joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403cae47
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
bswap rbx
xor dword [rsp + rcx - 0x738bd2cf], r10d
lea rsi, [rdi + 0x7e39363e]
jmp 0x1403e7265
xor edi, 0x3793fa8c
dec byte [rsp + rbp - 0x48115315]
mov qword [rsp + rbp - 0x48115319], rsi
xor dword [rsp + rcx - 9], edi
pop rsi
movsxd rdi, edi
ror edx, 0x76
adc r9, rdi
or ebp, 0xc1875aad
call fcn.1403c53ca
jg 0x1403e6907
xor eax, esi
mov edi, 0x1990b70d
mov ebp, ebx
lea eax, [rax + rdx*2 - 0x4f2c5701]
or dl, r10b
ja 0x1403c3734
mov rdx, qword [r8]
mov r10d, 0x738bc5a6
mov ebx, dword [r8 + r10 - 0x738bc59e]
shl r10w, 0x83
mov ecx, r10d
lea r8, [r8 + r10 - 0x738b2d24]
mov dword [rdx + r10 - 0x738b2d30], ebx
lea rdi, [rcx*4 - 0x1c572de7]
lea r11, [r11 + r10 - 0x738b2d34]
lea rax, [rdi + rcx*4 + 0x53223491]
not cx
lea rbx, [rax*8 + 0x541a2a28]
mov r10d, dword [rcx + r11 - 0x738bd2cf]
mov ebp, ebx
mov edx, ebp
xor r10d, esi
dec r10d
not r10d
rol r10d, 1
jmp 0x1403de97b
rol edi, 1
not al
lea edi, [rdi + rax - 0xe8486e9]
xor r10d, edx
shr ecx, cl
not edi
ror edx, 0x3d
and cl, ah
neg edi
push rdx
jmp 0x1403ba41d
ror eax, 1
lea eax, [rdx + rax - 0x723dcd30]
sal bp, 0xf
call fcn.1403b12c7
jmp r9
xor dword [rsp + rcx - 0x2ef12444], edi
mov edx, r10d
xadd ecx, r10d
xchg dx, ax
mov rsi, qword [rsp + rcx - 0x2ef11360]
jg 0x1403d6f70
jmp 0x1403bbe5a
inc dl
jp 0x1403c2dee
movsxd rdi, edi
not dx
shl dx, 0x8a
sal rbx, 0xa3
adc r9, rdi
mov rbp, qword [r8 + rcx*2 - 0x5de226e0]
xchg ah, al
pop r10
mov qword [rsp + rcx - 0x2ef11370], rax
lea r8, [r8 + rcx - 0x2ef11368]
rol cx, 0x4a
mov qword [rsp + rcx*2 - 0x5de38092], rbp
push qword [rsp + 8]
popfq
mov qword [rsp + rcx - 0x2ef1c04d], r9
ret 8
not rax
neg r10d
jmp 0x1403b957d
pop rsi
movsxd rcx, ecx
add r9, rcx
lea rcx, [rbp + rdx*4 + 0x33a52b9d]
add rcx, rdx
mov dx, word [rbp + r8 - 0x298a]
sub rax, 0xffffffff9033f4b0
mov di, word [rbp + r8 - 0x2988]
sar r10d, cl
or ax, 0xdb32
lea r8, [rbp + r8 - 0x2988]
and dx, di
not dx
mov word [r8 + rbp*2 - 0x5314], dx
jmp r9
shl rcx, cl
pop rsi
ror edx, 0xd1
sar rax, 0xd4
movsxd r10, r10d
add r9, r10
call fcn.1403e6ae8
ror ebx, 3
sub ebx, 0xb88b07af
mov qword [rsp + rdi - 0xaa], rsi
xadd edi, eax
sbb rdi, rbp
push rax
xor dword [rsp + rdi + 0x41eda6e4], ebx
inc word [rsp + rdi + 0x41eda6df]
call fcn.1403b98e0
Function at 0x1403cb38e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r10*2 + 8], rdx
xor sil, bl
mov qword [rsp + r10], rdx
lea rbx, [rsp + rbx + 0x10]
and edx, edx
mov byte [r10 + rbx], cl
jl 0x1403dc75c
jmp 0x1403c4d38

Function at 0x1403cda2c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shrd ax, di, cl
call fcn.1403cad53
not ebx
dec ebx
xor ebx, 0x3a2695bd
movzx r10d, di
mov qword [rsp + r10*2 - 0x1ff68], rsi
xor dword [rsp + r10 - 0xffac], ebx
pop rax
dec edx
jl 0x1403d335a
mov ecx, 0xd9232d98
movzx edi, cl
lea r10, [rcx + rcx*2 + 0x4a9f8a3e]
mov ax, word [r8 + rdi - 0x98]
mov di, word [r8 + rdi - 0x96]
mov cl, byte [r8 + 4]
movsx edx, r10b
lea r8, [r8 + rdx*2 - 8]
not r10w
jmp 0x1403bfa06
mov rsi, qword [rsp + r10*4 - 0x3fee8]
add byte [rsp + r10*2 - 0x1ff72], dl
seta dil
neg bpl
movsxd rbx, ebx
add r9, rbx
xchg byte [rsp + r10 - 0xffb6], bpl
lea r11, [r11 + r10*4 - 0x3fef2]
lea r10, [rbp - 0x2dfc2755]
movzx eax, bp
sub bp, 0x8011
movzx ecx, word [r11 + r10 - 0x55335684]
inc rdi
xor cx, si
pop rbp
pop rdx
push rbp
sub cx, 0x2aab
neg dil
add edi, 0xd2a3739b
call fcn.1403c5c4c
mov edx, 0x1427f003
mov r10d, 0x4225d00
movsx ecx, r10w
lea r11, [r11 + rdx - 0x1427f004]
rol dl, 0x27
movzx edi, byte [r11 + r10*8 - 0x2112e800]
call fcn.1403cc997

Function at 0x1403ce595
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea rbx, [rsp + rbx + 0x10]
mov edi, dword [rbx + rdx*4 - 0xeeef7f8]
lea rbx, [rbp + rcx*2 + 0x539dbf35]
lea r8, [rdx + r8 - 0x3bbbe02]
sar bx, cl
mov qword [rsp + rdx*8 - 0x1dddeff0], rcx
mov dword [rdx + r8 - 0x3bbbdfe], edi
sal word [rsp + rdx - 0x3bbbdf7], cl
lea r11, [r11 + rdx*4 - 0xeeef7fc]
or ebp, dword [r11 + rdx*4 - 0xeeef7f8]
xor ebp, esi
ror byte [rsp + rdx*2 - 0x7777bf9], 0x41
xor ebp, 0x448a3dbf
or r10w, word [rsp + rdx*2 - 0x7777bf6]
lea ebp, [rbp + rdx - 0x48dbf2ba]
or word [rsp + rdx*2 - 0x7777bf6], cx
bswap ebp
add qword [rsp + rdx - 0x3bbbdf6], rcx
or dx, r10w
jle 0x1403bf6e4
call fcn.1403c4bb8
push 0xfffffffff7bb77a7
lea rsp, [rsp + 8]
jmp 0x1403c5808

Function at 0x1403d5d45
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, 1
lea rsp, [rsp + 8]
jne 0x1403d9a9d
mov rcx, rax
push 0xffffffffbb394192
lea rsp, [rsp + 8]
jmp 0x1403c173c
jmp 0x1403db317

Function at 0x1403d8a2b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x10]
je 0x1403de471

Function at 0x1403da479
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sub ebp, 0xfa98e9af
mov qword [rsp + rdx - 0x2f3ed636], 0x109fa411
not word [rsp + rdx - 0x2f3ed636]
movzx edi, cx
ror ebp, 3
inc qword [rsp + rdx - 0x2f3ed62e]
movzx eax, r10b
call fcn.1403bc004
mov edx, 0x26858b81
call fcn.1403c7b05
Function at 0x1403daa45
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dword [rsp + rax - 0xd01bff8], r10d
mov rsi, qword [rsp + rax - 0xd01bff8]
xor di, di
sub dl, 7
movsxd r10, r10d
adc r9, r10
movzx ebx, cl
mov rbx, qword [r8 + rax*2 - 0x1a038000]
lea r8, [rax + r8 - 0xd01bff8]
lea r11, [r11 + rax*2 - 0x1a038002]
lea rbp, [rax*2 - 0x18789847]
rol di, 0x8d
inc rdi
movzx eax, word [r11 + rax*4 - 0x34070000]
xor ax, si
shr dl, 0x61
ror ax, 1
mov qword [rsp + rdi*8 - 8], rcx
not cx
add ax, 0x348c
neg ax
call fcn.1403ba50e
movsx r10d, al
movzx ebp, al
mov word [r8 + r10 - 0x17], di
call fcn.1403cc73c
dec ecx
call fcn.1403b0db9
mov edi, 0xd4067b1e
mov r10d, edi
or edi, edi
mov rbx, qword [r8]
lea rax, [rdi + rdi + 0x62b29f83]
mov rax, qword [r8 + 8]
neg dil
mul rbx
mov qword [r8], rdx
movsx ebx, r10b
shr ebx, 0x86
mov qword [rbx + r8 + 8], rax
lea r11, [r11 + rbx*2 - 4]
rol edi, 0x41
mov ebp, dword [r11 + rbx*4]
cmovno rdi, rbx
mov eax, ebx
lea rcx, [rbx + rdi*2 - 0x5b72f5cc]
xor ebp, esi
movsx edx, r10b
inc rcx
call fcn.1403dac46

Function at 0x1403dab67
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
bswap ebp
shr rcx, 0xcf
call fcn.1403e09c0
mov r10d, 0x4c1717a7
lea r11, [r11 + r10 - 0x4c1717ab]
mov edi, 0xc7be1702
dec r10b
mov ecx, dword [r11 + r10 - 0x4c1717a6]
lea rbx, [rdi - 0x376284db]
lea rdx, [rdi + rbx*2 - 0xfdd805b]
sal ebx, 0xbd
xor ecx, esi
call fcn.1403b48df
bswap ebx
inc rax
push rdx
xor ebx, 0xcb9d2006
xchg word [rsp + rax + 0x11], r10w
inc qword [rsp + rcx - 0x3b00]
add ebx, eax
sar r10b, 0xe1
ror ebx, 1
mov qword [rsp + rcx - 0x3af8], rsi
and dword [rsp + rcx - 0x3b00], 0x1f27ecab
sbb word [rsp + rcx*4 - 0xec18], bp
xor dword [rsp + rcx - 0x3af8], ebx
shr byte [rsp + rcx*4 - 0xec18], 0xa1
not dword [rsp + rcx*4 - 0xec1d]
mov rsi, qword [rsp + rcx*2 - 0x7600]
xor ecx, 0x7a9f8c07
jno 0x1403de95c
movzx edi, cx
movsxd rbx, ebx
adc r9, rbx
xadd qword [rsp + rax*2 + 6], rax
xor eax, 0x502f640a
pop r10
pop rbp
pop r10
jp fcn.1403c82e3

Function at 0x1403dee35
Capabilities:
Execute anti-debugging instructions

Disassembly:
or qword [rsp + rbp - 0x7e9e1380], rbp
inc edx
xchg ebp, ebx
not edx
xor dword [rsp + rbp - 0x5bb62a1c], r10d
mov qword [rsp + r10 - 0x61fe5522], rsi
xor dword [rsp + rbx - 0x7e9e1378], edx
mov qword [rsp + rbp - 0x5bb62a2a], rbx
dec byte [rsp + rbp - 0x5bb62a26]
Function at 0x1403e51dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r11, [r11 + rdx*2 + 0x1b3fc]
shl di, 0xe4
xor rdi, rdi
movsx r10d, byte [rsp + rdx + 0xda03]
mov ecx, dword [r11 + rdx*2 + 0x1b400]
mov word [rsp + rdx + 0xda06], r10w
xadd rdx, rbx
xor ecx, esi
xor ecx, 0x448a3dbf
jmp 0x1403bd5dd
push r10
lea ecx, [rcx + rbx*2 - 0x451e80bc]
mov byte [rsp + rbx*2 + 0x1b401], 3
bswap ecx
xor ecx, 0xcb9d2006
sub word [rsp + rbx*2 + 0x1b40c], bx
inc ecx
and qword [rsp + rbx + 0xda01], rbx
sal qword [rsp + rbx + 0xda06], 0xc4
pop rbp
ror ecx, 1
mov qword [rsp + rbx + 0xda00], rsi
ror al, 0x27
inc rbx
setg dl
xor dword [rsp + rbx + 0xd9ff], ecx
pop rsi
shl rbp, 0x31
ror ebp, 0x79
dec di
movsxd rcx, ecx
jno 0x1403e382f
mov edx, dword [r11 + rax - 0x1911da8c]
call fcn.1403d69bb
call fcn.1403afae2
adc r9, rcx
sub r10w, ax
jbe fcn.1403c82e3
mov qword [rsp + rdx*4], rdi
lea r10, [rsp + r10 + 0x10]
xor eax, 0xa5949d2e
xchg ecx, eax
mov ecx, dword [rdx + r10]
pop rdx
lea r8, [r8 + rdx + 0xd9fc]
mov dword [r8 + rax - 0xda08], ecx
jno 0x1403b72f3
lea rdx, [rbp*8 - 0x28f9d644]
lea r11, [r11 + rbp - 0x213a4e0e]
lea rcx, [rbp + rbx*8 - 0xb4d9edd]
not rbp
jno 0x1403e1627
or ebp, edx
ror bl, 0x65
xor dword [rsp + rcx - 0x15], eax
neg cx
sbb bp, 0xe788
pop rsi
neg r10d
and cx, di
movsxd rax, eax
adc r9, rax
xchg cx, bx
lea rdi, [rdi + rcx*2 + 0x2f9aa81f]
dec cl
mov r10, qword [r8 + rcx - 0x715e]
lea rcx, [rbp + rcx*8 - 0x47faa55a]
ror edi, cl
setnp cl
mov rdx, qword [r8 + 8]
mov cl, byte [r8 + 0x10]
lea rax, [rbp + rbx*8 + 0x22304b8c]
or ebp, eax
adc r8, 0xa
xor ebp, edi
xor ax, 0xd380
jb 0x1403daf88
shld r10, rdx, cl
inc bpl
movzx ecx, bx
mov qword [r8 + rbp - 0x3a948f08], r10
mov edx, 0x9623ed82
jmp r9

