joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ab4a4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r13d, r13d
mov r12, rcx
xor eax, eax
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov rsi, r9
mov ebp, r13d
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x24], eax
mov word [rsp + 0x50], r13w
call sub.msvcrt.dll_memset
lea edi, [r13 + 0x57]
cmp rsi, r13
jne 0x1000ab540
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000ab6a1
test byte [rcx + 0x1c], 1
je 0x1000ab6a1
mov rcx, qword [rcx + 0x10]
lea edx, [rdi - 0x16]
lea r8, [0x100002ff8]
call fcn.100020584
jmp 0x1000ab6a1
lea rax, [rsp + 0x50]
mov r14d, 0x104
mov r8, r12
lea rcx, [rsp + 0x50]
mov r9d, r13d
sub r8, rax
mov rdx, r14
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x1000ab580
movzx eax, word [r8 + rcx]
cmp ax, r13w
je 0x1000ab580
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000ab55c
cmp rdx, r13
jne 0x1000ab58f
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r13d
mov word [rcx], r13w
jge 0x1000ab5c3
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000ab6a1
test byte [rcx + 0x1c], 1
je 0x1000ab6a1
mov edx, 0x46
jmp 0x1000ab691
mov ebx, r13d
lea r8, [rsp + 0x50]
mov r9d, ebx
mov rdx, r14
mov rcx, rsi
call fcn.100058674
cmp eax, r13d
mov r9d, eax
jl 0x1000ab673
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, r13d
je 0x1000ab66e
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp eax, r13d
je 0x1000ab62e
cmp ebx, r13d
je 0x1000ab622
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, r13d
jle 0x1000ab62e
mov rax, qword [rsp + 0x3c]
mov ebp, ebx
mov qword [rsp + 0x20], rax
inc ebx
cmp ebx, 0xa
jb 0x1000ab5c6
mov r9d, ebp
mov r8, r12
mov rdx, r14
mov rcx, rsi
call fcn.100058674
cmp eax, r13d
mov r9d, eax
jge 0x1000ab66e
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000ab6a1
test byte [rcx + 0x1c], 1
je 0x1000ab6a1
mov edx, 0x48
jmp 0x1000ab691
mov edi, r13d
jmp 0x1000ab6a1
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000ab6a1
test byte [rcx + 0x1c], 1
je 0x1000ab6a1
mov edx, 0x47
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020d8c
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000abaa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xa0]
mov r15, r8
mov r13d, edx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp dword [rsp + 0xa0], 0xffffffff
je 0x1000abaf5
cmp dword [rsp + 0xa0], 0
je 0x1000abaf5
mov ebp, dword [rsp + 0xa0]
sub ebp, ebx
mov r9d, ebp
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp eax, r13d
jne 0x1000abb4e
mov ebx, 1
jmp 0x1000abb33
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1000abb1d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r12d
cmp r12d, eax
jbe 0x1000abb60
dec ebx
cmp edi, r13d
je 0x1000abad8
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000abb9e
test byte [rcx + 0x1c], 4
je 0x1000abb9e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov edx, 0x54
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.100020b88
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret

Function at 0x1000af8b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1000af911
mov rax, qword [0x1000dedd8]
lea rcx, [0x1000dedd8]
cmp rax, rcx
je 0x1000af911
test byte [rax + 0x1c], 1
je 0x1000af911
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1000dedd8]
lea r8, [0x100002f38]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x7f
call fcn.100020d8c
lea rcx, [rbx + 0x88]
call fcn.1000b0220
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000af92f
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and qword [rbx], 0
lea rcx, [rbx + 0x88]
call fcn.1000b028c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1000af954
Function at 0x1000b00a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
mov ecx, edi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000b0123
test byte [rcx + 0x1c], 4
je 0x1000b0123
cmp eax, esi
jb 0x1000b0103
sub eax, esi
jmp 0x1000b0107
sub eax, esi
dec eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb8]
mov edx, 0x18
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.100020b88
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1000b2ac0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, r8
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x92]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x90], bp
call sub.msvcrt.dll_memset
xor eax, eax
lea r8, [0x10001aca0]
lea rcx, [rsp + 0x90]
mov r9, rdi
mov edx, 0x104
mov word [rsp + 0x68], bp
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], eax
call fcn.100058674
cmp eax, ebp
mov edi, eax
jge 0x1000b2b8d
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000b2cb6
test byte [rcx + 0x1c], 1
je 0x1000b2cb6
lea edx, [rbp + 0x22]
mov r9d, eax
jmp 0x1000b2ca6
lea r8, [0x10000c438]
lea rcx, [rsp + 0x68]
mov r9d, esi
mov edx, 0x10
call fcn.100058674
cmp eax, ebp
mov edi, eax
jge 0x1000b2bd4
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000b2cb6
test byte [rcx + 0x1c], 1
je 0x1000b2cb6
mov edx, 0x23
jmp 0x1000b2b85
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x1000b2c77
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x1000b2c77
mov eax, dword [rsp + 0x64]
lea rdx, [rsp + 0x68]
mov r9d, 0xb
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebp
je 0x1000b2c73
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000b2cb6
test byte [rcx + 0x1c], 1
je 0x1000b2cb6
mov edx, 0x25
jmp 0x1000b2c95
mov edi, ebp
jmp 0x1000b2cb6
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000b2cb6
test byte [rcx + 0x1c], 1
je 0x1000b2cb6
mov edx, 0x24
movzx r9d, ax
or r9d, 0x80070000
cmp eax, ebp
cmovle r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020d8c
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x1000b2cc6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000cd2b8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1000cd34b
cmp dword [rsp + 0x24], 5
jb 0x1000cd365
jmp 0x1000cd361
cmp dword [rsp + 0x30], esi
jne 0x1000cd365
cmp dword [rsp + 0x24], 4
ja 0x1000cd361
jne 0x1000cd365
cmp dword [rsp + 0x28], 0
jbe 0x1000cd365
mov byte [rbx + 0x18], sil
lea rax, [0x100002328]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1000483d0
movzx ecx, byte [0x1000e2c2c]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1000e2c2c], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1000cd7d0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1000de138]
jne 0x1000cd7eb
rol rcx, 0x10
test cx, 0xffff
jne 0x1000cd7e7
ret 0
ror rcx, 0x10
jmp 0x1000cdef0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1000df140]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1000df238]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000cdf75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1000df140]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x1000cdf97
mov rax, qword [rsp + 0x88]
mov qword [0x1000df238], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000df1d8], rax
mov rax, qword [0x1000df238]
mov qword [0x1000df0b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000df1c0], rax
mov dword [0x1000df0a0], 0xc0000409
mov dword [0x1000df0a4], 1
mov rax, qword [0x1000de138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1000de140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000023b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1000cdd8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000cddd9
cmp rcx, 0xffffffffffffffff
je 0x1000cddd9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000cddd1
cmp dword [rcx + 0x3c], edx
jl 0x1000cddd1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000cddd1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000cddd9
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1000ce048
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1000ce0b3
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1000ce0d3
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1000023c8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1400029f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002a3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002a3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002a3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002a3a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002a3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002a3c
xor al, al
add rsp, 0x28
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40da8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x411e70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x411e7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x411e8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x411e75
lea eax, [rcx + 1]
jmp 0x411e9b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x411eae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x411e94
sub eax, 3
jb 0x411ece
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x411f1d
sar eax, 1
movsxd rbp, eax
jb 0x411f04
jmp 0x411edc
add ebx, ebx
jne 0x411eda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x411f04
inc ecx
add ebx, ebx
jne 0x411eea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x411f04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x411efd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x411eec
add ecx, 2
jmp 0x411f09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00411e32
jmp 0x411e7d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x6600
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x411f69
cmp rsi, rcx
jae 0x411f71
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x411f50
cmp al, 0x8f
ja 0x411f50
cmp byte [rsi - 2], 0xf
je 0x411f56
sub al, 0xe8
cmp al, 1
ja 0x411f3a
cmp rsi, rcx
jae 0x411f71
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x411f40
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x411f71
lodsb al, byte [rsi]
jmp 0x411f50
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf000]
mov eax, dword [rdi]
or eax, eax
je 0x411fce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x12000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x411f7e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x411fc8
mov qword [rbx], rax
add rbx, 8
jmp 0x411f9e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x412026
sub rsp, 0xffffffffffffff80
jmp 0x401710
Function at 0x18000a140
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movaps xmmword [rax - 0x28], xmm6
mov r15, rcx
test r8, r8
je 0x18000a268
mov rdi, rcx
lea rbp, [r8 - 1]
sub rdi, rdx
shr rbp, 4
add rdi, 0xf0
lea rsi, [rdx + 9]
inc rbp
lea rbx, [rsi - 9]
mov r8, r15
movups xmm6, xmmword [rbx]
mov rdx, rbx
mov cl, 0xe
call fcn.18000a2b8
mov r14b, 0xd
mov al, byte [rsi]
mov rdx, rbx
mov cl, byte [rsi + 4]
mov r9d, 4
mov byte [rsi + 4], al
mov al, byte [rsi - 4]
mov byte [rsi], al
mov al, byte [rsi - 8]
mov byte [rsi - 4], al
mov al, byte [rsi + 1]
mov byte [rsi - 8], cl
mov cl, byte [rsi - 7]
mov byte [rsi - 7], al
mov al, byte [rsi + 5]
mov byte [rsi + 1], cl
mov cl, byte [rsi - 3]
mov byte [rsi - 3], al
mov al, byte [rsi - 2]
mov byte [rsi + 5], cl
mov cl, byte [rsi - 6]
mov byte [rsi - 6], al
mov al, byte [rsi + 2]
mov byte [rsi - 2], al
mov al, byte [rsi + 6]
mov byte [rsi + 2], al
mov byte [rsi + 6], cl
mov rcx, rdx
mov r8d, 4
movzx eax, byte [rcx]
lea r10, [0x1800374a0]
mov al, byte [rax + r10]
mov byte [rcx], al
lea rcx, [rcx + 4]
sub r8, 1
jne 0x18000a1f3
inc rdx
sub r9, 1
jne 0x18000a1ea
mov r8, r15
mov rdx, rbx
mov cl, r14b
call fcn.18000a2b8
test r14b, r14b
je 0x18000a23a
mov rcx, rbx
call fcn.18000a440
add r14b, 0xff
jmp 0x18000a19b
mov ecx, 0x10
mov al, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000a23f
add rsi, 0x10
sub rdi, 0x10
movdqu xmmword [r15 + 0xf0], xmm6
sub rbp, 1
jne 0x18000a184
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18000a2b8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov dword [rsp + 0x38], 0x78
xor edi, edi
mov al, byte [0x18004d013]
mov rbx, r8
mov eax, 0x74
movzx r10d, cl
mov word [rsp + 0x38], ax
mov r9, rdx
movzx eax, byte [0x18004d04b]
mov dword [rsp + 0x38], 0xc07428ff
mov dword [rsp + 0x38], eax
mov qword [rsp + 8], 0xc01c
mov rax, qword [0x18004d100]
mov word [rsp], ax
mov al, byte [0x18004d033]
cmp word [0x18004d04c], di
mov rcx, qword [0x18004d140]
mov byte [rsp + 0x38], al
movzx eax, word [0x18004d0c4]
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x38], 0x8c
mov word [rsp + 4], ax
movabs rax, 0xca6d9379e309
mov qword [rsp + 0x38], rax
mov eax, 0x5496
mov byte [rsp + 0x38], 0x2e
mov word [rsp + 0x38], ax
movzx eax, word [0x18004d0d8]
mov qword [rsp + 0x38], rax
mov eax, 0xd549
mov word [rsp + 0x38], ax
mov eax, 0x89
mov word [rsp + 0x38], ax
movsx rax, word [0x18004d158]
mov qword [rsp + 0x38], rax
mov eax, dword [0x18004d0f8]
mov byte [rsp + 0x38], 0xe3
mov dword [rsp + 0x38], eax
mov eax, 0xbac66d8f
mov dword [rsp + 0x38], 0x8cbd5cd8
mov qword [rsp + 0x38], rax
je 0x18000a3f5
test rcx, rcx
je 0x18000a3bf
mov eax, 0xff9b
mov word [0x1800d9cf6], ax
jmp 0x18000a3fa
movsx ecx, word [rsp]
mov edx, edi
movzx eax, word [0x18004d07c]
cmp ecx, eax
movzx eax, word [rsp + 4]
mov ecx, edi
setle dl
cmp ax, word [0x18004d174]
sete cl
cmp ecx, edx
jae 0x18000a3fa
movzx eax, byte [0x18004d04e]
add dword [0x18004d138], eax
jmp 0x18000a3fa
mov rax, qword [rsp + 8]
mov r11d, r10d
mov r8b, dil
shl r11d, 2
movzx edx, r8b
mov r10b, dil
add edx, r11d
shl edx, 2
movzx eax, r10b
inc r10b
add eax, edx
mov cl, byte [rax + rbx]
xor byte [r9], cl
inc r9
cmp r10b, 4
jb 0x18000a411
inc r8b
cmp r8b, 4
jb 0x18000a404
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x10
pop rdi
ret
Function at 0x18002e50c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18002e3e3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18002e3e3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002e3e3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18002e3e3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18002e3e3
cmp dword [rcx + 0x84], 0xe
jbe 0x18002e3e3
cmp dword [rcx + 0xf8], 0
je 0x18002e3e3
mov ecx, ebx
call fcn.18002e484
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.18002e274
cmp dword [rbp + 0x20], 0
je 0x18002e430
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18002e438
int3
xor r8d, r8d
xor edx, edx
jmp 0x18002e37c