joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a3a9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400a3ae8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400a3ae0
cmp dword [rcx + 0x3c], edx
jl 0x1400a3ae0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400a3ae0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400a3ae8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400a3c74
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400a3c80
push rbx
sub rsp, 0x540
mov rax, qword [0x1400d2258]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400a3cfd
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400a3d1d
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400a3310
add rsp, 0x540
pop rbx
ret

Function at 0x1400a3c80
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400a3c80
push rbx
sub rsp, 0x540
mov rax, qword [0x1400d2258]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400a3cfd
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400a3d1d
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400a3310
add rsp, 0x540
pop rbx
ret
Function at 0x7feee631090
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x388]
sub rsp, 0x488
mov rax, qword [0x7feee642410]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r12, rcx
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x70], 0
call fcn.7feee634520
mov dword [rsp + 0x28], 0x6b554066
mov dword [rsp + 0x2c], 0x43722164
mov dword [rsp + 0x30], 0x52206f74
mov word [rsp + 0x34], 0x2e24
mov byte [rsp + 0x36], 0
call entry0
test eax, eax
je 0x7feee63121b
mov qword [rsp + 0x4a8], rbx
mov qword [rsp + 0x4b0], rsi
xor esi, esi
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x480], rdi
mov dword [rsp + 0x20], eax
mov edi, esi
mov ebx, esi
call qword [0x7feee647008]
movsxd rcx, eax
test eax, eax
jle 0x7feee631158
nop word [rax + rax]
mov eax, edi
inc rbx
inc edi
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
xor byte [rsp + rbx + 0x27], al
cmp rbx, rcx
jl 0x7feee631140
lea rcx, [rsp + 0x28]
call qword [0x7feee647008]
mov rdi, qword [rsp + 0x480]
test eax, eax
jle 0x7feee6311fd
lea rbx, [rsp + 0x28]
nop dword [rax + rax]
xor eax, eax
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov byte [rsp + 0x69], al
mov eax, esi
and eax, 0x80000003
jge 0x7feee6311b9
dec eax
or eax, 0xfffffffc
inc eax
movzx r8d, byte [rbx]
lea rcx, [rsp + 0x38]
lea rdx, str._02X
test eax, eax
je 0x7feee6311d4
lea rdx, str._02x
call fcn.7feee6326c0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call qword [0x7feee647010]
lea rcx, [rsp + 0x28]
inc esi
inc rbx
call qword [0x7feee647008]
cmp esi, eax
jl 0x7feee631180
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [0x7feee647018]
mov rsi, qword [rsp + 0x4b0]
mov rbx, qword [rsp + 0x4a8]
mov eax, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.7feee6326a0
add rsp, 0x488
pop r12
pop rbp
ret
Function at 0x7feee631420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x7feee642410]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov edi, edx
mov rbx, rcx
cmp r8, 0x457
jne 0x7feee631468
call fcn.7feee631240
mov eax, 1
jmp 0x7feee63157c
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.7feee634520
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [0x7feee647048]
lea rdx, [rsp + 0x40]
lea rcx, [0x7feee644640]
call qword [0x7feee647018]
lea rdx, [rsp + 0x20]
lea rcx, [0x7feee644640]
mov dword [rsp + 0x20], 0x64746e5c
mov dword [rsp + 0x24], 0x642e6c6c
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [0x7feee647010]
dec edi
jne 0x7feee63145e
mov rcx, rbx
call qword [0x7feee647050]
lea rdx, [0x7feee644530]
mov r8d, 0x104
mov rcx, rbx
call qword [0x7feee647058]
lea rcx, [rbp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x50], dil
call fcn.7feee634520
lea rdx, [rbp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [0x7feee647058]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
mov dword [rsp + 0x30], 0x646e7572
mov dword [rsp + 0x34], 0x32336c6c
mov dword [rsp + 0x38], 0x6578652e
mov byte [rsp + 0x3c], dil
call qword [0x7feee647330]
test rax, rax
jne 0x7feee63145e
call fcn.7feee632450
mov dword [0x7feee644744], eax
test eax, eax
jle 0x7feee63157a
movsxd rcx, eax
call fcn.7feee632de0
mov qword [0x7feee644748], rax
call fcn.7feee6324d0
test eax, eax
jle 0x7feee63157a
call fcn.7feee631ea0
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.7feee6326a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x7feee6315a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x7feee642410]
xor rax, rsp
mov qword [rbp + 0x160], rax
or ecx, 0xffffffff
mov rbx, r8
call qword [0x7feee647060]
lea rcx, [0x7feee63f79c]
call fcn.7feee632b84
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x50]
mov dword [rsp + 0x20], 0x104
call qword [0x7feee647310]
lea rsi, [rbp + 0x50]
lea rdi, str.SYSTEM
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
je 0x7feee63162f
call fcn.7feee632760
lea rdx, [0x7feee63f7a8]
lea rcx, [0x7feee63f7ac]
lea r8, [rax + 0x30]
call fcn.7feee632d40
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.7feee634520
lea rcx, [0x7feee63f79c]
mov dword [rsp + 0x28], 0x4d53545c
mov dword [rsp + 0x2c], 0x72534953
mov dword [rsp + 0x30], 0x4c442e76
mov word [rsp + 0x34], 0x4c
call fcn.7feee632b84
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [0x7feee647048]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call qword [0x7feee647010]
lea rdx, [rsp + 0x40]
lea rcx, [0x7feee644530]
xor r8d, r8d
call qword [0x7feee647068]
test eax, eax
je 0x7feee6316f4
lea rcx, [rsp + 0x40]
call fcn.7feee6325a0
lea rcx, str.__write_success_r_n
call fcn.7feee632b84
mov rcx, rbx
call fcn.7feee632b78
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.7feee631930
test eax, eax
je 0x7feee6316e6
lea rcx, str.__load_success_r_n
call fcn.7feee632b84
jmp 0x7feee631708
lea rcx, str.___load_failed_r_n
call fcn.7feee632b84
jmp 0x7feee631708
call qword [fcn.7feee647070]
lea rcx, str.___write_failed__d__r_n
mov edx, eax
call fcn.7feee632b84
call fcn.7feee632760
lea rcx, [rax + 0x30]
call fcn.7feee632b28
call qword [0x7feee647078]
mov ecx, 0xbb8
call qword [0x7feee647080]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.7feee6326a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x7feee631750
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x7feee642410]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov edi, 1
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rbx
call qword [fcn.7feee647088]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x28]
mov rcx, rax
call qword [0x7feee647318]
test eax, eax
je 0x7feee6317e7
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x7feee647320]
test eax, eax
je 0x7feee6317e7
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [0x7feee647328]
test eax, eax
je 0x7feee6317e7
call qword [fcn.7feee647070]
cmp eax, 0x514
cmovne ebx, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x7feee6317f7
call qword [fcn.7feee647030]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.7feee6326a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x7feee631ea0
Capabilities:
Parse pe header

Disassembly:
push rbp
sub rsp, 0x20
mov rbp, qword [0x7feee644748]
mov eax, 0x5a4d
cmp word [rbp], ax
je 0x7feee631ec0
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x38], rsi
movsxd rsi, dword [rbp + 0x3c]
add rsi, rbp
cmp dword [rsi], 0x4550
je 0x7feee631ee1
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbp
ret
mov edx, dword [rsi + 0x50]
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x2000
mov qword [rsp + 0x48], r12
call qword [fcn.7feee6470d8]
mov r12, rax
test rax, rax
jne 0x7feee631f34
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x2000
call qword [fcn.7feee6470d8]
mov r12, rax
test rax, rax
jne 0x7feee631f34
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
call qword [fcn.7feee6470f8]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [fcn.7feee6472c8]
mov r8d, 0x1000
mov rcx, r12
mov rdi, rax
mov qword [rax + 8], r12
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
call qword [fcn.7feee6470d8]
mov edx, dword [rsi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r12
call qword [fcn.7feee6470d8]
mov r8d, dword [rsi + 0x54]
mov rdx, rbp
add r8d, dword [rbp + 0x3c]
mov rcx, rax
mov rbx, rax
call fcn.7feee63a4a0
movsxd rax, dword [rbp + 0x3c]
mov r8, rdi
add rax, rbx
mov rdx, rsi
mov rcx, rbp
mov qword [rdi], rax
mov qword [rax + 0x30], r12
call fcn.7feee631a70
mov rdx, r12
sub rdx, qword [rsi + 0x30]
je 0x7feee631fd5
mov rcx, rdi
call fcn.7feee631c70
mov rcx, rdi
call fcn.7feee631d20
test eax, eax
je 0x7feee632045
mov rcx, rdi
call fcn.7feee631b60
mov r11, qword [rdi]
mov eax, dword [r11 + 0x28]
test eax, eax
je 0x7feee632040
mov esi, eax
add rsi, r12
je 0x7feee632045
lea rcx, [0x7feee644530]
call qword [0x7feee647008]
inc eax
movsxd rcx, eax
call fcn.7feee632ec4
lea rdx, [0x7feee644530]
mov rcx, rax
mov rbx, rax
call qword [0x7feee647018]
mov edx, 1
mov r8d, 0x457
mov rcx, rbx
call rsi
test eax, eax
je 0x7feee632045
mov dword [rdi + 0x1c], 1
mov rax, rdi
jmp 0x7feee63204f
mov rcx, rdi
call fcn.7feee632070
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbp
ret
Function at 0x7feee632130
Capabilities:
Encrypt data using rc6

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x7feee642410]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, edx
lea ebx, [rdx + 3]
mov r8d, edx
mov rdx, rcx
shr rax, 2
lea rcx, [rsp + 0x20]
mov dword [rsp + rax*4 + 0x20], 0
shr ebx, 2
call fcn.7feee63a4a0
mov dword [0x7feee644750], 0xb7e15163
lea rcx, [0x7feee644754]
mov edx, 0x19
mov eax, dword [rcx - 4]
add rcx, 4
sub eax, 0x61c88647
dec rdx
mov dword [rcx - 4], eax
jne 0x7feee632181
mov ecx, 0x1a
mov eax, ebx
cmp ebx, ecx
cmovb eax, ecx
xor r11d, r11d
xor edi, edi
lea r9d, [rax + rax*2]
xor esi, esi
xor r10d, r10d
xor r8d, r8d
test r9d, r9d
je 0x7feee632225
mov qword [rsp + 0xa0], rbp
lea rbp, [0x7feee644750]
nop word [rax + rax]
mov eax, dword [rbp + r10*4]
inc r11d
inc r10
add eax, edi
add esi, eax
mov eax, dword [rsp + r8*4 + 0x20]
rol esi, 3
add eax, edi
lea ecx, [rdi + rsi]
lea edi, [rsi + rax]
mov dword [rbp + r10*4 - 4], esi
and ecx, 0x1f
rol edi, cl
mov dword [rsp + r8*4 + 0x20], edi
cmp r11d, 0x1a
jb 0x7feee63220a
xor r11d, r11d
xor r10d, r10d
inc edx
inc r8
cmp edx, ebx
jb 0x7feee632218
xor edx, edx
xor r8d, r8d
dec r9d
jne 0x7feee6321d0
mov rbp, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7feee6326a0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x7feee632240
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
mov r11, rdx
mov rsi, rcx
cmp r8d, 8
jae 0x7feee63228d
test r8d, r8d
je 0x7feee63243e
lea rcx, [0x7feee644750]
sub r11, rsi
mov r9d, r8d
nop dword [rax + rax]
movzx eax, byte [r11 + rsi]
inc rsi
add rcx, 4
xor al, byte [rcx - 4]
dec r9
mov byte [rsi - 1], al
jne 0x7feee632270
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x38], r12
mov eax, r8d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
xor r15d, r15d
and eax, 7
je 0x7feee6322b5
lea r14d, [rax + 8]
sub r8d, r14d
jmp 0x7feee6322b8
mov r14d, r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov r12d, 0xc
mov qword [rsp + 0x30], r13
lea rbp, [0x7feee6447b0]
test r8d, r8d
je 0x7feee632356
lea eax, [r8 - 1]
mov rdi, rcx
mov r9, rdx
shr eax, 3
sub rdi, rdx
inc eax
mov r13d, eax
lea r15d, [rax*8]
nop word [rax + rax]
mov edx, dword [r9 + 4]
mov r8d, dword [r9]
mov ebx, r12d
mov r10, rbp
nop dword [rax]
sub edx, dword [r10 + 4]
mov ecx, r8d
sub r10, 8
and ecx, 0x1f
ror edx, cl
xor edx, r8d
sub r8d, dword [r10 + 8]
mov ecx, edx
and ecx, 0x1f
ror r8d, cl
xor r8d, edx
dec ebx
jne 0x7feee632310
sub edx, dword [0x7feee644754]
add r9, 8
mov dword [rdi + r9 - 4], edx
sub r8d, dword [0x7feee644750]
dec r13
mov dword [rdi + r9 - 8], r8d
jne 0x7feee632300
test r14d, r14d
je 0x7feee63241b
lea r13, [r15 + rsi]
lea rdx, [r15 + r11]
mov r8d, r14d
mov rcx, r13
mov edi, r14d
call fcn.7feee63a4a0
lea r11, [r15 + rdi]
mov r10d, r12d
mov edx, dword [r11 + rsi - 4]
mov r8d, dword [r11 + rsi - 8]
mov r9, rbp
nop dword [rax]
sub edx, dword [r9 + 4]
mov ecx, r8d
sub r9, 8
and ecx, 0x1f
ror edx, cl
xor edx, r8d
sub r8d, dword [r9 + 8]
mov ecx, edx
and ecx, 0x1f
ror r8d, cl
xor r8d, edx
dec r10d
jne 0x7feee632390
sub edx, dword [0x7feee644754]
mov dword [r11 + rsi - 4], edx
sub r8d, dword [0x7feee644750]
mov dword [r11 + rsi - 8], r8d
mov edx, dword [r13 + 4]
mov r8d, dword [r13]
nop word [rax + rax]
sub edx, dword [rbp + 4]
mov ecx, r8d
sub rbp, 8
and ecx, 0x1f
ror edx, cl
xor edx, r8d
sub r8d, dword [rbp + 8]
mov ecx, edx
and ecx, 0x1f
ror r8d, cl
xor r8d, edx
dec r12d
jne 0x7feee6323e0
sub edx, dword [0x7feee644754]
mov dword [r13 + 4], edx
sub r8d, dword [0x7feee644750]
mov dword [r13], r8d
mov rdi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop rsi
ret
Function at 0x1400063b2
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
bt ax, 0xf0
cmp edi, edx
push rsi
cmp r10w, 0x1513
xor esi, 0x71f9222f
push rdi
push r14
xadd ax, si
stc
sub rsp, 0x20
bt ax, bp
movzx ax, bh
rol ax, 0x7c
lea rax, [rcx - 1]
bt si, bx
mov r14b, r14b
mov dword [rsp + 0x58], 0
bsf r14w, bp
movzx r14w, r10b
movzx esi, r9w
mov r14, rdx
movsxd rsi, r10d
shld esi, r8d, 0x34
mov rsi, rcx
jmp 0x140006417
cmp rax, 0xfffffffffffffffd
jmp 0x140006420
ja 0x140006631
mov eax, 0x5a4d
test rbx, 0x191f1687
test r15b, r13b
cmp word [rcx], ax
jmp 0x14000643d
jne 0x140006631
mov edi, dword [rcx + 0x3c]
test rsi, rbx
add rdi, rcx
cmp dword [rdi], 0x4550
jmp 0x140006457
jne 0x140006631
test rdi, rdi
jmp 0x140006465
je 0x140006631
movzx eax, word [rdi + 0x18]
adc ch, 0x3f
mov ecx, 0x10b
mov qword [rsp + 0x48], rbp
cmp ax, cx
je 0x1400064ed
mov ecx, 0x20b
test sil, al
clc
cmp bp, si
cmp ax, cx
jmp 0x140006499
je 0x1400064d4
mov rbp, qword [rsp + 0x48]
btr edi, 0x8b
mov eax, 0xfffffffe
movzx r14, r14w
xor r14b, r10b
movzx edi, di
add rsp, 0x20
movzx esi, r14w
movsx r14, r15w
pop r14
movzx rdi, si
pop rdi
movsx si, r14b
movsxd rsi, esp
pop rsi
ret
mov rbp, qword [rdi + 0x30]
jmp 0x1400064e8
jmp 0x1400064f0
mov ebp, dword [rdi + 0x34]
mov r8d, 5
jmp 0x1400064fb
mov qword [rsp + 0x40], rbx
jmp 0x14000650a
lea r9, [rsp + 0x58]
jmp 0x140006514
mov rcx, rsi
jmp 0x14000651c
call section..code0
test rax, rax
je 0x14000661a
mov ebx, dword [rsp + 0x58]
stc
test ebx, ebx
jmp 0x140006536
je 0x14000661a
mov rdi, rsi
bts dx, r12w
sub rdi, rbp
and cl, 0xdc
test r13b, 0x22
lea rdi, [rdi + r14]
nop dword [rax]
cmp sil, 0x6b
movsx r9d, ax
mov edx, dword [rax + 4]
btr ecx, r15d
sub r9b, r9b
lea r8, [rax + 8]
adc r9d, esi
mov ecx, dword [rax]
sbb r9b, 0x75
sub ebx, edx
cmovnp r9d, r10d
cmp esp, 0x341d6bbe
add edx, 0xfffffff8
lea rcx, [rcx + rsi]
ror r9d, cl
btc r9w, 0xfd
adc r9b, bl
shr edx, 1
cmovs r9, rsp
xchg r9d, r9d
mov r9, rdi
jmp 0x1400065a8
call fcn.140006661
test rax, rax
jmp 0x1400065b5
je 0x14000660b
test ebx, ebx
jmp 0x1400065c2
jne 0x140006561
sub eax, eax
movsx rdi, si
rcr ebp, cl
not ebx
mov rbx, qword [rsp + 0x40]
cmovo si, r15w
mov rbp, qword [rsp + 0x48]
ror si, cl
btc edi, 0xc2
shl esi, 0x78
add rsp, 0x20
setg dil
pop r14
movzx esi, si
movsx edi, si
pop rdi
cmovo si, bp
movzx esi, r12w
pop rsi
jmp 0x14000660a
ret
mov eax, 0xfffffffe
jmp 0x140006615
jmp 0x1400065d2
movzx eax, byte [rdi + 0x16]
cmp r8b, r10b
and al, 1
neg al
jmp 0x14000662a
sbb eax, eax
jmp 0x1400065d2
mov eax, 0xfffffffe
bsr rsi, r9
add rsp, 0x20
movzx r14, r11w
movzx esi, r12w
setae r14b
pop r14
cmovp rdi, rax
jmp 0x140006659
pop rdi
pop rsi
jmp 0x140006660
ret
Function at 0x14000706c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
bsf bx, bp
shr bl, 0x68
mov qword [rsp + 0x20], rbp
jmp 0x140007082
push rsi
movzx rbp, sp
sub bl, 0xff
sub rsp, 0x20
ror bpl, cl
btc ax, 0xb4
mov rbx, rcx
bt cx, 0x4d
movzx ebp, bp
xor esi, esi
shr bp, cl
shrd rbp, r12, 0xed
mov ecx, esi
or bpl, 0xa1
mov ebp, 0x5a4d
lea rax, [rbx - 1]
jmp 0x1400070bf
cmp rax, 0xfffffffffffffffd
jmp 0x1400070c8
ja 0x1400070f7
cmp word [rbx], bp
jne 0x1400070f7
mov eax, dword [rbx + 0x3c]
lea rax, [rax + rbx]
cmp dword [rax], 0x4550
jmp 0x1400070e9
cmove rcx, rax
cbw
shrd rax, rax, 0x33
shr eax, 0x79
mov eax, 0x2000
test r15w, si
test word [rcx + 0x16], ax
jmp 0x140007109
je 0x1400071a2
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
jmp 0x14000711c
ja 0x140007151
cmp word [rbx], bp
jmp 0x14000712a
jne 0x140007151
mov eax, dword [rbx + 0x3c]
lea rax, [rax + rbx]
btr ecx, r8d
xor bp, r9w
not dh
cmp dword [rax], 0x4550
mov bpl, spl
movsxd rbp, ebp
cmove rsi, rax
mov eax, dword [rsi + 0x28]
bsr esi, ebx
shr dh, cl
sub r8d, r8d
mov sil, 0x4b
shr dx, 0xca
btc bp, 0xd9
lea rax, [rax + rbx]
bts si, di
mov rcx, rbx
or edx, r11d
movzx ebx, r8w
movsx rbx, dx
lea edx, [r8 + 1]
clc
rcr sil, cl
xor rsi, r8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
not si
pop rsi
jmp 0x1400071a0
push rax
ret
mov r8d, 9
setle ch
mov cl, 0x76
lea r9, [rsp + 0x38]
mov ecx, r15d
mov rcx, rbx
jmp 0x1400071bd
call section..code0
test rax, rax
jmp 0x1400071ca
je 0x140007255
mov qword [rsp + 0x30], rdi
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140007250
mov rax, qword [rdi]
test r13w, si
test rax, rax
jmp 0x1400071f1
je 0x140007250
nop dword [rax]
rcl cx, 0x2a
movsx cx, r15b
nop dword [rax + rax]
sub dx, bp
btc rcx, 0x34
xor r8d, r8d
lea rdi, [rdi + 8]
jmp 0x140007220
mov rcx, rbx
movzx edx, r11w
jmp 0x14000722c
lea edx, [r8 + 1]
jmp 0x140007235
call rax
mov rax, qword [rdi]
clc
stc
test r15w, 0x2faa
test rax, rax
jmp 0x14000724a
jne 0x140007214
mov rdi, qword [rsp + 0x30]
lea rax, [rbx - 1]
test r10d, ebp
test r15b, 0xc4
cmp rax, 0xfffffffffffffffd
jmp 0x140007269
ja 0x1400072a5
cmp word [rbx], bp
jmp 0x140007277
jne 0x1400072a5
mov eax, dword [rbx + 0x3c]
add rax, rbx
btc ebp, r12d
cmp dword [rax], 0x4550
movzx ebp, r9w
cmove rsi, rax
shrd eax, r12d, 0x6a
cmp rbx, 0x19945900
sar bpl, 0x2b
mov eax, dword [rsi + 0x28]
mov rsi, rdi
movzx rbp, r15w
shl sil, cl
add rax, rbx
and bpl, 0xcf
xor ebp, r14d
mov esi, r8d
mov rbx, qword [rsp + 0x40]
btr ebp, edx
shrd rsi, r14, 0x9e
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
setp sil
mov rsi, 0x62ff519d
jmp 0x1400072e5
pop rsi
push rax
ret
Function at 0x1400082fe
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
movzx ecx, r11w
movzx ecx, word [rax]
stc
cmp cx, 0x22
jne 0x140008391
nop
movzx edx, cx
test r13b, r15b
clc
test r11b, 0x63
cmp cx, 0x22
jmp 0x14000833b
je 0x140008365
movzx ecx, word [rbx + 2]
sub dl, 0xe
btr dx, 0x28
add rbx, 2
sub dh, 0xde
and dx, 0x2f24
movzx edx, cx
test cx, cx
jne 0x140008327
lea rax, [rbx + 2]
movzx rcx, r11w
cmp dx, 0x22
xchg cx, cx
movsx rcx, di
cmovne rax, rbx
xchg cx, cx
mov rbx, rax
movzx rcx, ax
sete ch
movzx ecx, word [rax]
jmp 0x1400083cd
cmp cx, 0x20
jmp 0x14000839a
jbe 0x1400083cd
nop dword [rax]
test rsi, 0x36fb2239
rol cl, cl
nop word [rax + rax]
movzx ecx, word [rbx + 2]
add rbx, 2
cmp cx, 0x20
jmp 0x1400083c7
ja 0x1400083b6
test cx, cx
jmp 0x1400083d5
je 0x1400083ff
cmp cx, 0x20
jmp 0x1400083e4
ja 0x1400083ff
movzx ecx, word [rbx + 2]
test dl, 0x33
cmc
add rbx, 2
test cx, cx
jne 0x1400083db
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x5c], 0
jmp 0x140008411
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.14000862f
test byte [rsp + 0x5c], 1
xchg rdi, rdi
mov dil, 0x95
movzx edi, bx
movzx edi, word [rsp + 0x60]
jne 0x14000843e
mov edi, 0xa
test r10w, r9w
sub ecx, ecx
jmp 0x140008445
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
movsx cx, spl
and ecx, 0xac61c02
mov r8, rbx
sbb rcx, 0x5e6a5e04
ror ch, cl
rcr cx, 0x83
mov rcx, rax
cmp dh, ah
test rbx, r13
cmp edi, 0x7eac05b9
xor edx, edx
jmp 0x14000847e
call fcn.140007a25
mov ebx, eax
jmp 0x14000848a
call fcn.1400084a1
mov ecx, ebx
jmp 0x140008496
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14001af50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, qword [0x140049d48]
mov eax, 0xffffffff
test edx, edx
je 0x14001b014
mov r9d, edx
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
mov ecx, eax
and cl, 1
neg cl
sbb edx, edx
shr eax, 1
and edx, 0xedb88320
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
sub r9, 1
jne 0x14001af70
not eax
ret
Function at 0x140021020
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002106a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002106a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002106a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002106a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002106a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002106c
xor al, al
add rsp, 0x28
ret

Function at 0x1400267fc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140026628