joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlNormalizeProcessParams]
mov rbx, qword [rax + 0x78]
test rbx, rbx
je 0x1400014f5
cmp word [rbx], 0
jne 0x1400014f9
mov rbx, qword [rax + 0x68]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call fcn.140001310
mov rax, qword gs:[0x30]
mov esi, dword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov eax, dword [rsp + 0x50]
lea edx, [rsi*8 + 8]
mov rcx, qword [rcx + 0x30]
lea r8, [rdx + rax*2]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x140001553
mov edx, 0xc0000017
jmp 0x140001582
lea eax, [rsi + 1]
mov rdx, rdi
lea r8, [rdi + rax*8]
mov rcx, rbx
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001310
mov ecx, dword [rsp + 0x48]
mov rdx, rdi
call fcn.140001070
mov edx, eax
mov rcx, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ntdll.dll_NtTerminateProcess]

Function at 0x1400015a0
Capabilities:
Disable driver code integrity
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov rbp, rcx
cmp word [rcx], ax
jne 0x14000165d
movsxd rcx, dword [rcx + 0x3c]
add rcx, rbp
cmp dword [rcx], 0x4550
jne 0x14000165d
mov r8d, 0x20b
mov eax, 0x88
cmp word [rcx + 0x18], r8w
mov edx, 0x78
cmovne eax, edx
xor esi, esi
mov r12d, dword [rax + rcx]
mov eax, dword [rax + rcx + 4]
lea r13, [r12 + rbp]
mov r15d, dword [r13 + 0x20]
mov edi, dword [r13 + 0x18]
add r15, rbp
mov dword [rsp + 0x68], eax
mov eax, dword [r13 + 0x1c]
add rax, rbp
mov qword [rsp + 0x70], rax
mov eax, dword [r13 + 0x24]
add rax, rbp
sub edi, 1
mov qword [rsp + 0x60], rax
js 0x14000165d
nop
lea ebx, [rdi + rsi]
sar ebx, 1
lea rcx, str.CiInitialize
movsxd r14, ebx
mov edx, dword [r15 + r14*4]
add rdx, rbp
call sub.ntdll.dll_strcmp
test eax, eax
jns 0x140001654
lea edi, [rbx - 1]
jmp 0x140001659
jle 0x140001674
lea esi, [rbx + 1]
cmp edi, esi
jge 0x140001630
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp edi, esi
jl 0x14000165d
cmp ebx, dword [r13 + 0x14]
jge 0x14000165d
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
movzx eax, word [rax + r14*2]
mov ecx, dword [rcx + rax*4]
cmp ecx, r12d
jb 0x1400016a0
mov eax, dword [rsp + 0x68]
add eax, r12d
cmp ecx, eax
jb 0x14000165d
lea rax, [rcx + rbp]
jmp 0x14000165f
Function at 0x1400016b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
push rsi
push r14
sub rsp, 0x158
mov r14, rdx
mov qword [rdx], 0
xor edx, edx
mov dword [rax + 0x10], 0
mov rsi, rcx
lea r9, [rax + 0x10]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000184f
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x178]
mov qword [rsp + 0x180], rbp
add r8, r8
mov qword [rsp + 0x150], rdi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x178]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebp, eax
test eax, eax
js 0x140001821
mov qword [rsp + 0x170], rbx
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140001819
nop
mov ecx, ebx
lea rax, [rsp + 0x20]
imul rdx, rcx, 0x128
lea rcx, [rdi + 8]
add rcx, rdx
mov edx, 2
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140001780
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x48]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
mov rcx, rsi
movzx eax, word [rsp + 0x46]
add rdx, rax
call qword [sym.imp.ntdll.dll__stricmp]
test eax, eax
je 0x14000180f
inc ebx
cmp ebx, dword [rdi]
jb 0x140001760
jmp 0x140001819
mov rax, qword [rsp + 0x30]
xor ebp, ebp
mov qword [r14], rax
mov rbx, qword [rsp + 0x170]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x150]
mov eax, ebp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rsi
ret
Function at 0x140001860
Capabilities:
Disable driver code integrity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov qword [r8], rbx
mov rbp, rdx
mov rsi, rcx
call fcn.1400015a0
mov rcx, rsi
mov rdi, rax
call fcn.1400015a0
mov r9, rax
test rax, rax
je 0x14000198d
mov rax, qword gs:[0x30]
mov r10d, ebx
mov r8d, ebx
mov rcx, qword [rax + 0x60]
mov eax, 0x3fab
cmp word [rcx + 0x120], ax
jb 0x140001922
lea r11, [0x140003e60]
sub r9, r11
nop
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x1400018e2
test dl, dl
jne 0x14000191e
inc ecx
inc rax
cmp ecx, 0x10
jb 0x1400018d5
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x1400018d0
movzx ecx, bx
nop dword [rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140001910
jmp 0x14000197c
xor cl, cl
jmp 0x1400018ee
lea r11, [0x140003e50]
sub r9, r11
nop dword [rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x140001942
test dl, dl
jne 0x140001994
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140001935
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x140001930
mov ecx, ebx
nop dword [rax + rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140001970
test r10d, r10d
jne 0x140001998
lea rcx, str.failed_to_find_CipInitialize_n
call fcn.140001000
xor eax, eax
jmp 0x140001a80
xor cl, cl
jmp 0x14000194e
movzx r9d, cx
mov edx, r10d
movsxd rcx, r10d
lea rax, [rcx + r9]
mov r8d, dword [rax + rdi]
add rdi, 4
lea rax, [rcx + r8]
add rax, r9
lea rcx, str.CipOffset_:__d___CipInitOffset_:_0x_llx__CipInitialize_:_0x_llx_n
add rdi, rax
mov r9, rdi
call fcn.140001000
lea r11, [0x140003e40]
mov r8, rdi
sub r8, r11
mov r10d, ebx
mov r9d, ebx
nop word [rax + rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x1400019f2
test dl, dl
jne 0x140001a42
inc ecx
inc rax
cmp ecx, 0xc
jb 0x1400019e5
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
movsxd r10, eax
cmp r9d, 0xff
jl 0x1400019e0
nop dword [rax]
inc bx
movzx eax, bx
cmp byte [rax + r11], 0
jne 0x140001a20
test r10d, r10d
jne 0x140001a46
lea rcx, str.failed_to_find_Ci_gOptions_n
call fcn.140001000
xor eax, eax
jmp 0x140001a80
xor cl, cl
jmp 0x1400019fe
movzx r9d, bx
lea rcx, str.Offset_:__d_RealOffset_:__d__g_CiOptions_:_0x_llx
mov edx, r10d
lea rax, [r10 + r9]
add r9, 4
movsxd r8, dword [rax + rdi]
lea rbx, [r10 + r8]
add rbx, r9
add rbx, rdi
mov r9, rbx
call fcn.140001000
sub rbx, rsi
mov eax, 1
add rbx, rbp
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140003190
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov r14, r8
mov rbp, qword [rcx + 0x88]
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x4478
add rcx, 0x818
mov r9, qword [rax + 0x60]
lea rax, [0x1400c1920]
sub rbp, qword [r9 + 0x10]
add rbp, rax
mov qword [rsp + 0x60], 0
call sym.VBoxNetDHCP.exe_nocrt_memset
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
mov r9d, 0x4478
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x818]
mov rdx, rbp
call qword [0x1400bf250]
test eax, eax
js 0x1400032f3
mov edx, dword [rdi + 0x830]
cmp edx, esi
je 0x1400032e0
mov byte [rdi + 0x4c8b], 0
lea rbx, [rdi + 0x88c]
mov byte [rdi + 0x88b], 0
lea rbp, [rdi + 0x83c]
mov r9d, dword [rdi + 0x838]
lea rcx, str.supR3HardenedWinCheckChild:_enmRequest_d_rc_d_enmWhat_d__s:__s_n
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.14000cf70
mov eax, dword [rdi + 0x830]
cmp eax, 2
jne 0x140003316
mov rcx, qword [rdi + 0x18]
xor edx, edx
call qword [0x1400bf2a0]
test eax, eax
js 0x140003340
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x78], 0xfffffffffd050f80
call fcn.140001cff
test eax, eax
je 0x1400032bd
mov edx, eax
lea rcx, str.supR3HardNtChildProcessRequest:_Child_is_taking_too_long_to_quit__rcWait_x___killing_it..._n
call fcn.14000cf70
mov rcx, qword [rdi]
mov edx, 0x40010004
call qword [0x1400bf320]
mov edx, dword [rdi + 0x838]
lea r9, [0x14007f900]
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x20], rbx
test edx, edx
jne 0x140003370
jmp 0x14000335e
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x28], eax
