joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008e910
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18008e9a9
mov r14, rsi
test rsi, rsi
jle 0x18008ea1d
mov r14, rsi
jmp 0x18008e96f
cmp r14, r15
cmovb r15, r14
mov rdx, rdi
mov r8, r15
call fcn.1800c1c50
add rdi, r15
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jle 0x18008ea1d
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18008e987
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jg 0x18008e940
movzx edx, byte [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18008ea1d
inc rdi
dec r14
test r14, r14
jg 0x18008e96f
jmp 0x18008ea1d
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18008e9f6
test rsi, rsi
jle 0x18008e9f6
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x18008e9f6
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call fcn.1800c1c50
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x18008e9fe
jmp 0x18008ea1d
mov r14, rsi
test r14, r14
jle 0x18008ea1d
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18008ea1d
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.1800a6f18
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18008edb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov al, 1
cmp qword [rcx + 0x68], 0
je 0x18008ee48
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18008ee48
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18008ee46
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x18008ee50
cmp eax, 1
je 0x18008ee17
test eax, eax
jne 0x18008ee46
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x18008ee3d
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call fcn.1800a6f18
cmp rbx, rax
jne 0x18008ee46
cmp byte [rsi + 0x71], 0
sete al
jmp 0x18008ee48
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov al, 1
jmp 0x18008ee48

Function at 0x180090870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret

Function at 0x1800a8f80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800a8fa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800a8fa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800b57bc
Capabilities:
Read file on windows

Disassembly:
jmp 0x1800b57c4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800b57fa
call fcn.1800a4ae0
mov dword [rax], 0x16
call fcn.1800a5278
jmp 0x1800b5945
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800b5945
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1800b5945
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1800b5829
lock or dword [rcx + 0x14], 0x10
jmp 0x1800b5945
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1800b583d
call fcn.1800b7d0c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1800b584d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1800b5850
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1800b2abc
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1800b5db4
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1800b5933
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1800b58e1
mov rcx, rbx
call fcn.1800b2abc
cmp eax, 0xffffffff
je 0x1800b58cc
mov rcx, rbx
call fcn.1800b2abc
cmp eax, 0xfffffffe
je 0x1800b58cc
mov rcx, rbx
call fcn.1800b2abc
movsxd rdi, eax
lea r14, [0x1800dd3b0]
mov rcx, rbx
sar rdi, 6
call fcn.1800b2abc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1800b58d3
lea rdx, [0x1800dabc0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800b58e1
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1800b5905
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1800b5905
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1800b5905
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1800b5923
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1800b592e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1800b594a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140001540
Capabilities:
Read file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
and qword [rbp + 0x6f], 0
lea rdx, [0x140002b40]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp + 7]
and qword [rsp + 0x48], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
and dword [rsp + 0x30], 0
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
mov qword [rbp + 0x37], rax
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, str.0000000000000
mov dword [rsp + 0x30], 0x32
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rbp + 0x67]
mov byte [0x140004051], 0
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xb0
pop rbp
ret

Function at 0x140001624
Capabilities:
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
and qword [rbp + 0xc0], 0
lea rdx, [0x140002eb0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
and qword [rsp + 0x48], 0
lea r9, [rsp + 0x70]
and qword [rbp - 0x78], 0
lea r8, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0xc0]
mov eax, 0x40
mov dword [rbp - 0x80], 0x30
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
mov dword [rsp + 0x38], 3
mov edx, 0x40000000
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp - 0x68], eax
movdqu xmmword [rbp - 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x14000174c
cmp qword [rbp + 0xc0], 0
je 0x14000174c
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x100
call fcn.140002940
lea r8, str.0000000000000
lea rdx, [0x140002ee0]
lea rcx, [rbp - 0x50]
call sub.ntoskrnl.exe_sprintf_s
lea rcx, [rbp - 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400016fe
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x1b0
pop rbp
ret
Function at 0x1400017e4
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x20], 0x220020
lea rax, [0x140002c80]
mov qword [rbp + 0x10], rbx
mov qword [rbp - 0x18], rax
xor r9d, r9d
lea rax, [rbp + 0x10]
xor r8d, r8d
mov qword [r11 - 0x30], rax
lea edx, [rbx + 0x40]
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov qword [r11 - 0x38], rbx
mov byte [rsp + 0x28], bl
mov rcx, qword [rax]
mov qword [r11 - 0x48], rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
test eax, eax
js 0x1400018ba
mov eax, dword [0x140007080]
lea rcx, [0x1400050a0]
movaps xmm0, xmmword [rbp - 0x20]
mov edx, eax
inc eax
shl rdx, 5
add rdx, rcx
mov dword [0x140007080], eax
mov rax, qword [rbp + 0x10]
lea rcx, [0x1400011c0]
add rax, 0xe0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rdx + 0x10], rax
xchg qword [rax], rcx
movaps xmm0, xmmword [rbp - 0x10]
mov qword [rdx + 0x18], rcx
movdqu xmmword [rdx], xmm0
mov qword [0x140005068], rcx
lea rdx, [rbp - 0x10]
lea rcx, [0x140002ba0]
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x20], ebx
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x10]
mov edx, 0x74446973
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObjectWithTag]
jmp 0x1400018cd
mov r8d, eax
lea rdx, [rbp - 0x20]
lea rcx, [0x140002bc0]
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400018d8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rdx, [0x140002cb0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x58]
mov edx, 1
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
xor ebp, ebp
mov ebx, eax
test eax, eax
jns 0x14000192d
mov edx, eax
lea rcx, [0x140002cd0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x140001aab
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_IoGetLowerDeviceObject]
test rax, rax
jne 0x140001953
lea rcx, [0x140002d00]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001aab
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetAttachedDevice]
mov rbx, rax
test rax, rax
jne 0x14000196d
lea rcx, [0x140002d20]
jmp 0x140001944
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
cmp eax, 0xc0000004
je 0x140001997
mov edx, eax
lea rcx, [0x140002d40]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400019f7
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x544147
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x1400019bf
lea rcx, [0x140002d60]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400019f7
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov esi, eax
test eax, eax
jns 0x140001a09
mov edx, eax
lea rcx, [0x140002d40]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x544147
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14000196d
jmp 0x140001aab
cmp word [rdi], bp
jbe 0x140001a9e
mov rcx, qword [rdi + 8]
lea rdx, [0x140002d80]
call sub.ntoskrnl.exe_wcsstr
test rax, rax
je 0x140001a90
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140001a90
movups xmm0, xmmword [0x140002da0]
movups xmmword [rcx], xmm0
movsd xmm0, qword [0x140002db0]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [0x140002db8]
mov word [rcx + 0x18], ax
mov al, byte [0x140002dba]
mov byte [rcx + 0x1a], al
movups xmm0, xmmword [0x140002dc0]
movups xmmword [rcx + 0x1b], xmm0
movups xmm1, xmmword [0x140002dd0]
movups xmmword [rcx + 0x2b], xmm1
movsd xmm0, qword [0x140002de0]
movsd qword [rcx + 0x3b], xmm0
mov eax, dword [0x140002de8]
mov dword [rcx + 0x43], eax
mov al, byte [0x140002dec]
mov byte [rcx + 0x47], al
mov edx, 0x544147
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400024b4
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebp, ebp
lea r9, [rax + 0x18]
and dword [rax + 0x18], ebp
mov rsi, rdx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbp + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x140002504
mov edx, eax
lea rcx, [0x140002f20]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x140002632
mov edx, dword [rsp + 0x180]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140002531
mov edx, dword [rsp + 0x180]
lea rcx, [0x140002f60]
jmp 0x1400024f8
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rbx
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edi, eax
test eax, eax
jns 0x140002562
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, edi
lea rcx, [0x140002fa0]
jmp 0x1400024f8
xor edi, edi
cmp dword [rbx], edi
jbe 0x140002624
mov eax, edi
lea rcx, [rsp + 0x20]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140002586
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.140002688
mov rcx, rax
mov rdx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140002614
inc edi
cmp edi, dword [rbx]
jb 0x14000256c
jmp 0x140002624
mov rbp, qword [rsp + 0x30]
test rsi, rsi
je 0x140002624
mov ecx, dword [rsp + 0x38]
mov dword [rsi], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14000264c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x140002656
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4f9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x140002683
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x14000266e
mov eax, ecx
ret
Function at 0x140002740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rsi
call fcn.14000264c
xor ebx, eax
test edi, edi
je 0x14000279f
mov r8d, edi
imul ebx, ebx, 0x41c64e6d
mov eax, 0x80808081
add ebx, 0x3039
mov ecx, ebx
shr ecx, 0x10
and ecx, 0x7fff
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
xor byte [rsi], cl
inc rsi
sub r8, 1
jne 0x14000276b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x1400153c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012ef0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012f10
xor al, al
jmp 0x140012f91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012f23
xor al, al
jmp 0x140012f91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012f4d
xor al, al
jmp 0x140012f91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012f61
xor al, al
jmp 0x140012f91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012f73
xor al, al
jmp 0x140012f91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012f8f
xor al, al
jmp 0x140012f91
mov al, 1
add rsp, 0x38
ret

Function at 0x140011cb0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113bb
movzx eax, al
test eax, eax
jne 0x140011cd0
mov ecx, 7
call fcn.14001132f
nop
mov byte [rsp + 0x20], 0
call fcn.140011343
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011cf4
mov ecx, 7
call fcn.14001132f
nop
jmp 0x140011d4c
cmp dword [0x14001c220], 0
jne 0x140011d47
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.1400111ae
test eax, eax
je 0x140011d28
mov eax, 0xff
jmp 0x140011e51
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.140011339
mov dword [0x14001c220], 2
jmp 0x140011d4c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011320
call fcn.1400112bc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011da9
mov rcx, qword [rsp + 0x30]
call fcn.140011163
movzx eax, al
test eax, eax
je 0x140011da9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140023020]
nop
call fcn.1400112ee
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011ddd
mov rcx, qword [rsp + 0x38]
call fcn.140011163
movzx eax, al
test eax, eax
je 0x140011ddd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011375
nop
call fcn.140011f00
mov dword [rsp + 0x28], eax
call fcn.140011299
movzx eax, al
test eax, eax
jne 0x140011dfc
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011e0b
call fcn.14001137f
nop
xor edx, edx
mov cl, 1
call fcn.140011154
mov eax, dword [rsp + 0x28]
jmp 0x140011e51
add rsp, 0x68
ret
Function at 0x180001070
Capabilities:
Get common file path
Get disk information

Disassembly:
sub rsp, 0x178
mov rax, qword [0x180023010]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.180004210
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x180001113
lea rdx, [0x180020d38]
lea rcx, [rsp + 0x50]
call fcn.1800034b0
test rax, rax
je 0x180001113
and dword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x28], 0
xor r8d, r8d
and qword [rsp + 0x20], 0
xor edx, edx
mov byte [rax + 1], 0
and dword [0x180051020], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x180001113
mov eax, dword [rsp + 0x40]
mov dword [0x180051020], eax
mov al, 1
jmp 0x180001115
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180001fc0
add rsp, 0x178
ret
Function at 0x140001330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140001382
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 0x79914
lea rdx, [0x14005c4f0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400013b1
mov byte [rsp + 0x44], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [rsp + 0x44]
add rsp, 0x58
ret

Function at 0x1400013d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140001422
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 0x29000
lea rdx, [0x1400d5e10]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140001451
mov byte [rsp + 0x44], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [rsp + 0x44]
add rsp, 0x58
ret
Function at 0x140002d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x14005ac60]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x28], 0x43
mov byte [rsp + 0x29], 0x3a
mov byte [rsp + 0x2a], 0x2f
mov byte [rsp + 0x2b], 0x55
mov byte [rsp + 0x2c], 0x73
mov byte [rsp + 0x2d], 0x65
mov byte [rsp + 0x2e], 0x72
mov byte [rsp + 0x2f], 0x73
mov byte [rsp + 0x30], 0x2f
mov byte [rsp + 0x31], 0x50
mov byte [rsp + 0x32], 0x75
mov byte [rsp + 0x33], 0x62
mov byte [rsp + 0x34], 0x6c
mov byte [rsp + 0x35], 0x69
mov byte [rsp + 0x36], 0x63
mov byte [rsp + 0x37], 0x2f
mov byte [rsp + 0x38], 0x44
mov byte [rsp + 0x39], 0x6f
mov byte [rsp + 0x3a], 0x77
mov byte [rsp + 0x3b], 0x6e
mov byte [rsp + 0x3c], 0x6c
mov byte [rsp + 0x3d], 0x6f
mov byte [rsp + 0x3e], 0x61
mov byte [rsp + 0x3f], 0x64
mov byte [rsp + 0x40], 0x73
mov byte [rsp + 0x41], 0x2f
mov byte [rsp + 0x42], 0x4d
mov byte [rsp + 0x43], 0x69
mov byte [rsp + 0x44], 0x6e
mov byte [rsp + 0x45], 0x63
mov byte [rsp + 0x46], 0x72
mov byte [rsp + 0x47], 0x61
mov byte [rsp + 0x48], 0x66
mov byte [rsp + 0x49], 0x74
mov byte [rsp + 0x4a], 0x68
mov byte [rsp + 0x4b], 0x65
mov byte [rsp + 0x4c], 0x6c
mov byte [rsp + 0x4d], 0x70
mov byte [rsp + 0x4e], 0x2e
mov byte [rsp + 0x4f], 0x65
mov byte [rsp + 0x50], 0x78
mov byte [rsp + 0x51], 0x65
mov byte [rsp + 0x52], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.140003220
nop
lea rcx, [rsp + 0x58]
call fcn.1400032a0
xor edx, edx
mov rcx, rax
call fcn.14002caac
cmp eax, 0xffffffff
jne 0x140002ebc
call fcn.1400020c0
jmp 0x140002ec1
call fcn.140001880
mov dword [rsp + 0x80], 0
lea rcx, [rsp + 0x58]
call fcn.140003280
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002c100
add rsp, 0xa8
ret

Function at 0x140006328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
je 0x14000639a
call fcn.1400153d0
mov r8d, 0xf0
mov rdx, rdi
mov r13, qword [rax + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x14000639a
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400063e7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov edi, 1
test rsi, rsi
je 0x1400063c7
mov r10, qword [r14]
mov r9, r12
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call qword [r10 + 0x40]
mov edi, eax
test rbx, rbx
je 0x1400063c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rbp + 0x98], 0
je 0x1400063e5
mov rcx, qword [rbp + 0x98]
mov rdx, r12
mov r8, qword [rcx]
call qword [r8 + 0x140]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret