joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093b70
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x78
lea rdx, str.c:_no_fod.exe
lea rcx, str.COMPLUS_FodPath
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140067720
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400982b0
nop
lea r8, str..NET_CLR_Memory
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140098320
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.140097cf0
lea rdx, str..NET_CLR_Memory
lea rcx, [rsp + 0x48]
call fcn.140097d00
test rax, rax
setne byte [0x14018e9a0]
test rax, rax
je 0x140093c40
mov edx, 1
lea rcx, str.psapi.dll
call fcn.140035800
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x14018e9a0], 0
je 0x140093c40
mov rax, qword [0x14018e9a8]
mov qword [0x14018e9b0], rax
lea rcx, [0x14018e9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r8, str..NET_CLR_Memory_.NET_CLR_Exceptions_.NET_CLR_Remoting_.NET_CLR_LocksAndThreads_.NET_CLR_Security_.NET_CLR_Jit_.NET_CLR_Loading_.NET_CLR_Interop_.NET_CLR_Data
xor edx, edx
lea rcx, [0x14018e9e0]
call fcn.140098320
nop
lea rcx, [rsp + 0x20]
call fcn.1400982c0
nop
lea rcx, [rsp + 0x30]
call fcn.140067920
nop
add rsp, 0x78
ret

Function at 0x1400947e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
cmp byte [0x14018e9a0], 0
je 0x140094821
mov rax, qword [0x14018e9a8]
lea rcx, [0x14018e9a8]
mov qword [0x14018e9b0], rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r8, str..NET_CLR_Memory_.NET_CLR_Exceptions_.NET_CLR_Remoting_.NET_CLR_LocksAndThreads_.NET_CLR_Security_.NET_CLR_Jit_.NET_CLR_Loading_.NET_CLR_Interop_.NET_CLR_Data
xor edx, edx
lea rcx, [0x14018e9e0]
add rsp, 0x28
jmp fcn.140098320
add rsp, 0x28
ret
Function at 0x140098ce0
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140098ce0
push rdi
sub rsp, 0x20
cmp byte [0x14018df9c], 0
mov rdi, rcx
je 0x140098d06
mov rcx, qword [0x14018ec78]
call fcn.14008d8b0
xor eax, eax
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018ec78]
mov dl, 1
call fcn.1400840b0
mov ebx, 1
mov edx, ebx
mov rcx, rdi
call fcn.14008e6e0
inc ebx
cmp ebx, 8
jl 0x140098d26
mov rcx, qword [0x14018f248]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor edx, edx
lea rcx, [0x140189740]
call fcn.140095280
mov rcx, qword [0x14018f240]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140098db0
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, r9
mov rbp, r8
mov r14d, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea rcx, [0x1401a9580]
call fcn.140086780
xor r15d, r15d
lea r10, [rdi + 0x68]
test rdi, rdi
mov rbx, rax
mov ecx, r15d
mov edx, dword [rax + 0x10]
cmove r10, r15
test edx, edx
jle 0x140087995
mov rax, qword [rax + 8]
nop dword [rax + rax]
cmp qword [rax], r10
je 0x140087921
inc ecx
add rax, 8
cmp ecx, edx
jl 0x140087910
jmp 0x140087995
test ecx, ecx
js 0x140087995
cmp ecx, edx
jge 0x140087995
lea eax, [rdx - 1]
cmp ecx, eax
je 0x140087992
sub edx, ecx
movsxd rcx, ecx
lea eax, [rdx - 1]
movsxd r8, eax
mov rax, qword [rbx + 8]
shl r8, 3
lea rcx, [rax + rcx*8]
lea r9, [rcx + 8]
test r8, r8
je 0x140087992
test rcx, rcx
jne 0x140087965
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
test r9, r9
jne 0x14008797a
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
movsxd rax, edx
shl rax, 3
cmp rax, r8
jb 0x140087a5f
mov rdx, r9
call fcn.1400e3010
dec dword [rbx + 0x10]
mov edx, dword [rbx + 0x20]
lea r8, [rdi + 0x70]
test rdi, rdi
mov ecx, r15d
cmove r8, r15
test edx, edx
jle 0x140087a2d
mov rax, qword [rbx + 0x18]
cmp qword [rax], r8
je 0x1400879c3
inc ecx
add rax, 8
cmp ecx, edx
jl 0x1400879b2
jmp 0x140087a2d
test ecx, ecx
js 0x140087a2d
cmp ecx, edx
jge 0x140087a2d
lea eax, [rdx - 1]
cmp ecx, eax
je 0x140087a2a
sub edx, ecx
movsxd rcx, ecx
lea eax, [rdx - 1]
movsxd r8, eax
mov rax, qword [rbx + 0x18]
shl r8, 3
lea rcx, [rax + rcx*8]
lea r9, [rcx + 8]
test r8, r8
je 0x140087a2a
test rcx, rcx
jne 0x140087a04
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
test r9, r9
jne 0x140087a16
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
movsxd rax, edx
shl rax, 3
cmp rax, r8
jb 0x140087a5f
mov rdx, r9
call fcn.1400e3010
dec dword [rbx + 0x20]
mov rax, qword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov edx, r14d
mov dword [rax], r15d
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp 0x140098db0
call fcn.1400e864c
mov dword [rax], 0x22
call fcn.1400e8140
mov ecx, 0x80070057
call fcn.140032b30
int3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018ec78]
mov dl, 1
call fcn.1400840b0
mov ebx, 1
nop dword [rax + rax]
mov edx, ebx
mov rcx, rdi
call fcn.14008e6e0
inc ebx
cmp ebx, 8
jl 0x140098de0
mov rcx, qword [0x14018f248]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor edx, edx
lea rcx, [0x140189740]
call fcn.140095280
mov rcx, qword [0x14018f240]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400a2620
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x30
xor ebp, ebp
mov qword [rsp + 0x50], rsi
mov rsi, rcx
mov dword [rsp + 0x48], ebp
lea rdx, [0x14018e1ce]
lea rcx, str.srv
lea r8d, [rbp + 4]
call fcn.1400e8bbc
test eax, eax
jne 0x1400a26dc
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x48]
lea rcx, [0x14018dfc4]
mov qword [rsp + 0x58], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.1400e8270
mov r9, rax
lea rcx, [0x14018dfc4]
mov r8d, ebx
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x1400a26cf
cmp dword [rdi + 0x30], 0x60000
jae 0x1400a26cf
mov rcx, qword [0x1401896c0]
lea r9, [0x14005f720]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.SYMBOLCONFIGWARNING
test rsi, rsi
je 0x1400a26c9
lea rdx, [0x140135f50]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, rdi
call fcn.1400e825c
mov rdi, qword [rsp + 0x58]
cmp byte [0x14018e1cc], bpl
mov rsi, qword [rsp + 0x50]
jne 0x1400a2734
cmp qword [0x1401940a8], rbp
je 0x1400a26fc
cmp word [0x14018e1ce], bp
jne 0x1400a2734
mov rcx, qword [0x1401896c0]
lea r9, [0x14005f720]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.SYMBOLCONFIGWARNING
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [0x14018ec78]
mov dl, 1
mov byte [0x14018e1cc], 1
call fcn.1400840b0
add rsp, 0x30
pop rbp
ret
Function at 0x1400a49a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edi, edi
movzx ebp, ax
cmp ax, 1
jbe 0x1400a49e9
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
movzx ebx, di
nop dword [rax]
mov sil, 1
cmp bx, bp
jae 0x1400a4a71
cmp bp, 1
jbe 0x1400a4a36
cmp edi, dword [0x14018ed70]
jge 0x1400a4a77
xor eax, eax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsxd rcx, edi
xor r9d, r9d
mov esi, eax
lea r8d, [rax + rax*2]
lea rdx, [rcx + rcx*2]
shl r8d, 4
shl rdx, 4
lea ecx, [r9 + 8]
add rdx, r14
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400a4a6e
add edi, esi
inc bx
jmp 0x1400a49f0
xor sil, sil
cmp bp, 1
jbe 0x1400a4a8e
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a70a0
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
sub rsp, 0x458
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rdx, [0x140173248]
lea rcx, str.PROCEXP152
call fcn.140067fa0
test eax, eax
jne 0x1400a71f2
mov edx, 0x104
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r9, str.PROCEXP152.SYS
lea r8, [rsp + 0x230]
lea rdx, str._sDrivers_s
lea rcx, [rsp + 0x20]
call fcn.1400358d0
lea rdx, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_DllRegisterServer
call fcn.140067c10
test al, al
jne 0x1400a71ab
lea r8, str.PROCEXP152.SYS
lea rdx, str.__TEMP___s
lea rcx, [rsp + 0x230]
call fcn.1400358d0
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_DllRegisterServer
call fcn.140067c10
test al, al
jne 0x1400a71ab
lea rdx, [rsp + 0x230]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r9, str.PROCEXP152.SYS
lea r8, [rsp + 0x230]
lea rdx, [0x140124790]
lea rcx, [rsp + 0x20]
call fcn.1400358d0
lea rdx, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_DllRegisterServer
call fcn.140067c10
test al, al
je 0x1400a71d2
lea r8, [0x140173248]
lea rdx, [rsp + 0x20]
lea rcx, str.PROCEXP152
call fcn.140067cc0
lea rcx, [rsp + 0x20]
test eax, eax
jne 0x1400a71ec
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x458
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x458
ret
Function at 0x1400ac000
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], edx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x40], r8
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x1400a89d0]
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1400f7ce8
mov edx, 0x1388
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
cmp eax, 0x102
jne 0x1400ac075
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x20
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
add rsp, 0x50
pop rbx
ret

Function at 0x1400ac340
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 0xa
jb 0x1400ac375
jne 0x1400ac36e
movzx ecx, ax
shr cx, 8
test cl, cl
jne 0x1400ac36e
shr eax, 0x10
mov ecx, 0x4a61
cmp ax, cx
setae al
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400cd630
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0xe8
xorps xmm0, xmm0
mov dword [rax - 0x78], 0x68
lea rcx, [rax - 0x78]
movups xmmword [rax - 0x70], xmm0
movups xmmword [rax - 0x60], xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
movups xmmword [rax - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400cd6cb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
add rsp, 0xe8
ret
xor eax, eax
add rsp, 0xe8
ret
Function at 0x1400e20dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e2126
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e2126
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e2126
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e2126
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e2126
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400e2128
xor al, al
add rsp, 0x28
ret

Function at 0x1400f7c20
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov edi, edx
test rcx, rcx
jne 0x1400f7c4a
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
call fcn.1400e8140
or rax, 0xffffffffffffffff
jmp 0x1400f7cda
mov rdx, r8
call fcn.1400f7bbc
mov rbx, rax
test rax, rax
je 0x1400f7cd3
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x1400f7ae8]
mov rdx, rdi
mov dword [rsp + 0x20], 4
mov r9, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400f7ca0
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400f7cd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e85c0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400f7cbc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400f7ccb
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140103f68
or rdi, 0xffffffffffffffff
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f7ce8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400f7d1f
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
call fcn.1400e8140
xor eax, eax
jmp 0x1400f7dad
mov rdx, r9
mov rcx, r8
call fcn.1400f7bbc
mov rbx, rax
test rax, rax
je 0x1400f7daa
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400f7a78]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400f7d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e85c0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400f7d7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400f7d8d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140103f68
jmp 0x1400f7daa
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400f7da7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fc45c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400fc2c7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400fc2c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400fc2c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400fc2c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400fc2c7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400fc2c7
cmp dword [rcx + 0xf8], 0
je 0x1400fc2c7
mov ecx, ebx
call fcn.1400fc378
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400fc154
nop
cmp dword [rbp + 0x20], 0
je 0x1400fc315
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400fc320
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400fc258

Function at 0x140105d20
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140105d36
mov al, 1
jmp 0x140105d96
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140105d47
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140105d94
mov ecx, dword [rcx + 0x18]
nop
call fcn.14010e1e8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140105d94
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140105d94
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140105d94
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140105d96
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14002caf4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14002cb2c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x14002cb34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14002cb2e

Function at 0x14002cd54
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140121748]
test rax, rax
je 0x14002cd84
call rax
mov al, 1
jmp 0x14002cf01
xor eax, eax
mov dword [rbp - 0x30], 0x5b792cc7
mov dword [rbp - 0x2c], 0xaafed739
xor r9d, r9d
mov word [rbp - 0x28], 0x9e6f
movabs rsi, 0x1647a34f3
mov byte [rbp - 0x26], al
movabs rdi, 0x8080808080808081
lea r11d, [rax + 0xa]
movabs r10, 0xdecc61188
movabs r14, 0x1647a34f4
mov cl, r9b
mov rax, rdi
mul r10
and cl, 7
mov r8, rsi
shl cl, 3
shr r8, cl
mov rcx, r10
shr rdx, 7
add r10, r14
imul rax, rdx, 0xff
sub rcx, rax
mov rax, rdi
mul r11
xor r8b, cl
mov rcx, r11
shr rdx, 7
add r11, 0xa
imul rax, rdx, 0xff
sub rcx, rax
movabs rax, 0x1bd98c2310
xor r8b, cl
xor r8b, r9b
xor byte [rbp + r9 - 0x30], r8b
inc r9
cmp r10, rax
jb 0x14002cdcc
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x14002ceff
movdqa xmm0, xmmword [0x1400fb170]
xor r10d, r10d
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd3fb6888
movabs r11, 0x1d3e065804
mov word [rbp - 0xc], 0xb8
lea ebx, [r10 + 0x15]
mov cl, r10b
mov rax, rdi
mul r11
and cl, 7
mov r8, rsi
shl cl, 3
shr r8, cl
mov rcx, r11
shr rdx, 7
add r11, r14
imul rax, rdx, 0xff
sub rcx, rax
mov rax, rdi
xor r8b, cl
mov rcx, rbx
mul rbx
add rbx, 0x15
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
movabs rax, 0x3a7c0cb008
xor r8b, cl
xor r8b, byte [rbp + r10 - 0x20]
xor r8b, r10b
mov byte [rbp + r10 - 0x20], r8b
inc r10
cmp r11, rax
jb 0x14002ce75
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xb], 0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140121748], rax
test rax, rax
jne 0x14002cd7b
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14002cf1c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140105700]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov esi, ecx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002cf97
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x14002cf84
cmp dword [rsp + 0x28], esi
je 0x14002cf8a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14002cf70
jmp 0x14002cf8e
mov ebx, dword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14009bb20
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14002d02c
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140105700]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.1400c5c00
xor eax, eax
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14002d108
mov edi, dword [rsp + 0x60]
xor ebx, ebx
mov rdx, rdi
lea rcx, [0x14002cfc0]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x140121740], 0
jne 0x14002d0f0
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3a98
jl 0x14002d0c2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14009bb20
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret