joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e7a0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42ea26
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42ea1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x005e3e2f], 0
jne 0x42e7fa
xor edx, edx
xor ebx, ebx
jmp 0x42e840
xor edx, edx
jmp 0x42e825
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041db80
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42e7fe
add rax, 0x1268
call fcn.0042e720
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42e9b4
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42e83b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00411d80
test rax, rax
jne 0x42e88c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e83b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42e8cc
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e83b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42ea0d
lea r10, [0x005b6218]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42e94f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42e985
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e83b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42ea05
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42e83b
cmp rbx, 0x200
ja 0x42e9f4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004243a0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042e720
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00461040
mov rax, r8
call fcn.00460fc0
mov rax, r8
mov ecx, 0x40
call fcn.00460fe0
mov edx, 0x200
nop
call fcn.00461020
nop
mov qword [rsp + 8], rax
call fcn.00465880
mov rax, qword [rsp + 8]
jmp fcn.0042e7a0
Function at 0x443540
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4436a7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x443552
cmp edx, ecx
jne 0x443695
nop word [rax + rax]
test rsi, rsi
jne 0x443695
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4435b4
nop
call fcn.00462820
xorps xmm15, xmm15
mov r14, qword [0x005e4068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00443460
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x443690
mov rdx, qword [0x00590e08]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x443685
mov rcx, qword [0x00590e00]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00591ab0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00591ab0], rax
nop
mov edx, 1
lea rsi, [0x00591ab8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x443673
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004bb5a2]
mov ebx, 0x28
nop
call fcn.00434a80
mov rax, rsi
mov rcx, rdx
call fcn.00460fc0
call fcn.00433120
lea rax, [0x004ba807]
mov ebx, 0x23
call fcn.00434a80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ed40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00443540
Function at 0x44ec60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44edd7
movzx edx, byte [rax]
test edx, edx
jne 0x44ec94
nop dword [rax]
test r8b, r8b
jne 0x44ec94
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44eca7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44ed97
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44ed85
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44ed77
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44ecfd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44ed40
mov eax, 1
cmp rax, rbx
ja 0x44ed2b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00461080
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44ed6f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44ed33
mov rcx, r11
mov eax, r12d
jmp 0x44ed02
mov rcx, rbx
call fcn.00460fc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00460fc0
mov eax, r8d
mov rcx, rbx
call fcn.00461080
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44edcd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44ed90
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44ecad
mov eax, edx
mov rcx, rbx
call fcn.00460fc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00460fc0
nop
int3
Function at 0x4561e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45628f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004562e0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ec00
xorps xmm15, xmm15
mov r14, qword [0x005e4068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045ed40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004561e0
Function at 0x460b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403203
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408c60
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ed40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4031e0
cmp byte [0x005e3e28], 0
je 0x460b35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45dd80
jmp 0x4031e0

Function at 0x460b40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e4100]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e3e28], 0
je 0x460b75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e43c0]
aesenc xmm0, xmmword [0x005e43d0]
aesenc xmm0, xmmword [0x005e43e0]
movq rax, xmm0
ret
jmp 0x408e80

Function at 0x460b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e4100]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e3e28], 0
je 0x460bb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e43c0]
aesenc xmm0, xmmword [0x005e43d0]
aesenc xmm0, xmmword [0x005e43e0]
movq rax, xmm0
ret
jmp 0x408ee0

Function at 0x462880
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4628b4
mov rcx, 0x28
jmp 0x4628bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x005e4068], rcx
pop rbp
ret
Function at 0x477ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477f6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x005e4068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x477f4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0049cc80]
xor ebx, ebx
mov rcx, rdx
call fcn.004477e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00478280
inc rbx
cmp rcx, rbx
jae 0x477f3e
mov edi, 1
lea rsi, [0x0049cc80]
call fcn.004478c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0050e018]
lea rsi, [0x0050d990]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ed40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00477ea0
Function at 0x48ade0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x48adf7
inc rax
cmp rax, 4
jge 0x48ae0f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x48adf4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x48ae20
inc rax
cmp rax, 4
jge 0x48ae2e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x48ae57
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x48ae3b
jmp 0x48ae1d
Function at 0x14001108c
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140011a80
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x708]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x14002401b]
call fcn.1400113a2
mov qword [rbp + 8], 0xffffffffffffffff
mov edx, dword [rbp + 0x6e0]
mov ecx, 8
call fcn.1400111ae
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140011afd
lea rcx, str.CreateToolhelp32Snapshot__of_modules_
call fcn.14001138e
xor eax, eax
jmp 0x140011bc0
mov dword [rbp + 0x30], 0x438
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011249
test eax, eax
jne 0x140011b32
lea rcx, str.Module32First
call fcn.14001138e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140011bc0
lea rdx, [rbp + 0x60]
lea rcx, str._n_n_____MODULE_NAME:______s
call fcn.14001102d
lea rdx, [rbp + 0x260]
lea rcx, str._n_____Executable_______s
call fcn.14001102d
mov edx, dword [rbp + 0x38]
lea rcx, str._n_____Process_ID______0x_08X
call fcn.14001102d
mov edx, dword [rbp + 0x3c]
lea rcx, str._n_____Ref_count__g____0x_04X
call fcn.14001102d
mov edx, dword [rbp + 0x40]
lea rcx, str._n_____Ref_count__p____0x_04X
call fcn.14001102d
mov edx, dword [rbp + 0x48]
lea rcx, str._n_____Base_address____0x_08X
call fcn.14001102d
mov edx, dword [rbp + 0x50]
lea rcx, str._n_____Base_size________d
call fcn.14001102d
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400110a5
test eax, eax
jne 0x140011b32
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad00]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret
Function at 0x1400111e5
Capabilities:
Enumerate threads

Disassembly:
jmp 0x140011c50
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x168]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002401b]
call fcn.1400113a2
mov qword [rbp + 8], 0xffffffffffffffff
xor edx, edx
mov ecx, 4
call fcn.1400111ae
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140011cbd
xor eax, eax
jmp 0x140011d53
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.14001124e
test eax, eax
jne 0x140011cef
lea rcx, str.Thread32First
call fcn.14001138e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140011d53
mov eax, dword [rbp + 0x140]
cmp dword [rbp + 0x34], eax
jne 0x140011d33
mov edx, dword [rbp + 0x30]
lea rcx, str._n_n_____THREAD_ID_______0x_08X
call fcn.14001102d
mov edx, dword [rbp + 0x38]
lea rcx, str._n_____Base_priority____d
call fcn.14001102d
mov edx, dword [rbp + 0x3c]
lea rcx, str._n_____Delta_priority___d
call fcn.14001102d
lea rcx, [0x14001b500]
call fcn.14001102d
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.14001107d
test eax, eax
jne 0x140011cef
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad80]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x1400135c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011294
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011820
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x14002401b]
call fcn.1400113a2
xor edx, edx
mov ecx, 2
call fcn.1400111ae
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140011887
lea rcx, str.CreateToolhelp32Snapshot__of_processes_
call fcn.14001138e
xor eax, eax
jmp 0x1400119d2
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.140011235
test eax, eax
jne 0x1400118bc
lea rcx, str.Process32First
call fcn.14001138e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400119d2
lea rcx, str._n_n
call fcn.14001102d
lea rdx, [rbp + 0x7c]
lea rcx, str._nPROCESS_NAME:___s
call fcn.14001102d
lea rcx, str._n_______________________________________________________
call fcn.14001102d
mov dword [rbp + 0x2a4], 0
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140011918
lea rcx, str.OpenProcess
call fcn.14001138e
jmp 0x140011947
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 0
jne 0x14001193d
lea rcx, str.GetPriorityClass
call fcn.14001138e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbp + 0x58]
lea rcx, str._n__Process_ID_________0x_08X
call fcn.14001102d
mov edx, dword [rbp + 0x6c]
lea rcx, str._n__Thread_count________d
call fcn.14001102d
mov edx, dword [rbp + 0x70]
lea rcx, str._n__Parent_process_ID__0x_08X
call fcn.14001102d
mov edx, dword [rbp + 0x74]
lea rcx, str._n__Priority_base_______d
call fcn.14001102d
cmp dword [rbp + 0x2a4], 0
je 0x14001199e
mov edx, dword [rbp + 0x2a4]
lea rcx, str._n__Priority_class______d
call fcn.14001102d
mov ecx, dword [rbp + 0x58]
call fcn.14001108c
mov ecx, dword [rbp + 0x58]
call fcn.1400111e5
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.140011352
test eax, eax
jne 0x1400118bc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014910
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014930
xor al, al
jmp 0x1400149b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014943
xor al, al
jmp 0x1400149b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001496d
xor al, al
jmp 0x1400149b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014981
xor al, al
jmp 0x1400149b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014993
xor al, al
jmp 0x1400149b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400149af
xor al, al
jmp 0x1400149b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140006d70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x140006e1c
test r8, r8
je 0x140006e1c
xor r9d, r9d
mov r10, r8
mov eax, r9d
nop dword [rax]
mov byte [r10], al
inc eax
inc r10
cmp eax, 0x100
jl 0x140006da0
mov r10d, r9d
nop word [rax + rax]
movzx ecx, byte [r8]
xor edx, edx
mov eax, r10d
div edi
movzx eax, byte [rdx + rbx]
add r9d, eax
add r9d, ecx
and r9d, 0x800000ff
jge 0x140006deb
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r8]
movsxd rdx, r9d
inc r10d
movzx eax, byte [rdx + r11]
inc r8
mov byte [r8 - 1], al
mov byte [rdx + r11], cl
cmp r10d, 0x100
jl 0x140006dc0
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
xor eax, eax
ret

Function at 0x140006e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x20
mov rsi, r9
mov r12d, r8d
mov rbp, rdx
test r9, r9
je 0x140006f54
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140006f54
mov ecx, 0x100
mov qword [rsp + 0x30], rdi
call fcn.140007d08
mov edx, dword [rsp + 0x50]
mov rcx, rsi
mov r8, rax
mov rdi, rax
call fcn.140006d70
test eax, eax
jne 0x140006ea5
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
xor r8d, r8d
mov r9d, r8d
test r12d, r12d
je 0x140006f3c
sub rbp, rbx
mov r11, r12
nop word [rax + rax]
inc r8d
and r8d, 0x800000ff
jge 0x140006ed9
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd r10, r8d
movzx eax, byte [r10 + rdi]
add r9d, eax
and r9d, 0x800000ff
jge 0x140006efa
dec r9d
or r9d, 0xffffff00
inc r9d
movzx edx, byte [r10 + rdi]
movsxd rcx, r9d
movzx eax, byte [rcx + rdi]
mov byte [r10 + rdi], al
mov byte [rcx + rdi], dl
movzx ecx, byte [r10 + rdi]
add ecx, edx
and ecx, 0x800000ff
jge 0x140006f26
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rax, ecx
inc rbx
movzx ecx, byte [rax + rdi]
xor cl, byte [rbx + rbp - 1]
dec r11
mov byte [rbx - 1], cl
jne 0x140006ec0
mov rax, qword [rsp + 0x60]
mov rcx, rdi
mov dword [rax], r12d
call fcn.140007ca4
or eax, 0xffffffff
jmp 0x140006e8a
xor eax, eax
jmp 0x140006e8f
Function at 0x140006f80
Capabilities:
Create process on windows
Create process suspended
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x710
mov rax, qword [0x1400190a8]
xor rax, rsp
mov qword [rsp + 0x700], rax
lea rdx, [rsp + 0x1f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0xe0]
lea rdx, str.xxmm
lea rcx, [rsp + 0x1f0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rdx, str..bat
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x300]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor esi, esi
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x50]
lea r8d, [rsi + 0xb]
lea rdx, str.:try_r_ndel__
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x300]
lea r9, [rsp + 0x50]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x300]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x50]
lea r8d, [rsi + 0xd]
lea rdx, str.__r_nif_exist__
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x300]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x300]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x50]
lea r8d, [rsi + 0x12]
lea rdx, str.__goto_try_r_ndel__0
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8d, [rsi + 0x68]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.14000b6a0
lea rax, [rsp + 0x58]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov word [rsp + 0xb0], si
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000717a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.1400077a0
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret