joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a0a8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call 0x140177000
add rsp, 0x28
jmp 0x14002a0a8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x1400dad08], rbx
je 0x14002a0f2
cmp rax, rbx
jne 0x14002a107
mov edi, 1
mov eax, dword [0x1400dad10]
cmp eax, 1
jne 0x14002a114
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14002a181
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14002a0db
mov eax, dword [0x1400dad10]
test eax, eax
jne 0x14002a177
mov dword [0x1400dad10], 1
lea r14, [0x1400a2ce8]
lea rbx, [0x1400a2cd0]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x14002a169
test eax, eax
jne 0x14002a16d
cmp qword [rbx], 0
je 0x14002a15e
mov rax, qword [rbx]
mov rcx, qword [case.0x1400244c5.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14002a13f
test eax, eax
je 0x14002a181
mov eax, 0xff
jmp 0x14002a2d4
mov dword [0x1400da400], 1
mov eax, dword [0x1400dad10]
cmp eax, 1
jne 0x14002a1a9
lea rdx, [0x1400a2cc8]
lea rcx, [0x1400a2ae8]
call sub.msvcrt.dll__initterm
mov dword [0x1400dad10], 2
test edi, edi
jne 0x14002a1b6
xor eax, eax
xchg qword [0x1400dad08], rax
cmp qword [0x1400dad28], 0
je 0x14002a1ea
lea rcx, [0x1400dad28]
call fcn.14002ac30
test eax, eax
je 0x14002a1ea
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400dad28]
mov r9, qword [case.0x1400244c5.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14002a276
test cl, cl
je 0x14002a20d
test edi, edi
jne 0x14002a276
dec cl
cmp cl, 0x1f
ja 0x14002a220
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x14002a20d
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400062a8
mov dword [0x1400da3fc], eax
cmp dword [0x1400da420], 0
jne 0x14002a25f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400da400], 0
jne 0x14002a274
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400da3fc]
jmp 0x14002a2d4
cmp cl, 0x22
jne 0x14002a288
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14002a29a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14002a1fd
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140098314
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
test r8, r8
je 0x14009833d
movzx eax, byte [r10 + rdx]
inc r10
add eax, dword [rcx]
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor eax, r9d
mov dword [rcx], eax
cmp r10, r8
jb 0x14009831c
ret

Function at 0x34585d080
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x34b4247b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x34585d0a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x34585d0a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x34585d0a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x34585d0fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x34585d0f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x34585d0a0
add rax, 0x28
cmp rax, r9
jne 0x34585d0e0
xor eax, eax
ret

Function at 0x34585d100
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x34b4247b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x34585d11f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x34585d128
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x34585d11f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x34585d1c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x34b4247b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x34585d1df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x34585d1e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400023d0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14000240d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14000256c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000250c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000256c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140002480
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.1400012f0
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14000254b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000254b
call fcn.140001440
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140002532
mov rcx, r14
call fcn.140001440
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140001380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14004a018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.140001240
lea edx, [rcx - 0x5b]
mov word [rsp + 0x40], ax
call fcn.140001240
lea ecx, [rdx + 0x2d]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.140001240
lea ecx, [rdx + 0x5a]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.140001240
lea ecx, [rdx + 0x4d]
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x4c]
call fcn.140001240
lea ecx, [rdx + 0x51]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x50]
call fcn.140001240
lea ecx, [rdx + 0x4e]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4d]
call fcn.140001240
lea edx, [rcx - 0x4c]
mov word [rsp + 0x4c], ax
call fcn.140001240
lea ecx, [rdx + 0x52]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x51]
call fcn.140001240
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.140001240
lea edx, [rcx + 0xa]
mov word [rsp + 0x52], ax
movzx ecx, word [0x140043eec]
call fcn.140001240
movzx ecx, word [0x140043eee]
mov edx, 0xb
mov word [rsp + 0x54], ax
call fcn.140001240
movzx ecx, word [0x140043ef0]
mov edx, 0xc
mov word [rsp + 0x56], ax
call fcn.140001240
movzx ecx, word [0x140043ef2]
mov edx, 0xd
mov word [rsp + 0x58], ax
call fcn.140001240
movzx ecx, word [0x140043ef4]
mov edx, 0xe
mov word [rsp + 0x5a], ax
call fcn.140001240
movzx ecx, word [0x140043ef6]
mov edx, 0xf
mov word [rsp + 0x5c], ax
call fcn.140001240