Function at 0x1403e66d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdi - 0x73a5864d], rsi
xor dword [rsp + rax - 0x73a5864d], ecx
lea rbx, [rdi + rax*4 - 0x7acaf0dc]
lea rbp, [rdi*8 - 0x206ac660]
pop rsi
inc edi
movsxd rcx, ecx
and edi, ebp
adc r9, rcx
call fcn.1403ba664
sar rax, 0x60
sbb ax, 0x4736
mov rax, rbp
add rax, rdx
push 0xffffffff810cbd27
jmp 0x1403ce853

Function at 0x1403e6a24
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov r13, qword [rsp + r12 + 0x6bcdad62]
call fcn.1403de059
pop r13
jmp 0x1403e364b

Function at 0x1403e6b62
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
mov rax, qword [rbp + rbx*8 + 0x20]
jmp 0x1403c173b
cmp ebx, 4
jne 0x1403c4782
mov r9, rax
jmp 0x1403c173c
push 0x1275905
shr qword [rsp], 0xd0
cmp ebx, 3
lea rsp, [rsp + 8]
jne 0x1403d1a60
mov r8d, 0x1c82a332
call fcn.1403b9be4
lea rsp, [rsp + 8]
jne 0x1403e5677
push 0xffffffff8dbec996
call fcn.1403c3fcd
or bp, 0xa5
call fcn.1403b0292
Function at 0x1400088d4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140008638
Function at 0x14000297c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029c8
xor al, al
add rsp, 0x28
ret

Function at 0x140001230
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub rsp, 0x4d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], 0
xor r8d, r8d
lea rcx, [0x1400032e0]
mov edx, 0x8000
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov r9, qword [rsp + 0x30]
lea rdx, [0x140005a30]
mov r8d, 0x104
mov qword [rsp + 0x20], 0x104
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r9, [0x140005a30]
mov edx, 0x104
lea r8, str._sCyberLinkFaceMeSDKFaceMeSecurityCentral
lea rcx, [0x140005700]
call fcn.140001010
lea r9, [0x140005700]
mov edx, 0x104
lea r8, str._sconfigjettyConfig.xml
lea rcx, [0x140005920]
call fcn.140001010
lea r9, [0x140005700]
mov edx, 0x104
lea r8, str._s_ssl_sslKeystore
lea rcx, [0x140005810]
call fcn.140001010
lea rcx, [rsp + 0x38]
call fcn.140001400
xor edx, edx
mov byte [rsp + 0xc0], 0
mov r8d, 0x3ff
lea rcx, [rsp + 0xc1]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x60]
lea rcx, [0x140005920]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x14000135f
lea rdx, [rsp + 0x90]
lea rcx, [0x140005810]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x14000135f
lea rdx, str.explorer__https:__localhost:_d_timestamp_s_
mov r8d, 0x2382
jmp 0x14000136c
lea rdx, str.explorer__http:__localhost:_d_timestamp_s_
mov r8d, 0x1f90
cmp qword [rsp + 0x50], 0xf
lea r9, [rsp + 0x38]
lea rcx, [rsp + 0xc0]
cmova r9, qword [rsp + 0x38]
call fcn.1400015b0
xor edx, edx
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400013da
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000167c
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.140001620
add rsp, 0x4d8
ret

Function at 0x140001f98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001fe2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001fe2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001fe2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001fe2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001fe2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001fe4
xor al, al
add rsp, 0x28
ret
Function at 0x3350900
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x335090d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x335091d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x3350905
lea eax, [rcx + 1]
jmp 0x335092b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x335093e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x3350924
sub eax, 3
jb 0x335095e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x33509ad
sar eax, 1
movsxd rbp, eax
jb 0x3350994
jmp 0x335096c
add ebx, ebx
jne 0x335096a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x3350994
inc ecx
add ebx, ebx
jne 0x335097a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x3350994
call r11
adc ecx, ecx
add ebx, ebx
jne 0x335098d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x335097c
add ecx, 2
jmp 0x3350999
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.033508c2
jmp 0x335090d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x33ea00
mov dl, 0x27
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x33509f9
cmp rsi, rcx
jae 0x3350a01
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x33509e0
cmp al, 0x8f
ja 0x33509e0
cmp byte [rsi - 2], 0xf
je 0x33509e6
sub al, 0xe8
cmp al, 1
ja 0x33509ca
cmp rsi, rcx
jae 0x3350a01
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x33509d0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x3350a01
lodsb al, byte [rsi]
jmp 0x33509e0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2f44000]
mov eax, dword [rdi]
or eax, eax
je 0x3350a5e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2fba30c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x3350a0e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x3350a58
mov qword [rbx], rax
add rbx, 8
jmp 0x3350a2e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x3350aa2
cmp al, 0xef
ja 0x3350a8a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x3350a6a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x3350a79
mov eax, dword [rdi]
add rdi, 4
jmp 0x3350a79
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x3350af6
sub rsp, 0xffffffffffffff80
jmp 0x477880
Function at 0x1401f24b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401f24bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401f24cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401f24b5
lea eax, [rcx + 1]
jmp 0x1401f24db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401f24ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401f24d4
sub eax, 3
jb 0x1401f250e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401f255d
sar eax, 1
movsxd rbp, eax
jb 0x1401f2544
jmp 0x1401f251c
add ebx, ebx
jne 0x1401f251a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401f2544
inc ecx
add ebx, ebx
jne 0x1401f252a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401f2544
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401f253d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401f252c
add ecx, 2
jmp 0x1401f2549
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401f2472
jmp 0x1401f24bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x31200
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401f25a9
cmp rsi, rcx
jae 0x1401f25b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401f2590
cmp al, 0x8f
ja 0x1401f2590
cmp byte [rsi - 2], 0xf
je 0x1401f2596
sub al, 0xe8
cmp al, 1
ja 0x1401f257a
cmp rsi, rcx
jae 0x1401f25b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401f2580
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401f25b1
lodsb al, byte [rsi]
jmp 0x1401f2590
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1e8000]
mov eax, dword [rdi]
or eax, eax
je 0x1401f260e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1f2598]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401f25be
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401f2608
mov qword [rbx], rax
add rbx, 8
jmp 0x1401f25de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401f2652
cmp al, 0xef
ja 0x1401f263a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401f261a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1401f2629
mov eax, dword [rdi]
add rdi, 4
jmp 0x1401f2629
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401f26a6
sub rsp, 0xffffffffffffff80
jmp 0x1400161d0
Function at 0x140007040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400070c0
cmp r11, r10
ja 0x140007137
cmp r10, rdx
ja 0x140007149
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x1400070c2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400070a0
jmp 0x140007124
ja 0x1400070ca
mov r11, r10
cmp rax, r8
jne 0x14000706e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140007100
mov rdi, r8
sub ecx, edx
jns 0x14000711b
jmp 0x140007126
cmp r8, rsi
je 0x140007158
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140007126
xor al, 1
cmp rdi, rsi
jne 0x1400070e0
jmp 0x140007126
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400382e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140037ff0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140038350
int3
Function at 0x140010440
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140010465
cmp rax, rcx
je 0x14001046b
cmp rdx, 4
jae 0x140010472
xor eax, eax
xor r8d, r8d
jmp 0x140010510
pop rbp
jmp fcn.140004600
xor eax, eax
jmp 0x140010527
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14003b780]
movdqa xmm3, xmmword [0x14003b790]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400104a0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140010527
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140010510
pop rbp
ret
Function at 0x140019390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
Function at 0x140023760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140018640
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x14002379e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x1400237c4
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140023680
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x1400237dd
lea rcx, [rbp - 8]
call fcn.140013ad0
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140023800
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400237d0
mov qword [rsi], rbx
test r14, r14
je 0x1400237d0
mov edx, 2
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.1400086c0