joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1804173c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
jmp 0x1804173ec
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x20], eax
jge 0x1804174f4
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x104]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x104], eax
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x104]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x108]
add ecx, eax
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x108], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov r9d, dword [rcx + 0x108]
mov rcx, qword [rsp + 0x40]
mov r8d, dword [rcx + 0x104]
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.1804172d0
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x104]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x40]
movsxd rcx, dword [rcx + 0x108]
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rdx + rcx]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rdx + rcx]
xor eax, ecx
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
jmp 0x1804173e2
add rsp, 0x38
ret
Function at 0x14000107c
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400010c3
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400010c3
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov rbx, rax
test rax, rax
je 0x1400010c3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
jmp 0x1400010c5
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140001168
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
test rcx, rcx
jne 0x14000118d
xor eax, eax
jmp 0x140001200
mov rbx, qword [rcx + 0x28]
test rbx, rbx
jne 0x1400011a1
call fcn.1400012b0
mov ecx, eax
mov rbx, qword [rcx + rdi]
mov rax, rbx
shr rax, 0x38
cmp al, 0x40
jne 0x1400011fd
cmp byte [0x140003058], 0
jne 0x1400011f1
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, cr3
lea rcx, [rsp + 0x20]
mov qword [0x140003050], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [0x140003058], 1
mov rax, qword [0x140003050]
test rax, rax
jne 0x140001200
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001850
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140001218
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, 0x20
lea r9, [r11 - 0x38]
lea rdx, [r11 - 0x30]
mov dword [r11 - 0x38], r8d
mov edi, ecx
call fcn.140001877
mov edx, dword [rsp + 0x20]
mov ecx, 0x400
mov r8d, 0xb1127cfc
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x14000126d
xor eax, eax
jmp 0x140001295
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbx
mov ecx, edi
call fcn.140001877
test eax, eax
je 0x140001292
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140001269
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001850
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140001488
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000152a
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000152a
call fcn.140001168
mov rdi, rax
test rax, rax
je 0x14000152a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call fcn.14000157c
test rax, rax
je 0x14000152a
and qword [rsp + 0x48], 0
mov rcx, rax
and ecx, 0xfff
mov r8d, 0x1000
sub r8, rcx
mov r9d, 1
mov rcx, qword [rbx + 0x20]
mov rdx, rax
cmp r8, rcx
cmovae r8, rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x14000152f
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400017a4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000182b
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000182b
call fcn.140001168
mov rcx, qword [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
call fcn.14000157c
test rax, rax
je 0x14000182b
mov rdx, qword [rdi + 0x18]
lea r9, [rsp + 0x38]
mov rcx, rax
mov r8d, 0x1000
and ecx, 0xfff
sub r8, rcx
mov rcx, qword [rdi + 0x20]
cmp r8, rcx
cmovae r8, rcx
mov rcx, rax
call fcn.140001730
xor eax, eax
jmp 0x140001830
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x141252a94
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141252a9e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141252ac7
pop rbp
sub rbp, 0x33
sub rbp, 0x1252a94
sub rsp, 0x20
in al, dx
and byte [rax], al
add byte [rax], al
jmp 0x141252ae6
mov rax, 0x1252a94
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc64ad433
invalid
xor byte [rax], dl
inc rax
dec rcx
jne 0x141252b05
jmp 0x141252b1c
jnp 0x141252ad8
fidivr dword [rax + 0x33330fba]
xor edi, dword [rbx - 0x4e]
cmp esi, dword [rdx]
xor esi, dword [rbx]
jnp 0x141252b60
fidivr dword [rbx - 0xc]
xor al, 0x33
xor esi, dword [rbx]
jnp 0x141252b2c
int1
sbb esi, dword [rbx]
xor esi, dword [rbx]
jnp 0x141252b03
sar dword [rbx + 0x32], 1
mov eax, 0x33333fb2
xor edi, dword [rbx + 0x32]
invalid
xor esi, dword [rbx]
jnp 0x141252b96
fidivr dword [rbx - 0x77]
or eax, 0x33ca9286
xor esi, dword [rbx]
xor ebx, ebx
xor esi, dword ss:[rbx]
xor ebx, edx
and eax, 0xf2333333
invalid
outsb dx, byte [rsi]
invalid
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.10139000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x140002820
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov byte [rsp + 0x30], sil
mov qword [r11 - 0x44], rsi
mov dword [rsp + 0x7c], 0x67452301
mov dword [r11 - 0x38], 0xefcdab89
mov dword [r11 - 0x34], 0x98badcfe
mov dword [r11 - 0x30], 0x10325476
cmp qword [rdx + 0x18], 0x10
jb 0x14000288a
mov rdx, qword [rdx]
mov r8d, dword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.140002320
lea rcx, [rsp + 0x30]
call fcn.1400023f0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140002660
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400028e6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400028e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000291d
mov rcx, r8
call fcn.140004f48
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140004d70
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140003500
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140003590
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rbx + 0x10]
mov ecx, 2
inc rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140003585
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp qword [rbx + 0x18], 0x10
mov rcx, rax
jb 0x140003550
mov rbx, qword [rbx]
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140003560
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x14000587c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400058c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400058c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400058c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400058c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400058c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400058c8
xor al, al
add rsp, 0x28
ret
Function at 0x180001744
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
xor eax, eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
call qword [0x180011010]
mov qword [rsp + 0x40], rax
lea rcx, [0x18001fa38]
call qword [0x180011018]
mov qword [rsp + 0x58], rax
mov r9d, 0x18
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [0x180011038]
nop
mov r12, qword [rsp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
lea rcx, [0x18001fa48]
call qword [0x180011020]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, qword [rsp + 0x48]
call qword [0x180011068]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, qword [rsp + 0x50]
call qword [0x180011070]
mov r13, rax
mov qword [rsp + 0x80], rax
movsxd rbx, dword [r12 + 0x3c]
add rbx, r12
mov qword [rsp + 0x88], rbx
movzx edi, r15w
cmp di, word [rbx + 6]
jae 0x180001902
movzx eax, di
lea rdx, [rax + rax*4]
movzx ecx, word [rbx + 0x14]
add rcx, rbx
lea r15, [rcx + rdx*8]
lea rdx, [0x18001fa68]
lea rcx, [r15 + 0x18]
call fcn.18000f8e0
test eax, eax
jne 0x1800018fa
mov esi, dword [r15 + 0x24]
lea rsi, [rsi + r12]
mov r14d, dword [r15 + 0x20]
mov dword [rsp + 0xc0], eax
lea r9, [rsp + 0xc0]
lea r8d, [rax + 0x40]
mov edx, r14d
mov rcx, rsi
call qword [0x180011008]
nop
mov edx, dword [r15 + 0x24]
add rdx, r13
test r14, r14
je 0x1800018dd
test rsi, rsi
je 0x1800018cc
mov r8, r14
mov rcx, rsi
test rdx, rdx
je 0x1800018c7
call fcn.180005ef0
jmp 0x1800018dd
call fcn.1800039d0
call fcn.180006834
mov dword [rax], 0x16
call fcn.1800066a0
nop
lea r9, [rsp + 0xc0]
mov r8d, dword [rsp + 0xc0]
mov rdx, r14
mov rcx, rsi
call qword [0x180011008]
nop
inc di
jmp 0x180001844
mov rcx, qword [rsp + 0x40]
call qword [0x180011030]
mov rcx, qword [rsp + 0x48]
call qword [0x180011030]
mov rcx, qword [rsp + 0x50]
call qword [0x180011030]
mov rcx, qword [rsp + 0x58]
call qword [0x180011060]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800020ac
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rdi, rcx
mov ecx, 0x18
call fcn.18000252c
mov rbx, rax
mov esi, 1
test rax, rax
je 0x180002102
and qword [rax + 8], 0
lea rcx, [0x18001fb38]
mov dword [rax + 0x10], esi
call qword [0x1800112d0]
mov qword [rbx], rax
test rax, rax
je 0x18000225f
jmp 0x180002104
xor ebx, ebx
test rbx, rbx
je 0x18000225f
call fcn.1800016ac
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000213a
movsxd rdx, dword [rax + 0x3c]
lea rcx, [rdx - 0x40]
cmp rcx, 0x3bf
ja 0x18000213a
cmp dword [rax + rdx], 0x4550
jne 0x18000213a
mov rax, qword [rbp + 0x6f]
mov ecx, 0x14
mov qword [rbp - 9], rax
mov word [rbp - 0x11], cx
lea rcx, [rbp + 0x27]
call qword [0x180011290]
lea rcx, [rbp - 0x29]
call qword [0x180011290]
and dword [rbp + 0x6f], 0
mov ecx, 0xc
mov r8d, esi
xor edx, edx
call qword [0x1800112c0]
mov rcx, rax
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0x6f]
mov rsi, rax
call qword [0x1800112a8]
movups xmm0, xmmword [rbp - 0x29]
mov rcx, qword [rdi]
movsd xmm1, qword [rbp - 0x19]
movaps xmmword [rbp + 7], xmm0
movsd qword [rbp + 0x17], xmm1
test rcx, rcx
je 0x180002254
mov rax, qword [rcx]
lea rdx, [rbp + 0x27]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
lea rdx, [rbp + 7]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdx
mov r8d, 0x118
mov rdx, qword [rbx]
call qword [rax + 0x1c8]
mov rcx, rsi
call qword [0x180011288]
lea rcx, [rbp - 0x29]
call qword [0x1800112c8]
lea rcx, [rbp + 0x27]
call qword [0x1800112c8]
lea rcx, [rbp - 0x11]
call qword [0x1800112c8]
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180002233
mov rcx, qword [rbx]
test rcx, rcx
je 0x180002213
call qword [0x1800112a0]
and qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002226
call fcn.18000294c
and qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.18000294c
mov rcx, qword [rdi]
test rcx, rcx
je 0x180002241
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004003
call fcn.180003240
int3
mov ecx, 0x8007000e
call fcn.180003240
int3
Function at 0x140001340
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov r8, rdi
sub r8, rdx
nop dword [rax + rax]
movzx ecx, word [rdx]
movzx eax, word [rdx + r8]
sub ecx, eax
jne 0x1400013a4
add rdx, 2
test eax, eax
jne 0x140001390
test ecx, ecx
je 0x1400013cb
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001380
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x1400013e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001421
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x140001494
cmp dword [rsi], 0x905a4d
jne 0x140001494
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x140001630
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
movsxd rdx, ecx
lea rcx, [0x1400015e0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [0x1400081b8]
add rsp, 0x28
ret
Function at 0x140005acc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005b16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005b16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005b16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005b16
cmp dword [rcx + 0x84], 0xe
jbe 0x140005b16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005b18
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x140
mov ebx, 2
lea rcx, [rsp + 0x20]
mov eax, ebx
lea rdx, [0x140002250]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140001020
mov eax, dword [rdx + 0x10]
mov r8d, 0x1000
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, byte [rdx + 0x14]
mov edx, 0x115
mov byte [rcx + 0x14], al
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
lea rcx, [rsp + 0x20]
mov rdx, rax
nop dword [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x1400010b0
mov eax, dword [rcx + 0x10]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
movzx eax, byte [rcx + 0x14]
mov byte [rdx + 0x14], al
call r8
xor eax, eax
add rsp, 0x140
pop rbx
ret

Function at 0x140001a1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a66
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a68
xor al, al
add rsp, 0x28
ret
Function at 0x140001140
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
mov r8d, 0x20
call fcn.140026f80
test rax, rax
je 0x1400011b0
mov qword [rbp + 0x18], rax
mov rcx, rax
mov qword [rbp + 0x10], rdx
call qword [rdx]
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140001201
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.1400045a0
jmp 0x140001201
movaps xmm0, xmmword [rbp - 0x10]
movaps xmm1, xmmword [rbp]
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x60], xmm0
lea r8, [0x14004aff8]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x60]
mov r9d, 8
call fcn.140026d70
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
mov qword [rdi + 0x28], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdi + 0x18], xmm0
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdi + 8], xmm0
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
mov qword [rdi + 0x40], rbx
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.1400247e0