joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c1810
Capabilities:
Check os version
Get common file path

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x140278ec8]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rax, qword [0x14027d190]
xor esi, esi
mov dword [rsp + 0x30], esi
test rax, rax
jne 0x1400c1a69
xor edx, edx
lea rcx, [rbp + 0x64]
mov r8d, 0x110
call fcn.140187df0
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x64], 5
ja 0x1400c1884
jne 0x1400c1a62
cmp dword [rbp + 0x68], 1
jb 0x1400c1a62
mov edx, 0x104
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400c18eb
call sub.libcef.dll_cef_get_min_log_level
cmp eax, 2
jg 0x1400c18d4
mov r9d, 2
lea rdx, str.D:uworkspace03_27cefwinauto_srccbwcef_dark_aero_window.cpp
lea rcx, [rsp + 0x38]
lea r8d, [r9 + 0x49]
call fcn.1400c7000
lea rdx, str.Couldnt_find_system_path
lea rcx, [rax + 8]
call fcn.1400025c0
mov esi, 1
test sil, 1
je 0x1400c18e4
lea rcx, [rsp + 0x38]
call fcn.1400c7360
xor eax, eax
jmp 0x1400c1a69
movdqa xmm0, xmmword [0x14020c440]
lea rax, [rbp + 0x180]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], si
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x1400c1910
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x38]
call fcn.1400258a0
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x1400c198f
mov qword [rsp + 0x4b0], rbx
cmp rdx, 8
lea rbx, [rbp + 0x38]
mov qword [rsp + 0x4b8], rdi
cmovae rbx, qword [rbp + 0x38]
lea rdi, [rcx + 0xb]
mov r8d, SafeArrayPutElement
mov qword [rbp + 0x48], rdi
lea rdx, [0x1402122a8]
lea rcx, [rbx + rcx*2]
call fcn.1401879e0
mov word [rbx + rdi*2], si
mov rdi, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4b0]
jmp 0x1400c19b2
lfence
xor r8d, r8d
mov qword [rsp + 0x20], reloc.WS2_32.dll_inet_addr
lea r9, [0x1402122a8]
lea rcx, [rbp + 0x38]
lea edx, [r8 + 0xb]
call fcn.140037d80
cmp qword [rbp + 0x50], 8
lea rcx, [rbp + 0x38]
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14027d190], rax
test rax, rax
je 0x1400c1a26
lea rdx, str.DwmExtendFrameIntoClientArea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14027d190]
lea rdx, str.DwmDefWindowProc
mov qword [0x14027d198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14027d190]
lea rdx, str.DwmIsCompositionEnabled
mov qword [0x14027d1a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14027d1a8], rax
mov rax, qword [0x14027d190]
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x1400c1a69
mov rcx, qword [rbp + 0x38]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1a5d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c1a89
call fcn.140157a40
mov rax, qword [0x14027d190]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140157ae0
mov rsi, qword [rsp + 0x4c0]
add rsp, 0x4a0
pop rbp
ret
call fcn.140195efc
int3
Function at 0x14015ded0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14015dee3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14015f010
lea rdx, [0x140273360]
lea rcx, [rsp + 0x20]
call fcn.14018856c
int3

Function at 0x14016c7d8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14027e230]
xor edx, edx
jmp fcn.14015ded0

Function at 0x14016e248
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14027e230]
jmp fcn.14015ded0

Function at 0x14017fae8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14017fbc8]
mov r9, qword [r9 + 8]
jmp fcn.140169460

Function at 0x14017fba0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14017fbd8]
mov r9, qword [r9 + 8]
jmp fcn.140169460

Function at 0x1401b2e00
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401b2e20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401b7020
or eax, 0xffffffff
jmp 0x1401b2e22
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401d1b44
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401d17ea
call fcn.1401b7090
mov dword [rax], SafeArrayPutElement
call fcn.140195edc
jmp 0x1401d1935
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401d1935
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1401d1935
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1401d1819
lock or dword [rcx + 0x14], 0x10
jmp 0x1401d1935
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401d182d
call fcn.1401d3238
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1401d183d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1401d1840
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1401cc5fc
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1401d2864
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1401d1923
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401d18d1
mov rcx, rbx
call fcn.1401cc5fc
cmp eax, 0xffffffff
je 0x1401d18bc
mov rcx, rbx
call fcn.1401cc5fc
cmp eax, 0xfffffffe
je 0x1401d18bc
mov rcx, rbx
call fcn.1401cc5fc
movsxd rdi, eax
lea r14, [0x14027f160]
mov rcx, rbx
sar rdi, 6
call fcn.1401cc5fc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401d18c3
lea rdx, [0x1402793e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401d18d1
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1401d18f5
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1401d18f5
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1401d18f5
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1401d1913
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1401d191e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1401d193a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1401d17b4
Function at 0x18001c900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001c934
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001c920
ret
Function at 0x18002e120
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x40
lea esi, [r9 + 6]
mov r15, rdx
mov rbp, rcx
cmp r9d, esi
jae 0x18002e1ce
mov r14, qword [rsp + 0x30]
lea edi, [r9 - 0x118]
lea r12, [0x180000000]
nop
cmp edi, 0xd
ja case.0x18002e170.1
mov ecx, dword [r12 + rdi*4 + 0x2e20c]
add rcx, r12
jmp rcx
mov qword [0x18008afe8], rbp
jmp case.0x18002e170.1
mov ecx, reloc.SHELL32.dll_ILFindLastID
call fcn.18004c3e4
mov r14, rax
jmp case.0x18002e170.1
mov qword [rsp + 0x28], 0
lea r8, [0x1800154e0]
mov r9, rbp
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbp + 0x80], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18002e1ed
xchg qword [0x18008aff0], rax
inc edi
lea eax, [rdi + 0x118]
cmp eax, esi
jb 0x18002e160
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov byte [rsp + 0x30], 0
jmp 0x18002e1ce
xor eax, eax
jmp 0x18002e1d3
mov byte [rsp + 0x30], 1
jmp 0x18002e1ce
xor eax, eax
mov qword [r14], rax
mov rax, r14
jmp 0x18002e1d3
Function at 0x1800436d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
imul r12d, r8d, 0x2d0
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
mov ebp, r8d
cmp r8d, r12d
ja 0x180043739
movzx edi, word [rsp + 0x70]
lea r13, section..data
nop dword [rax + rax]
mov eax, ebp
sub eax, 0x19
je 0x1800437a4
sub eax, 0x70
je 0x180043766
sub eax, 0x3e
je 0x180043753
cmp eax, 0x10e6
jne 0x1800437df
rol di, 8
mov word [rsp + 0x78], di
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rsi, rsi
je 0x1800437df
mov rcx, rsi
call fcn.18004c3dc
jmp 0x1800437df
mov ebx, 0x53
nop dword [rax + rax]
cmp ebx, 0x53
je 0x18004377f
cmp ebx, 0xff
je 0x180043739
jmp 0x180043794
mov ecx, reloc.SHELL32.dll_ILFindLastID
call fcn.18004c3e4
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rax], xmm0
add ebx, 0xac
cmp ebx, 0x1ab
jb 0x180043770
jmp 0x1800437df
mov edx, dword [r14]
mov edi, 0xffff
test edx, edx
je 0x1800437d6
dec dword [r14]
movzx ecx, byte [rsi]
inc rsi
mov edx, dword [r14]
movzx eax, di
xor rcx, rax
shr di, 8
movzx eax, cl
movzx eax, word [r13 + rax*2]
xor di, ax
test edx, edx
jne 0x1800437b0
lea eax, [rdx - 1]
not di
mov dword [r14], eax
imul eax, r15d, 0xb4
add ebp, eax
cmp ebp, r12d
jbe 0x180043710
jmp 0x180043739
Function at 0x1400011d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x140002050]
xor edx, edx
mov eax, 0xc
mov dword [rbp - 0x40], eax
movdqu xmmword [rbp - 0x3c], xmm0
test eax, eax
je 0x140001204
lea eax, [rdx + 0x78]
xor byte [rbp + rdx - 0x3c], al
inc edx
mov eax, dword [rbp - 0x40]
cmp edx, eax
jb 0x1400011f4
lea rcx, [rbp - 0x3c]
mov byte [rbp + rax - 0x3c], 0
call fcn.1400013f0
mov r9, rax
test rax, rax
je 0x14000129f
movdqa xmm0, xmmword [0x140002070]
mov edx, 0xe
mov dword [rbp - 0x2c], edx
xor r8d, r8d
movdqu xmmword [rbp - 0x28], xmm0
lea eax, [r8 + 0x78]
xor byte [rbp + r8 - 0x28], al
inc r8d
mov ecx, dword [rbp - 0x2c]
cmp r8d, ecx
jb 0x140001236
movdqa xmm0, xmmword [0x140002060]
xor r8d, r8d
mov byte [rbp + rcx - 0x28], 0
movdqu xmmword [rbp - 0x14], xmm0
mov dword [rbp - 0x18], edx
lea eax, [r8 + 0x78]
xor byte [rbp + r8 - 0x14], al
inc r8d
mov edx, dword [rbp - 0x18]
cmp r8d, edx
jb 0x140001262
mov byte [rbp + rdx - 0x14], 0
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x14]
mov rcx, r9
call fcn.140001350
test rax, rax
je 0x14000129f
movsxd rcx, dword [rax + 3]
xor edx, edx
mov qword [rcx + rax + 7], rdx
xor eax, eax
jmp 0x1400012a4
mov eax, 0xc0000001
add rsp, 0x60
pop rbp
ret

Function at 0x140001350
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test rsi, rsi
je 0x1400013d3
xor edi, edi
cmp dword [rbx], 0x45474150
je 0x1400013ab
cmp dword [rbx], 0x7865742e
jne 0x1400013c7
cmp byte [rbx + 4], 0x74
jne 0x1400013c7
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.1400012d8
mov r10, rax
test rax, rax
jne 0x1400013d3
inc rdi
add rbx, 0x28
cmp rdi, rsi
jl 0x140001395
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400013f0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebx, ebx
lea r9, [rax + 0x10]
mov r14, rcx
mov dword [rax + 0x10], ebx
xor r8d, r8d
lea rdx, [rax + 0x10]
lea esi, [rbx + 0xb]
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000152e
mov edx, dword [rsp + 0x178]
xor ecx, ecx
mov r8d, 0x6f616d4c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000152e
mov r8d, dword [rsp + 0x178]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x14000151e
mov esi, ebx
cmp qword [rdi], rbx
jbe 0x14000151e
lea rbp, [rdi + 8]
mov rax, rbp
lea rcx, [rsp + 0x20]
mov edx, 2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001488
movups xmm0, xmmword [rax]
mov rdx, r14
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140001519
inc esi
add rbp, 0x128
movsxd rax, esi
cmp rax, qword [rdi]
jb 0x14000147b
jmp 0x14000151e
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x140001530
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0xf4a930
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xf4a93d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xf4a94d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xf4a935
lea eax, [rcx + 1]
jmp 0xf4a95b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xf4a96e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xf4a954
sub eax, 3
jb 0xf4a98e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xf4a9dd
sar eax, 1
movsxd rbp, eax
jb 0xf4a9c4
jmp 0xf4a99c
add ebx, ebx
jne 0xf4a99a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xf4a9c4
inc ecx
add ebx, ebx
jne 0xf4a9aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xf4a9c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xf4a9bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xf4a9ac
add ecx, 2
jmp 0xf4a9c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00f4a8f2
jmp 0xf4a93d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb3e000]
mov eax, dword [rdi]
or eax, eax
je 0xf4aa39
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb56eb4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xf4a9e9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xf4aa33
mov qword [rbx], rax
add rbx, 8
jmp 0xf4aa09
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xf4aa7d
cmp al, 0xef
ja 0xf4aa65
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xf4aa45
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xf4aa54
mov eax, dword [rdi]
add rdi, 4
jmp 0xf4aa54
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xf4aad1
sub rsp, 0xffffffffffffff80
jmp 0x468dc0
Function at 0x140001140
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x140000000], 0x5a4d
je 0x14000117c
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x14000120a
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400011a0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120a
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x1400011e7
cmp ecx, 0x20b
je 0x1400011bf
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120a
cmp dword [rax + 0x84], 0xe
ja 0x1400011d3
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120a
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x14000120a
cmp dword [rax + 0x74], 0xe
ja 0x1400011f8
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120a
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x140026fd0], 0xffffffffffffffff
mov qword [0x140026fd8], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x1400253ec]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x1400253e8]
mov dword [rcx], eax
call fcn.140001410
cmp dword [section..data], 0
jne 0x140001264
lea rcx, [fcn.140001410]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x14001e860]
lea rcx, [0x14001e858]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x1400253e4]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x1400253e0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___wgetmainargs]
lea rdx, [0x14001e850]
lea rcx, [0x14001e7f0]
call sub.msvcrt.dll__initterm
mov r8, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [r8], 0
jne 0x1400012d9
mov eax, 0xff
jmp 0x1400013a9
mov r8, qword [r8]
mov qword [rsp + 0x30], r8
cmp word [r8], 0x22
jne 0x140001320
nop
nop
add r8, 2
mov qword [rsp + 0x30], r8
movzx eax, word [r8]
test ax, ax
je 0x14000130a
cmp ax, 0x22
je 0x14000130a
jmp 0x1400012f0
cmp word [r8], 0x22
jne 0x140001332
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140001332
cmp word [r8], 0x20
jbe 0x140001332
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140001320
movzx eax, word [r8]
test ax, ax
je 0x14000134c
cmp ax, 0x20
ja 0x14000134c
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140001332
test byte [rsp + 0x8c], 1
je 0x140001361
movzx r9d, word [rsp + 0x90]
jmp 0x140001367
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.140008614
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140001383
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x1400013a7
mov eax, edi
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x1400021d8
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov edi, edx
mov rsi, rcx
call fcn.140002138
xor ebx, ebx
cmp qword [0x140026570], rbx
je 0x14000222f
call fcn.14001285c
cmp dword [rax + 0x10], 1
jne 0x140002219
cmp edi, 0x19
je 0x14000222f
cmp edi, 0x17
je 0x14000222f
cmp edi, 0x16
je 0x14000222f
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
xor ecx, ecx
call qword [0x140026570]
jmp 0x1400022e9
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call sub.msvcrt.dll_memset
cmp edi, 0x19
je 0x14000225c
cmp edi, 0x17
je 0x14000225c
cmp edi, 0x16
mov rcx, 0xffffffff80000001
jne 0x140002263
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x2a0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x1400022c1
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.140001f18
mov rcx, qword [rsp + 0x2a0]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov r9d, 0x104
call fcn.1400032b0
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
mov rdx, rsi
lea rax, [rsp + 0x70]
sub rdx, rcx
movzx ecx, word [rax]
mov word [rdx + rax], cx
add rax, 2
cmp cx, bx
jne 0x1400022d1
cmp word [rsi], bx
setne bl
mov eax, ebx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140002300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r8d, edx
mov r10d, edx
xor r11d, r11d
mov r9d, edx
mov rbx, rcx
imul r8d, edx
shr r10d, 2
je 0x140002344
mov eax, dword [rbx]
add rbx, 4
lea ecx, [rax + r8]
mov edx, eax
imul edx, r11d
add r11d, 1
imul edx, r9d
imul edx, edx, 0x11
mov r8d, edx
xor r8d, ecx
cmp r11d, r10d
jb 0x14000231e
mov rbx, qword [rsp + 8]
mov eax, r8d
ret

Function at 0x140002420
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
xor ecx, ecx
mov dword [0x140025e00], 0x11223344
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400023f0]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov eax, dword [0x140025e00]
add rsp, 0x28
ret