joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005f330
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov r14d, r15d
mov ebx, r15d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800b18fc], esi
je 0x18005f381
cmp rbx, 0x20
jae 0x18005f36a
xor ecx, ecx
jmp 0x18005f36c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800b18fc], esi
jne 0x18005f360
cmp qword [0x1800b1910], r14
mov qword [rsp + 0x58], r13
je 0x18005f516
mov ecx, dword [0x1800b4cac]
mov ebx, r15d
test ecx, ecx
je 0x18005f3bf
mov rdx, qword [0x1800b4ca0]
mov rax, rdx
nop word [rax + rax]
cmp rdi, qword [rax]
je 0x18005f3ca
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18005f3b0
mov r14d, 4
jmp 0x18005f51c
cmp ebx, 0xffffffff
je 0x18005f3bf
mov eax, ebx
imul r13, rax, 0x38
test byte [rdx + r13 + 0x20], 2
je 0x18005f47b
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18005ec30
xor edx, edx
mov ecx, ebx
call fcn.18005ede0
mov r14d, eax
cmp qword [rsp + 0x20], r15
je 0x18005f46b
mov ecx, dword [rsp + 0x2c]
test ecx, ecx
je 0x18005f457
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov ebp, ecx
nop word [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18005f448
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x18005f420
mov rbp, qword [rsp + 0x50]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800b1910]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
jne 0x18005f51c
mov rdx, qword [0x1800b4ca0]
mov rcx, qword [rdx + r13 + 0x10]
call fcn.18005e260
mov edx, dword [0x1800b4cac]
dec edx
cmp ebx, edx
jae 0x18005f4ca
mov eax, edx
imul rcx, rax, 0x38
mov rax, qword [0x1800b4ca0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rax + r13], xmm0
movups xmm1, xmmword [rcx + rax + 0x10]
movups xmmword [rax + r13 + 0x10], xmm1
movups xmm0, xmmword [rcx + rax + 0x20]
movups xmmword [rax + r13 + 0x20], xmm0
movsd xmm1, qword [rcx + rax + 0x30]
movsd qword [rax + r13 + 0x30], xmm1
mov ecx, dword [0x1800b4ca8]
mov eax, ecx
mov dword [0x1800b4cac], edx
shr eax, 1
cmp eax, 0x20
jb 0x18005f51c
cmp eax, edx
jb 0x18005f51c
mov r8, qword [0x1800b4ca0]
mov eax, ecx
mov rcx, qword [0x1800b1910]
xor edx, edx
shr rax, 1
imul r9, rax, 0x38
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18005f51c
shr dword [0x1800b4ca8], 1
mov qword [0x1800b4ca0], rax
jmp 0x18005f51c
mov r14d, 2
xchg dword [0x1800b18fc], r15d
mov r13, qword [rsp + 0x58]
mov eax, r14d
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18005f540
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x1800b18fc], ebp
je 0x18005f597
cmp rbx, 0x20
jae 0x18005f580
xor ecx, ecx
jmp 0x18005f582
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800b18fc], ebp
jne 0x18005f576
cmp qword [0x1800b1910], r15
je 0x18005f691
test rdi, rdi
jne 0x18005f5b7
mov ecx, esi
call fcn.18005eef0
mov ebp, eax
jmp 0x18005f696
mov ecx, dword [0x1800b4cac]
mov ebx, r15d
test ecx, ecx
je 0x18005f5df
mov r8, qword [0x1800b4ca0]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x18005f5e9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18005f5d0
mov ebp, 4
jmp 0x18005f696
cmp ebx, 0xffffffff
je 0x18005f5df
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18005f688
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18005ec30
mov edx, esi
mov ecx, ebx
call fcn.18005ede0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18005f696
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18005f672
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18005f668
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x18005f640
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800b1910]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18005f696
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x18005f696
mov ebp, 2
xchg dword [0x1800b18fc], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18006e610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x18006e644
cmp ecx, r10d
jge 0x18006e632
mov rcx, rbx
call fcn.18006dde0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x18006e67e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x18006e660
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x18006e6ad
mov edx, dword [0x1800b13e4]
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x18006e6df
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x18006e6c9
xor dl, dl
jmp 0x18006e6d2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x18006e6c0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x18006e682
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x18006e754
mov edx, dword [0x1800b13e4]
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18006e76e
mov rcx, rbx
call fcn.18006df30
test eax, eax
je 0x18006e747
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180077db0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800b13e4]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800b4b00], ecx
jle 0x180077e10
lea rcx, [0x1800b4b00]
call fcn.180086418
cmp dword [0x1800b4b00], 0xffffffff
jne 0x180077e10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
lea rcx, [0x1800b4b00]
cvtsi2sd xmm0, rax
movsd qword [0x1800b4ac8], xmm0
call fcn.1800863b8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm0, xmm0
mov eax, eax
cvtsi2sd xmm0, rax
subsd xmm0, qword [0x1800b4ac8]
comisd xmm0, xmmword [0x18009ee08]
jb 0x180077e51
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mov al, 1
movsd qword [0x1800b4ac8], xmm0
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x140006a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140006ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140006ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140006aad
mov qword [rsi], rdi
call fcn.140006670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.plugin_container.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
pop rsi
test eax, ebp
invalid
pop rsi
mov bh, byte [rsi]
mov eax, 0x9dc80d5f
push rbp
jl 0x140078cb8
and byte [rsi - 0x79028ddb], ch
invalid
xchg byte [rdx + 0x33975ec8], bl
enter 0xffffffffffff975e, 0x33
or dword [rcx + 0x1ff7ce1], eax
sub eax, 0x81f1017c
push rax
jl 0x140078d4a
fldl2e
cdq
jb 0x140078c8b
dec dword [rdi]
invalid
fdivr qword [rsp + rdi*8]
in al, 0xb5
test al, 0x93
invalid

Function at 0x140006b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140006bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140006b98
add rdi, rbx
sub rsi, rbx
je 0x140006bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140006b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.1400016f0
mov rcx, r12
call fcn.1400017f0
jmp 0x140006b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400365a0
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001730
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [0x1400050c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140001880
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
lea r14, [rsp + 0x54]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
mov rdx, rcx
cmovb rdx, rax
test rdx, rdx
je 0x1400017d5
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x1400017af
mov r8, qword [rdi]
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rsp + r9*2 + 0x54]
jne 0x140001804
inc r9
cmp rdx, r9
jne 0x1400017c0
cmp rax, rcx
jne 0x140001804
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x140001880
xor edx, edx
cmp rax, rcx
setb dl
mov eax, 0xffffffff
cmovbe eax, edx
test eax, eax
je 0x1400017da
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140001877
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
mov rdx, rcx
cmovb rdx, rax
test rdx, rdx
je 0x1400017f0
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x14000183e
mov r8, qword [rdi]
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rsp + r9*2 + 0x54]
jne 0x140001870
inc r9
cmp rdx, r9
jne 0x140001850
jmp 0x1400017f0
mov eax, 1
jmp 0x140001800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001f80
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000278c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400027d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.VCRUNTIME140.dll___C_specific_handler
jne 0x1400027d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027d8
xor al, al
add rsp, 0x28
ret
Function at 0x14001117c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140019d80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14003c0f8]
call fcn.1400118f2
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x140019dbc
mov rcx, qword [rbp + 0x100]
call fcn.1400111b3
jmp 0x140019dd7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x140019dd7
mov rcx, qword [rbp + 0x100]
call fcn.14001145b
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001145b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14001b5f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14003c0f8]
call fcn.1400118f2
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x14001b634
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x14001b6c5
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x14001b68a
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14001b694
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14001b629
mov qword [rbp + 0x88], 0xe3
jmp 0x14001b6e3
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x14001b78c
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x14001b748
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14001b752
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14001b6d2
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x14001b7ec
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14001b7f6
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x140011514
Capabilities:
Terminate process

Disassembly:
jmp 0x140023760
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011640
Capabilities:
Parse pe header

Disassembly:
jmp 0x140024290
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400242b0
xor al, al
jmp 0x140024331
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400242c3
xor al, al
jmp 0x140024331
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400242ed
xor al, al
jmp 0x140024331
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140024301
xor al, al
jmp 0x140024331
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140024313
xor al, al
jmp 0x140024331
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002432f
xor al, al
jmp 0x140024331
mov al, 1
add rsp, 0x38
ret

Function at 0x140011677
Capabilities:
Create process on windows

Disassembly:
jmp 0x14001e110
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x140035040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14003c0f9]
call fcn.1400118f2
lea r8, [0x14002e5e8]
xor edx, edx
mov rcx, qword [rbp + 0x190]
call fcn.140011078
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rbp + 0x10], 0x70
mov dword [rbp + 0x14], 0x40
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
lea rax, str.cmd.exe
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x190]
call fcn.1400110e1
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14001e1eb
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x94]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x190]
call fcn.14001119a
lea rcx, [rbp - 0x20]
lea rdx, [0x14002d570]
call fcn.14001174e
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011447
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140001000
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400010b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
imul edi, ebx, 0x3e8
add edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jae 0x14000108b
xor ebx, ebx
nop word [rax + rax]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jb 0x140001060
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400012e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001ba8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bf2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bf2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bf2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bf2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bf2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bf4
xor al, al
add rsp, 0x28
ret
Function at 0x14000ae90
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Get ntdll base address
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400cd83d]
jmp 0x1403699dc

Function at 0x14000bd80
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400cd8af]
jmp 0x14036b49c

Function at 0x14011a24d
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
jmp 0x140190907
jmp 0x140467283
sub edx, edx
jmp 0x140176568

Function at 0x140136a64
Capabilities:
Access peb ldr_data

Disassembly:
ret
je 0x140113ae4
mov word [rcx], 0
jmp 0x140113ae4
cmovb r8, rdx
jmp 0x14024f23a
movzx eax, word [0x1400b7f50]
test r12b, 0xdd
stc
test bpl, spl
test ax, ax
jmp 0x1401f94e1
jne 0x1401a0c8c
sub r8, rax
test r8, r8
je 0x14017d8b2
mov word [r10], 0
movzx eax, word [0x1400b7f50]
bt r8w, 0xfb
cmovae r8w, di
cmp rdx, 0x104
setl r8b
mov r8d, 0x104
jmp 0x14018c574
cmovb r8, rdx
test ax, ax
jmp 0x14024f234
je 0x14017d8ac
mov word [r10], r11w
add r10, 2
and r11d, 0x2f7f4267
movzx r11d, word [r9 + rax*2 + 2]
add rax, 1
test r11w, r11w
jmp 0x14017d89a
je 0x14017d8a3
xor eax, eax
stc
cmp r13b, bpl
nop word [rax + rax]
cmp r12b, dl
stc
cmp r8, rax
jmp 0x140190268
mov rax, qword gs:[0x30]
shr r10b, cl
mov rax, qword [rax + 0x60]
bsf r8w, si
rol r9b, cl
sar r8b, 0xe8
mov rax, qword [rax + 0x18]
bsr r11, rdi
shld r9d, r14d, 8
mov rax, qword [rax + 0x10]
neg r10b
movzx r8d, word [rax + 0x58]
mov r10w, r15w
rcl r9, 0x6a
cmp r8, rdx
movsx r10d, sp
cmovae r8, rdx
bts r11d, r14d
bts r9d, r15d
mov r9, qword [rax + 0x60]
sub r10b, 0x48
shrd r10w, si, 0x43
sal r10, 0xff
movzx r11d, word [r9]
lea r10, [0x1400b7f50]
test r11w, r11w
jmp 0x1401a0c76
je 0x1401aeb50
cmp rdx, 0x104
movzx r8w, r13b
not r8w
mov r8d, 0x104
jmp 0x14013695b
je 0x14024f28e
xor edx, edx
movsx r9, r13w
bts r9w, r13w
lea r9, [0x1400b7f50]
nop word cs:[rax + rax]
cmc
nop dword [rax + rax]
cmp r8, rdx
je 0x140134f09
mov word [rcx], ax
adc ah, 0x13
shld rax, r10, 0xb1
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
test r9w, r14w
add rdx, 1
test ax, ax
jne 0x14024f25c
sub r8, rdx
test r8, r8
jmp 0x140134f03