movzx ecx, word [0x140043ef8]
mov edx, 0x10
mov word [rsp + 0x5e], ax
call fcn.140001240
movzx ecx, word [0x140043efa]
mov edx, 0x11
mov word [rsp + 0x60], ax
call fcn.140001240
movzx ecx, word [0x140043efc]
mov edx, 0x12
mov word [rsp + 0x62], ax
call fcn.140001240
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x140001510
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140010310
add rsp, 0x70
pop rbx
ret
Function at 0x140003930
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14004a018]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov r8, rcx
jb 0x140003959
mov r8, qword [rcx]
mov ecx, 0x72
xor edx, edx
call fcn.140001240
lea ecx, [rdx + 0x75]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x74]
call fcn.140001240
lea ecx, [rdx + 0x6d]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x6c]
call fcn.140001240
lea ecx, [rdx + 0x5f]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x5e]
call fcn.140001240
lea ecx, [rdx + 0x70]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x6f]
call fcn.140001240
xor ecx, ecx
mov word [rsp + 0x38], ax
lea edx, [rcx + 5]
call fcn.140001240
lea edx, [rcx + 6]
mov word [rsp + 0x3a], ax
movzx ecx, word [0x14004409c]
call fcn.140001240
movzx ecx, word [0x14004409e]
mov edx, 7
mov word [rsp + 0x3c], ax
call fcn.140001240
movzx ecx, word [str..exe]
mov edx, 8
mov word [rsp + 0x3e], ax
call fcn.140001240
movzx ecx, word [0x1400440a2]
mov edx, 9
mov word [rsp + 0x40], ax
call fcn.140001240
movzx ecx, word [0x1400440a4]
mov edx, 0xa
mov word [rsp + 0x42], ax
call fcn.140001240
mov word [rsp + 0x44], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x46], ax
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0xb
jb 0x140003a40
mov dword [rsp + 0x28], edi
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov word [rsp + 0x46], di
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140003ab3
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003aae
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ada
mov rcx, r8
call fcn.1400107e8
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140010310
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.14001ad14
int3
Function at 0x140003ae0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x140003b02
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003b96
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003b75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003b70
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c3f
mov rcx, r8
call fcn.1400107e8
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x18], 7
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140003bdb
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003bd7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003bd2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c3f
mov rcx, r8
call fcn.1400107e8
xor al, al
jmp 0x140003b77
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x19200
mov qword [rsp + 0x20], rbp
lea rdx, [0x14004ac40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140003c28
cmp rax, 8
jb 0x140003bd7
lea rdx, [rax*2 + 2]
jmp 0x140003bae
cmp rax, 8
jb 0x140003b75
lea rdx, [rax*2 + 2]
jmp 0x140003b48
call fcn.14001ad14
int3
Function at 0x140003c50
Capabilities:
Delete file
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14004a018]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ecx, 0x2e
xor edx, edx
call fcn.140001240
mov word [rbp + 0xf], ax
lea ecx, [rdx + 0x65]
lea edx, [rcx - 0x64]
call fcn.140001240
mov word [rbp + 0x11], ax
lea ecx, [rdx + 0x77]
lea edx, [rcx - 0x76]
call fcn.140001240
mov word [rbp + 0x13], ax
lea ecx, [rdx + 0x63]
lea edx, [rcx - 0x62]
call fcn.140001240
mov word [rbp + 0x15], ax
xor ecx, ecx
lea edx, [rcx + 4]
call fcn.140001240
mov word [rbp + 0x17], ax
lea edx, [rcx + 5]
movzx ecx, word [0x1400440aa]
call fcn.140001240
mov word [rbp + 0x19], ax
mov edx, 6
movzx ecx, word [0x1400440ac]
call fcn.140001240
mov word [rbp + 0x1b], ax
mov edx, 7
movzx ecx, word [0x1400440ae]
call fcn.140001240
mov word [rbp + 0x1d], ax
mov edx, 8
movzx ecx, word [0x1400440b0]
call fcn.140001240
mov word [rbp + 0x1f], ax
xor eax, eax
mov word [rbp + 0x21], ax
xor r9d, r9d
mov r8d, 0x133
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rbp + 0xf]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
xor word [rdx], cx
inc eax
cmp eax, 9
jb 0x140003d20
mov word [rbp + 0x21], r9w
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x11]
call fcn.14000a270
mov rdx, rax
lea rcx, [rbp + 0x2f]
call fcn.1400036c0
nop
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.14000a300
mov rcx, rax
call fcn.140003ae0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.14000a300
mov rcx, rax
call fcn.140003930
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x140003dfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003df8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e12
call fcn.1400107e8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140010310
add rsp, 0x90
pop rbp
ret
call fcn.14001ad14
int3
Function at 0x140003e20
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003e61
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
mov ebx, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x140003ebb
cmp dword [rdi], 0x905a4d
je 0x140003ecc
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x1400049f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140004b72
test byte [r8 + 0x5e], 0x40
jne 0x140004a1d
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx eax, word [rsi + 0x14]
lea rdx, [rsi + 0x18]
mov r8d, dword [r8 + 0xb0]
add rdx, rax
movzx eax, word [rsi + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004b72
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004a56
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004a6d
add rdx, 0x28
cmp rdx, r9
jb 0x140004a44
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140004b68
cmp rbx, r15
jae 0x140004b68
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140004b63
add eax, 0xfffffff8
shr eax, 1
je 0x140004b54
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140004ae2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x140004aee
cmp ax, 0xa
jne 0x140004b46
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x140004b3b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140004b22
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x140004b2d
add rax, 0x28
cmp rax, r10
jb 0x140004b10
jmp 0x140004b3b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x140004b3e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140004ac0
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140004aa4
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x140004b80
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
push r13
sub rsp, 0x40
movzx eax, word [r8 + 0x14]
lea r10, [r8 + 0x18]
mov r11d, dword [r8 + 0x90]
add r10, rax
movzx eax, word [r8 + 6]
mov rbp, r8
mov r13, rdx
mov edi, ecx
lea r9, [rax + rax*4]
lea r8, [r10 + r9*8]
cmp r10, r8
jae 0x140004be1
nop dword [rax]
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x140004bd8
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x140004c75
add r10, 0x28
cmp r10, r8
jb 0x140004bc0
xor eax, eax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r11d, r11d
je 0x140004c4e
cmp dword [rbp + 0x94], 0
je 0x140004c4e
lea rbx, [rax + 0x10]
movzx eax, word [rbp + 0x14]
lea rdx, [rbp + 0x18]
mov r8d, dword [rbx - 4]
add rdx, rax
movzx eax, word [rbp + 6]
mov qword [rsp + 0x70], rbx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004c4e
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004c45
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004c87
add rdx, 0x28
cmp rdx, r9
jb 0x140004c33
mov eax, 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop rdi
pop rbp
ret
mov eax, dword [r10 + 0x14]
sub rax, rcx
add rax, r11
add rax, r13
jmp 0x140004be3
mov r15d, dword [rdx + 0x14]
sub r15, rcx
add r15, r8
add r15, r13
je 0x140004c4e
mov rdx, r15
mov ecx, edi
call fcn.140003ef0
mov r12, rax
test rax, rax
je 0x140004dc2
movzx eax, word [rbp + 0x14]
lea rdx, [rbp + 0x18]
mov r8d, dword [rbx]
add rdx, rax
movzx eax, word [rbp + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004ceb
nop dword [rax + rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004ce2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004d10
add rdx, 0x28
cmp rdx, r9
jb 0x140004cd0
xor r14d, r14d
mov rdi, qword [r14]
test rdi, rdi
je 0x140004da7
jns 0x140004d1f
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
movzx edx, di
jmp 0x140004d70
mov r14d, dword [rdx + 0x14]
sub r14, rcx
add r14, r8
add r14, r13
jmp 0x140004cee
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r8, [rax + rdx*8]
cmp rax, r8
jae 0x140004d5b
nop dword [rax + rax]
mov edx, dword [rax + 0xc]
cmp rdi, rdx
jb 0x140004d52
mov ecx, dword [rax + 8]
add ecx, edx
cmp rdi, rcx
jb 0x140004db4
add rax, 0x28
cmp rax, r8
jb 0x140004d40
xor esi, esi
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rdx, [rsi + 2]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, rbx
sub rdi, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rdi + r12]
mov qword [r14], rax
add r14, 8
mov rdi, qword [r14]
test rdi, rdi
jne 0x140004cfa
mov rbx, qword [rsp + 0x70]
mov edi, dword [rsp + 0x60]
add rbx, 0x14
jmp 0x140004c0e
mov esi, dword [rax + 0x14]
sub rsi, rdx
add rsi, rdi
add rsi, r13
jmp 0x140004d5d
jmp 0x140004c53
Function at 0x140008980
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14004a018]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x30], eax
lea rdi, [0x14007e4f0]
mov qword [rsp + 0x48], rdi
mov qword [0x14007e4f0], rax
mov qword [0x14007e500], rax
mov qword [0x14007e508], 0xf
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 0x40
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test ebx, ebx
jne 0x140008a77
test eax, eax
jne 0x140008a77
lea rcx, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x140008a60
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000bc00
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140010310
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
Function at 0x1400090d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140009168
test r8, r8
jle 0x140009160
nop word [rax + rax]
mov rcx, rdi
call fcn.14000b950
test rax, rax
jle 0x14000913e
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140012400
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140009158
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140009160
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140009100
sub r14, rbx
mov rax, r14
jmp 0x1400091e6
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x140009181
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140009183
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x1400091db
test ecx, ecx
jle 0x1400091bc
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.140012400
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x1400091db
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400091db
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140019fe4
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret