joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458610
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x45861d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x45862d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x458615
lea eax, [rcx + 1]
jmp 0x45863b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x45864e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x458634
sub eax, 3
jb 0x45866e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x4586bd
sar eax, 1
movsxd rbp, eax
jb 0x4586a4
jmp 0x45867c
add ebx, ebx
jne 0x45867a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x4586a4
inc ecx
add ebx, ebx
jne 0x45868a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x4586a4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x45869d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x45868c
add ecx, 2
jmp 0x4586a9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.004585d2
jmp 0x45861d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2200
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x45870d
cmp rsi, rcx
jae 0x458715
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x4586f4
cmp al, 0x8f
ja 0x4586f4
cmp byte [rsi - 2], 0xf
je 0x4586fa
sub al, 0xe8
cmp al, 1
ja 0x4586de
cmp rsi, rcx
jae 0x458715
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x4586e4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x458715
lodsb al, byte [rsi]
jmp 0x4586f4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x56000]
mov eax, dword [rdi]
or eax, eax
je 0x458772
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x58000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x458722
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x45876c
mov qword [rbx], rax
add rbx, 8
jmp 0x458742
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.004587f5], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.004587f5
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4587e5
sub rsp, 0xffffffffffffff80
jmp 0x4014c0
Function at 0x14155a54b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
jmp 0x1415f5d91
jmp 0x1415c4be3
xor dl, r11b
movzx eax, di
add dl, 0x1e
lea rax, [r10*8 - 0x1fc2070]
ror dl, 1
call fcn.1415f0cef
mov rax, qword [rbp + rbx*8]
push 0xffffffffe11e7f38
cmp ebx, 1
push 0xffffffffbb0623a2
lea rsp, [rsp + 0x10]
jne 0x1415f5985
push 0x5208cea2
mov rcx, rax
call fcn.141591398
lea rdi, [rbx*4 - 0x4bfad352]
mov rsp, qword [rbp + rbx - 0x5a05c797]
mov r9d, edi
mov rbp, qword [r9 + rbp - 0x1c1c4ad2]
lea r10, [rdi*4 - 0x60598de7]
mov qword [rbp + r9 - 0x1c1c4aca], rax
movsx r11d, dil
mov r11, rbp
call fcn.1416053f5
call fcn.1415e1d40
movzx edx, byte [r9]
mov r10d, 0x5c1560a2
lea r9, [r9 + r10 - 0x5c1560a1]
movsx edi, r10w
jmp 0x14159ea8d
dec ebx
lea rsp, [rsp + 8]
jne 0x1415662d6
push 0xfffffffff697c913
mov rax, qword [rbp + riz]
sub rsp, 0x18
push 0xffffffffe11d4c35
lea rsp, [rsp + 8]
call rax
mov ebx, 0x5a05c787
jmp 0x1415c605a

Function at 0x14155c38c
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
lea r8, [r8 + rax*2 - 0x6c5cc94]
and rbp, r10
not rbp
mov qword [rsp + rax*8 - 0x1b173270], rax
xchg byte [rsp + rcx - 0x6dbc651d], ah
mov qword [r8 + rcx - 0x6dbc6521], rbp
movzx r10d, si
mov edx, dword [r9 + rax*4 - 0xd880138]
sub rcx, 0x3628519f
and ecx, r10d
lea r9, [r9 + rcx*4 - 0x4bfc]
mov edi, r10d
xor word [rsp + rcx - 0x12ff], 0x4635
xor edx, r11d
rol edx, 2
call fcn.1415fef63

Function at 0x14156b32a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
dec dword [rsp + r10 - 0x3633ef72]
shr byte [rsp + rbp*2 - 0x7c946750], 0x86
lea rsi, [r10 + rsi - 0x3633ef80]
shld r11w, r9w, cl
ror qword [rsp + r10*2 - 0x6c67defc], 0xc4
jb 0x1415a4b8c
jb 0x1415fb7fd
mov word [rsi + r10 - 0x3633ef84], r11w
movzx r11d, bpl
push rax
lea rbx, [r10 + rbx - 0x3633ef88]
mov r11d, dword [r10 + rbx - 0x3633ef84]
lea rdx, [rbp*2 - 0x36e85e55]
pop rcx
lea r9, [rbp*4 + 0x4f2e2211]
xor r11d, edi
neg byte [rsp + r10 - 0x3633ef74]
inc byte [rsp + r10*2 - 0x6c67def2]
xadd rcx, r10
xor r11d, 0xd70d301c
and qword [rsp + rdx - 0x45ac08f9], 0x1aaf0588
not r11d
xor r11d, 0xb985b62e
rol cl, 0xc4
sal dword [rsp + rbp*2 - 0x7c94674b], cl
inc r11d
bswap r9d
or r10d, dword [rsp + rdx - 0x45ac08fb]
cmovnp rbp, rdx
mov qword [rsp + rbp - 0x3e4a339d], rdi
xor dword [rsp + rbp - 0x3e4a339d], r11d
push r10
mov rdi, qword [rsp + rbp - 0x3e4a3395]
bswap ecx
shl dx, 0x25
movsxd r11, r11d
add r8, r11
sar dword [rsp + rbp - 0x3e4a339c], cl
mov qword [rsp + rbp*2 - 0x7c946742], r9
mov qword [rsp + rbp - 0x3e4a33ad], r8
ret 0x18
ror edi, 1
mov r9d, eax
neg r9b
bswap edi
call fcn.14159b164
mov edi, 0x7b12f3a0
mov r11, qword [rbx + rdi - 0x7b12f3a0]
lea rbx, [rbx + r8 - 0x212b3c4]
sal word [rsp + r8 - 0x212b3a4], 0x29
mov dword [r8 + rbx - 0x212b3c0], r11d
jbe 0x1415b86a7
lea rsi, [rsi + rax*2 - 0x15a]
xor edi, ebp
jmp 0x1415911e0
jmp 0x1415de675
inc r8b
add r10, r11
mov r11, rbx
mov qword [rsp + r8*2 - 0x4256768], rdx
jmp 0x1415f4133

Function at 0x141597d47
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea rbp, [rsp + rbp + 0x10]
mov edi, dword [rsi + rbp]
lea rbp, [rdx + rsi + 0x39ab53bb]
call fcn.1415c9d6f
jmp 0x1415627cf
Function at 0x141598e95
Capabilities:
Encode data using base64

Disassembly:
dec rdx
lea rax, [r10 + rdi*8 - 0x155f9676]
sal r10b, 0x61
pop rcx
xor rdx, 0xffffffffc39e8727
ror rdx, 5
jmp 0x14161e110
xor r11, rdx
add r10d, dword [rsp + rbp - 0x2630]
shl ebp, 0x3f
mov qword [rbp + r8 - 8], rdx
call fcn.141557e30

Function at 0x1415b0506
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov dword [rbp + rsi - 0x438000], r9d
sal edx, cl
pop rax
jae 0x1415c46bb

Function at 0x1415b95ea
Capabilities:
Encrypt data using chaskey
Encrypt data using rc4 ksa

Disassembly:
dec eax
mov qword [rsp + rdi*2 + 0x10], rsi
or rdi, 0x5f0e1981
xor qword [rsp + r10*2 - 0x513e740], r11
movsx r11d, sil
movsx edx, byte [rsp + r10 - 0x289f39b]
xor dword [rsp + r10*2 - 0x513e740], eax
lea rcx, [rsi*4 + 0x57112685]
sub r10d, 0xe80de0b
call fcn.14159a4e0
movzx ebp, word [r9]
mov edx, 0xe497bd0e
movzx esi, dx
lea r9, [r9 + rsi*4 - 0x2f436]
movzx ecx, si
xor bp, r11w
sub ecx, edx
movsx edi, dl
rol bp, 1
shr ecx, 0x86
sar ecx, 0x4f
not bp
sar rdi, cl
rol bp, 1
sal rdx, cl
mov eax, 0x9832289
inc bp
lea r10, [rsi - 0x57c0e146]
sub ecx, r10d
xchg esi, edi
xor r11w, bp
shr di, 0xaa
call fcn.1415ffcd2

Function at 0x1415d5f05
Capabilities:
Encode data using base64

Disassembly:
bswap r9d
inc r10w
or byte [rsp + rax - 0x1d09fff3], 0xb7
sbb r9d, 0xa6baa332
push r10
not rax
mov qword [rsp + rax*2 + 0x3a14001a], r8
xadd rbp, r10
call fcn.1415fca29
mov eax, dword [rsi + r11*4 - 0x7edda294]
lea rsi, [rsi + r11*2 - 0x3f6ed146]
xor eax, ebp
bswap eax
xor eax, 0xcb57986
movzx edi, r11b
not eax
xor eax, 0xf6ba989a
push rbp
xor dword [rsp + r11 - 0x1fb768a5], eax
pop rbp
rol dil, 0x41
movzx ecx, dil
adc dil, 8
movsxd rax, eax
setl r11b
adc r10, rax
inc cl
mov ebx, dword [rbx + r11*2 - 0x3f6ed000]
Function at 0x1415e319d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
add rsi, 4
movsx r10d, bl
movzx ecx, r10b
xor r9d, r8d
bswap r10d
bswap r9d
sub r9d, 0x92b76304
shr dword [rsp + r10*4 - 0x1bfffffc], 6
bswap r9d
movsx eax, byte [rsp + r10*4 - 0x1bffffff]
rol bp, cl
not r9d
ror r9d, 1
add cl, bh
pop rbx
dec cx
push r8
dec bp
xchg cl, bpl
xor dword [rsp + r10*2 - 0xe000000], r9d
pop r8
jmp 0x141595f8b
call fcn.141614782
mov cx, word es:[r10]
lea rbx, [rbp + rbp - 0x4a4f8559]
add r11, 6
mov word [r11], cx
mov qword [rsp], rbx
mov r9d, dword [rsi]
jmp 0x141587ac8

Function at 0x1415ef9c9
Capabilities:
Encode data using xor

Disassembly:
push rbp
pushfq
movabs rbp, 0x9b2cce0c842cf390
or rbp, 0xffffffffbf0a4098
mov rbp, qword [rsp + rbp + 0x40d10c70]
mov qword [rsp + 8], 0x7efa5ae0
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1415d72de
xor ch, ah
adc dl, bpl
outsb dx, byte [rsi]
insd dword [rdi], dx
invalid
add rbx, r10
mov qword [rsp + 8], 0x750db017
lea rsp, [rsp + 0x28]
jmp 0x1412fc7cb

Function at 0x1415f10f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc r10d
mov eax, 0x951fa09f
ror r10d, 2
mov qword [rsp + 8], rax
movsx ebp, ax
mov qword [rsp + 0x10], r11
movzx ecx, bp
lea r11, [rbp*8 + 0x4c3f9b3b]
xor dword [rsp + rcx - 0xa08f], r10d
mov edi, 0xfcb705b7
mov r11, qword [rsp + rcx - 0xa08f]
not eax
sal cx, 0x83
movsxd r10, r10d
pop rbp
inc edi
add rbx, r10
inc qword [rsp + rax - 0x6ae05f60]
movzx ebp, dil
mov r10d, 0x138d96b6
mov esi, dword [r8 + rcx*2 - 0x9f0]
sub bp, bp
jbe 0x14163fa47
call fcn.1415eb66d

Function at 0x1415f2aa1
Capabilities:
Execute anti-debugging instructions

Disassembly:
or dword [rsp + rdx*4 - 0x82ba], 0xca9320aa
mov r11d, r8d
xor eax, 0x143aa236
lea eax, [rdx + rax - 0x7c1894cb]
xchg byte [rsp + rdx*8 - 0x10577], r11b
neg eax
rol r8, 0xf2
mov edi, 0x6096e183
xadd word [rsp + rdx*2 - 0x4158], dx
bswap eax
mov qword [rsp + rdx - 0xfffb], rbp
push rdi
xor dword [rsp + rdx - 0xfff3], eax
mov rbp, qword [rsp + rdx - 0xfff3]
xor ax, di
inc ax
dec r9b
neg ax
mov qword [rsp], r11
xor ax, 0xaf1d
ror ax, 1
xor di, ax
call fcn.141635add
push 0x47ba008a
mov edi, dword [rsp]
rdtsc
lea rbx, [rbx + rdi - 0x47ba0092]
and word [rsp + rdi - 0x47ba0084], di
mov dword [rbx + rdi - 0x47ba0086], eax
mov eax, 0xeb186c84
jl 0x141558990
mov dword [rbx + rdi - 0x47ba008a], edx
lea r9, [rdi + 0x3282b0a3]
xadd word [rsp + r9 - 0x7a3cb12b], ax
mov edx, dword [rdi + rsi - 0x47ba008a]
lea r9, [rax + 0x46bb1d8f]
pop rcx
lea rsi, [rsi + rdi - 0x47ba0086]
xor edx, ebp
mov r11d, 0x7a3f438a
sub ecx, 0xe9272997
movsx r8d, cx
xor edx, 0x3116612f
call fcn.14163e9df

Function at 0x141603d9e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
bswap eax
add rdx, rbp
or sil, byte [rbp + rcx - 0x24201a24]
lea r8, [rdx + r8 - 0x24201a26]
or al, dh
mov word [r8 + rbp - 0x24201a24], si
sal dil, 0x25
mov qword [rsp + rdx - 0x24201a0c], 0xffffffffd51d271d
pop rdi
pop rdi
pop rdi
pop rcx
jns fcn.1415e0f85

Function at 0x141607f5a
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x2ca53236
dec ebx
jmp 0x1415c7531
Function at 0x14161967a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp], 0xffffffff8ebeafba
mov rsp, r8
jmp 0x1416213c5

Function at 0x141619df8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
movsxd r9, r9d
pop r10
call fcn.141565366

Function at 0x14161ab7a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea ebp, [r9 + rbp + 0x4a0c289b]
xor ebp, 0xd1aa81ad
mov qword [rsp + rdx - 0x1d0e1c40], r8
pop rcx
xor dword [rsp + rdx*2 - 0x3a1c3898], ebp
pop rax
jmp 0x141604b1a

Function at 0x14163151a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub eax, 0x61a81db7
xor dword [rsp + rsi + 0x2bd225fa], r10d
jmp 0x14161f1aa
mov qword [rsp + rsi*2 + 0x57a44bf4], r11
or dil, al
jp 0x1416010f0
dec rdi
push rbp
mov r11, qword [rsp + rsi + 0x2bd22602]
mov qword [rsp + rsi + 0x2bd22602], rbp
lea r8, [r8 + rax - 0x42754563]
mov dword [r8 + rsi + 0x2bd225fa], r10d
pop rsi
pop rdx
jnp fcn.1415e0f85
mov rsi, qword [r8 + rsi + 0x47140001]
call fcn.14159a4f1
jmp 0x1416053d5

Function at 0x1416371eb
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x10387507], r9
dec ebp
or qword [rsp + rbx - 0x10387507], r8
jmp 0x1415d5f85
Function at 0x140006b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r9, r8
mov r15, rdx
mov rbp, rcx
mov qword [rsp + 0x58], rcx
xor r12d, r12d
cmp byte [r8 + 0x1a], r12b
je 0x140006c75
movdqa xmm2, xmmword [0x140009f80]
movd xmm1, dword [r8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8], xmm1
movdqa xmm2, xmmword [0x140009f90]
movd xmm1, dword [r8 + 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 4], xmm1
movdqa xmm2, xmmword [0x140009fa0]
movd xmm1, dword [r8 + 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 8], xmm1
movdqa xmm2, xmmword [0x140009fb0]
movd xmm1, dword [r8 + 0xc]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 0xc], xmm1
mov eax, 8
mov edx, 0x317c
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [r8 + rax*2], cx
inc rax
cmp rax, 0xc
jb 0x140006c60
mov byte [r8 + 0x1a], r12b
add r8, 0x18
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.140006de0
nop
mov r14, r15
cmp qword [r15 + 0x18], 7
jbe 0x140006c94
mov r14, qword [r15]
mov r15, qword [r15 + 0x10]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp r15, rax
ja 0x140006d3a
lea rax, [r15 + r8]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x30]
cmp rcx, 7
cmova rdi, qword [rsp + 0x30]
lea rax, [r14 + r15*2]
cmp rax, rdi
jbe 0x140006cf0
lea rax, [rdi + r8*2]
cmp r14, rax
ja 0x140006cf0
cmp rdi, r14
ja 0x140006ce5
mov rsi, r12
jmp 0x140006cf3
mov rsi, rdi
sub rsi, r14
sar rsi, 1
jmp 0x140006cf3
mov rsi, r15
lea rcx, [rdi + r15*2]
lea r8, [r8*2 + 2]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8, r15
sub r8, rsi
add r8, r8
lea rax, [rsi + r15]
lea rdx, [r14 + rax*2]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
jmp 0x140006d51
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140006f30
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140006dc4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006dbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006dbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
mov rax, rbp
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400124d0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov word [rsp + 0x30], 0
movzx eax, byte [rcx]
test al, al
je 0x140012596
mov rdi, rcx
mov r15d, 0x28
lea r12, [rsp + 0x30]
lea rbx, [rsp + 0x2a]
lea r14, [rsp + 0x2e]
nop
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], 0
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.14001af7c
cmp rax, 1
jne 0x1400125c6
cmp word [r12], 0
mov rcx, r15
mov rax, r12
je 0x140012571
mov rdx, r12
mov rcx, r15
nop dword [rax + rax]
lea rax, [rdx + 2]
dec rcx
cmp word [rdx + 2], 0
mov rdx, rax
jne 0x140012560
test rcx, rcx
je 0x1400125c6
movzx ecx, word [rsp + 0x2a]
mov word [rax], cx
mov word [rax + 2], 0
add r12, 2
dec r15
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x140012520
lea rcx, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140014a30
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14001af00
int3
Function at 0x1400130d0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x140040b08]
test rcx, rcx
je 0x14001313a
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001312d
mov rcx, qword [0x140040b08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140040b08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140043350], 1
jne 0x1400131e7
mov rbx, qword [0x14002f060]
mov qword [rsp + 0x50], rbx
movups xmm6, xmmword [0x14002f050]
movaps xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [0x14002f040]
movaps xmmword [rsp + 0x30], xmm7
movups xmm8, xmmword [0x14002f030]
movaps xmmword [rsp + 0x20], xmm8
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
lea rdi, [0x140040b20]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax + rax]
mov rcx, rdi
call r14
cmp eax, 0xffffffff
je 0x1400131e7
and eax, 0x10
je 0x1400131e7
mov ecx, 0x64
call r15
mov qword [rsp + 0x50], rbx
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
mov rcx, rsi
call r12
dec ebp
jne 0x1400131b0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014a30
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140014870
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x2030
call fcn.1400149d0
sub rsp, rax
mov rsi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2028], rax
mov eax, dword [0x140040b10]
test eax, eax
je 0x1400148a5
test eax, eax
jg 0x1400148ed
jmp 0x140014922
lea rdx, [0x140035126]
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.140012780
test al, al
je 0x1400149aa
lea rcx, [rsp + 0x20]
call fcn.14001ac24
movsxd rcx, dword [0x140040b10]
lea rdx, [0x140045b90]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x140040b10], eax
test eax, eax
jle 0x140014922
lea rdi, [0x140045b90]
xor ebx, ebx
nop word cs:[rax + rax]
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.14001b880
test eax, eax
je 0x14001498b
inc rbx
movsxd rax, dword [0x140040b10]
add rdi, 8
cmp rbx, rax
jl 0x140014900
mov rcx, rsi
call fcn.14001b8b8
cmp rax, 2
jne 0x140014939
mov bl, 1
cmp word [rsi + 2], 0x3a
je 0x14001498d
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x140014958
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x14001498d
cmp dword [0x140040b10], 0x3ff
jg 0x14001498d
mov rcx, rsi
call fcn.14001ac24
movsxd rcx, dword [0x140040b10]
lea rdx, [0x140045b90]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x140040b10], eax
mov bl, 1
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.140014a30
mov eax, ebx
add rsp, 0x2030
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140035126]
call fcn.140013dc0
int3

Function at 0x1400151a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400151ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400151ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400151ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400151ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400151ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400151ec
xor al, al
add rsp, 0x28
ret
Function at 0x1400199f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019b38
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019ba7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019ba7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019ba7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019ba7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019ba7
cmp dword [rcx + 0x84], 0xe
jbe 0x140019ba7
cmp dword [rcx + 0xf8], 0
je 0x140019ba7
mov ecx, ebx
call fcn.140019a70
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140019ccc
nop
cmp dword [rbp + 0x20], 0
je 0x140019bf5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140019b04
int3

Function at 0x140019b38
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019b38
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019ba7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019ba7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019ba7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019ba7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019ba7
cmp dword [rcx + 0x84], 0xe
jbe 0x140019ba7
cmp dword [rcx + 0xf8], 0
je 0x140019ba7
mov ecx, ebx
call fcn.140019a70
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140019ccc
nop
cmp dword [rbp + 0x20], 0
je 0x140019bf5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140019b04
int3

Function at 0x14001bd40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001bd68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001bd68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400215ec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140021673
mov rsi, rbx
cmp word [rax], bp
je 0x140021632
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002161c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140021618
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001eb14
mov rdi, rax
test rax, rax
je 0x140021660
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002a7e0
mov rbp, rdi
xor ecx, ecx
call fcn.14001dbc4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret