joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140194320
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r10, rdx
mov rdx, r10
xchg r10, rdx
xchg rbx, r11
mov rbx, rcx
xchg rbx, r11
mov dword [rsp + 0x30], 0x576c8f31
xor dword [rsp + 0x30], 0x2068decc
sub dword [rsp + 0x30], 0x49f59ff4
sub dword [rsp + 0x30], 0x21c3a4b
xor dword [rsp + 0x30], 0x76199a5d
xor dword [rsp + 0x30], 0x53273428
add dword [rsp + 0x30], 0x120b2c40
xor dword [rsp + 0x30], 0xd72ef0fd
mov dword [rsp + 0x36], 0x3d7fd1f2
xor dword [rsp + 0x36], 0x770a9aad
sub dword [rsp + 0x36], 0x156b3c52
sub dword [rsp + 0x36], 0x2fa495ea
sub dword [rsp + 0x36], 0x3bba470
add dword [rsp + 0x36], 0xfdb02aa7
mov dword [rsp + 0x3a], 0x68729342
sub dword [rsp + 0x3a], 0x62773d4d
xor dword [rsp + 0x3a], 0x1dd1d841
xor dword [rsp + 0x3a], 0x1e78f00c
add dword [rsp + 0x3a], 0x198e6f93
xor dword [rsp + 0x3a], 0x8030e6b
add dword [rsp + 0x3a], 0xe77b1c3d
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x1401943ec
xchg r11, rax
mov r11, qword [rsp + 0x70]
xchg r11, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
xchg r13, r8
mov r9, r13
xchg r8, r13
lea r8, [rsp + 0x36]
xchg r10, rdx
mov r10, rdx
xchg r10, rdx
xchg rsi, rcx
mov rsi, r11
xchg rsi, rcx
call fcn.1401944a0
nop
mov byte [rsp + rbx + 0x36], 0x71
sub byte [rsp + rbx + 0x36], 0x28
xor byte [rsp + rbx + 0x36], 0x7c
add byte [rsp + rbx + 0x36], 0x3d
sub byte [rsp + rbx + 0x36], 0x15
add byte [rsp + rbx + 0x36], 0x1c
xor byte [rsp + rbx + 0x36], 0x38
sub byte [rsp + rbx + 0x36], 0x41
inc rbx
cmp rbx, 8
jb 0x140194448
add rsp, 0x40
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140199270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rdi, r13
mov r13, rdx
xchg r13, rdi
test rdx, rdx
jne 0x140199297
mov eax, ebx
jmp 0x1401992e5
mov eax, 0x59625abd
sub eax, 0x7f6fa7e
xor eax, 0x5b0ac60b
add eax, 0x319f4235
add eax, 0x2800e55f
sub eax, 0x23f21d5c
sub eax, 0x1f7e996e
sub eax, 0x2090bcb1
cmp word [rdx], ax
je 0x1401992d4
xchg r14, rax
mov r14, rbx
xchg r14, rax
jmp 0x1401992e5
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg rdx, rbp
mov qword [rsp + 0x50], rdx
xchg rbp, rdx
mov ecx, 0x7e4f2cd5
sub ecx, 0x3b9ad3de
add ecx, 0x1288e684
xor ecx, 0x644fc238
add ecx, 0x4db30998
sub ecx, 0x255f200b
sub ecx, 0x27304f26
add ecx, 0x3924edcc
sub ecx, 0x6bbb836b
xchg rdx, rsi
mov qword [rsp + 0x58], rdx
xchg rsi, rdx
xchg r10, r12
mov qword [rsp + 0x60], r10
xchg r12, r10
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp word [rax + 0x18], cx
jne 0x1401993b9
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x1401993b9
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x1401993b9
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076220
cmp eax, r13d
je 0x14019940d
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140199389
xor eax, eax
xchg r9, r15
mov r9, qword [rsp + 0x20]
xchg r9, r15
mov r14, qword [rsp + 0x28]
xchg r12, r8
mov r8, qword [rsp + 0x60]
xchg r8, r12
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r13
push rax
push rdx
push rbx
push rax
push rcx
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rcx
pop rax
pop rbx
pop rdx
pop rax
add rsp, 8
nop
mov rbx, qword [rsp]
add rsp, 8
ret
mov rax, rbp
jmp 0x1401993bb
Function at 0x1401ab180
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdx, rbp
mov r11, rbp
xchg rdx, rbp
xchg r10, r14
mov r14, rcx
xchg r10, r14
test rdx, rdx
je 0x1401ab204
xchg rbx, r12
mov qword [rsp], r12
xchg rbx, r12
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab1f7
movzx eax, byte [r10]
test bl, bl
je 0x1401ab1d9
lea rcx, [r9 - 1]
xchg r9, rdx
mov r9, rdx
xchg r9, rdx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab1c8
jmp 0x1401ab1f7
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab1e8
inc r10
sub r11, 1
jne 0x1401ab1aa
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0190
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rbp
mov qword [rsp + 0x10], r9
xchg rbp, r9
mov qword [rsp + 0x20], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
mov eax, 0x4af6e661
add eax, 0x1188f379
sub eax, 0x2b609c7f
add eax, 0x25d3e731
xor eax, 0x3e0639d
xor eax, 0x551354a1
call fcn.1401fd400
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x6c4c1e60
xor r9d, 0xc03bd94
sub r9d, 0x34c2ede1
add r9d, 0x3748094
xor r9d, 0x64cc6935
xor r9d, 0x4bcd5f93
mov dword [rsp + 0x13a4], 0x3042db14
add dword [rsp + 0x13a4], 0x356eff6c
xor dword [rsp + 0x13a4], 0x3fad2892
xor dword [rsp + 0x13a4], 0xcd0a043
add dword [rsp + 0x13a4], 0x10f16a3c
xor dword [rsp + 0x13a4], 0x2f4899fc
xor dword [rsp + 0x13a4], 0x3ed19145
add dword [rsp + 0x13a4], 0x89db4bcb
nop dword [rax + rax]
mov r8d, eax
shr r8d, 4
shr r8d, 9
shr r8d, 0x10
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b0268
mov ebp, 0x4c7cd541
add ebp, 0x320c854
sub ebp, 0x2dcbd07a
xor ebp, 0x46b7f1f9
xor ebp, 0x2a1d613c
add ebp, 0xdf4568b
sub ebp, 0x483336c9
xor ebp, 0x287bc817
add ebp, 0x44b84a49
mov dword [rsp + 0x20], 0x79126ae4
sub dword [rsp + 0x20], 0x256dcc79
add dword [rsp + 0x20], 0x7ad4a1b
xor dword [rsp + 0x20], 0x6fbc993d
add dword [rsp + 0x20], 0x1a8b2393
xor dword [rsp + 0x20], 0x6c42d630
xor dword [rsp + 0x20], 0x579fe2ae
sub dword [rsp + 0x20], 0x74a59f60
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b0359
call fcn.1401b0610
mov ecx, eax
jmp 0x1401b03b3
inc edi
mov ebx, edi
call fcn.1401b0610
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b03a9
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b03a9
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0610
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b038e
shr rcx, 0x1e
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rdi, rbx
mov rdi, qword [r11 + 0x10]
xchg rdi, rbx
lea eax, [rdx + rbp]
xchg rcx, rbp
mov rcx, qword [r11 + 0x18]
xchg rcx, rbp
lea ecx, [rdx - 0x80000000]
xchg rbx, rsi
mov rbx, qword [r11 + 0x28]
xchg rsi, rbx
cmovae eax, ecx
mov rsp, r11
push rax
push rcx
push rcx
push rdx
push rbx
push rdx
push rbx
push rdx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0610
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x46261904
sub r9d, 0x23dd78f1
add r9d, 0x1fe3a3ce
add r9d, 0x3763c44e
sub r9d, 0x2bd5873a
xor r9d, 0x2316783
add r9d, 0x2dccb75f
sub r9d, 0x7d589c65
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b06aa
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b0665
mov ecx, dword [r10]
jmp 0x1401b07ef
cmp ecx, 0x4e0
jb 0x1401b07ef
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x23539b52
add ebx, 0x25e92456
sub ebx, 0x15ce6ad5
xor ebx, 0x3e7c15c3
add ebx, 0x628a9f21
sub ebx, 0x4e2ef696
sub ebx, 0x216de8b8
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b06ed
lea r11, [r10 + 0xd50]
mov ebx, 0x4a1db979
add ebx, 0x2fcf3f54
xor ebx, 0x8162818
sub ebx, 0x4faeab60
add ebx, 0x2dd95d5a
xor ebx, 0x611aad52
xor ebx, 0x3154c97c
xor ebx, 0x6be76d
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b076b
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rbx, r15
mov r15, qword [rsp]
xchg rbx, r15
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 5
shr ecx, 1
shr ecx, 4
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 3
shl eax, 3
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xc
shl eax, 2
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 4
shr eax, 3
shr eax, 2
shr eax, 8
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba4c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9b03
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9af0
mov r8, qword [rcx - 8]
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9b1b
xchg r10, r8
mov rcx, r10
xchg r10, r8
call fcn.1401fd08c
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
xchg qword [rsp + 8], rbx
pop rdx
add rsp, 8
jmp 0x1401ba4c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
nop
push r13
mov qword [rsp], rsi
sub rsp, 0x20
xchg rbx, rbp
mov rbp, qword [rcx]
xchg rbp, rbx
xchg r9, rcx
mov rsi, r9
xchg rcx, r9
mov rax, qword [rbx + 8]
mov qword [rax], 0x51845a7b
xor qword [rax], 0x7828cab0
sub qword [rax], 0x3b07cfb
add qword [rax], 0x3a04b489
sub qword [rax], 0x363337ad
xor qword [rax], 0x29cd90ac
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba58c
xchg r15, rdi
mov qword [rsp + 0x30], r15
xchg rdi, r15
nop dword [rax + rax]
xchg rdx, rdi
mov rdx, qword [rbx]
xchg rdx, rdi
lea rdx, [rbx + 0x10]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.1401b3640
mov edx, 0x166f3072
add edx, 0x90d2a10
add edx, 0x3741b146
add edx, 0x88e6ea4
xor edx, 0x29212c4b
xor edx, 0x766d5677
xchg rdi, rcx
mov rdi, rbx
xchg rcx, rdi
call fcn.1401fd08c
mov rbx, rdi
test rdi, rdi
jne 0x1401ba52f
mov rdi, qword [rsp + 0x30]
xchg rcx, r8
mov r8, qword [rsi]
xchg rcx, r8
mov edx, 0x4636272e
xor edx, 0x1dc03388
add edx, 0x1d9aff03
add edx, 0x5660e71
xor edx, 0x4c7ac089
xor edx, 0x26a53770
add edx, 0x35c785be
xor edx, 0x49f05bf1
xchg rbp, rbx
mov rbp, qword [rsp + 0x38]
xchg rbp, rbx
add rsp, 0x20
push rax
push rcx
push rcx
push rax
push rax
push rdx
push rdx
xchg qword [rsp + 0x38], rsi
add rsp, 0x40
jmp fcn.1401fd08c
Function at 0x1401bd0e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg rbp, rcx
mov rbx, rbp
xchg rbp, rcx
je 0x1401bd2aa
cmp byte [rcx + 0x71], 0
je 0x1401bd2aa
mov rax, qword [rcx]
mov edx, 0x720d2fdc
sub edx, 0x13a71e7c
add edx, 0x1a18c135
sub edx, 0x8df0516
sub edx, 0x136d534d
add edx, 0xa3cd85cd
xchg r12, rdi
mov qword [rsp + 0x68], r12
xchg rdi, r12
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1401bd28a
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg rcx, rax
mov qword [rsp + 0x20], rcx
xchg rcx, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401bd1c4
sub eax, 1
je 0x1401bd1e4
cmp eax, 2
jne 0x1401bd28a
mov rdi, qword [rsp + 0x68]
mov al, 0xf
add al, 4
xor al, 0x59
add al, 5
sub al, 5
sub al, 0x49
mov byte [rbx + 0x71], 0x1f
xor byte [rbx + 0x71], 0x15
add byte [rbx + 0x71], 0x18
add byte [rbx + 0x71], 0x4d
sub byte [rbx + 0x71], 0x39
add byte [rbx + 0x71], 0x1d
sub byte [rbx + 0x71], 0x53
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x71], 0x71
sub byte [rbx + 0x71], 6
xor byte [rbx + 0x71], 0x79
add byte [rbx + 0x71], 0x50
sub byte [rbx + 0x71], 0x1d
add byte [rbx + 0x71], 0x31
xor byte [rbx + 0x71], 0x73
xor byte [rbx + 0x71], 5
xchg rdi, r14
mov r14, qword [rsp + 0x60]
xchg rdi, r14
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401bd25c
xchg r9, r13
mov r13, qword [rbx + 0x80]
xchg r9, r13
lea rcx, [rsp + 0x30]
xchg r11, rdi
mov r8, r11
xchg r11, rdi
mov edx, 0x3765cceb
add edx, 0x25d133af
xor edx, 0x6300d6ac
xor edx, 0x525cf968
sub edx, 0x149bd0ce
xor edx, 0x1969aa38
add edx, 0x2b33152b
sub edx, 0x72a9cc4b
xor edx, 0x7303d89
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401bd28a
cmp byte [rbx + 0x71], 0
xchg rdi, r9
mov r9, qword [rsp + 0x68]
xchg r9, rdi
sete al
add rsp, 0x50
push rcx
push rax
push rax
xchg qword [rsp + 0x18], rbx
pop rax
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
push rcx
push rax
push rcx
xchg qword [rsp + 0x18], rbx
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 1
xor al, 0x72
sub al, 0x3a
xor al, 0x65
sub al, 0x54
xor al, 3
sub al, 0xa
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401fda5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fdaa6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fdaa6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fdaa6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fdaa6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fdaa6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fdaa8
xor al, al
add rsp, 0x28
ret

Function at 0x1401fe230
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x140c5c210
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x140b3faa6

Function at 0x140da3314
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1402e641b

Function at 0x140001000
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x278
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor eax, eax
lea rcx, [rsp + 0x52]
xor edx, edx
mov qword [rsp + 0x30], rax
mov r8d, 0x206
mov word [rsp + 0x50], ax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 4
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.MyApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x1400010d9
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x208
lea rdx, str.MyApp
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea r8, [0x1400022ec]
lea rdx, [0x1400022ec]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001130
add rsp, 0x278
ret

Function at 0x140001a40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a8c
xor al, al
add rsp, 0x28
ret
Function at 0x180002400
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rdi, r8d
mov rsi, rdx
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, rdi
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000244d
lea rcx, [0x1800164a0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.180003160
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180002970
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x358
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, str._version
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r11, rax
mov qword [0x18001f7b0], rax
test rax, rax
jne 0x180002a03
lea r8, [rsp + 0x20]
lea rdx, [0x1800166c8]
lea rcx, [rsp + 0x130]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, str.AheadLib
lea rdx, [rsp + 0x130]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r11, qword [0x18001f7b0]
xor eax, eax
test r11, r11
setne al
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180002fd0
add rsp, 0x358
ret

Function at 0x180002a30
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov rcx, qword [0x18001f7b0]
test rcx, rcx
jne 0x180002a74
call fcn.180002970
test eax, eax
jne 0x180002a6d
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x18001f7b0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180002ae3
mov rax, rbx
shr rax, 0x10
test ax, ax
jne 0x180002aa8
lea rdx, [0x180016720]
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rbx, [rsp + 0x20]
lea rdx, [0x1800166f8]
lea rcx, [rsp + 0x30]
mov r8, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, str.AheadLib
lea rdx, [rsp + 0x30]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180002fd0
add rsp, 0x150
pop rbx
ret
Function at 0x1800037eb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x180002fea
rol rcx, 0x10
test cx, 0xffff
jne 0x180002fe6
repz ret
ror rcx, 0x10
jmp 0x180003744
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001fb70]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18001fc68]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800037c9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001fb70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800037eb
mov rax, qword [rsp + 0x88]
mov qword [0x18001fc68], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001fc08], rax
mov rax, qword [0x18001fc68]
mov qword [0x18001fae0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001fbf0], rax
mov dword [0x18001fad0], 0xc0000409
mov dword [0x18001fad4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18001e008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001fb68], eax
mov ecx, 1
call fcn.180004f44
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180016878]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001fb68], 0
jne 0x180003872
mov ecx, 1
call fcn.180004f44
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180006650
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.180006504
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]