joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cff38
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140544f90]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400cff8f
cmp word [rdx], r13w
jne 0x1400cff8f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400cff94
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400d00b9
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400d00da
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400cffcd
mov rdx, r9
mov word [rbx], cx
jmp 0x1400cfff4
cmp r9, r8
jae 0x1400d0004
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400cffae
jmp 0x1400d00b9
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d00ae
cmp dword [rsp + 0x80], esi
je 0x1400d00ae
lea r8, [0x140544f90]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400d0086
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400d0056
mov word [rbx], r13w
jmp 0x1400d00b6
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400d0063
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400d00b6
cmp word [rsp + 0x70], r13w
jne 0x1400d0093
cmp rbx, r14
je 0x1400d0050
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400cfe94
cmp word [rsp + 0x70], r13w
je 0x1400d00b9
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140544f90]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400d00b3
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400d00b9
Function at 0x1400d1858
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400d186e
mov al, 1
jmp 0x1400d18ce
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400d187f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400d18cc
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400d7450
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d18cc
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400d18cc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400d18cc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400d18ce
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400d66a0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400d66d0
xor eax, eax
jmp 0x1400d6793
mov rbp, rbx
cmp word [rax], si
je 0x1400d66f5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400d66dc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400d66d8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400d5290
movsxd r14, eax
test eax, eax
jne 0x1400d6733
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400d66c9
mov rcx, r14
call fcn.1400ccef4
mov rdi, rax
test rax, rax
jne 0x1400d674c
xor ecx, ecx
call fcn.1400ccf54
jmp 0x1400d6728
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400d5290
test eax, eax
jne 0x1400d677d
mov rcx, rdi
call fcn.1400ccf54
jmp 0x1400d6787
xor ecx, ecx
call fcn.1400ccf54
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400d67b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400d6837
mov rsi, rbx
cmp word [rax], bp
je 0x1400d67f6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400d67e0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400d67dc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400ccef4
mov rdi, rax
test rax, rax
je 0x1400d6824
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400eb830
mov rbp, rdi
xor ecx, ecx
call fcn.1400ccf54
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d99a4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400cd6d4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400d9a45
cmp ebx, dword [rsp + 0x30]
je 0x1400d9a3e
test esi, esi
je 0x1400d9a3e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400d9a19
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400d9a26
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400d9a03
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400d9a2a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400d9a47
mov eax, 1
jmp 0x1400d9a47
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dd810
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400bb14c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400dd89a
cmp byte [rbp - 0x21], r15b
je 0x1400dd895
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400dd8d0
call fcn.1400d1ce0
test eax, eax
jne 0x1400dd8bc
cmp byte [rbp - 0x21], r15b
je 0x1400dd8b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400dd8d0
cmp byte [rbp - 0x21], r15b
je 0x1400dd8cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400c8c24
test eax, eax
jne 0x1400dd970
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400bb14c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400dd90f
cmp byte [rbp - 0x21], r15b
je 0x1400dd944
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400dd944
call fcn.1400d1ce0
test eax, eax
jne 0x1400dd930
cmp byte [rbp - 0x21], r15b
je 0x1400dd929
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400dd944
cmp byte [rbp - 0x21], r15b
je 0x1400dd941
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400c8c24
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400dd970
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400dd973
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400dd981
mov rcx, rdi
call fcn.1400ccf54
cmp byte [rbp + 0x3f], r15b
je 0x1400dd990
mov rcx, qword [rbp + 0x27]
call fcn.1400ccf54
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400de5cc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400cfe94
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400cfe94
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400de71c
cmp rax, 0xffffffffffffffff
je 0x1400de71c
xor edi, edi
test rbp, rbp
jle 0x1400de6c7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400d19a0
mov rbx, rax
test rax, rax
jne 0x1400de654
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400de6bd
mov edx, 0x8000
mov ecx, r14d
call fcn.1400cb3ac
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400d1458
cmp eax, 0xffffffff
je 0x1400de69d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400de664
mov edx, r15d
mov ecx, r14d
call fcn.1400cb3ac
jmp 0x1400de6bd
cmp byte [rsi + 0x38], dil
je 0x1400de6b4
cmp dword [rsi + 0x34], 5
jne 0x1400de6b4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400de6bd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400ccf54
jmp 0x1400de730
jns 0x1400de730
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400cfe94
cmp rax, 0xffffffffffffffff
jne 0x1400de6e8
cmp byte [rsi + 0x30], dil
je 0x1400de730
mov edi, dword [rsi + 0x2c]
jmp 0x1400de730
mov ecx, r14d
call fcn.1400d7450
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400de730
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400de730
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400de729
mov eax, dword [rsi + 0x2c]
jmp 0x1400de72e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400cfe94
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400e1b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r9, rcx
mov r10, rdx
mov rdx, qword [r8 + 0x1b8]
mov ecx, 0x3020100
mov dword [r8 + 0x1c4], ecx
mov r11, r8
mov eax, 1
add ecx, 0x4040404
mov dword [r8 + rax*4 + 0x1c4], ecx
inc rax
cmp rax, rdx
jbe 0x1400e1b51
xor r8d, r8d
test r10, r10
je 0x1400e1bb3
nop
movzx eax, byte [r9]
or r8, rax
movzx ecx, byte [rax + r11 + 0x1c4]
mov byte [r9], cl
mov byte [r11 + 0x1c3], cl
nop word [rax + rax]
movzx ecx, byte [rax + r11 + 0x1c3]
mov rdx, rax
sub rax, 1
mov byte [rdx + r11 + 0x1c4], cl
jns 0x1400e1b90
inc r9
sub r10, 1
jne 0x1400e1b70
shr r8, 2
mov qword [r11 + 0x1b8], r8
ret

Function at 0x1400e9950
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e9978
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400e9978
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400032e0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
mov edx, 0x28
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x40]
lea rdx, [0x140040af8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x50], 1
mov eax, 0xc
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + rax + 0x54], rcx
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0x5c], 2
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add rsp, 0x78
ret

Function at 0x140007660
Capabilities:
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0
xor edx, edx
mov ecx, 6
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x14000774c
mov dword [rsp + 0x50], 0x238
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000772d
lea rdx, [0x140041330]
lea rcx, [rsp + 0x7c]
call fcn.14001f2d0
test eax, eax
je 0x1400076e9
lea rdx, [0x140041380]
lea rcx, [rsp + 0x7c]
call fcn.14001f2d0
test eax, eax
jne 0x14000771a
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000771a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000772d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400076bf
cmp qword [rsp + 0x30], 0
je 0x140007740
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x14000774e
mov rax, qword [rsp + 0x2b0]
cmp qword [rax + 0x88], 0
je 0x1400077d6
mov rax, qword [rsp + 0x2b0]
mov r9, qword [rax + 0x88]
lea r8, [0x1400413c0]
xor edx, edx
xor ecx, ecx
call fcn.140008fe0
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
inc eax
cdqe
mov rcx, rax
call fcn.1400180e8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x98], rcx
mov rax, qword [rsp + 0x2b0]
mov r8, qword [rax + 0x88]
lea rdx, [0x1400413d0]
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rax + 0x98]
call fcn.140009130
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x2b0]
lea r8, [0x140008dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x2b0]
mov qword [rcx + 0x58], rax
add rsp, 0x2a0
pop rdi
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Check for software breakpoints
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ae860

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b0337
Function at 0x14016d026
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
test r12, 0x97b1e46
stc
sub edx, edx
jmp 0x1404b1b4c

Function at 0x140170f44
Capabilities:
Parse pe header

Disassembly:
sub edx, edx
sub ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1404b1b4c

Function at 0x140174fc2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc rcx
cmc
test al, al
jmp 0x1401d28ee
jne 0x1401b7d6c
movzx eax, byte [rcx - 1]
jmp 0x14022df97
je 0x1401d28f4
movzx eax, byte [rcx + 1]
jmp 0x140116101
jne 0x1401b7d88
ret
mov rax, qword [rdx]
mov rdx, qword [rax + 0xf8]
bt r9w, r10w
cbw
rol r9, cl
mov rax, qword [rdx]
rcl r9b, cl
movzx r9d, byte [rax]
sal al, 0x5a
btr ax, 0xe8
movzx eax, byte [rcx]
test al, al
jmp 0x1401a7842
je 0x1401d28f4
sub al, 0x45
test al, 0xdf
jmp 0x1401249ef
je 0x14026cb4e
movzx edx, al
shld ax, r9w, 0xb8
cbw
and eax, 0x3a914198
nop dword [rax + rax]
sar rax, cl
movzx eax, dl
clc
cmp r9w, r8w
cmp dl, r9b
je 0x14026cb4e
movzx eax, byte [rcx + 1]
not dh
cmovl rdx, rdi
inc rcx
movzx edx, al
cmp r10w, r8w
test al, al
jmp 0x14026cb48
je 0x140119de6
cmp al, r9b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop dword [rax]
rcr ax, 0xf0
cmp dil, r10b
xor al, r9b
movzx eax, byte [r8]
cmp r13b, 0xf6
stc
lea rdx, [rdx + 1]
cmp rdi, rsi
mov byte [rdx], al
test r14d, 0x54190aff
lea r8, [r8 + 1]
test al, al
jmp 0x14015d44d
jne 0x140175496
movzx eax, byte [rcx - 1]
movsx r8w, dl
mov r8, rcx
dec rcx
cmc
cmp al, 0x30
jmp 0x140119de0
dec rcx
test r9b, r9b
cmp al, 0x30
jmp 0x1401b7d66
jne 0x1401a7860
inc rcx
cmp esp, r10d
test al, al
jmp 0x140298221
je 0x14015d453
movzx eax, byte [rcx]
test al, al
jmp 0x140175490

Function at 0x14017828b
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x140446d64
push rsi
shld esi, ebp, 0xf1
movsx esi, bp
or eax, 0x7d5f2d40
push rdi
mov rax, 0x74624a3c
xadd sil, sil
sub rsp, 0x28
mov rsi, rcx
xor ax, r12w
mov rcx, qword [rcx + 0x18]
cmc
cbw
mov rax, qword [rcx]
cmp esp, eax
test dil, 0xbf
xor edx, edx
test al, 0x98
xor r8d, r8d
jmp 0x140446da4
call qword [rax + 0x188]
mov edi, eax
movsx cx, r9b
mov ch, 0xb9
bswap cx
lea rcx, [rsi + 0x30]
call fcn.14045a9c9
test edi, edi
jmp 0x140446dc7
je 0x140446df9
cmp edi, 0x8899000c
jmp 0x140446dd8
jne 0x140446e17
mov rcx, rsi
movzx rdi, r10w
add rsp, 0x28
pop rdi
movsx esi, r14w
pop rsi
jmp 0x140446df4
jmp fcn.140446a46
nop
ror sil, cl
add rsp, 0x28
mov dil, 0xb9
pop rdi
not sil
jmp 0x140446e10
pop rsi
jmp 0x140446e16
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
sal sil, cl
neg dl
or r9b, 0x1c
mov dl, 3
dec dil
add esi, 0x7a0149ca
sar dil, 0x16
mov r9d, 0x54
sal dil, 9
stc
mov esi, edx
add rsp, 0x28
setae sil
movzx rdi, r9w
movsx rsi, sp
pop rdi
not sil
movzx esi, dx
pop rsi
jmp 0x140446e65
jmp fcn.1403b08dd
Function at 0x1401d7b12
Capabilities:
Parse pe header

Disassembly:
jne 0x1402044b4
xor eax, eax
xadd cl, al
or al, 7
ror al, 0xa0
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
mov al, 0xda
sete al
jmp 0x1401d3668
jne 0x1402044b4
movsxd rdx, dword [rcx + 0x3c]
test r12b, dl
cmp r14w, 0x4895
cmp r12, r9
lea rdx, [rdx + rcx]
cmp bx, r13w
test rdi, 0x2097ad6
cmp dword [rdx], 0x4550
jmp 0x1400f5f34
ret
mov eax, 0x5a4d
jmp 0x14022c688
xor eax, eax
jmp 0x14020976c
ret
cmp word [rcx], ax
jmp 0x1401a1e12

Function at 0x140213144
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x140198fdd
cmp r8, rdx
jmp 0x140204489
je 0x1401ba09d
sub eax, eax
nop word [rax + rax]
cmp r11b, r15b
cmp r8, rax
jmp 0x140256c98
je 0x1401c52c7
cmp rdx, 0x104
mov r8b, 0x8e
not r8b
movzx r8w, dil
mov r8d, 0x104
cmovb r8, rdx
jmp 0x1400f3185
je 0x140198fb0
mov word [r10], 0
movzx eax, word [0x1400b8f10]
cmp rdx, 0x104
movzx r8d, r10w
bswap r8d
sets r8b
mov r8d, 0x104
cmovb r8, rdx
clc
test ax, ax
je 0x14024f93d
sub edx, edx
sar r9b, 0x1e
lea r9, [0x1400b8f10]
jmp 0x1400f8e28
ret
inc rax
clc
cmp esi, 0x2c1c7de2
cmp rsi, rdx
test r11w, r11w
jne 0x140110bd9
sub r8, rax
cmc
test r8, r8
jmp 0x140198fa4
mov rax, qword gs:[0x30]
movzx r10d, r14w
xadd r11b, r9b
mov rax, qword [rax + 0x60]
movsx r9w, r11b
mov rax, qword [rax + 0x18]
and r9b, dil
cmp rcx, 0x17b71e2f
mov rax, qword [rax + 0x10]
dec r8b
btc r8d, 0x93
rcl r11d, 0x30
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movsx r9w, cl
movzx r11w, sil
cmovae r8, rdx
xadd r9d, r10d
sar r9, cl
bsr r10d, r10d
mov r9, qword [rax + 0x60]
test rbp, 0x2b397548
sbb r11b, 0x79
rcl r10w, cl
movzx r11d, word [r9]
cmp r13d, 0x2c4f571d
sal r10, 0x9f
setp r10b
lea r10, [0x1400b8f10]
jmp 0x1401e0c82
test r11w, r11w
jmp 0x140110bc8
je 0x140217ed6
mov word [rcx], ax
sbb al, r11b
cwde
btc eax, 0x2c
add rcx, 2
mov ax, r13w
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
cmc
test ax, ax
jmp 0x14024f934
movzx eax, word [0x1400b8f10]
test ax, ax
jmp 0x140163bb9
je 0x14019c3ae
mov word [rcx], 0
jmp 0x14019c3ae
jne 0x1400f8e28
sub r8, rdx
test r8, r8
jmp 0x140217ed0
je 0x140198faa
mov word [r10], r11w
add r10, 2
cmovbe r11, r12
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1401ba082
Function at 0x140219da7
Capabilities:
Check for software breakpoints

Disassembly:
jne 0x1402312e4
movzx eax, byte [r11 + rcx*4 + 2]
cmp r8w, r8w
cmp r13w, 0x3a62
cmp al, byte [rdx + 2]
jmp 0x1400e2972
je 0x140260844
movzx r10d, byte [rdx]
xchg r8d, r8d
mov r8d, r9d
test sil, 0xeb
sub ecx, ecx
jmp 0x140107f09
jne 0x1402312e4
mov byte [r11 + rcx*4 + 3], 0
cmovae r10d, r13d
movzx r10, r10w
mov r10b, dil
movzx r10d, byte [rdx]
jmp 0x1401def91
cmp al, byte [rdx + 1]
jmp 0x1400e00a4
test r9d, r9d
jmp 0x1400e022f
jmp 0x14023d7fa
mov byte [r11 + 1], cl
cmp r10b, byte [rdx]
setne cl
test bp, 0x1307
test spl, r15b
neg cl
cmp r10b, 0xd8
jmp 0x140221b42
jne 0x1402312e4
movzx eax, byte [r11 + rcx*4 + 1]
cmp r15, rsp
cmp ah, 0xcd
jmp 0x1400ee013
jmp 0x1402312e4
neg al
jmp 0x14025b6d2
je 0x140260844
and r9d, 3
bt rax, 0xe5
xor ecx, ecx
movzx rax, dx
test r11b, 0x97
nop word cs:[rax + rax]
movsx ax, dil
btr rax, 0x41
movzx eax, byte [r11 + rcx*2]
cmc
clc
cmp al, byte [rdx]
mov al, r9b
jmp 0x140232c57
mov r10, qword [rcx]
mov r11, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
test spl, bl
cmc
jmp 0x14029a1c3
jne 0x1400f9cdc
test r9d, r9d
je 0x140260844
lea ecx, [r9 - 1]
cmp ecx, 3
jb 0x140282842
mov r8d, r9d
shl ecx, cl
dec rcx
and r8d, 0xfffffffc
movsx cx, r9b
nop word cs:[rax + rax]
movzx ecx, byte [r11]
cmp cl, byte [rdx]
movzx r10d, byte [r11 + 2]
setne cl
stc
clc
test al, bpl
neg cl
jmp 0x1401095b8
mov byte [r11 + 3], cl
btc cx, dx
movzx ecx, byte [r11 + 4]
test r9w, 0x768e
cmp bpl, r14b
cmp cl, byte [rdx]
setne cl
cmc
cmp dil, 0x36
clc
neg cl
mov byte [r11 + 5], cl
adc ch, 0x3d
movzx ecx, byte [r11 + 6]
cmc
cmp r8b, 0x37
cmp cl, byte [rdx]
setne cl
jmp 0x14026ba11
inc rcx
test dl, ah
cmp r12b, r13b
cmp r8d, ecx
jmp 0x14023d7f4
setne al
jmp 0x1401ecb54
je 0x140260844
cmp byte [r11 + rcx*4], r10b
jmp 0x140118187
mov byte [r11 + rcx*2 + 1], al
jmp 0x140298390
ret
neg cl
mov byte [r11 + 7], cl
test r8w, ax
add r11, 8
stc
add r8d, 0xfffffffc
jmp 0x14028283c
jne 0x140220dfa
test r9b, 3
jmp 0x1401f1b8d
inc rcx
cmp r9d, ecx
jne 0x1401f1bba
jmp 0x140260844
imul r9d, dword [r10]
cmc
cmp r11, rsp
cmp bx, 0x35dc
cmp r8d, 2
jmp 0x140220dbf

Function at 0x140235d8b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x1401e7dbd
add rdx, 2
neg r8w
adc r8b, dl
shrd rax, rbp, 0xed
movzx eax, word [rdx]
bsf r8d, edi
adc r8b, spl
movzx r8d, word [rcx + rdx]
sub r8d, eax
je 0x14027f05f
mov eax, r8d
shr r8d, 0x1f
test cl, dl
neg eax
shr eax, 0x1f
sub eax, r8d
ret
movzx eax, word [rdx]
xor r8w, 0x66b3
movzx r8d, word [rcx]
cmp r8b, cl
cmp ax, 0x6c6b
sub r8d, eax
jmp 0x14027f04c
jne 0x1401e7dbd
sub rcx, rdx
test r14w, 0x7826
cmp r8b, 0x49
test ax, ax
jmp 0x1401e7d8f
Function at 0x140237a10
Capabilities:
Enumerate pe sections

Disassembly:
ret
jb 0x1400e3480
inc r9d
cmp dh, 0x87
cmp r8b, spl
add rax, 0x28
jmp 0x140232c80
jb 0x1401f4153
mov ecx, dword [rax + 8]
cmp r13w, di
test r11b, r14b
add ecx, edx
cmp dx, di
cmp r10, rcx
jmp 0x1401f414d
cmp r9d, r11d
jmp 0x1402536a5
movsxd r8, dword [rcx + 0x3c]
cmovb r11w, r11w
xor r9d, r9d
lea r8, [r8 + rcx]
shl r10d, 0x52
bsr r11w, r8w
bts rax, r10
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
cmp r15, 0x7f94bce
add rax, 0x18
clc
test r15, 0x3a220f9e
lea rax, [rax + r8]
clc
test r11d, r11d
je 0x1402536ab
mov edx, dword [rax + 0xc]
cmc
cmp r10, rdx
jmp 0x1402217d2
jb 0x140237a5b
sub eax, eax
jmp 0x1400e3480