joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001f6e8
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
xor eax, eax
lea rcx, [r11 - 0x30]
xor edx, edx
and qword [r11 - 0x38], rax
lea r8d, [rax + 0x28]
mov dword [r11 + 0xc], eax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 8
mov dword [rsp + 0x84], 3
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, qword [0x10003a8b0]
mov edx, 0xd1
mov qword [0x10003a8b8], rcx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov rdi, rax
test rax, rax
je 0x10001f8b9
mov rcx, qword [0x10003a8b0]
and qword [rsp + 0x20], 0
lea r9, [0x10001f2cc]
xor r8d, r8d
mov edx, 0x190
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rbx, rax
test rax, rax
je 0x10001f8b0
mov rdx, qword [0x10003ad20]
lea rbp, [0x10003a8b8]
cmp dword [rdx - 8], 0
je 0x10001f7a8
mov rcx, rbp
call fcn.10001b8d4
mov rdx, qword [0x10003ad30]
cmp dword [rdx - 8], 0
je 0x10001f7c5
xor r8d, r8d
mov rcx, rbp
call fcn.10001d8dc
jmp 0x10001f8b0
mov rdx, qword [0x10003ad38]
cmp dword [rdx - 8], 0
je 0x10001f7e5
mov r8d, 1
mov rcx, rbp
call fcn.10001d714
jmp 0x10001f8b0
mov rdx, qword [0x10003ad28]
mov r8d, dword [rdx - 8]
test r8d, r8d
je 0x10001f80c
cmp r8d, 4
jle 0x10001f801
sub r8d, 3
jmp 0x10001f804
xor r8d, r8d
mov rcx, rbp
call fcn.10001a554
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x10003ad18], 0
je 0x10001f86f
mov rcx, rbp
call fcn.10001f668
jmp 0x10001f86f
cmp eax, 0xffffffff
je 0x10001f86f
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x10001f86f
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x10001f86f
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x10001f82d
and qword [rsp + 0x38], 0
lea r8d, [rax + 1]
mov eax, dword [0x1000384d0]
lea r9, [rsp + 0x30]
mov edx, 0x803
xor ecx, ecx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r8d
call sub.ntdll.dll_WinSqmAddToStream
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyAcceleratorTable]
lea r11, [rsp + 0x70]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10001f8d4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor ebx, ebx
and dword [0x10003ad18], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea r14d, [rbx + 1]
test rax, rax
je 0x10001faa0
mov ecx, dword [rsp + 0x60]
cmp ecx, 2
jl 0x10001faa0
dec ecx
mov ebp, r14d
cmp ecx, r14d
jl 0x10001faa0
lea r13, [rax + 8]
lea r12d, [rbx + 2]
mov rdi, r13
mov rsi, qword [rdi]
cmp word [rsi], 0x2d
je 0x10001f951
cmp word [rsi], 0x2f
jne 0x10001fa5b
add rsi, 2
lea rdx, [0x1000081c8]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x10001fa99
lea rdx, [0x1000081d0]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x10001fa99
cmp r12d, dword [rsp + 0x60]
jge 0x10001faa0
lea rdx, [0x1000081e0]
mov rcx, rsi
add ebp, r14d
add r12d, r14d
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10001f9c6
mov rdx, qword [rdi + 8]
lea rcx, [0x10003ad38]
mov dword [0x1000384c8], r14d
call sub.MFC42u.dll_AfxDeleteObject
or ebx, 2
jmp 0x10001fa42
lea rdx, [0x1000081e8]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10001f9f6
mov rdx, qword [rdi + 8]
lea rcx, [0x10003ad30]
mov dword [0x1000384c8], r14d
call sub.MFC42u.dll_AfxDeleteObject
or ebx, 4
jmp 0x10001fa42
lea rdx, [0x1000081f8]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10001fa26
mov rdx, qword [rdi + 8]
lea rcx, [0x10003ad20]
mov dword [0x1000384cc], r14d
call sub.MFC42u.dll_AfxDeleteObject
or ebx, 8
jmp 0x10001fa42
lea rdx, [0x100008210]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10001fa3f
or ebx, 0x10
jmp 0x10001fa42
or ebx, r14d
mov eax, dword [rsp + 0x60]
add ebp, r14d
add r12d, r14d
add rdi, 0x10
dec eax
cmp ebp, eax
jg 0x10001fa70
jmp 0x10001f93e
cmp ebp, r14d
jne 0x10001fa70
mov rdx, qword [r13]
lea rcx, [0x10003ad28]
call sub.MFC42u.dll_AfxDeleteObject
test ebx, ebx
je 0x10001faa0
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x20]
mov r8d, r14d
mov edx, 0x802
xor ecx, ecx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x28], ebx
call sub.ntdll.dll_WinSqmAddToStream
jmp 0x10001faa0
mov dword [0x10003ad18], r14d
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, r14d
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000203a4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x10003ad48], rdi
je 0x100020404
cmp rax, rdi
jne 0x1000203f7
mov r12d, 1
jmp 0x100020404
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000203dd
mov eax, dword [0x10003ad40]
cmp eax, 1
jne 0x100020419
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x100020480
mov eax, dword [0x10003ad40]
cmp eax, ebx
jne 0x100020476
mov dword [0x10003ad40], 1
lea r13, [0x100001d58]
lea rdi, [0x100001d40]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x100020468
cmp eax, ebx
jne 0x100020468
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10002045d
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x100020446
cmp eax, ebx
je 0x100020480
mov eax, 0xff
jmp 0x1000205c8
mov dword [0x100037e34], 1
mov eax, dword [0x10003ad40]
cmp eax, 1
jne 0x1000204a8
lea rdx, [0x100001d38]
lea rcx, [0x100001a98]
call sub.msvcrt.dll__initterm
mov dword [0x10003ad40], 2
cmp r12d, ebx
jne 0x1000204b7
mov rax, rbx
xchg qword [0x10003ad48], rax
cmp qword [0x10003ad60], rbx
je 0x1000204df
lea rcx, [0x10003ad60]
call fcn.100020aac
cmp eax, ebx
je 0x1000204df
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10003ad60]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1000204f5
mov eax, 0xff
jmp 0x1000205c8
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10002057a
cmp word [rcx], bx
je 0x100020510
cmp edx, ebx
jne 0x10002057a
cmp word [rcx], bx
je 0x100020526
cmp word [rcx], 0x20
ja 0x100020526
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100020510
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.10001fac0
mov dword [0x100037e30], eax
cmp dword [0x100037e14], ebx
jne 0x100020564
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100037e34], ebx
jne 0x100020578
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100037e30]
jmp 0x1000205c8
cmp word [rcx], 0x22
jne 0x10002058d
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100020501
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.100020bc0
add rsp, 0x28
jmp 0x1000203a4
Function at 0x1000206f0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1000341e0]
jne 0x10002070b
rol rcx, 0x10
test cx, 0xffff
jne 0x100020707
ret 0
ror rcx, 0x10
jmp 0x100020c7c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100037ef0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100037fe8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100020d01
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100037ef0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100020d23
mov rax, qword [rsp + 0x88]
mov qword [0x100037fe8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100037f88], rax
mov rax, qword [0x100037fe8]
mov qword [0x100037e60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100037f70], rax
mov dword [0x100037e50], 0xc0000409
mov dword [0x100037e54], 1
mov rax, qword [0x1000341e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1000341e8]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001e18]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100020b18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100020b65
cmp rcx, 0xffffffffffffffff
je 0x100020b65
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100020b5d
cmp dword [rcx + 0x3c], edx
jl 0x100020b5d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100020b5d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100020b65
mov rax, rdx
add rsp, 0x18
ret
Function at 0x10000124c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.100001180
add rsp, 0x28
jmp 0x100001270
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [section..data], rdi
jne 0x10000169f
mov eax, dword [0x100003014]
cmp eax, 1
je 0x1000016bf
mov eax, dword [0x100003014]
cmp eax, ebx
jne 0x1000016d6
mov dword [0x100003014], 1
lea r13, [0x100002168]
lea rdi, [0x100002150]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000131c
cmp eax, ebx
jne 0x10000131c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100001311
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000012fa
cmp eax, ebx
jne 0x1000016cc
mov eax, dword [0x100003014]
cmp eax, 1
jne 0x10000134c
lea rdx, [0x100002148]
lea rcx, [0x100002138]
call fcn.10011f000
mov dword [0x100003014], 2
cmp r12d, ebx
jne 0x10000135b
mov rax, rbx
xchg qword [section..data], rax
cmp qword [0x1000035d8], rbx
jne 0x1000016e5
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x10000170e
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [rcx], 0x20
jbe 0x1000013ab
cmp word [rcx], 0x22
je 0x100001741
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100001390
cmp word [rcx], bx
je 0x1000013b4
cmp edx, ebx
jne 0x100001396
cmp word [rcx], bx
je 0x1000013ca
cmp word [rcx], 0x20
ja 0x1000013ca
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000013b4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100001400
nop
jmp 0x100001715
cmp rax, rdi
jne 0x1000016af
mov r12d, 1
jmp 0x1000012ba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000012a9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x100001324
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e4], 1
jmp 0x100001324
lea rcx, [0x1000035d8]
call fcn.1000018fc
cmp eax, ebx
je 0x100001368
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1000035d8]
nop
jmp 0x100001368
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e0], eax
cmp dword [0x100003008], ebx
jne 0x10000172b
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000036e4], ebx
jne 0x10000173f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000036e0]
jmp 0x100001780
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x1000013a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140012ad0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400453f0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x140012bea
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x140012b2a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140013af0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x140012b3e
mov edx, 8
mov rcx, rbx
call fcn.140013af0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x140012b8a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140012b60
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140012b99
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x140039814]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400453e8]
mov rcx, r15
cmovne rdi, rax
call fcn.140002b90
mov rbx, rax
test rax, rax
je 0x140012be5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001e8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001eaa7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001e986
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001e260
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001d870
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001e977
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140013830
mov dword [rbx + 0x80], 0
jmp 0x14001ea93
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001c6b0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140036c58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140036ca2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140036ca2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140036ca2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140036ca2
cmp dword [rcx + 0x84], 0xe
jbe 0x140036ca2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140036ca4
xor al, al
add rsp, 0x28
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.10136000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
push rax
pop rsi
in eax, dx
jg 0x140020a05
mov bh, 0x6f
mov esp, 0x650d0279
xchg edx, eax
jne 0x1400209fe
invalid
insb byte [rdi], dx
and eax, 0xf66dc91d
popfq
scasd eax, dword [rdi]
invalid
Function at 0x1800014f8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x50
mov eax, 0x400
lea r8, [rbp - 0x18]
lea rcx, [0x18000d0c0]
mov edx, 0xeb03dc
xor ebx, ebx
mov dword [rbp - 0x18], 0x3dc00
mov dword [rbp - 0x14], eax
mov word [rbp - 0x10], 8
mov dword [rbp - 0xc], 0xef8c
mov dword [rbp - 8], 1
mov dword [rbp - 0x30], 0xf10
mov dword [rbp - 0x2c], eax
mov word [rbp - 0x28], 8
mov dword [rbp - 0x24], 0x220
mov dword [rbp - 0x20], 1
call fcn.1800013cc
mov r12, rax
test rax, rax
je 0x180001628
lea r8, [rbp - 0x30]
lea rcx, [0x180ebd4a0]
mov edx, 0x17c0
call fcn.1800013cc
mov rsi, rax
test rax, rax
je 0x180001620
mov r13d, dword [rbp - 0x30]
lea r9d, [rbx + 0x40]
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1800015c9
mov r8d, r13d
mov rdx, rsi
mov rcx, rax
call fcn.180005420
jmp 0x1800015cc
mov rdi, rbx
test rdi, rdi
je 0x180001618
mov r9d, dword [rbp - 0x18]
mov r8, r12
mov edx, 1
xor ecx, ecx
call rdi
test rax, rax
je 0x180001618
xor r9d, r9d
mov r8d, 0x378
mov rcx, rax
lea edx, [r9 + 2]
call rdi
test rax, rax
je 0x180001618
mov rcx, qword [0x180ebfd18]
mov edx, 0x2ef8
call rax
test rax, rax
mov qword [0x180ebfd20], rax
setne bl
mov rcx, rsi
call fcn.18000199c
mov rcx, r12
call fcn.18000199c
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret