joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180d4c602
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
test al, 0x19
add ecx, ebp
stc
ror byte [rcx], cl
sbb edx, dword [rcx + 0x2474ff5d]
push qword [rsp + 0x50]
push qword [rsp + 0x50]
and al, 0x50
popfq
lea rsp, [rsp + 0x60]
call fcn.1819120a4
mov ebx, 0x40e1a28b
xchg ebx, eax
pop rdx
mov esp, 0xa28bbb00
loope 0x180d4c656
xor eax, esi
pop rbp
sbb edx, ebx
xor eax, 0xb91ad591
idiv dword [rdx + 0x4b]
insb byte [rdi], dx
or ebp, dword [rcx - 0x105b660a]
test eax, 0x2ce86ab9
call 0x180d5575e
test al, 0xf7
movabs eax, dword [0x43e07abdc705965b]
adc eax, 0x2c82cf8b
sub ebx, dword [rsi - 2]
adc esp, dword [rbx - 0x80]
lea edi, [rdi]
movsb byte [rdi], byte [rsi]
out dx, al
or al, 0x82
jne 0x180d4c60d
or esp, dword [rsi - 0x383be441]
jnp 0x180d4c6ba
invalid
add dh, byte [rax]
popfq
pop rsp
std
or esp, ebp
mov esp, 0x8f1aa88a
jl 0x180d4c604
leave
cmc
or dword [rcx], eax
jle 0x180d4c5f6
add al, 0x89
sar dword [rbp + 0x3cfa249], 1
mov ebp, ebp
invalid
out dx, al
add al, 0x7e
shr byte [rbx + rsi*8 + 0x56], 0x14
movabs byte [0x61a6970997115a8e], al
test ah, 0x78
mov ch, byte [rdi - 2]
rol dword [rsi], cl
movsb byte [rdi], byte [rsi]
invalid
Function at 0x140004c40
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140004c68
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140004c8e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004c90
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140004ce9
test ecx, ecx
jle 0x140004cc9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140004ce9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004ce9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140004d10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140004d32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140004d48
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140004d64
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004d66
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140004da2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140004e3e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140004ddd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140004e1e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140004e3e
cmp rbx, rax
ja 0x140004df0
test rbx, rbx
je 0x140004e3e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400052a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400052cd
xor eax, eax
jmp 0x140005439
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005307
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005307
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005439
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000542c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000534a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005375
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005431
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400053e4
sub eax, 1
je 0x1400053e4
cmp eax, 2
jne 0x14000542c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005431
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005412
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000542c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140005431
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008140
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400058e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400059b3
cmp byte [rcx + 0x71], 0
je 0x1400059b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400059af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005974
sub eax, 1
je 0x140005978
cmp eax, 2
jne 0x1400059af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008140
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400059a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400059af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000595c
xor al, al
jmp 0x14000595c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008140
add rsp, 0x60
pop rbx
ret

Function at 0x1400078e8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140007922
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140007927
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140007970
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000a520]
cmp byte [rcx + rax], 0
je 0x140007970
dec r8
sub rdx, 1
jne 0x140007956
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140008cec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008d36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008d36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008d36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008d36
cmp dword [rcx + 0x84], 0xe
jbe 0x140008d36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008d38
xor al, al
add rsp, 0x28
ret
Function at 0x180002bd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x18002c038]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180002c44
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x180002c70
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180002c20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180008090
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180002c4f

Function at 0x180003020
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180003048
xor eax, eax
lea r8, [0x180002df0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180004710
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180004930
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180004817
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180004774
mov rax, qword [0x18002c008]
cmp qword [rsp + 0x20], rax
ja 0x180004774
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180004736
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800047a3
jmp 0x180004817
cmp dword [rsp + 0x50], 0x10000
jne 0x1800047fa
cmp qword [rsp + 0x48], 0x10000
jb 0x1800047fa
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800047e8
mov rax, qword [rsp + 0x28]
jmp 0x180004819
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180004812
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180004930
mov qword [rsp + 0x20], rax
jmp 0x180004736
xor eax, eax
add rsp, 0x68
ret
Function at 0x180004820
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180004970
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180004923
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000487b
mov rax, qword [0x18002c008]
cmp qword [rsp + 0x20], rax
ja 0x18000487b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000483d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800048aa
jmp 0x180004923
cmp dword [rsp + 0x50], 0x10000
jne 0x180004901
cmp qword [rsp + 0x48], 0x10000
jb 0x180004901
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800048ef
mov rax, qword [rsp + 0x28]
jmp 0x180004925
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000491e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180004970
mov qword [rsp + 0x20], rax
jmp 0x18000483d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800049c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004f50
mov qword [rsp + 0x28], 0
cmp qword [0x18002c318], 0
jne 0x180004a08
cmp qword [0x18002c310], 0
je 0x180004a08
mov rax, qword [0x18002c310]
mov qword [0x18002c318], rax
cmp qword [0x18002c318], 0
je 0x180004aae
mov rax, qword [0x18002c318]
cmp qword [rax + 0x10], 0
je 0x180004aae
mov rax, qword [0x18002c318]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180004aae
mov rax, qword [0x18002c318]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180004aae
mov rax, qword [0x18002c318]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180004a74
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180004a7b
xor eax, eax
jmp 0x180004c29
mov rax, qword [0x18002c318]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180004c29
mov rax, qword [0x18002c310]
mov qword [0x18002c318], rax
jmp 0x180004ad0
mov rax, qword [0x18002c318]
mov rax, qword [rax + 8]
mov qword [0x18002c318], rax
cmp qword [0x18002c318], 0
je 0x180004b1d
cmp qword [0x18002c318], 0
je 0x180004b1b
mov rax, qword [0x18002c318]
cmp qword [rax + 0x10], 0
je 0x180004b1b
mov rax, qword [0x18002c318]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180004b1b
mov rax, qword [0x18002c318]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180004b1b
jmp 0x180004a4c
jmp 0x180004abe
mov rcx, qword [rsp + 0x60]
call fcn.180006b80
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004c30
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180004c27
mov rax, qword [rsp + 0x48]
mov qword [0x18002c318], rax
mov rax, qword [0x18002c318]
mov dword [rax], 0x52727464
mov rax, qword [0x18002c318]
mov qword [rax + 0x10], 0
mov rax, qword [0x18002c318]
mov rcx, qword [0x18002c310]
mov qword [rax + 8], rcx
mov rax, qword [0x18002c318]
mov qword [0x18002c310], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18002c318]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180004bd8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180004c12
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180004bce
mov rax, qword [0x18002c318]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180004a4c
xor eax, eax
add rsp, 0x58
ret
Function at 0x140001420
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x14000c880], 0
jne 0x140001601
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000160b
mov r9, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000148e
lea rdx, [r9 + rcx]
mov ecx, dword [r9 + rcx + 0xc]
mov eax, dword [rcx + r9]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14000148e
mov eax, dword [rcx + r9 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14000149a
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001451
test rdx, rdx
je 0x14000160b
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r9
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x10], rdi
add rsi, r9
mov edi, dword [rdx + 0x20]
mov qword [rsp + 8], r14
add rdi, r9
mov qword [rsp], r15
lea r14, [0x14000c880]
xor r8d, r8d
mov r15d, 0x775a
nop word [rax + rax]
lea eax, [rbx - 1]
mov edx, dword [rdi + rax*4]
add rdx, r9
cmp word [rdx], r15w
jne 0x140001555
xor r11d, r11d
mov r10d, 0x8eab0230
mov rax, rdx
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r10d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, rdx
xor r10d, ecx
cmp byte [rax], 0
jne 0x140001510
lea rdx, [r8*8]
inc r8d
mov dword [rdx + r14 + 4], r10d
lea eax, [rbx - 1]
movzx eax, word [rbp + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [rdx + r14 + 8], eax
cmp r8d, 0x1f4
je 0x14000155a
add ebx, 0xffffffff
jne 0x1400014f0
mov r15, qword [rsp]
lea eax, [r8 - 1]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov rbp, qword [rsp + 0x28]
mov dword [0x14000c880], r8d
test eax, eax
je 0x1400015f2
nop dword [rax]
mov ecx, r8d
xor eax, eax
sub ecx, edx
cmp ecx, 1
je 0x1400015e8
nop dword [rax]
mov ecx, eax
lea r9d, [rax + 1]
lea r10, [r9*8]
mov ebx, dword [r10 + r14 + 8]
lea r11, [rcx*8]
mov edi, dword [r11 + r14 + 8]
cmp edi, ebx
jbe 0x1400015d9
mov ecx, dword [r11 + r14 + 4]
mov eax, dword [r10 + r14 + 4]
mov dword [r11 + r14 + 4], eax
mov dword [r10 + r14 + 4], ecx
mov dword [r11 + r14 + 8], ebx
mov dword [r10 + r14 + 8], edi
mov r8d, dword [0x14000c880]
mov ecx, r8d
mov eax, r9d
sub ecx, edx
dec ecx
cmp r9d, ecx
jb 0x140001590
inc edx
lea eax, [r8 - 1]
cmp edx, eax
jb 0x140001580
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 8]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x140001c60
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x15882105
call fcn.140001620
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140001fa0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe69ff533
call fcn.140001620
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400024a0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdd95c91e
call fcn.140001620
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140002a20
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x801a9084
call fcn.140001620
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400097f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009842
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009842
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009842
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009842
cmp dword [rcx + 0x84], 0xe
jbe 0x140009842
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009844
xor al, al
add rsp, 0x28
ret
Function at 0x140027db0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f00
cmp rax, 0xffffffffffffffff
je 0x140027f00
xor edi, edi
test rbp, rbp
jle 0x140027eab
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd40
mov rbx, rax
test rax, rax
jne 0x140027e38
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027ea1
mov edx, 0x8000
mov ecx, r14d
call fcn.1400158f8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c430
cmp eax, 0xffffffff
je 0x140027e81
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e48
mov edx, r15d
mov ecx, r14d
call fcn.1400158f8
jmp 0x140027ea1
cmp byte [rsi + 0x38], dil
je 0x140027e98
cmp dword [rsi + 0x34], 5
jne 0x140027e98
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027ea1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019e18
jmp 0x140027f14
jns 0x140027f14
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b754
cmp rax, 0xffffffffffffffff
jne 0x140027ecc
cmp byte [rsi + 0x30], dil
je 0x140027f14
mov edi, dword [rsi + 0x2c]
jmp 0x140027f14
mov ecx, r14d
call fcn.140016ef8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f14
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f0d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f12
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14046ff6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol cx, 0x6f
mov cl, byte [rdi + rcx*2 - 0x1d3ac]
jae 0x14047ca2f
mov edx, 0x59c9a8c
inc rdx
rdtsc
sub r9, 8
push 0x57a4c1a1
mov dword [r9 + 4], eax
push 0xffffffffd32601bb
push 0xffffffffe78fa480
mov dword [r9], edx
lea rsp, [rsp + 0x18]
jmp 0x140459a7f
push 0xffffffffe49f9e9d
adc rdi, 2
shl edx, cl
mov dword [rdi], edx
lea rsp, [rsp + 0x18]
jmp fcn.14048d80f