joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63cc30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x63cc3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x63cc4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x63cc35
lea eax, [rcx + 1]
jmp 0x63cc5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x63cc6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x63cc54
sub eax, 3
jb 0x63cc8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x63ccdd
sar eax, 1
movsxd rbp, eax
jb 0x63ccc4
jmp 0x63cc9c
add ebx, ebx
jne 0x63cc9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x63ccc4
inc ecx
add ebx, ebx
jne 0x63ccaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x63ccc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x63ccbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x63ccac
add ecx, 2
jmp 0x63ccc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0063cbf2
jmp 0x63cc3d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd6c00
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x63cd29
cmp rsi, rcx
jae 0x63cd31
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x63cd10
cmp al, 0x8f
ja 0x63cd10
cmp byte [rsi - 2], 0xf
je 0x63cd16
sub al, 0xe8
cmp al, 1
ja 0x63ccfa
cmp rsi, rcx
jae 0x63cd31
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x63cd00
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x63cd31
lodsb al, byte [rsi]
jmp 0x63cd10
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x238000]
mov eax, dword [rdi]
or eax, eax
je 0x63cd8e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x23c000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x63cd3e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x63cd88
mov qword [rbx], rax
add rbx, 8
jmp 0x63cd5e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x63cdc8
cmp al, 0xef
ja 0x63cdba
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x63cd9a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x63cda9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x63ce1c
sub rsp, 0xffffffffffffff80
jmp 0x460740
Function at 0x20a01000
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [0x20a0c020], eax
xor eax, eax
mov word [rsp + 0x40], ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.20a01590
test rax, rax
je 0x20a01062
add rax, 2
jmp 0x20a01067
lea rax, [rsp + 0x40]
lea rdx, str.iexplore.exe
mov rcx, rax
call fcn.20a0177c
test eax, eax
jne 0x20a01135
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x270], rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test eax, eax
je 0x20a0112d
lea ecx, [rax + 0xa]
mov qword [rsp + 0x260], rdi
call fcn.20a01810
mov rdi, rax
test rax, rax
je 0x20a01125
lea rcx, [rsp + 0x40]
mov r9, rax
mov r8d, ebx
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x20a010ea
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x20a094a4]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x20a010f4
mov rcx, rdi
call fcn.20a018c8
jmp 0x20a01125
mov rax, qword [rsp + 0x28]
mov rcx, rdi
mov ebx, dword [rax + 8]
call fcn.20a018c8
movzx eax, byte [0x20a0c024]
and ebx, 0xffff0000
mov ecx, 1
cmp ebx, 0x90000
cmove eax, ecx
mov byte [0x20a0c024], al
mov rdi, qword [rsp + 0x260]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.20a01570
add rsp, 0x268
ret
Function at 0x20a01da7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x20a0158a
rol rcx, 0x10
test cx, 0xffff
jne 0x20a01586
repz ret
ror rcx, 0x10
jmp 0x20a01d00
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x20a0c100]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x20a0c1f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x20a01d85
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x20a0c100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x20a01da7
mov rax, qword [rsp + 0x88]
mov qword [0x20a0c1f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x20a0c198], rax
mov rax, qword [0x20a0c1f8]
mov qword [0x20a0c070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x20a0c180], rax
mov dword [0x20a0c060], 0xc0000409
mov dword [0x20a0c064], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x20a0b008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x20a0c0f8], eax
mov ecx, 1
call fcn.20a04754
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x20a08308]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x20a0c0f8], 0
jne 0x20a01e2e
mov ecx, 1
call fcn.20a04754
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x20a03438
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x20a032ac
Function at 0x20a064ac
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.20a02a3c
xor ebx, ebx
mov rdi, rax
cmp qword [0x20a0cd58], rbx
jne 0x20a065b2
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x20a06687
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x20a06687
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x20a0cd58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x20a0cd60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x20a0cd68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x20a0cd78], rax
test rax, rax
je 0x20a065a9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x20a0cd70], rax
jmp 0x20a065b9
mov rax, qword [0x20a0cd70]
jmp 0x20a065c0
mov rax, qword [0x20a0cd70]
mov r11, qword [0x20a0cd78]
cmp rax, rdi
je 0x20a06628
cmp r11, rdi
je 0x20a06628
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x20a0cd78]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x20a06628
test rax, rax
je 0x20a06628
call rsi
test rax, rax
je 0x20a06622
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x20a06622
test byte [rsp + 0x38], 1
jne 0x20a06628
bts ebp, 0x15
jmp 0x20a06666
mov rcx, qword [0x20a0cd60]
cmp rcx, rdi
je 0x20a06666
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x20a06666
call rax
mov rbx, rax
test rax, rax
je 0x20a06666
mov rcx, qword [0x20a0cd68]
cmp rcx, rdi
je 0x20a06666
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x20a06666
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x20a0cd58]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x20a06687
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x20a06689
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x14000925c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400092a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400092a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400092a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400092a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400092a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400092a8
xor al, al
add rsp, 0x28
ret
Function at 0x1400028bc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
xor eax, eax
mov word [rsp + 8], ax
mov qword [rsp], 0
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp], rax
mov rax, qword [rsp]
mov eax, dword [rax + 0x14]
cmp dword [rsp + 0x30], eax
jae 0x140002927
mov eax, dword [rsp + 0x30]
jmp 0x1400029c1
xor eax, eax
mov word [rsp + 8], ax
jmp 0x14000293d
movzx eax, word [rsp + 8]
inc ax
mov word [rsp + 8], ax
movzx eax, word [rsp + 8]
mov rcx, qword [rsp + 0x10]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x1400029bf
movzx eax, word [rsp + 8]
imul rax, rax, 0x28
mov rcx, qword [rsp]
mov eax, dword [rcx + rax + 0xc]
cmp dword [rsp + 0x30], eax
jb 0x1400029ba
movzx eax, word [rsp + 8]
imul rax, rax, 0x28
movzx ecx, word [rsp + 8]
imul rcx, rcx, 0x28
mov rdx, qword [rsp]
mov eax, dword [rdx + rax + 0xc]
mov rdx, qword [rsp]
add eax, dword [rdx + rcx + 0x10]
cmp dword [rsp + 0x30], eax
jae 0x1400029ba
movzx eax, word [rsp + 8]
imul rax, rax, 0x28
mov rcx, qword [rsp]
mov eax, dword [rcx + rax + 0xc]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 8]
imul rcx, rcx, 0x28
mov rdx, qword [rsp]
add eax, dword [rdx + rcx + 0x14]
jmp 0x1400029c1
jmp 0x140002930
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400029cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x30], 2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140002a55
cmp dword [rsp + 0x30], 1
je 0x140002a53
xor eax, eax
jmp 0x140002be7
jmp 0x140002a7c
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140002a75
cmp dword [rsp + 0x30], 2
je 0x140002a73
xor eax, eax
jmp 0x140002be7
jmp 0x140002a7c
xor eax, eax
jmp 0x140002be7
mov rax, qword [rsp + 0x48]
add rax, 0x88
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
call fcn.1400028bc
mov eax, eax
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 0x20]
call fcn.1400028bc
mov eax, eax
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 0x1c]
call fcn.1400028bc
mov eax, eax
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 0x24]
call fcn.1400028bc
mov eax, eax
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x20]
dec ecx
mov dword [rsp + 0x20], ecx
test eax, eax
je 0x140002be5
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
call fcn.1400028bc
mov eax, eax
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [0x140007038]
mov rcx, qword [rsp + 0x58]
call qword [0x140007150]
test rax, rax
je 0x140002bc4
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 0x1c]
call fcn.1400028bc
mov eax, eax
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax]
call fcn.1400028bc
jmp 0x140002be7
mov rax, qword [rsp + 0x28]
add rax, 4
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
add rax, 2
mov qword [rsp + 0x40], rax
jmp 0x140002b27
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400032d0
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x140
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0x11c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000332c
cmp dword [rsp + 0x24], 6
jb 0x140003316
cmp dword [rsp + 0x24], 6
jne 0x14000331a
cmp dword [rsp + 0x28], 1
jae 0x14000331a
mov al, 1
jmp 0x14000332e
cmp dword [rsp + 0x24], 6
jne 0x14000332c
cmp dword [rsp + 0x28], 1
jne 0x14000332c
mov al, 1
jmp 0x14000332e
xor al, al
add rsp, 0x140
pop rdi
ret

Function at 0x140003f68
Capabilities:
Acquire debug privileges

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x58], 0
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x38], 0
call qword [0x140007388]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [0x1400072d0]
test eax, eax
je 0x140004046
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x64], 2
lea r8, [rsp + 0x5c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x1400072d8]
test eax, eax
je 0x14000403b
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [0x1400072c8]
mov rcx, qword [rsp + 0x40]
call qword [0x140007110]
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov ecx, 0x43a
call qword [0x1400073b8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140004072
mov dword [rsp + 0x4c], 0
jmp 0x1400040c0
xor r9d, r9d
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.140002bfc
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400040a6
mov dword [rsp + 0x4c], 0
jmp 0x1400040c0
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [0x140007370]
xor eax, eax
test eax, eax
jne 0x140003fcf
cmp qword [rsp + 0x30], 0
je 0x1400040d3
mov rcx, qword [rsp + 0x30]
call qword [0x140007110]
mov eax, dword [rsp + 0x4c]
add rsp, 0x70
pop rdi
ret
Function at 0x13ceb64
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13ceb6e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x13ceb97
pop rbp
sub rbp, 0x33
sub rbp, 0xfceb64
sub rsp, 0x20
jmp 0x13cebb6
mov rax, 0xfceb64
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
call 0xffffffff85fd6d0c
add byte [rax], al
add byte [rax - 0x39], cl
ror dword [rbx], 6
add byte [rax], al
mov rdx, 0x5a1ed620
xor byte [rax], dl
inc rax
dec rcx
jne 0x13cebd5
jmp 0x13cebec
push 0xffffffffa9abc9a9
sbb al, 0x20
and byte [rax], ah
push 0x2128e1a1
and byte [rax], ah
push 0xffffffffe768c921
loopne 0x13cec27
and byte [rax], ah
and byte [rax - 0x19], ch
loop 0x13cec12
and byte [rax], ah
and byte [rax - 0x29], ch
ret 0x2168
loope 0x13cebbf
movabs eax, dword [0x70c821682020202c]
jo 0x13cec87
cwde
and byte [rcx + 0x20202007], ch
and byte [rax], ah
push 0xfffffffff5424299
and byte [rax - 0x67], ch
cmc
and byte [rax], ah
and byte [rax], ah
and byte [rax + 0x21], ch
leave
push 0xffffffffa15f079a
adc eax, 0x20202020
enter 0x2025, 0x20
and cl, cl
and byte ss:[rax], ah
and cl, ah
enter 0x1122, 0x31
push 0x2024e1a1
and byte [rax], ah
push 0xffffffffa52fe8df
invalid
and byte [rax], ah
and byte [rdx + 0x77], bh
push 0x1168f7a9
jmp 0xffffffffa52efdfe
Function at 0x140003cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140006880]
movabs rdi, 0x2b992ddfa23249d6
test rax, rax
je 0x140003d20
mov rax, qword [0x140006880]
cmp rax, rdi
jne 0x140003de1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
lea rcx, [rsp + 0x40]
xor rbx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor rbx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov edx, 8
lea rcx, [0x140006880]
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
test rbx, rbx
lea rcx, [0x140006880]
mov edx, 8
cmovne rdi, rbx
mov qword [0x140006880], rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 8
lea rcx, [0x140006880]
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov rax, qword [0x140006880]
not rax
mov qword [0x1400090f0], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400041d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140004261
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140004261
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004261
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140004245
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000423f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004247
add rdx, 0x28
jmp 0x140004224
xor edx, edx
test rdx, rdx
jne 0x140004250
xor al, al
jmp 0x140004267
test dword [rdx + 0x24], 0x80000000
je 0x14000425d
xor al, al
jmp 0x140004267
mov al, 1
jmp 0x140004267
xor al, al
jmp 0x140004267
add rsp, 0x18
ret

Function at 0x140004768
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x180001e20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x180001e37
sub edx, 1
je 0x180001e67
sub edx, 1
je 0x180001e37
cmp edx, 1
jne 0x180001e5d
lea rdx, [0x180001460]
lea rcx, [0x18000c9e0]
call fcn.180005320
lea rdx, [0x180001970]
lea rcx, [0x18000c980]
call fcn.180005320
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180001d00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x1800021d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800021f8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000221e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180002220
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180002279
test ecx, ecx
jle 0x180002259
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180002279
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180002279
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1800022a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800022d1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1800022ef
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000230b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000230d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180002349
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800023de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180002384
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800023be
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800023de
cmp rbx, rax
ja 0x180002390
test rbx, rbx
je 0x1800023de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret