joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001190
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea rcx, str.ntdll.dll
mov qword [rbp - 0x39], 0x25ff
mov dword [rbp - 0x31], 0
mov word [rbp - 0x2d], 0
mov qword [rbp - 0x49], 0
mov dword [rbp - 0x41], 0xe9
mov byte [rbp - 0x3d], 0
mov dword [rbp + 0x37], 0xe9
mov byte [rbp + 0x3b], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
lea rcx, str.NtQuerySystemInformation_address:_0x_p_n
mov r15, rax
call fcn.180001010
mov eax, dword [0x180022c90]
test eax, eax
jne 0x18000123d
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x2f]
mov dword [0x180022c90], eax
dec eax
mov qword [rsp + 0xe0], r14
mov ecx, 0x80000000
mov esi, eax
mov r12d, eax
not rsi
cmp r15, rcx
jb 0x18000127e
lea rbx, [r15 - 0x80000000]
movabs rax, 0xffffffff7fffffff
add rbx, r12
and rbx, rsi
cmp r15, rax
jb 0x180001280
mov r14, 0xffffffffffffffff
jmp 0x180001290
xor ebx, ebx
lea r14, [r15 + rcx]
and r14, rsi
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800012f5
mov rcx, qword [rbp - 0x29]
mov rbx, qword [rbp - 0x11]
add rbx, rcx
cmp dword [rbp - 9], 0x10000
jne 0x1800012f0
add rcx, r12
and rcx, rsi
cmp rcx, rbx
jae 0x1800012f0
mov rax, rbx
sub rax, rcx
cmp rax, 0x1b
jb 0x1800012f0
mov edx, 0x1b
mov r8d, 0x3000
lea r9d, [rdx + 0x25]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1800012f7
cmp rbx, r14
jb 0x180001290
xor edi, edi
mov rdx, rdi
lea rcx, str.Allocation_address:_0x_p
call fcn.180001010
lea rcx, [rdi + 0xf]
lea rax, [0x180001070]
mov qword [0x180022ca8], rcx
mov qword [rbp - 0x33], rax
mov eax, dword [rbp - 0x31]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rdi], xmm0
mov dword [rdi + 8], eax
movzx eax, word [rbp - 0x2d]
mov word [rdi + 0xc], ax
mov eax, dword [r15]
mov dword [rbp - 0x49], eax
movzx eax, byte [r15 + 4]
mov byte [rbp - 0x45], al
mov eax, r15d
movsd xmm0, qword [rbp - 0x49]
sub eax, edi
sub eax, 0x14
movsd qword [rcx], xmm0
mov dword [rbp - 0x40], eax
sub edi, r15d
mov eax, dword [rbp - 0x41]
sub edi, 5
mov dword [rcx + 8], eax
movzx eax, byte [rbp - 0x3d]
mov byte [rcx + 0xc], al
mov dword [rbp + 0x38], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 5
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rbp + 0x37]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180001400
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
Function at 0x18000d798
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000d7c8
xor eax, eax
jmp 0x18000d88b
mov rbp, rbx
cmp word [rax], si
je 0x18000d7ed
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000d7d4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000d7d0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000d6b8
movsxd r14, eax
test eax, eax
jne 0x18000d82b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000d7c1
mov rcx, r14
call fcn.180009d18
mov rdi, rax
test rax, rax
jne 0x18000d844
xor ecx, ecx
call fcn.18000918c
jmp 0x18000d820
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000d6b8
test eax, eax
jne 0x18000d875
mov rcx, rdi
call fcn.18000918c
jmp 0x18000d87f
xor ecx, ecx
call fcn.18000918c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001125c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180011272
mov al, 1
jmp 0x1800112d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180011283
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800112d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.18000f0a0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800112d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800112d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800112d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800112d2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x180014640
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180014668
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180014668
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x142670058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1426701df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142670089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14267006f
add dl, dl
jne 0x142670096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1426700f6
xor eax, eax
add dl, dl
jne 0x1426700a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1426701ad
add dl, dl
jne 0x1426700b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1426700c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1426700d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1426700dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1426700ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14267007e
mov eax, 1
add dl, dl
jne 0x142670106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142670113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1426700fb
sub eax, ebx
mov ebx, 1
jne 0x14267014c
mov ecx, 1
add dl, dl
jne 0x14267012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14267013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142670123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14267007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142670168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142670175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14267015d
cmp eax, 0x7d00
jae 0x14267019b
cmp eax, 0x500
jb 0x142670196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14267007e
cmp eax, 0x7f
ja 0x14267019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14267007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1426701d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14267007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400af810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
mov rcx, qword [rdx + 8]
test rcx, rcx
js 0x1400af84c
je 0x1400af84b
mov rdx, qword [rdx]
xor r8d, r8d
lea r9, [0x140165140]
nop word [rax + rax]
movzx r10d, byte [rdx + r8]
movzx r11d, al
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc r8
cmp rcx, r8
jne 0x1400af830
ret
int3

Function at 0x1400b0e08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b0e52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b0e52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b0e52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b0e52
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b0e52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b0e54
xor al, al
add rsp, 0x28
ret

Function at 0x1400b1320
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400b1398
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400b1398
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400b1398
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400b138c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400b13aa
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400b137a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400b139a

Function at 0x1400bfff8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400c002f
call fcn.1400c3324
mov dword [rax], 0x16
call fcn.1400c4cbc
xor eax, eax
jmp 0x1400c00bd
mov rdx, r9
mov rcx, r8
call fcn.1400c00e0
mov rbx, rax
test rax, rax
je 0x1400c00ba
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400c0150]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400c00a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c3364
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400c008e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400c009d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140084fc0
jmp 0x1400c00ba
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400c00b7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140001940
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x1400054a0]
xor eax, eax
movdqa xmm1, xmmword [0x140005500]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140005530]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x140005520]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140005670]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140005510]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp - 0x39], 0x6574537e
mov dword [rbp - 0x35], 0x72616c6c
mov byte [rbp - 0x31], 0
mov dword [rbp + 0x37], 0x7e36203f
mov dword [rbp + 0x3b], 0x36273637
mov dword [rbp + 0x3f], 0x3c3a2730
mov word [rbp + 0x43], 0x7d3d
mov byte [rbp + 0x45], 0
nop dword [rax]
movzx ecx, byte [rbp - 0x29]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0x6d
jb 0x1400019e0
mov r9d, 0x10
mov byte [rbp + 0x45], 0
lea r8, [rbp - 0x38]
xor ecx, ecx
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r8d, r8d
lea r9, [rbp + 0x47]
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rbp + 0x4b]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140003ca0
add rsp, 0xc0
pop rbp
ret
Function at 0x140001a60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140001b28
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140001b28
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140001b23
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001b00
cmp edx, 0x4cfe97c1
je 0x140001beb
test r8d, r8d
jne 0x140001ae0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140001b3d
cmp qword [rax + 0x30], r14
jne 0x140001ab0
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140001bd4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140001bd4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140001bcf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140001bb0
cmp edx, 0x6dd8a845
je 0x140001c07
test r8d, r8d
jne 0x140001b90
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140001c1f
cmp qword [rax + 0x30], r14
jne 0x140001b60
jmp 0x140001c1f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140001b40
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call r14
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbp
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140001c3d
call fcn.140001940
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003ca0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140003080
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x47], r9d
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rsi, r11
nop word [rax + rax]
mov r10, qword [r11 + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140003158
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140003158
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rcx, [rdi + r8*4]
mov eax, dword [rcx + r10]
add rax, r10
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140003153
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140003130
cmp edx, 0x53b2070f
je 0x140003239
test r8d, r8d
jne 0x140003110
mov r11, qword [r11]
cmp r11, rsi
je 0x14000316a
cmp qword [r11 + 0x30], r9
jne 0x1400030e0
mov r8, r9
mov dword [rbp - 0x19], 0x7970677c
mov dword [rbp - 0x15], 0x757c397a
mov word [rbp - 0x11], 0x76
mov byte [rbp - 0xf], 1
nop word [rax + rax]
lea eax, [r9 + 0x12]
xor byte [rbp + r9 - 0x19], al
inc r9
cmp r9, 9
jb 0x140003190
lea rcx, [rbp - 0x19]
mov byte [rbp - 0xf], 0
call r8
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140003256
movdqa xmm0, xmmword [0x140005680]
lea rdx, [rbp - 8]
mov rcx, rax
mov dword [rbp + 7], 0x506e6f69
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 0xb], 0x65636f72
mov word [rbp + 0xf], 0x7373
mov byte [rbp + 0x11], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140003256
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x47]
mov r9d, 0x30
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x17]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
js 0x140003256
mov rax, qword [rbp + 0x1f]
test rax, rax
je 0x140003256
cmp byte [rax + 2], 0
je 0x140003256
call fcn.140001940
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r8*2]
mov r8d, dword [rdx + rcx*4]
add r8, r10
jmp 0x14000316d
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140003ca0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140003280
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140003358
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140003358
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140003353
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140003330
cmp edx, 0x9bc5a608
je 0x140003483
test r8d, r8d
jne 0x140003310
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000336e
cmp qword [rax + 0x30], 0
jne 0x1400032e0
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140003418
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140003418
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140003413
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400033f0
cmp edx, 0x85cca27e
je 0x14000349f
test r8d, r8d
jne 0x1400033d0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x14000342e
cmp qword [rax + 0x30], 0
jne 0x1400033a0
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x1400034bd
cmp qword [rsp + 0x68], 0
jne 0x140003477
cmp qword [rsp + 0x70], 0
jne 0x140003477
cmp qword [rsp + 0x78], 0
jne 0x140003477
cmp qword [rsp + 0x80], 0
jne 0x140003477
cmp qword [rsp + 0x88], 0
jne 0x140003477
cmp qword [rsp + 0x90], 0
je 0x1400034bd
call fcn.140001940
mov eax, 1
jmp 0x1400034bf
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140003370
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140003430
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140003ca0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003bf0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 2]
and rax, 0xff
ret

Function at 0x140003c07
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0xbc]
and rax, 0x70
ret

Function at 0x140003c3d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov qword [rcx], rdx
mov qword [rcx + 8], rax
xor rax, rax
mov rax, 5
shr rax, 2
sub rax, rbx
cmp rax, rcx
rdtsc
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
ret

Function at 0x140004620
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000466a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000466a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000466a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000466a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000466a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000466c
xor al, al
add rsp, 0x28
ret