joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002320
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002365
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x14000235c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002367
add rax, 0x28
cmp rax, r9
jne 0x140002348
xor eax, eax
ret

Function at 0x140002370
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140002400
mov rdx, qword [0x1400043f0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x1400023ee
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400023ee
cmp word [rax + 0x18], 0x20b
jne 0x1400023ee
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140002400
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x1400023d9
add r12, 0x28
cmp r12, rsi
je 0x140002400
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x1400023d0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140002410
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002430
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002438
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002430
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140002485
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000247c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002430
add rax, 0x28
cmp rax, r9
jne 0x140002468
xor eax, eax
ret

Function at 0x140002490
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043f0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400024b0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400024b8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400024b0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400043f0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400024f0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400024f8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400024f0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002538
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000252f
test rcx, rcx
je 0x1400024f0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002520
xor eax, eax
ret
Function at 0x140002540
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043f0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002560
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002568
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002580
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400025a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400025a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025a0
sub rcx, rdx
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400025a0
lea eax, [r8 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop dword [rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400025ec
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002600
add rdx, 0x28
cmp rdx, r9
jne 0x1400025d8
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002610
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400043f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002632
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002640
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002632
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002632
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002632
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000268d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400026a0
add rdx, 0x28
cmp r10, rdx
jne 0x140002678
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400026af
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400026bf
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002696
test ecx, ecx
jg 0x1400026a8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x5987f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [rsp], dil
lea rsp, [rsp + 4]
mov r12d, r14d
mov r14, qword [rsp]
jmp 0x598802
mov cx, 0x3433
lea r9, [rax + riz + 0x6b1344ed]
jmp 0x5987de
mov r9b, bpl
not rdx
rdtsc
xchg bpl, r10b
xchg r9w, r12w
rdtsc
jmp 0x59886e
mov dx, 0x8b8c
mov r10b, byte [rsp]
push r12w
seto al
jmp 0x598884
xchg bp, dx
xchg r8b, cl
mov r9d, 0xb63c6899
mov r14, qword [rsp + 0x18]
mov r8d, dword [rsp]
lea rax, [r10 + r12]
jmp 0x598836
mov rbp, qword [rsp]
mov r12, qword [rsp + 0x10]
xchg rcx, rax
rdtsc
mov ecx, dword [rsp]
mov rbp, r11
jmp 0x59884c
lea rdx, [0xfffffffff0b76d3d]
mov dx, 0x6b68
mov ax, word [rsp + 1]
jmp 0x598982
lea rsp, [rsp + 2]
mov r8, qword [rsp + 0x20]
lea rax, [rdx + r9]
bswap rdi
mov r10, qword [rsp]
mov rdi, 0xffffffffb3ff1259
call fcn.0059893a
mov byte [rsp + 2], al
jmp 0x598aa2
bswap r9d
bswap r9
mov r9, qword [rsp + 0x7b]
lea rsp, [rsp + 0x90]
pop rsp
jmp 0x5989d2
mov rcx, qword [rsp + 0x6a]
mov r9d, esi
mov r9b, byte [rsp]
mov r9w, di
mov r9, 0x229cb754
pushfq
jmp 0x5989e8
xchg byte [rsp + 4], r9b
mov dword [rsp + 1], r11d
lea r9, [r14 + rbp]
lea rsp, [rsp + 2]
mov r9b, 0x40
lea rsp, [rsp + 6]
jmp 0x598a16
Function at 0x1400014f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlNormalizeProcessParams]
mov rbx, qword [rax + 0x78]
test rbx, rbx
je 0x140001525
cmp word [rbx], 0
jne 0x140001529
mov rbx, qword [rax + 0x68]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call fcn.140001330
mov rax, qword gs:[0x30]
mov esi, dword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov eax, dword [rsp + 0x50]
lea edx, [rsi*8 + 8]
mov rcx, qword [rcx + 0x30]
lea r8, [rdx + rax*2]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x140001583
mov edx, 0xc0000017
jmp 0x1400015b2
lea eax, [rsi + 1]
mov rdx, rdi
lea r8, [rdi + rax*8]
mov rcx, rbx
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001330
mov ecx, dword [rsp + 0x48]
mov rdx, rdi
call fcn.140001070
mov edx, eax
mov rcx, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ntdll.dll_NtTerminateProcess]

Function at 0x1400015d0
Capabilities:
Disable driver code integrity
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov rbp, rcx
cmp word [rcx], ax
jne 0x14000168d
movsxd rcx, dword [rcx + 0x3c]
add rcx, rbp
cmp dword [rcx], 0x4550
jne 0x14000168d
mov r8d, 0x20b
mov eax, 0x88
cmp word [rcx + 0x18], r8w
mov edx, 0x78
cmovne eax, edx
xor esi, esi
mov r12d, dword [rax + rcx]
mov eax, dword [rax + rcx + 4]
lea r13, [r12 + rbp]
mov r15d, dword [r13 + 0x20]
mov edi, dword [r13 + 0x18]
add r15, rbp
mov dword [rsp + 0x68], eax
mov eax, dword [r13 + 0x1c]
add rax, rbp
mov qword [rsp + 0x70], rax
mov eax, dword [r13 + 0x24]
add rax, rbp
sub edi, 1
mov qword [rsp + 0x60], rax
js 0x14000168d
nop
lea ebx, [rdi + rsi]
sar ebx, 1
lea rcx, str.CiInitialize
movsxd r14, ebx
mov edx, dword [r15 + r14*4]
add rdx, rbp
call sub.ntdll.dll_strcmp
test eax, eax
jns 0x140001684
lea edi, [rbx - 1]
jmp 0x140001689
jle 0x1400016a4
lea esi, [rbx + 1]
cmp edi, esi
jge 0x140001660
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp edi, esi
jl 0x14000168d
cmp ebx, dword [r13 + 0x14]
jge 0x14000168d
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
movzx eax, word [rax + r14*2]
mov ecx, dword [rcx + rax*4]
cmp ecx, r12d
jb 0x1400016d0
mov eax, dword [rsp + 0x68]
add eax, r12d
cmp ecx, eax
jb 0x14000168d
lea rax, [rcx + rbp]
jmp 0x14000168f
Function at 0x1400016e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
push rsi
push r14
sub rsp, 0x158
mov r14, rdx
mov qword [rdx], 0
xor edx, edx
mov dword [rax + 0x10], 0
mov rsi, rcx
lea r9, [rax + 0x10]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000187f
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x178]
mov qword [rsp + 0x180], rbp
add r8, r8
mov qword [rsp + 0x150], rdi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x178]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebp, eax
test eax, eax
js 0x140001851
mov qword [rsp + 0x170], rbx
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140001849
nop
mov ecx, ebx
lea rax, [rsp + 0x20]
imul rcx, rcx, 0x128
mov edx, 2
add rcx, 8
add rcx, rdi
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1400017b0
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x48]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
mov rcx, rsi
movzx eax, word [rsp + 0x46]
add rdx, rax
call qword [sym.imp.ntdll.dll__stricmp]
test eax, eax
je 0x14000183f
inc ebx
cmp ebx, dword [rdi]
jb 0x140001790
jmp 0x140001849
mov rax, qword [rsp + 0x30]
xor ebp, ebp
mov qword [r14], rax
mov rbx, qword [rsp + 0x170]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x150]
mov eax, ebp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rsi
ret
Function at 0x140001890
Capabilities:
Disable driver code integrity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov qword [r8], rbx
mov rbp, rdx
mov rsi, rcx
call fcn.1400015d0
mov rcx, rsi
mov rdi, rax
call fcn.1400015d0
mov r9, rax
test rax, rax
je 0x1400019bd
mov rax, qword gs:[0x30]
mov r10d, ebx
mov r8d, ebx
mov rcx, qword [rax + 0x60]
mov eax, 0x3fab
cmp word [rcx + 0x120], ax
jb 0x140001952
lea r11, [0x140003ec0]
sub r9, r11
nop
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x140001912
test dl, dl
jne 0x14000194e
inc ecx
inc rax
cmp ecx, 0x10
jb 0x140001905
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x140001900
movzx ecx, bx
nop dword [rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140001940
jmp 0x1400019ac
xor cl, cl
jmp 0x14000191e
lea r11, [0x140003eb0]
sub r9, r11
nop dword [rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x140001972
test dl, dl
jne 0x1400019c4
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140001965
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x140001960
mov ecx, ebx
nop dword [rax + rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x1400019a0
test r10d, r10d
jne 0x1400019c8
lea rcx, str.failed_to_find_CipInitialize_n
call fcn.140001000
xor eax, eax
jmp 0x140001aaa
xor cl, cl
jmp 0x14000197e
movzx r9d, cx
mov edx, r10d
movsxd rcx, r10d
lea rax, [rcx + r9]
mov r8d, dword [rax + rdi]
add rdi, 4
lea rax, [rcx + r8]
add rax, r9
lea rcx, str.CipOffset_:__d___CipInitOffset_:_0x_llx__CipInitialize_:_0x_llx_n
add rdi, rax
mov r9, rdi
call fcn.140001000
lea r11, [0x140003ea0]
mov r8, rdi
sub r8, r11
mov r10d, ebx
mov r9d, ebx
nop word [rax + rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140001a22
test dl, dl
jne 0x140001a71
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140001a15
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
movsxd r10, eax
cmp r9d, 0xff
jl 0x140001a10
nop dword [rax]
inc bx
movzx edx, bx
cmp byte [rdx + r11], 0
jne 0x140001a50
test eax, eax
jne 0x140001a75
lea rcx, str.failed_to_find_Ci_gOptions_n
call fcn.140001000
xor eax, eax
jmp 0x140001aaa
xor cl, cl
jmp 0x140001a2e
lea rax, [r10 + rdx]
movsxd r8, dword [rax + rdi]
lea rbx, [r10 + 4]
add rbx, r8
lea rcx, str.Offset_:__d_RealOffset_:__d__g_CiOptions_:_0x_llx
add rbx, rdx
mov edx, r10d
add rbx, rdi
mov r9, rbx
call fcn.140001000
sub rbx, rsi
mov eax, 1
add rbx, rbp
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x7ff7ed391778
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov eax, 0x88
movsxd r13, r9d
mov qword [rsp + 0x20], r8
mov ebp, edx
mov r12, rcx
mov esi, 0x64
sub esi, r13d
lea rcx, [rsp + 0x30]
lea r8d, [rax + 0x40]
add esi, esi
cmp r13d, r8d
cmove esi, eax
xor edx, edx
call fcn.7ff7ed6b7250
mov eax, esi
movsxd r14, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r15, eax
xor edi, edi
cmp ebp, esi
jl 0x7ff7ed391816
mov rcx, rdi
test r15, r15
jle 0x7ff7ed391800
mov rax, qword [r12 + rcx*8]
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, r15
jl 0x7ff7ed3917ef
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.7ff7ed3918b8
sub ebp, esi
add r12, r14
jmp 0x7ff7ed3917e3
movsxd rbx, ebp
lea rcx, [rsp + 0x100]
mov r8, rbx
mov rdx, r12
call fcn.7ff7ed6b67f0
inc ebp
mov byte [rsp + rbx + 0x100], 1
movsxd rax, ebp
lea rcx, [rsp + 0x100]
sub esi, ebp
add rcx, rax
movsxd r8, esi
xor edx, edx
call fcn.7ff7ed6b7250
or byte [rsp + r14 + 0xff], 0x80
test r15, r15
jle 0x7ff7ed391873
mov rax, qword [rsp + rdi*8 + 0x100]
xor qword [rsp + rdi*8 + 0x30], rax
inc rdi
cmp rdi, r15
jl 0x7ff7ed39185e
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.7ff7ed3918b8
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8, r13
call fcn.7ff7ed6b67f0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.7ff7ed6b54e0
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff7ed3965f8
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x7ff7ed396785
cmp ecx, 0x7c
je 0x7ff7ed396785
cmp ecx, 0x29
jne 0x7ff7ed396672
cmp dword [rdi + 0x1c], 0
jne 0x7ff7ed396785
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x7ff7ed39679e
cmp ecx, 0x5d
jne 0x7ff7ed39664f
test dword [rbx], 0x10000000
je 0x7ff7ed3967ac
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.7ff7ed395bf4
mov rcx, rdi
call fcn.7ff7ed398c68
mov rcx, rdi
call fcn.7ff7ed398cdc
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x7ff7ed39660a
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x7ff7ed396689
lea rcx, [rdi + 0x40]
call fcn.7ff7ed395e78
jmp 0x7ff7ed39665b
cmp ecx, 0x5c
jne 0x7ff7ed3966d7
mov rcx, rdi
call fcn.7ff7ed398c68
test byte [rbx], 0x80
je 0x7ff7ed3966cd
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x7ff7ed3966b5
lea rcx, [rdi + 0x40]
call fcn.7ff7ed3965ec
mov rcx, rdi
call fcn.7ff7ed398c68
jmp 0x7ff7ed39666b
cmp al, 0x42
jne 0x7ff7ed3966cd
lea rcx, [rdi + 0x40]
call fcn.7ff7ed3965ec
lea rcx, [rdi + 0x40]
call fcn.7ff7ed398c04
jmp 0x7ff7ed3966ab
mov rcx, rdi
call fcn.7ff7ed3967c8
jmp 0x7ff7ed396663
cmp ecx, 0x5b
jne 0x7ff7ed396702
mov rcx, rdi
call fcn.7ff7ed398c68
mov rcx, rdi
call fcn.7ff7ed396e4c
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.7ff7ed398054
jmp 0x7ff7ed396663
cmp ecx, 0x28
jne 0x7ff7ed396737
mov rcx, rdi
call fcn.7ff7ed398c68
mov rcx, rdi
call fcn.7ff7ed399310
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.7ff7ed398054
test bl, bl
je 0x7ff7ed39666b
jmp 0x7ff7ed396663
cmp ecx, 0x5e
jne 0x7ff7ed39674a
lea rcx, [rdi + 0x40]
call fcn.7ff7ed395be8
jmp 0x7ff7ed3966ab
cmp ecx, 0x24
jne 0x7ff7ed39675d
lea rcx, [rdi + 0x40]
call fcn.7ff7ed395f78
jmp 0x7ff7ed3966ab
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x7ff7ed3967ba
cmp ecx, 0x3f
je 0x7ff7ed3967ba
cmp ecx, 0x7b
je 0x7ff7ed3967ba
cmp ecx, 0x7d
jne 0x7ff7ed39663e
test dword [rbx], 0x10000000
je 0x7ff7ed396790
jmp 0x7ff7ed39664f
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.7ff7ed398048
int3
mov edx, 5
mov rcx, rdi
call fcn.7ff7ed398048
int3
mov edx, 4
mov rcx, rdi
call fcn.7ff7ed398048
int3
mov edx, 0xa
mov rcx, rdi
call fcn.7ff7ed398048
int3

Function at 0x7ff7ed39a514
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x100
call fcn.7ff7ed6b7250
mov edx, 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x7ff7ed39a56c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.7ff7ed3c039c
jmp 0x7ff7ed39a57b
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx], 0
and qword [rbx + 8], 0
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.7ff7ed6b54e0
add rsp, 0x140
pop rbx
ret
Function at 0x7ff7ed3bfb70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x7ff7ed3bfbc3
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x7ff7ed3bfb88
jmp 0x7ff7ed3bfbd0
cmp dword [rcx], 0x4e0
jb 0x7ff7ed3bfbd0
call fcn.7ff7ed3bfc10
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff7ed3bfc10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x7ff7ed3bfc27
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x7ff7ed3bfc72
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x7ff7ed3ca30c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.7ff7ed3a1134
mov r14d, 0xa8
lea rdi, [r14 + rax]
cmp byte [rdi], 0
je 0x7ff7ed3ca45f
mov ecx, 0x20
call fcn.7ff7ed6b5358
mov qword [rsp + 0x50], rax
test rax, rax
je 0x7ff7ed3ca362
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.7ff7ed4fcd30
mov rsi, rax
jmp 0x7ff7ed3ca364
xor esi, esi
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx + 0x10]
call fcn.7ff7ed3a1134
lea rdx, [rax + 0x148]
mov rcx, rsi
call fcn.7ff7ed4fcea4
movzx ebp, al
mov rcx, r14
call fcn.7ff7ed6b5358
mov qword [rsp + 0x50], rax
lea r14, [rdi + 8]
test rax, rax
je 0x7ff7ed3ca3ae
mov r9, qword [rbx + 0x38]
movzx r8d, word [rdi + 0x28]
mov rdx, r14
mov rcx, rax
call fcn.7ff7ed3d4180
nop
mov qword [rbx + 0x28], rax
mov rcx, rax
call fcn.7ff7ed3d42b4
mov esi, eax
mov ecx, eax
test eax, eax
jns 0x7ff7ed3ca3cd
call fcn.7ff7ed62ac50
movzx ecx, word [rdi + 0x28]
jmp 0x7ff7ed3ca3d4
lea rax, [0x7ff7ed6f0c0d]
xor ebp, 1
lea r8d, [rbp*4 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [r14]
lea rdx, str.HTTP_API
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1__dm_s:_d_e_1_31m_se_0m
call fcn.7ff7ed3a0bc8
test esi, esi
jns 0x7ff7ed3ca40e
mov rcx, rbx
call fcn.7ff7ed3ca474
xor al, al
jmp 0x7ff7ed3ca461
mov word [rbx + 0x30], si
mov edx, 1
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x7ff7ed3ca45f
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x7ff7ed3ca45f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x7ff7ed86f5c0], rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov qword [0x7ff7ed86f5c8], rcx
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret