joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0bc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x188a685a
add r9d, 0x5925f9c7
xor r9d, 0x2604eef4
sub r9d, 0x557d5b08
add r9d, 0x268fb6c8
add r9d, 0xb35d77f
sub r9d, 0x33fcbda4
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b0c53
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b0c0e
mov ecx, dword [r10]
jmp 0x1401b0daa
cmp ecx, 0x4e0
jb 0x1401b0daa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x31a8b184
xor ebx, 0x41ae4362
sub ebx, 0xc9183ab
xor ebx, 0x5e2380ad
xor ebx, 0x3d8194c3
add ebx, 0x3b80d223
xor ebx, 0x24cf868e
sub ebx, 0xc3cab1
xor ebx, 0x17d401a6
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0ca2
lea r11, [r10 + 0xd50]
mov ebx, 0x16777732
add ebx, 0xe361781
add ebx, 0x1b6d7242
sub ebx, 0x3a5e5bdc
add ebx, 0x3f296868
add ebx, 0xfd8a824
sub ebx, 0x2d409128
sub ebx, 0x19bd2e0
sub ebx, 0x25e25011
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0d26
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg r12, rbx
mov r12, qword [rsp]
xchg rbx, r12
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 6
shr ecx, 3
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 5
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xa
shl eax, 4
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0xd
shr eax, 1
shr eax, 3
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401baa40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401ba010
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9ffd
xchg r13, r8
mov r13, qword [rcx - 8]
xchg r13, r8
nop
sub rdx, 0x2fc76e8
add rdx, 0x2fc770f
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401ba027
mov rcx, r8
call fcn.1401fd468
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
xchg qword [rsp + 8], rbx
add rsp, 0x10
jmp 0x1401baa40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xchg r11, rbx
mov r11, qword [rcx]
xchg rbx, r11
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x5d330d7e
add qword [rax], 0x1dcbef98
sub qword [rax], 0x77601ebd
xor qword [rax], 0x45bebcf1
xor qword [rax], 0x43d8d9a6
add qword [rax], 0x368721b0
add qword [rax], 0x1959c00d
xor qword [rax], 0x7b8563e2
sub qword [rax], 0x2e5cff29
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401bab0f
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.1401b3b70
mov edx, 0x5e5cdf2e
sub edx, 0x56f5b4b
sub edx, 0x1940f8dd
add edx, 0x19409029
sub edx, 0x162ce9a1
xor edx, 0x2a383870
sub edx, 0x68f809ae
xchg rcx, rdx
mov rdx, rbx
xchg rdx, rcx
call fcn.1401fd468
xchg rdi, rbx
mov rdi, rbx
xchg rdi, rbx
test rdi, rdi
jne 0x1401baab2
mov rdi, qword [rsp + 0x30]
xchg r10, rcx
mov r10, qword [rsi]
xchg r10, rcx
mov edx, 0x3bdc4948
sub edx, 0x73543dd
xor edx, 0x335d5b64
add edx, 0x5367ab5d
xor edx, 0x72333755
xor edx, 0x29513e69
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fd468
Function at 0x1401bab60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, r15
mov r15, rcx
xchg rbx, r15
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401ba09b
xchg r9, rdx
mov r9, qword [rbx + 0x28]
xchg r9, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401ba080
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401ba0bb
xchg r8, rcx
mov r8, rcx
xchg rcx, r8
call fcn.1401fd468
xor eax, eax
xchg r13, rax
mov qword [rbx + 0x18], r13
xchg r13, rax
mov qword [rbx + 0x20], rax
xchg rbp, rax
mov qword [rbx + 0x28], rbp
xchg rbp, rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rax
push rcx
push rcx
push rcx
push rcx
xchg qword [rsp + 0x28], rbx
pop rcx
pop rcx
pop rcx
pop rcx
pop rax
add rsp, 8
jmp 0x1401bab60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rsi, r14
mov r14, rcx
xchg rsi, r14
xchg r8, rax
mov r8, qword [rbx + 8]
xchg r8, rax
mov qword [rax], 0x54bd739e
sub qword [rax], 0x34db9011
sub qword [rax], 0x45d1c87
add qword [rax], 0x264446a7
sub qword [rax], 0x35e37234
xor qword [rax], 0x4a285931
sub qword [rax], 0x41cdc248
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401bac22
xchg r13, rdi
mov qword [rsp + 0x30], r13
xchg r13, rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401bac80
mov edx, 0x6f9b34cf
xor edx, 0x9afac2a
sub edx, 0x3a90cbd9
xor edx, 0x279d7a44
add edx, 0x8b6d068
xor edx, 0x2c53c53b
sub edx, 0x38a6424b
mov rcx, rbx
call fcn.1401fd468
xchg rbp, rbx
mov rbp, rdi
xchg rbp, rbx
test rdi, rdi
jne 0x1401babce
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x787d59e0
sub edx, 0x75e48004
add edx, 0x52cf957a
sub edx, 0x51920be5
add edx, 0x59b1e991
xor edx, 0x37666e4b
sub edx, 0x5165bd13
sub edx, 0x198865f6
xchg rbx, r8
mov r8, qword [rsp + 0x38]
xchg rbx, r8
add rsp, 0x20
push rax
xchg qword [rsp + 8], rsi
add rsp, 0x10
jmp fcn.1401fd468
Function at 0x1401bd710
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
je 0x1401bd8e5
cmp byte [rcx + 0x71], 0
je 0x1401bd8e5
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
mov edx, 0x72e51db0
xor edx, 0x2de5a020
add edx, 0x151a9e0d
sub edx, 0x2909f849
add edx, 0x2d4639af
sub edx, 0x4818fe06
add edx, 0xcfc16102
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1401bd8bc
xchg rcx, rdx
mov rdx, qword [rbx + 0x68]
xchg rcx, rdx
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg r11, rax
mov qword [rsp + 0x20], r11
xchg r11, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401bd80c
sub eax, 1
je 0x1401bd828
cmp eax, 2
jne 0x1401bd8bc
xchg rdi, rdx
mov rdx, qword [rsp + 0x68]
xchg rdx, rdi
mov al, 0x53
sub al, 0xa
sub al, 0x2b
add al, 0x4a
sub al, 0xa
sub al, 0x51
add al, 0x4a
sub al, 0x56
mov byte [rbx + 0x71], 0x20
sub byte [rbx + 0x71], 0x20
xor byte [rbx + 0x71], 0x10
add byte [rbx + 0x71], 7
add byte [rbx + 0x71], 0x2a
add byte [rbx + 0x71], 0x21
add byte [rbx + 0x71], 8
sub byte [rbx + 0x71], 0x6a
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x71], 0x19
add byte [rbx + 0x71], 0x55
xor byte [rbx + 0x71], 0x3f
sub byte [rbx + 0x71], 0xb
xor byte [rbx + 0x71], 0x58
xor byte [rbx + 0x71], 0x51
sub byte [rbx + 0x71], 0x4f
xchg r11, rdi
mov r11, qword [rsp + 0x60]
xchg rdi, r11
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401bd894
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
xchg rdi, r8
mov rdi, r8
xchg r8, rdi
mov edx, 0x58762f97
xor edx, 0x7b5a2dd9
add edx, 0x3db58f88
xor edx, 0x74263a48
add edx, 0x634d71ed
sub edx, 0x61bb8bc4
sub edx, 0x1135e2ee
sub edx, 0x523aed8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401bd8bc
cmp byte [rbx + 0x71], 0
xchg r10, rdi
mov r10, qword [rsp + 0x68]
xchg rdi, r10
sete al
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xchg r10, rdi
mov r10, qword [rsp + 0x68]
xchg r10, rdi
xor al, al
add rsp, 0x50
push rdx
push rax
push rax
push rcx
push rdx
push rcx
xchg qword [rsp + 0x30], rbx
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 0x53
sub al, 0x16
add al, 3
xor al, 0x5b
xor al, 0x34
sub al, 4
sub al, 7
sub al, 0x1e
xor al, 7
add rsp, 0x50
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401fde3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fde86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fde86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fde86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fde86
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fde86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fde88
xor al, al
add rsp, 0x28
ret

Function at 0x14022d570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022d59d
xor al, al
jmp 0x14022d6ff
mov rax, qword [0x14024c6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024c6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024c6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024c6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024c6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024c6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024c6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024c6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024c700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022d6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022d649
mov r11d, 2
jmp 0x14022d66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022d663
mov r11d, 1
jmp 0x14022d66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022d715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022d6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022d6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022d6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022d6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022d630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022d6fa
Function at 0x140270eb2
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140ca1c62
syscall
ret

Function at 0x140a3507b
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1409676c1
Function at 0x140003e20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003e54
cmp word [rcx], 0x5a4d
jne 0x140003e54
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003e54
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003e54
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003d60
test eax, eax
jne 0x140003e70
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003dd0
test rax, rax
je 0x140003e65
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000461c
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004520
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400044c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004974
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140469558]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140469554]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400049c2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400049ba
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004aa9
inc ebx
add rax, 0x28
jmp 0x14000499a
mov rcx, r12
call fcn.1400051a1
mov rbp, rax
test rax, rax
jne 0x1400049e1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004910
movsxd rbx, ebx
mov rax, qword [0x140469558]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000524f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140469558]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004a43
mov rax, qword [0x140469558]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004910
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004aa3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004aa3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140469558]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004aa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004910
inc dword [0x140469554]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004ed0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1404695c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1404695a0]
test rbx, rbx
je 0x140004f1c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004f16
test eax, eax
jne 0x140004f16
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004eee
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400050d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400050f3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400050f3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400050f4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000512e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140005125
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140005130
inc r8d
add rax, 0x28
jmp 0x14000510c
xor eax, eax
ret

Function at 0x1400051a1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140465650]
mov r8, rcx
mov rcx, r9
call fcn.1400050d0
test eax, eax
je 0x1400051cd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400050f4
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov edx, 0x58
xor ecx, ecx
mov rbx, r8
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov rcx, rax
mov rbp, rax
lea r8d, [rdx + 0x58]
call fcn.140002f80
or byte [rsi + 0xc2], 2
lea r9, [0x1400010b0]
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov byte [rsp + 0x30], 1
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov rcx, rbp
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
test al, al
jne 0x140001091
lea rcx, [0x140003360]
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140002110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000220b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002213
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x14000224a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002220
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002275
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000229b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140002280
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a3e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a425
xor al, al
jmp 0x14000a472
cmp word [rbx], 0
je 0x14000a43d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a430
cmp word [rsp + 0x30], 0
je 0x14000a46b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a493
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a450
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b460
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000f570
int3
Function at 0x14000aae0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001ed40
sub rsp, rax
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002fd70]
lea rsi, [0x140031da0]
mov rdi, rcx
test r11d, r11d
jne 0x14000ab53
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a4a0
test al, al
je 0x14000ac3f
lea rcx, [rsp + 0x20]
call fcn.140013a9c
movsxd r11, dword [0x14002fd70]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002fd70], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ab94
mov r10, rsi
nop
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ab84
add rax, 2
test ecx, ecx
jne 0x14000ab70
test edx, edx
je 0x14000abb7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ab60
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000aba0
cmp rax, 2
jne 0x14000abbb
cmp word [rdi + 2], 0x3a
jne 0x14000abbb
mov al, 1
jmp 0x14000ac1e
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000abe8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000abe8
mov bl, 1
jmp 0x14000abec
test bl, bl
je 0x14000ac13
cmp dword [0x14002fd70], 0x400
jge 0x14000ac13
mov rcx, rdi
call fcn.140013a9c
movsxd rdx, dword [0x14002fd70]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fd70], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b460
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000a930
int3
Function at 0x14000ad60
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fd78]
test rcx, rcx
je 0x14000ad9b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ad8e
mov rcx, qword [0x14002fd78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140033dc8], 0
je 0x14000ae8e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140028800]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002fda0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000ae6f
test al, 0x10
je 0x14000ae6f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000ae15
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret