18006c21b
mov edx, dword [rbx + 8]
mov rax, qword [rbx + 0x10]
or edx, 1
mov dword [rbx + 8], edx
test rax, rax
je 0x18006c21b
and ebp, 2
je 0x18006c1e0
or edx, 2
mov dword [rbx + 8], edx
test r13d, r13d
je 0x18006c20c
mov r9d, dword [rbx + 0x30]
and edx, 2
cmp r9d, dword [rbx + 0xc]
jne 0x18006c1fa
mov eax, dword [rax + 0xc]
cmp dword [rbx + 0x3c], eax
jl 0x18006c20c
mov rax, qword [rbx]
mov rcx, rdi
mov r8d, dword [rax]
call fcn.180059a40
mov qword [rbx + 0x50], rax
test ebp, ebp
je 0x18006c21b
mov rdx, rbx
mov rcx, rdi
call fcn.18006b9b0
test byte [rbx + 8], 2
je 0x18006c22e
lea rax, [0x18006b920]
mov qword [rbx + 0x28], rax
jmp 0x18006c24b
mov rax, qword [rdi]
lea rcx, [0x18006b1b0]
lea rdx, [0x18006b6f0]
cmp dword [rax + 0x5c], 1
cmove rcx, rdx
mov qword [rbx + 0x28], rcx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008dd00
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rsp + 0x20], ebx
mov r9, rdx
mov rsi, rcx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
call fcn.1800caa80
test ebx, ebx
jne 0x18008dd44
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.1800caa80
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800aeab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1800aebb9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x180122790]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x1800aeb31
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1800aeb6c
test ecx, ecx
jne 0x1800aeb7a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.180038930
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1800aeb50
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1800aeaf0
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x1800aeb7f
inc r8
jmp 0x1800aeb20
test r10d, r10d
jne 0x1800aeb49
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1800aeba5
test edx, edx
je 0x1800aeb31
inc rax
jmp 0x1800aeb90
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x1800aeb49
inc rax
jmp 0x1800aeb90
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800c0900
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rsp + 0x70]
xor r13d, r13d
movsxd rdi, r9d
mov r14d, edx
mov rsi, r8
mov rdx, rcx
mov r9d, r14d
mov dword [r15], r13d
test rcx, rcx
je 0x1800c0a43
lea eax, [rdi - 1]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r12
lea r10d, [r13 + 0xd]
movsxd r8, eax
test eax, eax
js 0x1800c0968
nop dword [rax + rax]
movsx ecx, byte [r8 + rsi]
lea eax, [r10*8]
xor ecx, eax
xor r10d, ecx
sub r8, 1
jns 0x1800c0950
lea ecx, [r10*8]
mov eax, r10d
xor rcx, r9
xor rcx, rax
and ecx, 0x1ff
mov rbx, qword [rdx + rcx*8]
lea r12, [rdx + rcx*8]
test rbx, rbx
je 0x1800c09b6
nop dword [rax]
cmp dword [rbx + 0xc], r14d
jne 0x1800c09ad
cmp dword [rbx + 8], edi
jne 0x1800c09ad
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800c0a29
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1800c0990
mov qword [rsp + 0x58], rbp
lea rbp, [rdi + 0x18]
call fcn.1800fff70
test eax, eax
jne 0x1800c0a35
mov rcx, rbp
call fcn.1800ca1d0
mov rbx, rax
test rax, rax
je 0x1800c0a35
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0x18]
mov dword [rbx + 8], edi
mov r8, rdi
mov qword [rbx], rcx
mov rdx, rsi
mov dword [rbx + 0xc], r14d
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r12]
mov eax, r13d
mov qword [rbx + 0x10], rcx
mov qword [r12], rbx
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov dword [r15], 1
mov eax, r13d
jmp 0x1800c0a12
test rbp, rbp
mov eax, 7
cmovle eax, r13d
jmp 0x1800c0a0d
mov eax, r13d
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x1800c0ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
cmp ecx, 0x80
jge 0x1800c0f12
lea edx, [rcx - 0x41]
cmp edx, 0x19
lea eax, [rcx + 0x20]
cmova eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x1800c0fd7
xor r10d, r10d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov r9d, 0xa2
mov r11d, r10d
lea rsi, [0x180000000]
lea ebx, [r10 - 1]
nop
lea eax, [r11 + r9]
mov r8d, ecx
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx edx, word [rsi + rdx*4 + 0x121510]
sub r8d, edx
mov edx, eax
cmovs edx, ebx
test r8d, r8d
movsxd rbx, edx
lea edx, [rax + 1]
cmovs edx, r11d
dec eax
test r8d, r8d
mov r11d, edx
cmovs r9d, eax
cmp r9d, edx
jge 0x1800c0f40
lea r8, [rbx*4 + 0x121510]
mov rbx, qword [rsp + 0x30]
movzx edx, word [r8 + rsi]
movzx eax, byte [r8 + rsi + 3]
add eax, edx
cmp ecx, eax
jge 0x1800c0fba
movzx eax, byte [r8 + rsi + 2]
xor edx, ecx
and edx, eax
test dl, 1
jne 0x1800c0fba
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x1217a0]
add eax, ecx
movzx ecx, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1800c0fe5
cmp edi, 2
sete r10b
mov edx, r10d
add rsp, 0x20
pop rdi
jmp fcn.180073da0
lea eax, [rcx - 0x10400]
cmp eax, 0x27
lea eax, [rcx + 0x28]
jbe 0x1800c0fe7
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x18010a710
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.1800ca1d0
mov rbx, rax
test rax, rax
jne 0x18010a74e
lea eax, [rbx + 7]
jmp 0x18010a7d1
cmp byte [0x180147094], 0
je 0x18010a7a3
mov rax, qword [0x180147218]
test rax, rax
je 0x18010a76e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x18010a7a3
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x1800dca00]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x18010a7b3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x18010a7cc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0xcb9240
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xcb924d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xcb925d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xcb9245
lea eax, [rcx + 1]
jmp 0xcb926b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xcb927e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xcb9264
sub eax, 3
jb 0xcb929e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xcb92ed
sar eax, 1
movsxd rbp, eax
jb 0xcb92d4
jmp 0xcb92ac
add ebx, ebx
jne 0xcb92aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xcb92d4
inc ecx
add ebx, ebx
jne 0xcb92ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xcb92d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xcb92cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xcb92bc
add ecx, 2
jmp 0xcb92d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00cb9202
jmp 0xcb924d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2bdc00
mov dl, 0x27
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xcb9339
cmp rsi, rcx
jae 0xcb9341
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xcb9320
cmp al, 0x8f
ja 0xcb9320
cmp byte [rsi - 2], 0xf
je 0xcb9326
sub al, 0xe8
cmp al, 1
ja 0xcb930a
cmp rsi, rcx
jae 0xcb9341
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xcb9310
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xcb9341
lodsb al, byte [rsi]
jmp 0xcb9320
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x8b1000]
mov eax, dword [rdi]
or eax, eax
je 0xcb939e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8b9000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xcb934e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xcb9398
mov qword [rbx], rax
add rbx, 8
jmp 0xcb936e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xcb93e2
cmp al, 0xef
ja 0xcb93ca
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xcb93aa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xcb93b9
mov eax, dword [rdi]
add rdi, 4
jmp 0xcb93b9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xcb9436
sub rsp, 0xffffffffffffff80
jmp 0x4667a0
Function at 0x140002288
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022d4
xor al, al
add rsp, 0x28
ret
Function at 0x140001ce0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x14001c040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], 0
mov dword [rsp + 0x170], 0
lea r9, [rsp + 0x170]
xor r8d, r8d
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc0000004
je 0x140001d4e
mov eax, dword [rsp + 0x20]
jmp 0x140001e5b
mov eax, dword [rsp + 0x170]
shl rax, 1
mov qword [rsp + 0x30], rax
call fcn.140001010
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x30]
mov edx, 8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x170]
shl eax, 1
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140001dbd
jmp 0x140001e3d
mov dword [rsp + 0x24], 0
jmp 0x140001dd1
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jae 0x140001e3d
mov eax, dword [rsp + 0x24]
imul rax, rax, 0x128
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdi, rcx
lea rsi, [rdx + rax + 8]
mov ecx, 0x128
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x66]
lea rax, [rsp + rax + 0x68]
mov rdx, rax
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140001e3b
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov dword [rsp + 0x20], 0
jmp 0x140001e3d
jmp 0x140001dc7
call fcn.140001010
mov rax, qword [rax + 0x60]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14000aa60
add rsp, 0x188
pop rdi
pop rsi
ret