joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400341c2
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x1400696b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x1400c7040]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x1400d46f4]
call fcn.14003587e
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.14003521b
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x14006977d
cmp qword [rbp + 8], 0
je 0x140069745
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov eax, dword [rbp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.14003521b
mov dword [rbp + 0x44], eax
jmp 0x140069722
cmp dword [rbp + 0x44], 0
jge 0x1400697a4
cmp qword [rbp + 8], 0
je 0x14006979d
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
jmp 0x1400698df
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1400697ba
xor eax, eax
jmp 0x1400698df
mov dword [rbp + 0x84], 0
jmp 0x1400697d4
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x84], eax
jae 0x1400698ca
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x128
mov rdx, qword [rbp + 0x68]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140034b13
nop
mov rcx, qword [rbp + 0x210]
call fcn.14003429e
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.14003429e
mov qword [rbp + 0x1e0], rax
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1400698b8
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx + rax + 0x18]
mov qword [rbp + 0xe8], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400344bf
mov rax, qword [rbp + 0x1c8]
jmp 0x1400698df
lea rcx, [rbp + 0xa8]
call fcn.1400344bf
nop
jmp 0x1400697c6
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400bac70]
call fcn.140035428
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.140034be5
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x1400342b7
Capabilities:
Write file on windows

Disassembly:
jmp 0x140051730
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400d40fc]
call fcn.14003587e
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140051788
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14005189a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140051833
cmp qword [rbp + 0x28], 0
jle 0x140051833
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400517d1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400356c6
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x140051889
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140051889
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400346f4
Capabilities:
Get common file path

Disassembly:
jmp 0x1400694c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1400c7040]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, [0x1400d46f4]
call fcn.14003587e
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x14006954e
cmp dword [rbp + 0x234], 0x105
jbe 0x1400695a8
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140034c99
mov qword [rbp + 0x408], rax
lea rdx, [0x140034bf9]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [0x1400b354c]
mov rcx, qword [rbp + 0x440]
call fcn.140034839
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x14006961b
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x1400695f5
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x1400695e1
jmp 0x1400695e7
call fcn.1400351a8
nop
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.140034839
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400baa90]
call fcn.140035428
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.140034be5
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x14003483e
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140069340
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x1400d46f4]
call fcn.14003587e
nop
mov rcx, qword [rbp + 0x180]
call fcn.140034afa
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x1400693bc
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x140069464
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.140034942
test eax, eax
jne 0x14006945f
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.140034afa
cmp qword [rbp + 8], rax
jne 0x14006945f
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x140069429
xor eax, eax
jmp 0x140069466
cmp qword [rbp + 0x190], 0
je 0x140069446
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x140069466
jmp 0x1400693b4
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x140034dd4
Capabilities:
Terminate process

Disassembly:
jmp 0x1400980e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140034fdc
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400940c0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400940fd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140035860
add rsp, 0x58
ret
Function at 0x1400350ef
Capabilities:
Parse pe header

Disassembly:
jmp 0x14009afc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14009afe0
xor al, al
jmp 0x14009b061
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14009aff3
xor al, al
jmp 0x14009b061
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009b01d
xor al, al
jmp 0x14009b061
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14009b031
xor al, al
jmp 0x14009b061
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14009b043
xor al, al
jmp 0x14009b061
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14009b05f
xor al, al
jmp 0x14009b061
mov al, 1
add rsp, 0x38
ret
Function at 0x14003559a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140064ca0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400d4492]
call fcn.14003587e
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140064cdd
xor eax, eax
jmp 0x140064d0a
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x140064d06
xor eax, eax
jmp 0x140064d0a
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400356cb
Capabilities:
Get explorer pid

Disassembly:
jmp 0x140057a00
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400c7040]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1400d4247]
call fcn.14003587e
nop
mov dword [rbp + 4], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
call fcn.140035a36
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 4]
cmp dword [rbp + 0x24], eax
jne 0x140057ad5
lea rdx, str.___Pausing_to_allow_for_debugging
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140034c99
mov qword [rbp + 0xf8], rax
lea rdx, [0x140034bf9]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, str.___Press_enter_to_close
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140034c99
mov qword [rbp + 0xf8], rax
lea rdx, [0x140034bf9]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1400b7070]
call fcn.140035428
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.140034be5
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140035810
Capabilities:
Write file on windows

Disassembly:
jmp 0x14004c4b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1400c7040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400d40fc]
call fcn.14003587e
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14004c517
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004c51e
mov al, 1
jmp 0x14004c68e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.140034708
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.140034708
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140035342
movzx eax, al
test eax, eax
je 0x14004c581
xor al, al
jmp 0x14004c68e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14004c5f4
cmp dword [rbp + 0x160], 1
je 0x14004c5ff
cmp dword [rbp + 0x160], 3
je 0x14004c67d
jmp 0x14004c68c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14004c64f
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14004c64f
xor al, al
jmp 0x14004c68e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004c66a
mov dword [rbp + 0x154], 1
jmp 0x14004c674
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14004c68e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14004c68e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400b1d80]
call fcn.140035428
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.140034be5
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140035a36
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14005aba0
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400c7040]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400d4247]
call fcn.14003587e
nop
mov dword [rbp + 0x284], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2a4], eax
xor edx, edx
mov ecx, 2
call fcn.140034ba4
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14005ac0d
jmp 0x14005ac60
mov r8d, 0x238
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140035257
nop
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140034ef1
test eax, eax
jne 0x14005ac39
jmp 0x14005ac60
mov eax, dword [rbp + 0x2a4]
cmp dword [rbp + 0x38], eax
jne 0x14005ac4f
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x284], eax
jmp 0x14005ac60
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400354d7
test eax, eax
jne 0x14005ac39
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14005ac72
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400b6ff0]
call fcn.140035428
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.140034be5
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret

Function at 0x140098790
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140035941
movzx eax, al
test eax, eax
jne 0x1400987b0
mov ecx, 7
call fcn.140035455
nop
mov byte [rsp + 0x20], 0
call fcn.1400354be
mov byte [rsp + 0x21], al
cmp dword [0x1400c8278], 1
jne 0x1400987d4
mov ecx, 7
call fcn.140035455
nop
jmp 0x14009882c
cmp dword [0x1400c8278], 0
jne 0x140098827
mov dword [0x1400c8278], 1
lea rdx, [0x1400a4770]
lea rcx, [0x1400a4440]
call fcn.140034b90
test eax, eax
je 0x140098808
mov eax, 0xff
jmp 0x140098931
lea rdx, [0x1400a4330]
lea rcx, [section..rdata]
call fcn.1400354a0
mov dword [0x1400c8278], 2
jmp 0x14009882c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140035405
call fcn.140035194
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140098889
mov rcx, qword [rsp + 0x30]
call fcn.140034979
movzx eax, al
test eax, eax
je 0x140098889
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400d6020]
nop
call fcn.140035298
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400988bd
mov rcx, qword [rsp + 0x38]
call fcn.140034979
movzx eax, al
test eax, eax
je 0x1400988bd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140035798
nop
call fcn.1400989e0
mov dword [rsp + 0x28], eax
call fcn.1400350ef
movzx eax, al
test eax, eax
jne 0x1400988dc
mov ecx, dword [rsp + 0x28]
call fcn.140034217
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400988eb
call fcn.1400357e8
nop
xor edx, edx
mov cl, 1
call fcn.140034901
mov eax, dword [rsp + 0x28]
jmp 0x140098931
add rsp, 0x68
ret
Function at 0x140b99058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b991df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b99089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b9906f
add dl, dl
jne 0x140b99096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b990f6
xor eax, eax
add dl, dl
jne 0x140b990a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b991ad
add dl, dl
jne 0x140b990b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b990c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b990d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b990dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b990ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b9907e
mov eax, 1
add dl, dl
jne 0x140b99106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b99113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b990fb
sub eax, ebx
mov ebx, 1
jne 0x140b9914c
mov ecx, 1
add dl, dl
jne 0x140b9912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b9913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b99123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b9907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b99168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b99175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b9915d
cmp eax, 0x7d00
jae 0x140b9919b
cmp eax, 0x500
jb 0x140b99196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b9907e
cmp eax, 0x7f
ja 0x140b9919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b9907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b991d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b9907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400030a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
mov rdx, rcx
je 0x1400031e8
movdqa xmm3, xmmword [0x140051fd0]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x140051ff0]
xor eax, eax
mov r9d, 0xf35a
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xf372
jb 0x1400030d0
cmp rax, 0x1e
jae 0x1400031e4
mov r8d, 0xcad
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x1e
jb 0x1400031d0
mov byte [rdx + 0x3e], 0
mov rax, rdx
ret

Function at 0x1400031f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x1400027d0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret