joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001679
Capabilities:
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
lea rax, [rcx + 1]
cmp rax, 2
jb 0x180001697
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.18000115e
mov rcx, rsi
call fcn.18000809e
mov ebx, eax
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x1800016ca
mov rcx, qword [rsp + 0x48]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
test bl, bl
je 0x1800017cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.18000123e
cmp qword [rsi + 0x18], 8
jb 0x1800016eb
mov rsi, qword [rsp + 0x28]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x48]
mov rdx, rsi
mov r8d, 0x22
mov r9d, 0x40
call fcn.180002254
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
imul rcx, rax, 0x7249ae75
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x34
add ecx, edx
imul ecx, ecx, 0x23d6df
neg ecx
add eax, ecx
add eax, 0x1649d
movsxd r14, eax
mov rcx, r14
call fcn.18000866c
mov rsi, rax
test r14d, r14d
je 0x180001789
cmp r14, 2
mov ebx, 1
cmovae rbx, r14
xor edi, edi
mov r15, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call r15
cdqe
imul rcx, rax, 0xffffffff80808081
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
shr ecx, 7
add ecx, edx
add ecx, eax
mov byte [rsi + rdi], cl
inc rdi
cmp rbx, rdi
jne 0x180001760
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
mov rcx, rbx
call fcn.180002362
mov rcx, rsi
call fcn.180008638
cmp qword [rsp + 0x40], 8
jb 0x1800017d0
mov rcx, qword [rsp + 0x28]
jmp 0x1800017d5
xor esi, esi
jmp 0x180001845
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
test eax, eax
sete sil
lea rdi, [rsp + 0xf0]
mov rax, qword [rdi - 0xa8]
movsxd rax, dword [rax + 4]
lea rcx, [0x1800127f0]
mov qword [rsp + rax + 0x48], rcx
mov rax, qword [rdi - 0xa8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x44], ecx
lea rcx, [rsp + 0x50]
call fcn.180005060
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x180001845
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800026f2
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm6
test rdx, rdx
je 0x180002948
mov r12, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea rbp, [rsp + 0x70]
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
xor ebx, ebx
lea rcx, [rsp + 0xb8]
mov r8d, 0x108
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x40
mov rcx, rsi
mov rdx, rbp
mov r8, rdi
call fcn.18000239f
test al, al
je 0x18000294a
movzx eax, word [rsp + 0x70]
cmp eax, 0x5a4d
jne 0x18000294a
movsxd r8, dword [rsp + 0xac]
add r8, rdi
lea rdx, [rsp + 0xb8]
mov r9d, 0x108
mov rcx, rsi
call fcn.18000239f
xor ebx, ebx
test al, al
je 0x18000294a
cmp dword [rsp + 0xb8], 0x4550
jne 0x18000294a
mov r13d, dword [rsp + 0x140]
xor ebx, ebx
test r13, r13
je 0x18000294a
mov ebp, dword [rsp + 0x144]
test ebp, ebp
je 0x18000294a
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
lea r8, [rdi + r13]
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x38], r8
mov r9, rbp
call fcn.18000239f
test al, al
je 0x180002933
mov qword [rsp + 0x28], rbp
cmp dword [r15 + 0x18], 0
je 0x180002933
mov rbp, r15
sub rbp, r13
mov eax, dword [r15 + 0x1c]
mov r14d, dword [r15 + 0x20]
add r14, rbp
mov ecx, dword [r15 + 0x24]
add rcx, rbp
mov qword [rsp + 0x40], rcx
add rax, rbp
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
add qword [rsp + 0x28], rax
xor r13d, r13d
xorps xmm6, xmm6
mov qword [rsp + 0x30], rbp
mov esi, dword [r14 + r13*4]
add rsi, rbp
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
movups xmmword [rax], xmm6
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov r8, rax
call fcn.1800049e6
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x18000289a
mov rdx, qword [r12]
cmp qword [rsp + 0x68], 0x10
lea rcx, [rsp + 0x50]
jb 0x1800028ac
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov esi, eax
test eax, eax
jne 0x180002907
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + r13*2]
mov rcx, qword [rsp + 0x48]
mov ebp, dword [rcx + rax*4]
cmp rbp, 0x1001
jae 0x1800028d7
xor ebx, ebx
jmp 0x180002902
add rbp, rdi
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp rbp, qword [rsp + 0x28]
mov ebx, 0
cmova rbx, rbp
cmp rbp, qword [rsp + 0x38]
cmovb rbx, rbp
mov rbp, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000291f
mov rcx, qword [rsp + 0x50]
inc rdx
call fcn.180004cf8
test esi, esi
je 0x18000294a
inc r13
mov eax, dword [r15 + 0x18]
cmp r13, rax
jb 0x18000285b
xor ebx, ebx
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x18000294a
xor ebx, ebx
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180005bca
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov al, 1
cmp qword [rcx + 0x68], 0
je 0x180005c71
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x180005c71
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180005c67
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x180005c6b
cmp eax, 1
je 0x180005c35
test eax, eax
jne 0x180005c67
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x180005c5e
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180005c67
cmp byte [rsi + 0x71], 0
sete al
jmp 0x180005c71
xor eax, eax
jmp 0x180005c71
mov byte [rsi + 0x71], 0
mov al, 1
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800070fb
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1800071e8
mov rdi, rdx
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1800071e8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov ebx, dword [rdi + rax + 0xb0]
test rbx, rbx
je 0x1800071e8
add rbx, rdi
mov r12d, dword [rdi + rax + 0xb4]
add r12, rbx
cmp rbx, r12
jae 0x180007209
movabs r13, 0x1fffffff8
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x38]
cmp dword [rbx + 4], 0
je 0x1800071dc
mov eax, dword [rbx]
add rax, rdi
mov qword [rsp + 0x38], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x40], rax
mov eax, dword [rbx + 4]
add rax, r13
shr rax, 1
mov dword [rsp + 0x48], eax
mov rdx, qword [rsp + 0x28]
cmp rdx, qword [rsp + 0x30]
je 0x1800071c6
mov rax, qword [rsp + 0x48]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
add qword [rsp + 0x28], 0x18
jmp 0x1800071d1
mov rcx, r14
mov r8, r15
call fcn.180007470
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r12
jb 0x18000717b
mov rax, qword [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x18000720b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
jmp 0x1800071f6
Function at 0x180007214
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov rsi, rcx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x18000740e
mov rdi, rdx
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x18000740e
mov r15d, dword [rdi + rax + 0x90]
test r15, r15
je 0x18000740e
xorps xmm8, xmm8
movaps xmmword [rsp + 0x50], xmm8
mov qword [rsp + 0x60], 0
cmp dword [r15 + rdi + 0x10], 0
je 0x18000744c
mov qword [rsp + 0x68], rsi
lea r12, [r15 + rdi]
add r12, 0x10
add r15, rdi
lea r13, [rsp + 0x90]
movaps xmm7, xmmword [0x180012780]
xorps xmm6, xmm6
lea rsi, [rsp + 0x28]
xor eax, eax
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x80], xmm7
mov byte [rsp + 0x70], 0
mov qword [r13 + 0x10], rax
movups xmmword [r13], xmm6
mov ebx, dword [r15 + 0xc]
add rbx, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
movups xmmword [rax], xmm6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rsi
mov rdx, rbx
mov r8, rax
call fcn.1800049e6
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x18000731e
mov rcx, qword [rsp + 0x70]
inc rdx
call fcn.180004cf8
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov r14d, dword [r15]
cmp qword [r14 + rdi], 0
je 0x1800073b8
add r14, rdi
mov ebp, dword [r12]
add rbp, rdi
add r14, 8
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x38], xmm7
mov byte [rsp + 0x28], 0
mov rax, qword [r14 - 8]
lea rbx, [rax + rdi]
add rbx, 2
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rsi
mov rdx, rbx
mov r8, rax
call fcn.180007590
mov qword [rsp + 0x48], rbp
mov rcx, r13
mov rdx, rsi
call fcn.180007692
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800073aa
mov rcx, qword [rsp + 0x28]
inc rdx
call fcn.180004cf8
add rbp, 8
cmp qword [r14], 0
lea r14, [r14 + 8]
jne 0x18000734d
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x70]
call fcn.180007996
mov rcx, r13
call fcn.180007048
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x1800073ea
mov rcx, qword [rsp + 0x70]
inc rdx
call fcn.180004cf8
lea r12, [r15 + 0x24]
cmp dword [r15 + 0x24], 0
lea r15, [r15 + 0x14]
jne 0x1800072bc
mov rax, qword [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
jmp 0x180007451
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm8
mov qword [rcx + 0x10], 0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
call fcn.180006fba
jmp 0x18000741c
Function at 0x180007dfc
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rbx, rcx
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.18000115e
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.180008035
lea rdx, str.___
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call fcn.180008035
cmp qword [rdi + 0x18], 8
jb 0x180007e59
mov rdi, qword [rsp + 0x80]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x180007eb7
mov eax, dword [rsp + 0x50]
add eax, eax
cmp qword [rsp + 0x58], 8
jb 0x180007e85
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r8, str.ImagePath
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x180007f29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x180007ed6
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
mov rax, qword [rsp + 0x98]
cmp rax, 8
jb 0x180007ef9
mov rcx, qword [rsp + 0x80]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
mov rax, qword [rsp + 0xb8]
cmp rax, 8
jb 0x180007f1c
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
mov eax, esi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
lea rax, [0x1800128a4]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, str.Type
xor esi, esi
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x180007eb9
lea rcx, [0x180012dd7]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180007eb7
mov rsi, rax
lea rdx, str.RtlAdjustPrivilege
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call rdi
mov rdi, rax
xor esi, esi
lea r9, [rsp + 0x37]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rbx
test eax, eax
js 0x180007eb9
lea rdx, [0x180012fbc]
lea rsi, [rsp + 0x60]
lea r8, [rsp + 0xa0]
mov rcx, rsi
call fcn.180008035
cmp qword [rsi + 0x18], 8
jb 0x180007fea
mov rsi, qword [rsp + 0x60]
lea rbx, [rsp + 0xc0]
mov rcx, rbx
mov rdx, rsi
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
call rdi
cmp eax, 0xc000010e
sete sil
test eax, eax
setns bl
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x18000802d
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
or sil, bl
jmp 0x180007eb9
Function at 0x18000809e
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rdi, rcx
lea rcx, [0x180012dd7]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180008138
mov rsi, rax
lea rdx, [0x180012fbc]
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov r8, rdi
call fcn.180008035
cmp qword [rbx + 0x18], 8
jb 0x1800080e3
mov rbx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8, rdi
call fcn.180008035
cmp qword [rbx + 0x18], 8
jb 0x180008113
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000002
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x18000813f
mov sil, 1
cmp eax, 2
je 0x18000818a
xor esi, esi
jmp 0x18000818a
xor esi, esi
jmp 0x1800081c4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x50]
call rax
mov esi, eax
cmp qword [rsp + 0x48], 8
jb 0x180008172
mov rdx, qword [rsp + 0x30]
jmp 0x180008177
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or esi, eax
sete sil
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x1800081a7
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x1800081c4
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + rax]
add rdx, 2
call fcn.180004cf8
mov eax, esi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x1800081d4
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x105
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, 0xfffffefa
add eax, ecx
cmp eax, ecx
ja 0x18000822b
mov qword [rsi], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
lea rdx, [0x1800130b2]
mov rcx, rsi
xor r8d, r8d
jmp 0x180008268
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp word [rsp + rax*2 + 0x1e], 0x5c
jne 0x180008244
mov word [rsp + rax*2 + 0x1e], 0
mov qword [rsi], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.180004d2e
mov rax, rsi
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x180008330
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov r15, rcx
lea r9, [rsp + 0x2c]
mov dword [r9], 0
xor r13d, r13d
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1800084b0
xor edi, edi
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rbx, [rsp + 0x2c]
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
test rdi, rdi
je 0x180008398
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call rsi
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rbp
mov rdi, rax
mov r8d, dword [rsp + 0x2c]
mov ecx, 0xb
mov rdx, rax
mov r9, rbx
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x180008386
test eax, eax
js 0x180008492
test rdi, rdi
je 0x1800084ad
cmp dword [rdi], 0
je 0x180008497
mov rbx, rdi
add rbx, 0x30
xor r12d, r12d
xorps xmm6, xmm6
lea r14, [rsp + 0x30]
movzx ebp, word [rbx - 2]
add rbp, rbx
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
movups xmmword [rax], xmm6
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, r14
mov rdx, rbp
mov r8, rax
call fcn.1800049e6
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x180008432
mov rdx, qword [r15]
cmp qword [rsp + 0x48], 0x10
mov rcx, r14
jb 0x180008442
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebp, eax
test eax, eax
jne 0x18000845f
mov r13, qword [rbx - 0x18]
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call rsi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180008477
mov rcx, qword [rsp + 0x30]
inc rdx
call fcn.180004cf8
test ebp, ebp
je 0x1800084b0
inc r12
mov eax, dword [rdi]
add rbx, 0x128
cmp r12, rax
jb 0x1800083f7
jmp 0x180008497
test rdi, rdi
je 0x1800084ad
xor r13d, r13d
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800084b0
xor r13d, r13d
mov rax, r13
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180008526
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rsi, rax
movsxd rax, dword [r12 + 0x3c]
movzx ebx, word [rax + r12 + 6]
test rbx, rbx
je 0x1800085b1
movzx ecx, word [rax + r12 + 0x14]
add rax, r12
lea rdi, [rcx + rax]
add rdi, 0x18
xor r15d, r15d
mov rcx, rdi
mov rdx, r13
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180008589
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rsi, rax
je 0x180008594
add rdi, 0x28
dec rbx
jne 0x18000856a
jmp 0x1800085b4
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1800085b1
test r14, r14
je 0x1800085a9
mov eax, dword [rdi + 8]
mov dword [r14], eax
mov eax, dword [rdi + 0xc]
mov r15d, eax
add r15, r12
jmp 0x1800085b4
xor r15d, r15d
mov rax, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002b60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002bbd
lea rbx, [0x14003f980]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002ba4
cmp r10, 2
jb 0x140002ba4
cmp byte [r9], r8b
jne 0x140002ba4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002b80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002bff
lea rbx, [0x14003f980]
cmp r8b, 0x23
jne 0x140002be3
cmp byte [r9], r8b
jne 0x140002be3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002bd0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002d40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002d5a
mov qword [r8], 0
lea rdx, [0x14003f4f0]
call fcn.140002c10
mov rbx, rax
test rax, rax
jne 0x140002d7a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002e51
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002e51
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002e51
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002e51
cmp rdi, 0xffffffffffffffff
je 0x140002e51
mov rax, qword [0x14004b700]
test rax, rax
je 0x140002dee
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002e51
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002e3e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004b700]
test rax, rax
je 0x140002e33
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002e5a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002e4c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002e5c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400063e0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14003f980]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x140006476
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140019e60
mov eax, ebx
add rsp, 0x20
pop rbx
ret