joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400baa70
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x1400baa94
mov rbx, rdx
jmp 0x1400bac36
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x1400baae9
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x1400baad8
mov rcx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x1400bac36
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r15d, 1
cmovne r15, rcx
mov rax, r15
shr rax, 0x3d
jne 0x1400bac53
lea r14, [r15 + 3]
shr r14, 2
lea rcx, [r15*8]
call fcn.140006100
lea rbx, [rax + r14*8]
mov rcx, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
mov r10, r9
sub r10, rcx
lea rdx, [rax + r15*8]
mov r8, rbx
sub r9, rcx
je 0x1400bac13
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
add r9, 0xfffffffffffffff8
cmp r9, 0xf8
jae 0x1400bab63
mov r10, rbx
jmp 0x1400bac00
lea r10, [rax + r14*8]
sub r10, rcx
cmp r10, 0x100
jae 0x1400bab7b
mov r10, rbx
jmp 0x1400bac00
shr r9, 3
inc r9
shl r14, 3
mov r15, r9
and r15, 0xffffffffffffffe0
lea r11, [r15*8]
lea r10, [rbx + r15*8]
add r14, rax
add r14, 0xc0
xor r12d, r12d
nop word cs:[rax + rax]
vmovups zmm0, zmmword [rcx + r12*8]
vmovups zmm1, zmmword [rcx + r12*8 + 0x40]
vmovups zmm2, zmmword [rcx + r12*8 + 0x80]
vmovups zmm3, zmmword [rcx + r12*8 + 0xc0]
vmovups zmmword [r14 + r12*8 - 0xc0], zmm0
vmovups zmmword [r14 + r12*8 - 0x80], zmm1
vmovups zmmword [r14 + r12*8 - 0x40], zmm2
vmovups zmmword [r14 + r12*8], zmm3
add r12, 0x20
cmp r15, r12
jne 0x1400babb0
cmp r9, r15
je 0x1400bac13
add rcx, r11
nop
mov r9, qword [rcx]
mov qword [r10], r9
add r10, 8
add rcx, 8
cmp r10, r8
jne 0x1400bac00
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x1400bac36
vzeroupper
call fcn.1400061e0
mov rbx, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
vzeroupper
ret
call fcn.140084c90
int3
Function at 0x1400c12d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8d, 0xffffffff
cmp rdx, 4
jb 0x1400c1349
lea rax, [0x1400d9df0]
nop word cs:[rax + rax]
mov r9d, r8d
xor r8b, byte [rcx]
shr r9d, 8
movzx r8d, r8b
xor r9d, dword [rax + r8*4]
mov r8d, r9d
xor r9b, byte [rcx + 1]
shr r8d, 8
movzx r9d, r9b
xor r8d, dword [rax + r9*4]
mov r9d, r8d
xor r8b, byte [rcx + 2]
shr r9d, 8
movzx r8d, r8b
xor r9d, dword [rax + r8*4]
mov r8d, r9d
xor r9b, byte [rcx + 3]
shr r8d, 8
movzx r9d, r9b
xor r8d, dword [rax + r9*4]
add rcx, 4
add rdx, 0xfffffffffffffffc
cmp rdx, 3
ja 0x1400c12f0
test rdx, rdx
je 0x1400c135e
test dl, 1
jne 0x1400c1364
mov r9, rdx
cmp rdx, 1
jne 0x1400c138c
jmp 0x1400c13cd
mov eax, r8d
not eax
ret
mov eax, r8d
shr eax, 8
xor r8b, byte [rcx]
movzx r8d, r8b
lea r9, [0x1400d9df0]
xor eax, dword [r9 + r8*4]
inc rcx
lea r9, [rdx - 1]
mov r8d, eax
cmp rdx, 1
je 0x1400c13cd
xor edx, edx
lea r10, [0x1400d9df0]
mov eax, r8d
nop dword [rax + rax]
mov r8d, eax
shr r8d, 8
xor al, byte [rcx + rdx]
movzx eax, al
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr eax, 8
xor r8b, byte [rcx + rdx + 1]
movzx r8d, r8b
xor eax, dword [r10 + r8*4]
add rdx, 2
cmp r9, rdx
jne 0x1400c13a0
not eax
ret
Function at 0x140003f50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003fe0
jmp 0x140003fcf
jae 0x1400040a0
cmp r8, 0x201
jae 0x140003fe0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140004038
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14000400f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001c730
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140004061
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004108
mov r8d, r14d
cmp r15, r8
jne 0x140003fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000412b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003fcf
jmp 0x140003fe0
cmp rsi, r8
jb 0x140004145
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140006dd0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400040f1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140001220
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400040d9
jmp 0x1400040f1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_5680fa18feaa87f3ff04063800aec256c3d4b4belibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001d2c0
jmp 0x14000415a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001d710
ud2
Function at 0x1400077d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140007800
test ecx, ecx
jne 0x140007850
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14000780c
test ecx, ecx
jne 0x140007850
mov rcx, rdi
call fcn.1400076b0
movzx eax, al
test bpl, bpl
jne 0x140007857
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140007843.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x1400079c8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140007843.2
xor eax, eax
test bpl, bpl
je 0x14000781c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1400079a9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14000788a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140007909
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1400078d0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1400078eb
inc rax
dec rdi
cmp rax, 1
jne 0x1400078b0
jmp 0x140007909
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400078eb
cmp ebx, 0x5c
je 0x1400078eb
inc rax
dec rdi
cmp rax, 1
jne 0x1400078d0
jmp 0x140007909
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x1400079b7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140007933
mov al, 9
cmp rdx, 2
je 0x140007937
cmp rdx, 1
jne 0x140007947
cmp byte [r8], 0x2e
jne 0x140007947
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140007947
mov al, 0xa
jmp 0x140007947
cmp byte [r8], 0x2e
jne 0x140007947
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140007843.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140007843.2
mov ecx, 2
jmp case.0x140007843.2
lea r8, str.library_std_srcpath.rs
call fcn.14001d690
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001d690
ud2
Function at 0x14000bee0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001fee8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000bf24
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000bf8a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000bfc1
test eax, eax
js 0x14000bf9b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000bfb4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140006a50
mov rcx, rax
call fcn.140001c40
mov ecx, 7
int 0x29
ud2

Function at 0x14001a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001a5da
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001a5d0
cmp r10, r11
jb 0x14001a673
cmp r10, rdx
ja 0x14001a687
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001a5d2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001a5b0
jmp 0x14001a647
ja 0x14001a5da
mov r11, r10
cmp rax, r8
jne 0x14001a582
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001a64b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001a620
mov r8, r10
sub ecx, r9d
jns 0x14001a63e
jmp 0x14001a64d
cmp r10, rdx
je 0x14001a659
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001a64d
xor al, 1
cmp r8, rdx
jne 0x14001a600
jmp 0x14001a64d
xor eax, eax
jmp 0x14001a64d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001d2c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001d790
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001d710
ud2
Function at 0x14001c0bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c106
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c106
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c106
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c106
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c106
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c108
xor al, al
add rsp, 0x28
ret
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call fcn.140131000
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000caf0
add rsp, 0x28
jmp 0x14000c43c
Function at 0x1400022b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004390]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400022d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400022d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400022d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000232d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002324
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400022d0
add rax, 0x28
cmp rax, r9
jne 0x140002310
xor eax, eax
ret

Function at 0x140002330
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004390]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000234f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002358
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000234f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400023f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004390]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000240f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002418
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002760
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
sub rsp, 0x28
call fcn.1400015e0
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x1000
mov edx, 0x13a
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x13a
lea rdx, [0x1400030a0]
mov rcx, rax
call sub.msvcrt.dll_memmove
xor r8d, r8d
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002e7d
xor eax, eax
jmp 0x140002fc3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002eb7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002eb7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002fc3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002fb6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002efa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002f09
movsx ecx, dil
jmp 0x140002f5d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140002fb6
cmp eax, 1
jle 0x140002f77
cmp eax, 3
jne 0x140002fb6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000e328
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002fbb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002fa4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14000eed0
cmp rsi, rax
jne 0x140002fb6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002fbb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400050b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140004350
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140008300
mov eax, 1
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], eax
xor r9d, r9d
mov word [rsp + 0xb0], ax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], SafeArrayLock
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400043f5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400043f7
xor al, al
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400050b0
add rsp, 0xf0
pop rbx
ret
Function at 0x1400049c0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x870
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x860], rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x60]
call fcn.140008300
mov ecx, 0x20
call fcn.140005634
mov rdi, rax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
lea r14, [rdi + 0x10]
xor ebp, ebp
mov qword [r14], rbp
lea rsi, [rdi + 0x18]
mov qword [rsi], rbp
mov qword [rdi], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140004a5d
cmp eax, 0x80010106
jne 0x140004b2a
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rsp + 0x20], rsi
lea r9, [0x140028668]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140028658]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140004bab
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [r14]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
lea r9, [rsp + 0x60]
mov rcx, rdi
call fcn.140004bc0
mov rcx, qword [r14]
test rcx, rcx
je 0x140004b45
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi]
test rcx, rcx
je 0x140004b53
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140004b61
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, [rsp + 0x60]
lea rcx, str.OperatingSystem_Name:__ls__n
call fcn.1400012c0
mov eax, 1
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400050b0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov ecx, 0x8007000e
call fcn.140004980
int3

Function at 0x14000e304
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e130