joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea r14, [0x140000000]
mov ecx, dword [rcx + 0xa8]
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x3ff0000
je 0x14005e708
bt ecx, 0x10
jb 0x14005e6a8
movzx eax, byte [rdi + 0xbd]
test byte [rax + r14 + 0xb37a0], 0x60
jne 0x14005e6a8
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14005b320
mov eax, ecx
and eax, 0xb0000
cmp eax, 0xb0000
je 0x14005e6e4
movzx edx, byte [rdi + 0xbd]
movzx eax, byte [rdx + r14 + 0xb37a0]
and al, 0x60
cmp al, 0x40
jne 0x14005e6e4
cmp dl, 0x47
je 0x14005e6e4
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.1400541c0
and ecx, 0x110000
cmp ecx, 0x110000
je 0x14005e708
movzx eax, byte [rdi + 0xbd]
movzx eax, byte [rax + r14 + 0xb37a0]
and al, 0x60
cmp al, 0x60
je 0x14005e6d1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x7ffd
mov qword [rsp + 0x40], rsi
nop dword [rax]
movzx r8d, byte [rdi + 0xbd]
movzx eax, word [rdi + 0xb8]
shl r8d, 0x11
cmp eax, dword [rdi + 0x28]
jb 0x14005e776
mov ecx, eax
mov rax, qword [rdi + 0x20]
lea rdx, [rax + rcx*8]
movzx eax, byte [rax + rcx*8 + 5]
shl eax, 0xa
add r8d, eax
mov rax, qword [rdx]
mov qword [rdi + 0xc0], rax
movzx eax, word [rdi + 0xb8]
cmp ax, bp
jae 0x14005e776
movzx ecx, ax
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax + rcx*8 + 8]
mov qword [rdi + 0xc8], rcx
movzx edx, word [rdi + 0xba]
cmp edx, dword [rdi + 0x28]
jb 0x14005e7b9
mov rax, qword [rdi + 0x20]
mov ecx, edx
movzx edx, byte [rax + rdx*8 + 5]
mov rax, qword [rax + rcx*8]
mov qword [rdi + 0xd0], rax
movzx eax, word [rdi + 0xba]
cmp ax, bp
jae 0x14005e7bf
movzx ecx, ax
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax + rcx*8 + 8]
mov qword [rdi + 0xd8], rcx
jmp 0x14005e7bf
and edx, 0x3ff
lea esi, [rdx + r8]
xor ebx, ebx
nop word [rax + rax]
mov r8d, ebx
mov eax, 0x5e1d27b
and r8d, 0x1ffff
or r8d, esi
mov ecx, r8d
ror ecx, 0xb
sub ecx, r8d
rol ecx, 0xe
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e9
sub ecx, eax
mov edx, dword [r14 + rcx*4 + 0xb4600]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
je 0x14005e82e
lea eax, [rcx + 1]
mov edx, dword [r14 + rax*4 + 0xb4600]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
jne 0x14005e846
mov eax, edx
mov rcx, rdi
shr rax, 0x18
call qword [r14 + rax*8 + 0xb4110]
movzx edx, ax
test edx, edx
jne 0x14005e860
cmp ebx, 0xfffff
je 0x14005e883
mov eax, ebx
shr eax, 0xa
or ebx, eax
xor ebx, 0xffc00
jmp 0x14005e7d0
cmp edx, 5
jae 0x14005e899
cmp edx, 1
je 0x14005e720
cmp edx, 2
jne 0x14005e88d
mov edx, dword [rdi + 0xb8]
mov rcx, rdi
call fcn.1400545d0
jmp 0x14005e8a7
mov rcx, rdi
call fcn.14005b320
jmp 0x14005e8a7
cmp edx, 3
je 0x14005e8c2
mov eax, 0xffff
jmp 0x14005e8a7
mov rax, qword [rdi + 0x20]
movzx eax, byte [rax + rdx*8 + 4]
shl eax, 0x18
add eax, edx
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, 0x18
mov rcx, rdi
call fcn.140019fd0
int3
Function at 0x14005e8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
movzx r11d, word [rdx + 2]
mov r14, rcx
movzx r9d, word [r8 + 2]
cmp rdx, r8
je 0x14005ea2f
mov r10, qword [rcx + 0x20]
cmp byte [r10 + r11*8 + 5], 0x1e
lea rbx, [r10 + r11*8]
jne 0x14005e907
movzx r11d, word [rbx]
lea rbx, [r10 + r11*8]
cmp byte [r10 + r9*8 + 5], 0x1e
lea rcx, [r10 + r9*8]
mov rax, r9
jne 0x14005e921
movzx r9d, word [rcx]
mov eax, r9d
lea rcx, [r10 + r9*8]
movzx edi, byte [rdx + 5]
lea eax, [rdi - 0x38]
cmp al, 1
jbe 0x14005e931
movzx eax, word [rdx]
jmp 0x14005e939
movzx eax, word [rdx]
movzx eax, word [r10 + rax*8]
movzx edx, ax
movzx eax, byte [r8 + 5]
sub al, 0x38
cmp al, 1
jbe 0x14005e94d
movzx eax, word [r8]
jmp 0x14005e956
movzx eax, word [r8]
movzx eax, word [r10 + rax*8]
movzx r8d, ax
cmp r11d, r9d
jne 0x14005e978
cmp edx, r8d
je 0x14005ea2f
mov rcx, r14
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp fcn.14005ead0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r15
mov r15d, 0x8000
cmp r11d, r15d
jae 0x14005e997
cmp r9d, r15d
jb 0x14005e9ff
cmp dil, 0x38
jne 0x14005e9f4
xor esi, esi
mov ebp, r11d
cmp byte [rbx + 5], 0x29
mov edi, esi
jne 0x14005e9c7
movzx eax, word [rbx + 2]
cmp ax, r15w
jae 0x14005e9c7
movzx ebp, word [rbx]
movzx eax, ax
mov esi, dword [r10 + rax*8]
cmp ebp, r9d
jne 0x14005e9c7
test esi, esi
jne 0x14005e9ff
cmp byte [rcx + 5], 0x29
jne 0x14005e9eb
movzx eax, word [rcx + 2]
cmp ax, r15w
jae 0x14005e9eb
movzx r9d, word [rcx]
movzx eax, ax
mov edi, dword [r10 + rax*8]
cmp r11d, r9d
jne 0x14005e9eb
test edi, edi
jne 0x14005e9ff
cmp ebp, r9d
jne 0x14005ea19
cmp esi, edi
jmp 0x14005e9fd
movzx eax, byte [rcx + 4]
xor al, byte [rbx + 4]
test al, 0x1f
je 0x14005ea19
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
cmp edx, r8d
jne 0x14005ea25
mov eax, 1
jmp 0x14005ea01
mov rcx, r14
call fcn.14005ead0
jmp 0x14005ea01
mov eax, 2
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x14005f9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx + 0xd4]
lea rsi, [rcx + 0xb8]
movzx r12d, word [rsi]
and al, 0x1f
mov r15, rcx
cmp al, 0xe
jne 0x14005fa38
movzx edx, word [rcx + 0x208]
cmp edx, r12d
jbe 0x14005fa38
movzx eax, word [rcx + 0x226]
cmp eax, r12d
jbe 0x14005fa38
nop
cmp eax, edx
jb 0x14005fb9a
mov ecx, eax
mov rax, qword [r15 + 0x20]
movzx eax, word [rax + rcx*8 + 6]
cmp eax, r12d
ja 0x14005fa20
movzx eax, word [r15 + 0x228]
cmp eax, r12d
jbe 0x14005fb9e
mov rbx, qword [r15 + 0x20]
mov ebp, 0x8000
mov dword [rsp + 0x50], ebp
nop word [rax + rax]
lea r13, [rbx + rax*8]
movzx eax, word [rbx + rax*8]
movzx ecx, word [rbx + rax*8 + 2]
lea rdx, [rbx + rax*8]
cmp rsi, rdx
je 0x14005fb9a
movzx r9d, word [rsi + 2]
cmp byte [rbx + r9*8 + 5], 0x1e
lea r8, [rbx + r9*8]
jne 0x14005fa93
movzx r9d, word [r8]
lea r8, [rbx + r9*8]
cmp byte [rbx + rcx*8 + 5], 0x1e
lea r10, [rbx + rcx*8]
mov rax, rcx
jne 0x14005faab
movzx ecx, word [r10]
mov eax, ecx
lea r10, [rbx + rcx*8]
movzx r11d, byte [rsi + 5]
lea eax, [r11 - 0x38]
cmp al, 1
jbe 0x14005fabd
movzx eax, word [rsi]
jmp 0x14005fac4
movzx eax, word [rsi]
movzx eax, word [rbx + rax*8]
movzx r14d, ax
movzx eax, byte [rdx + 5]
sub al, 0x38
cmp al, 1
jbe 0x14005fad7
movzx eax, word [rdx]
jmp 0x14005fade
movzx eax, word [rdx]
movzx eax, word [rbx + rax*8]
movzx edi, ax
cmp r9d, ecx
je 0x14005fb6f
cmp r9d, ebp
jae 0x14005faf7
cmp ecx, ebp
jb 0x14005fb86
cmp r11b, 0x38
jne 0x14005fb62
xor r11d, r11d
xor edx, edx
cmp byte [r8 + 5], 0x29
mov ebp, r9d
jne 0x14005fb2c
movzx eax, word [r8 + 2]
cmp ax, word [rsp + 0x50]
jae 0x14005fb2c
movzx ebp, word [r8]
movzx eax, ax
mov r11d, dword [rbx + rax*8]
cmp ebp, ecx
jne 0x14005fb2c
test r11d, r11d
jne 0x14005fb86
cmp byte [r10 + 5], 0x29
jne 0x14005fb57
movzx eax, word [r10 + 2]
mov r8d, 0x8000
cmp ax, r8w
jae 0x14005fb57
movzx ecx, word [r10]
movzx eax, ax
mov edx, dword [rbx + rax*8]
cmp r9d, ecx
jne 0x14005fb57
test edx, edx
jne 0x14005fb86
cmp ebp, ecx
jne 0x14005fb6f
cmp r11d, edx
je 0x14005fb6f
jmp 0x14005fb86
movzx eax, byte [r10 + 4]
xor al, byte [r8 + 4]
test al, 0x1f
jne 0x14005fb86
cmp r14d, edi
je 0x14005fb9a
mov r8d, edi
mov edx, r14d
mov rcx, r15
call fcn.14005ead0
test eax, eax
jne 0x14005fb9a
movzx eax, word [r13 + 6]
cmp eax, r12d
jbe 0x14005fb9e
mov ebp, 0x8000
jmp 0x14005fa60
xor eax, eax
jmp 0x14005fba3
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005feb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx esi, dx
mov rdi, rcx
mov r14d, esi
movzx r9d, word [rcx + rsi*2 + 0x1a2]
cmp r9d, r8d
jbe 0x14005ff51
mov r11, qword [rcx + 0x20]
mov eax, r8d
lea rbp, [r11 + rax*8]
nop dword [rax + rax]
movzx ecx, word [r11 + r9*8]
lea rbx, [r11 + r9*8]
mov eax, r9d
movzx eax, byte [rbx + 4]
and al, 0x1f
cmp ecx, r8d
je 0x14005ff92
test al, al
jne 0x14005ff47
movzx r9d, word [r11 + rcx*8 + 2]
movzx r10d, word [rbp + 2]
cmp si, 0x42
je 0x14005ff30
movzx edx, byte [r11 + r10*8 + 4]
xor dl, byte [r11 + r9*8 + 4]
test dl, 0x1f
jne 0x14005ff47
cmp r9d, r10d
je 0x14005ff79
cmp r9d, 0x8000
jae 0x14005ff79
cmp r10d, 0x8000
jae 0x14005ff79
movzx r9d, word [rbx + 6]
cmp r9d, r8d
ja 0x14005fef0
movzx eax, word [rdi + r14*2 + 0x192]
cmp eax, r8d
jbe 0x14005ff79
mov rdx, qword [rdi + 0x20]
lea rcx, [rdx + rax*8]
movzx eax, word [rdx + rax*8]
cmp eax, r8d
je 0x14005ff9d
movzx eax, word [rcx + 6]
cmp eax, r8d
ja 0x14005ff63
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
jmp 0x14005ff7b
test byte [rcx + 4], 0x1f
mov ecx, 0
setne cl
mov eax, ecx
jmp 0x14005ff7b
Function at 0x140061040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x20
mov r10, qword [rcx + 0x20]
mov esi, r9d
movzx r14d, dx
mov r12d, r8d
mov r9d, edx
mov rbp, rcx
movzx r15d, byte [r10 + r14*8 + 5]
cmp r15d, 0x35
jb 0x14006117f
cmp r15d, r8d
jg 0x14006117f
xor edx, edx
add rcx, 0xb24
nop word [rax + rax]
cmp word [rcx], r14w
jne 0x1400610aa
mov eax, dword [rcx + 4]
cmp eax, esi
jb 0x1400610aa
xor eax, esi
test eax, 0xfff
je 0x14006116e
inc rdx
add rcx, 8
cmp rdx, 0x10
jl 0x140061090
movzx edx, word [r10 + r14*8]
mov r9d, esi
mov qword [rsp + 0x40], rbx
mov rcx, rbp
movzx ebx, word [r10 + r14*8 + 2]
mov qword [rsp + 0x48], rdi
call fcn.140061040
mov r9d, esi
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov edi, eax
call fcn.140061040
mov ecx, 0xf4
mov word [rbp + 0xb8], di
add r15w, cx
mov word [rbp + 0xba], ax
movzx edx, r15w
mov ecx, pe_nt_image_headers64
imul edx, ecx
mov r8d, esi
shr r8d, 5
mov rcx, rbp
and r8w, 0x1f
or r8w, dx
mov word [rbp + 0xbc], r8w
call fcn.14005e650
mov ecx, dword [rbp + 0xba4]
mov r9d, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [rcx*8]
lea eax, [rcx + 1]
and eax, 0xf
mov dword [rbp + 0xba4], eax
mov word [rdx + rbp + 0xb24], r14w
mov word [rdx + rbp + 0xb26], r9w
mov dword [rdx + rbp + 0xb28], esi
jmp 0x1400611c0
movzx ecx, word [rcx + 2]
movzx eax, byte [r10 + rcx*8 + 4]
shl eax, 0x18
add eax, ecx
jmp 0x1400611c3
bt esi, 0xb
jae 0x1400611c0
movzx ecx, byte [r10 + r14*8 + 4]
mov edx, 0x605fd9
and ecx, 0x1f
shr edx, cl
test dl, 1
jne 0x1400611c0
mov eax, 0x5b15
mov word [rbp + 0xb8], r14w
mov rcx, rbp
mov word [rbp + 0xbc], ax
mov word [rbp + 0xba], si
call fcn.14005e650
mov r9d, eax
mov eax, r9d
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14006abe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov edx, 0x14
call fcn.1400545d0
mov ecx, 0x548a
mov word [rdi + 0xb8], ax
mov word [rdi + 0xbc], cx
mov rcx, rdi
mov word [rdi + 0xba], bx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005e650

Function at 0x14008acc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14008ab53
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008ab53
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008ab53
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008ab53
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008ab53
cmp dword [rcx + 0x84], 0xe
jbe 0x14008ab53
cmp dword [rcx + 0xf8], 0
je 0x14008ab53
mov ecx, ebx
call fcn.14008abf4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14008a9e4
cmp dword [rbp + 0x20], 0
je 0x14008aba0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14008aba8
int3
xor r8d, r8d
xor edx, edx
jmp 0x14008aaec
Function at 0x14009e088
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14009ddae
call fcn.14008ad84
mov dword [rax], 0x16
call fcn.140098160
jmp 0x14009def9
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14009def9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14009def9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14009dddd
lock or dword [rcx + 0x14], 0x10
jmp 0x14009def9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14009ddf1
call fcn.1400a19f0
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14009de01
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14009de04
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14008a088
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14009d804
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14009dee7
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14009de95
mov rcx, rbx
call fcn.14008a088
cmp eax, 0xffffffff
je 0x14009de80
mov rcx, rbx
call fcn.14008a088
cmp eax, 0xfffffffe
je 0x14009de80
mov rcx, rbx
call fcn.14008a088
movsxd rdi, eax
lea r14, [0x1400cfbd0]
mov rcx, rbx
sar rdi, 6
call fcn.14008a088
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14009de87
lea rdx, [0x1400ce330]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14009de95
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14009deb9
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14009deb9
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14009deb9
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14009ded7
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14009dee2
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14009defe
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14009dd78

Function at 0x1400a3e84
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a3ea4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14008ad14
or eax, 0xffffffff
jmp 0x1400a3ea6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400281f8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14003cd00], eax
call fcn.140028cc4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14003cd00], 0
jne case.default.0x14002824e
mov ecx, 1
call fcn.140028cc4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xchg dword [rcx + 0x157b220d], ecx
clc
sub dh, byte [rdi + rbp*2 + 0x40]
sub al, 0x26
sbb al, 0xfd
sbb eax, 0xe318d881
adc eax, 0x444ee569
sbb bl, byte [0xe8db19a5]
mov r9b, 0xbe
mov eax, 0xde7fe08a
invalid
loope 0x140067b6d
jae 0x140067b1c
xchg ebx, eax
invalid
invalid
Function at 0x100016ac0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], di
call sub.msvcrt.dll_memset
lea ebp, [rdi + 0x5c]
cmp rbx, rdi
je 0x100016b38
cmp word [rbx], di
je 0x100016b38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x100016b38
cmp word [rbx], 0x7f
jae 0x100016b2d
cmp word [rbx + 2], 0x3a
je 0x100016ba2
cmp word [rbx], bp
jne 0x100016b38
cmp word [rbx + 2], bp
je 0x100016ba2
mov esi, 0x105
lea rcx, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x100016ba2
lea ecx, [rax + 2]
cmp ecx, esi
ja 0x100016ba2
mov ecx, eax
inc eax
mov r8, rbx
mov word [rsp + rcx*2 + 0x20], bp
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov word [rsp + rax*2 + 0x20], di
call fcn.100004e28
cmp eax, edi
jl 0x100016ba2
lea r8, [0x100004ce0]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.100004e28
cmp eax, edi
setge al
cmp al, dil
je 0x100016ba2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100016ba4
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000170f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x100016cc8
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rdx], 0
lea rcx, [rsp + 0x20]
mov r8d, 0x114
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x100016d2f
cmp dword [rsp + 0x24], 5
ja 0x100016d20
jne 0x100016d2f
cmp dword [rsp + 0x28], 1
jb 0x100016d2f
lea rcx, [0x100003c38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100016d3b
lea rcx, [0x100003c38]
call fcn.100016ac0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000170f0
add rsp, 0x158
ret

Function at 0x1000173cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100017419
cmp rcx, 0xffffffffffffffff
je 0x100017419
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100017411
cmp dword [rcx + 0x3c], edx
jl 0x100017411
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100017411
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100017419
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400019c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13f0
call fcn.1400089e0
sub rsp, rax
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], setsockopt
lea ecx, [rdi + 0x40]
call fcn.140007d14
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x3e
mov qword [rsp + 0x48], 0x3f
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14000a900]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14000a910]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x14000a920]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x14000a928]
mov dword [rsi + 0x38], eax
movzx eax, word [0x14000a92c]
mov word [rsi + 0x3c], ax
mov byte [rsi + 0x3e], dil
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], setsockopt
mov byte [rbx], dil
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0x54], ecx
inc rdi
cmp rdi, 0x270
jb 0x140001ab0
mov dword [rsp + 0x50], 0x270
mov edi, 8
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.1400078b0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x140001b0a
lea rcx, [rsp + 0x50]
call fcn.1400078b0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x140001af5
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001b42
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140001b37
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001b4a
mov rcx, rbx
call fcn.140006b90
sub rdi, 1
jne 0x140001ae0
lea edx, [rdi + 0x40]
mov rcx, rsi
call fcn.140007b90
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140007b70
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140001c90
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rdi, rcx
mov qword [r11 - 0x98], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [r11 - 0x74], xmm0
movups xmmword [r11 - 0x64], xmm0
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [r11 - 0x24], eax
mov dword [rsp + 0xa0], WSAGetLastError
movups xmmword [rsp + 0x78], xmm0
mov qword [r11 - 0xa0], rax
mov rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.140005df0
mov rcx, rax
call fcn.140001b90
mov rbx, rax
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006810
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140001e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.CreateProcess_failed__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006600
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000a930]
call fcn.140006600
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140001dd7
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140001dd2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001e3c
mov rcx, r8
call fcn.140007b90
mov byte [rdi], 0
mov qword [rdi + 0x18], setsockopt
mov qword [rdi + 0x10], rsi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140007b70
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, str.Process_started_successfully._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006600
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001da1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3