lea r9, str.NtReadVirtualMemory___p___failed_reading_child_process_status:__x_n
mov r8d, eax
mov qword [rsp + 0x20], rbp
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f30
int3
mov qword [rsp + 0x30], r14
lea r9, str.Unexpected_child_request__d._Was_expecting__d___s_._n
mov dword [rsp + 0x28], esi
lea rdx, str.supR3HardenedWinCheckChild
mov r8d, 0xfffffffe
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.140007f30
int3
lea r9, str.NtSetEvent_failed:__x_n
mov dword [rsp + 0x20], eax
mov r8d, eax
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f30
int3
mov edx, 5
lea rcx, str.supR3HardenedWinCheckChild
call fcn.14000cd00
int3
mov rcx, rbp
call fcn.14000cd00
int3
Function at 0x140015980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x140086db0]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x140015afc
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x140015af0
cmp dword [r10 + r8*4], ecx
jle 0x140015b0b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x140015b02
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x140015b32
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140015b75
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x140015b71
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x140015b75
mov al, 1
jmp 0x140015b77
xor al, al
test al, al
lea rdx, [0x140086d68]
movzx eax, al
lea r10, [0x140086d88]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x140015bd1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x140015bc0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x14001b080
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword [rcx + 0x28]
mov r8, rcx
xor edx, edx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b0bd
mov edx, dword [rax + 0x3c]
cmp edx, 0x800
jbe 0x14001b0bd
mov al, byte [2]
inc al
mov byte [2], al
int3
mov r9d, edx
add r9, rax
mov qword [r8 + 0x30], r9
cmp dword [r9], 0x4550
je 0x14001b0e1
mov al, byte [3]
inc al
mov byte [3], al
int3
mov eax, 0xf0
cmp word [r9 + 0x14], ax
je 0x14001b0fe
mov al, byte [4]
inc al
mov byte [4], al
int3
mov eax, 0x20b
cmp word [r9 + 0x18], ax
je 0x14001b11b
mov al, byte [5]
inc al
mov byte [5], al
int3
cmp dword [r9 + 0x84], 0x10
je 0x14001b136
mov al, byte [6]
inc al
mov byte [6], al
int3
mov dword [r8 + 0x38], edx
movzx eax, word [r9 + 6]
lea ecx, [rax*4 + 0x21]
add ecx, eax
lea eax, [rdx + rcx*8]
mov edx, eax
mov dword [r8 + 0x3c], eax
mov eax, dword [r9 + 0x50]
mov dword [r8 + 0x40], eax
mov rax, qword [r9 + 0x88]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
jb 0x14001b17e
cmp eax, edx
jb 0x14001b17e
mov edx, dword [r9 + 0x50]
cmp eax, edx
jae 0x14001b17e
add ecx, eax
cmp ecx, edx
jbe 0x14001b18f
mov cl, byte [7]
inc cl
mov byte [7], cl
int3
mov r10d, eax
mov rcx, rax
add r10, qword [r8 + 0x28]
shr rcx, 0x20
mov dword [r8 + 0x44], eax
mov dword [r8 + 0x48], ecx
mov eax, dword [r10 + 0x14]
dec eax
cmp eax, 0xffffe
ja 0x14001b1c2
mov eax, dword [r10 + 0x18]
cmp eax, 0x100000
jae 0x14001b1c2
cmp eax, 1
jae 0x14001b1d7
mov al, byte [8]
inc al
mov byte [8], al
int3
mov edi, dword [r8 + 0x3c]
mov dword [r8 + 0x5c], eax
mov ecx, dword [r10 + 0x18]
cmp ecx, dword [r10 + 0x14]
cmovb ecx, dword [r10 + 0x14]
mov dword [r8 + 0x58], ecx
mov r11d, dword [r10 + 0x1c]
cmp r11d, edi
jb 0x14001b20b
mov ebx, dword [r9 + 0x50]
cmp r11d, ebx
jae 0x14001b20b
lea rdx, [r11 + rcx*4]
cmp rdx, rbx
jbe 0x14001b224
mov al, byte [9]
inc al
mov byte [9], al
int3
mov rbx, qword [r8 + 0x28]
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x50], rax
mov r11d, dword [r10 + 0x20]
cmp r11d, edi
jb 0x14001b252
cmp r11d, dword [r9 + 0x50]
jae 0x14001b252
mov ecx, dword [r10 + 0x18]
mov eax, dword [r9 + 0x50]
lea rdx, [r11 + rcx*4]
cmp rdx, rax
jbe 0x14001b26f
mov al, byte [0xa]
inc al
mov byte [0xa], al
int3
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x60], rax
mov r11d, dword [r10 + 0x24]
cmp r11d, edi
jb 0x14001b298
mov r9d, dword [r9 + 0x50]
cmp r11d, r9d
jae 0x14001b298
mov ecx, dword [r10 + 0x18]
lea rdx, [r11 + rcx*4]
cmp rdx, r9
jbe 0x14001b2b1
mov al, byte [0xb]
inc al
mov byte [0xb], al
int3
mov rdi, qword [rsp + 0x10]
mov eax, r11d
add rax, rbx
mov rbx, qword [rsp + 8]
mov qword [r8 + 0x68], rax
ret
Function at 0x140020270
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov edi, r8d
mov ebp, edx
mov rbx, rcx
cmp r8d, 2
jne 0x140020291
call fcn.1400247c0
mov edi, eax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov rcx, rbx
lea r8d, [r9 + 4]
call qword [case.0x14002090f.0]
test eax, eax
js 0x140020470
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r13
mov r13d, 0x5a4d
mov qword [rsp + 0x38], r14
mov r14d, 0x584c
mov qword [rsp + 0x30], r15
cmp ax, r13w
je 0x140020321
cmp eax, 0x4550
je 0x140020321
cmp eax, 0x464c457f
je 0x140020321
cmp ax, r14w
je 0x140020321
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020321
cmp eax, 0xfefaedfe
je 0x140020321
cmp eax, 0xcefaedfe
je 0x140020321
cmp eax, 0xcafebabe
je 0x140020321
cmp eax, 0xbebafeca
jne 0x1400203ad
mov dword [rsp + 0x70], 0
mov r12d, 0x454c
lea r15d, [r12 + 2]
cmp ax, r13w
jne 0x1400203b7
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r9d, 0x3c
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [case.0x14002090f.0]
test eax, eax
js 0x14002045c
mov eax, dword [rsp + 0x70]
cmp eax, 0x40
jbe 0x1400203ad
mov r9d, eax
lea rdx, [rsp + 0x80]
mov rax, qword [rbx + 8]
mov r8d, 4
mov rcx, rbx
call qword [case.0x14002090f.0]
test eax, eax
js 0x14002045c
mov eax, dword [rsp + 0x80]
cmp eax, 0x4550
je 0x1400203be
cmp ax, r14w
je 0x1400203b7
cmp ax, r12w
je 0x1400203b7
cmp ax, r15w
je 0x1400203b7
mov eax, 0xfffffda8
jmp 0x14002045c
cmp eax, 0x4550
jne 0x1400203e6
mov rax, qword [rsp + 0x90]
mov r8d, edi
mov r9d, dword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400410f0
mov ecx, eax
jmp 0x14002045a
cmp eax, 0x464c457f
jne 0x1400203f4
mov ecx, 0xfffffda7
jmp 0x14002045a
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020455
cmp eax, 0xfefaedfe
je 0x140020455
cmp eax, 0xcefaedfe
je 0x140020455
cmp eax, 0xcafebabe
je 0x140020455
cmp eax, 0xbebafeca
je 0x140020455
cmp ax, r14w
jne 0x140020428
mov ecx, 0xfffffda5
jmp 0x14002045a
cmp ax, r12w
jne 0x140020435
mov ecx, 0xfffffda4
jmp 0x14002045a
cmp ax, r15w
jne 0x140020442
mov ecx, 0xfffffda3
jmp 0x14002045a
cmp ax, r13w
mov ecx, 0xfffffda8
mov edx, 0xfffffda2
cmove ecx, edx
jmp 0x14002045a
mov ecx, 0xfffffda8
mov eax, ecx
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140024540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x140024589
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x14002459f
mov r10b, 1
jmp 0x1400245a8
cmp cl, 0x2d
jne 0x1400245b1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x140024592
lea rbx, [0x140000000]
test edx, edx
jne 0x140024606
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x14002463e
cmp r8d, 1
jbe 0x1400245f1
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x1400245f1
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xa7910], 0x10
jae 0x1400245f1
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x14002463e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xa7910], 8
jae 0x14002463e
mov edi, 8
jmp 0x14002463e
mov edi, edx
cmp edx, 0x10
jne 0x14002463e
cmp byte [rax], 0x30
jne 0x14002463e
cmp r8d, 1
jbe 0x14002463e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x140024626
cmp cl, 0x58
jne 0x14002463e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xa7910], 0x10
jae 0x14002463e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xa7a10]
mov rbx, r9
test r8d, r8d
je 0x1400246a7
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x14002469d
movzx esi, byte [rcx + r13 + 0xa7910]
cmp esi, edi
jae 0x14002469d
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x14002468e
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x140024694
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140024661
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x1400246ca
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x1400246d3
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x1400246f6
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140024743
cmp byte [rax], r9b
je 0x140024743
test r8d, r8d
je 0x140024743
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14002471d
cmp cl, 9
jne 0x140024730
inc rax
add r8d, 0xffffffff
jne 0x140024710
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x140024726
test cl, cl
je 0x140024726
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x14003d230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rcx + 0xb8]
mov qword [rcx + 0x130], rax
mov eax, dword [rcx + 0xb4]
mov qword [rcx + 0x128], rax
mov eax, dword [rcx + 0xb0]
mov qword [rcx + 0x120], rax
mov eax, dword [rcx + 0xac]
mov qword [rcx + 0x118], rax
mov eax, dword [rcx + 0xa8]
mov qword [rcx + 0x110], rax
mov eax, dword [rcx + 0xa4]
mov qword [rcx + 0x108], rax
mov eax, dword [rcx + 0xa0]
mov qword [rcx + 0x100], rax
mov eax, dword [rcx + 0x9c]
mov qword [rcx + 0xf8], rax
mov eax, dword [rcx + 0x98]
mov dword [rcx + 0xf4], eax
mov eax, dword [rcx + 0x94]
mov dword [rcx + 0xf0], eax
mov eax, dword [rcx + 0x90]
mov qword [rcx + 0xe8], rax
movzx eax, word [rcx + 0x8e]
mov word [rcx + 0xe6], ax
movzx eax, word [rcx + 0x8c]
mov word [rcx + 0xe4], ax
mov eax, dword [rcx + 0x88]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0x84]
mov qword [rcx + 0xd8], rax
mov eax, dword [rcx + 0x80]
mov qword [rcx + 0xd0], rax
mov eax, dword [rcx + 0x7c]
mov qword [rcx + 0xc8], rax
mov eax, dword [rcx + 0x78]
mov qword [rcx + 0xc0], rax
mov eax, dword [rcx + 0x74]
mov qword [rcx + 0xb8], rax
mov eax, dword [rcx + 0x70]
mov qword [rcx + 0xb0], rax
mov eax, dword [rcx + 0x6c]
mov qword [rcx + 0xa8], rax
mov eax, dword [rcx + 0x68]
mov qword [rcx + 0xa0], rax
mov eax, dword [rcx + 0x64]
mov dword [rcx + 0x9c], eax
mov eax, dword [rcx + 0x60]
mov dword [rcx + 0x98], eax
movzx eax, word [rcx + 0x5e]
mov word [rcx + 0x96], ax
movzx eax, word [rcx + 0x5c]
mov word [rcx + 0x94], ax
mov eax, dword [rcx + 0x58]
mov dword [rcx + 0x90], eax
mov eax, dword [rcx + 0x54]
mov qword [rcx + 0x88], rax
mov eax, dword [rcx + 0x50]
mov qword [rcx + 0x80], rax
mov eax, dword [rcx + 0x4c]
mov qword [rcx + 0x78], rax
mov eax, dword [rcx + 0x48]
mov qword [rcx + 0x70], rax
mov eax, dword [rcx + 0x44]
mov qword [rcx + 0x68], rax
mov eax, dword [rcx + 0x40]
mov qword [rcx + 0x60], rax
mov eax, dword [rcx + 0x3c]
mov qword [rcx + 0x58], rax
mov eax, dword [rcx + 0x38]
mov qword [rcx + 0x50], rax
movzx eax, word [rcx + 0x36]
mov word [rcx + 0x4e], ax
movzx eax, word [rcx + 0x34]
mov word [rcx + 0x4c], ax
mov eax, dword [rcx + 0x2c]
mov dword [rcx + 0x48], eax
mov eax, dword [rcx + 0x30]
mov qword [rcx + 0x40], rax
mov eax, dword [rcx + 0x28]
mov qword [rcx + 0x38], rax
mov eax, dword [rcx + 0x24]
mov qword [rcx + 0x30], rax
mov eax, dword [rcx + 0x20]
mov qword [rcx + 0x28], rax
mov eax, dword [rcx + 0x1c]
mov qword [rcx + 0x20], rax
mov eax, dword [rcx + 0x18]
mov qword [rcx + 0x18], rax
ret
Function at 0x1400646a0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0xf]
and rax, 0xfffffffffffffff0
jbe 0x1400646cd
mov rdx, qword [0x1400bf9d0]
dec rax
shr rax, 3
inc rax
nop dword [rax + rax]
xor qword [rcx], rdx
lea rcx, [rcx + 8]
sub rax, 1
jne 0x1400646c0
xor eax, eax
ret