joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140113fe0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140114022
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140114069
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1401140c2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140114080
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140114103
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140133b92]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140133b93]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401140d0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140181aa2
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x3d12c499
pushf
not eax
add eax, 0xcc8c2034
xor eax, 0x8e7dc217
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x81e9f5f9
xor eax, 0xa2907de6
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xc67c8632
xor eax, 0x8abb5960
rol eax, 5
popf
cmp eax, 0
jne 0x140181af2
popf
pop rax
jmp 0x140181af2
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
jmp 0x140181b1f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x28
ret
Function at 0x1401fbc0c
Capabilities:
Get file attributes

Disassembly:
push rax
pushf
mov eax, 0xcc1b61d6
pushf
not eax
add eax, 0xc93b91b6
xor eax, 0x9b446037
rol eax, 0x82
popf
pushf
not eax
add eax, 0x9474a734
xor eax, 0xfb0f401d
rol eax, 0x85
popf
pushf
not eax
add eax, 0x904e6446
xor eax, 0x88d961dd
rol eax, 9
popf
pushf
not eax
add eax, 0xaa43a414
xor eax, 0x8a1c325f
rol eax, 0xf7
popf
cmp eax, 2
jne 0x1401fbc6f
popf
pop rax
jmp 0x1401fbd4b
cmp eax, 0
jne 0x1401fbc7e
popf
pop rax
jmp 0x1401fbc9c
cmp eax, 3
jne 0x1401fbc8d
popf
pop rax
jmp 0x1401fbd86
cmp eax, 1
jne 0x1401fbc9c
popf
pop rax
jmp 0x1401fbd41
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, rax
call fcn.140005330
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
jmp 0x1401fbcbd
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401fbcfb
push rax
pushf
mov eax, 0x2555d24d
pushf
not eax
add eax, 0xa2612f11
xor eax, 0x98c96557
rol eax, 0x35
popf
pushf
not eax
add eax, 0xec43a643
xor eax, 0xb9a6adfb
rol eax, 0x52
popf
jmp 0x1401fbc60
push rax
pushf
mov eax, 0x9b8471d3
pushf
not eax
add eax, 0xfbbc5ebc
xor eax, 0xdb564b29
rol eax, 0x38
popf
pushf
not eax
add eax, 0xf9fb739a
xor eax, 0xb0f370be
rol eax, 0xae
popf
pushf
not eax
add eax, 0x919cdf54
xor eax, 0xb949bd23
rol eax, 0xff
popf
jmp 0x1401fbc60
mov dword [rsp + 0x20], 1
jmp 0x1401fbd86
mov dword [rsp + 0x20], 0
push rax
pushf
mov eax, 0x57ce85b2
pushf
not eax
add eax, 0xd2ef3e9d
xor eax, 0xc7bba206
rol eax, 0x37
popf
pushf
not eax
add eax, 0xf66e9f2b
xor eax, 0x8010499d
rol eax, 0xf5
popf
jmp 0x1401fbc60
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1402566fa
Capabilities:
Authenticate hmac
Hash data using murmur3
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0xe9a7f6e9
pushf
not eax
add eax, 0x969d69f1
xor eax, 0xa91dcb31
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xd13fa171
xor eax, 0xf17d4d7b
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xb322789f
xor eax, 0xe6e09f66
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x8e3298cb
xor eax, 0xdb69f514
rol eax, 0x38
popf
Function at 0x14027383d
Capabilities:
Read file on windows

Disassembly:
push rax
pushf
mov eax, 0x1c016099
pushf
not eax
add eax, 0x90c200e6
xor eax, 0xf99a5ff0
rol eax, 0x91
popf
pushf
not eax
add eax, 0xe6ceb5f0
xor eax, 0xe7559b3a
rol eax, 0x83
popf
cmp eax, 0
jne 0x14027387a
popf
pop rax
jmp 0x14027387a
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
jmp 0x1402738a7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rsp, 0x28
ret
Function at 0x1402e9531
Capabilities:
Create thread

Disassembly:
push rax
pushf
mov eax, 0xce9a3248
pushf
not eax
add eax, 0xdf52ecbc
xor eax, 0x8da61c2c
rol eax, 0x71
popf
pushf
not eax
add eax, 0x9d9f13bd
xor eax, 0xc63fda7c
rol eax, 0x52
popf
pushf
not eax
add eax, 0xf393698f
xor eax, 0xe7850e0e
rol eax, 0x9d
popf
cmp eax, 2
jne 0x1402e9581
popf
pop rax
jmp 0x1402e96fa
cmp eax, 0
jne 0x1402e9590
popf
pop rax
jmp 0x1402e95ae
cmp eax, 3
jne 0x1402e959f
popf
pop rax
jmp 0x1402e9793
cmp eax, 1
jne 0x1402e95ae
popf
pop rax
jmp 0x1402e96c8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.140188f4b
lea rax, [0x1ba3a7f13]
pushf
sub rax, 0x7a392c63
popf
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
jmp 0x1402e9610
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1402e966f
push rax
pushf
mov eax, 0x1fc28cba
pushf
not eax
add eax, 0xc04efd5f
xor eax, 0x9157e901
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x93f44f41
xor eax, 0xa995c53f
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xf6ab84d0
xor eax, 0xb3d9f39b
rol eax, 0x37
popf
jmp 0x1402e9572
push rax
pushf
mov eax, 0x669068a8
pushf
not eax
add eax, 0xeb9eb9f7
xor eax, 0xfa5b3548
rol eax, 0x44
popf
pushf
not eax
add eax, 0xb3cf8fcc
xor eax, 0xb38a1f71
rol eax, 0x60
popf
pushf
not eax
add eax, 0xab637f63
xor eax, 0xa5ddece2
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xfd3ced40
xor eax, 0x8f1f537a
rol eax, 0x34
popf
jmp 0x1402e9572
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x1402e9793
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 0x9fb01dd1
pushf
not ecx
add ecx, 0xbf8cc4b8
xor ecx, 0x81cf041d
rol ecx, 0xf8
popf
pushf
not ecx
add ecx, 0xadaf7f68
xor ecx, 0xb2110bc5
rol ecx, 0x94
popf
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push rax
pushf
mov eax, 0xfe682133
pushf
not eax
add eax, 0xcf7f51d5
xor eax, 0xfad54234
rol eax, 0x92
popf
pushf
not eax
add eax, 0xa8ba4fa4
xor eax, 0x8f24c1d1
rol eax, 0xe
popf
pushf
not eax
add eax, 0xe57ddf10
xor eax, 0xafc2d859
rol eax, 0x86
popf
pushf
not eax
add eax, 0x8e3755bc
xor eax, 0xd3c29c03
rol eax, 0x3c
popf
jmp 0x1402e9572
lea rcx, [rsp + 0x30]
call fcn.1403cc542
add rsp, 0x68
ret
Function at 0x140305085
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xd84bccd9
pushf
not eax
add eax, 0x8ce504fe
xor eax, 0x93cc7af5
rol eax, 0x53
popf
pushf
not eax
add eax, 0x828b1f3d
xor eax, 0xb8fe1fa0
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xb8f12265
xor eax, 0x8ba122b1
rol eax, 0x37
popf
cmp eax, 4
jne 0x1403050d5
popf
pop rax
jmp 0x14030529b
cmp eax, 0
jne 0x1403050e4
popf
pop rax
jmp 0x140305120
cmp eax, 3
jne 0x1403050f3
popf
pop rax
jmp 0x140305210
cmp eax, 1
jne 0x140305102
popf
pop rax
jmp 0x1403051be
cmp eax, 5
jne 0x140305111
popf
pop rax
jmp 0x1403052dd
cmp eax, 2
jne 0x140305120
popf
pop rax
jmp 0x14030520b
mov qword [rsp + 8], rcx
sub rsp, 0x38
call sub.MSVCP140.dll_int___cdecl_std::uncaught_exceptions_void_
test eax, eax
jne 0x140305165
push rax
pushf
mov eax, 0xeb9797b
pushf
not eax
add eax, 0x8ede2e74
xor eax, 0x88f0275a
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xff710b15
xor eax, 0xbe1678a0
rol eax, 0xca
popf
jmp 0x1403050c6
push rax
pushf
mov eax, 0x78c711b6
pushf
not eax
add eax, 0xa463dfce
xor eax, 0x8b6c99ed
rol eax, 0x26
popf
pushf
not eax
add eax, 0x87b4b5e4
xor eax, 0xf69d5981
rol eax, 0x79
popf
pushf
not eax
add eax, 0x82ff9cb9
xor eax, 0xfe75dae6
rol eax, 0xda
popf
pushf
not eax
add eax, 0xca9a1dfd
xor eax, 0xd2ca5ccc
rol eax, 0x1e
popf
jmp 0x1403050c6
mov byte [rsp + 0x20], 1
jmp 0x140305210
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x140305268
push rax
pushf
mov eax, 0x7a16990a
pushf
not eax
add eax, 0x8877e227
xor eax, 0x81c848d8
rol eax, 0x36
popf
pushf
not eax
add eax, 0xf0fdfe2e
xor eax, 0xc153158b
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xa117c905
xor eax, 0xc944a838
rol eax, 0x51
popf
jmp 0x1403050c6
push rax
pushf
mov eax, 0x691a92d1
pushf
not eax
add eax, 0xa9b89065
xor eax, 0x809cfc1b
rol eax, 0x64
popf
pushf
not eax
add eax, 0x8cae1d7e
xor eax, 0xdc9e04f1
rol eax, 4
popf
jmp 0x1403050c6
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
jmp 0x1403052a4
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::_Osfx_void____ptr64]
push rax
pushf
mov eax, 0xb9b756ee
pushf
not eax
add eax, 0x875088c3
xor eax, 0x829e6ab2
rol eax, 0x10
popf
pushf
not eax
add eax, 0xed5dfb80
xor eax, 0x91e3ac78
rol eax, 0xae
popf
jmp 0x1403050c6
mov rcx, qword [rsp + 0x40]
call fcn.1403367fa
add rsp, 0x38
ret
Function at 0x14032fdf5
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x392fc406
pushf
not eax
add eax, 0xa3218f55
xor eax, 0xf59cce1f
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x97fe51b4
xor eax, 0xef301b31
rol eax, 0x63
popf
cmp eax, 0
jne 0x14032fe32
popf
pop rax
jmp 0x14032fe32
sub rsp, 0x28
xor ecx, ecx
jmp 0x14032fe39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret
Function at 0x14035a562
Capabilities:
Log keystrokes via polling

Disassembly:
push rax
pushf
mov eax, 0x583adc3a
pushf
not eax
add eax, 0xead7789e
xor eax, 0xf1459b8b
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xd8aeda17
xor eax, 0xec2ae5e5
rol eax, 0x4d
popf
cmp eax, 2
jne 0x14035a59f
popf
pop rax
jmp 0x14035a692
cmp eax, 0
jne 0x14035a5ae
popf
pop rax
jmp 0x14035a5cc
cmp eax, 3
jne 0x14035a5bd
popf
pop rax
jmp 0x14035a6f3
cmp eax, 1
jne 0x14035a5cc
popf
pop rax
jmp 0x14035a688
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
jmp 0x14035a5d9
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14035a62f
push rax
pushf
mov eax, 0x349e6929
pushf
not eax
add eax, 0x9578fc46
xor eax, 0xdd322217
rol eax, 0x8a
popf
pushf
not eax
add eax, 0x8b3ee8ad
xor eax, 0xf18fb778
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xf5a4bf32
xor eax, 0xe6d7a57c
rol eax, 0x7a
popf
jmp 0x14035a590
push rax
pushf
mov eax, 0x429a3e49
pushf
not eax
add eax, 0xd562802b
xor eax, 0x9a3635b0
rol eax, 0xfc
popf
pushf
not eax
add eax, 0xb480f4ff
xor eax, 0xdb233be8
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xbb022b88
xor eax, 0xfca16ab9
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xa7e98bad
xor eax, 0xf6185989
rol eax, 0x3b
popf
jmp 0x14035a590
mov dword [rsp + 0x20], 1
jmp 0x14035a6f3
mov dword [rsp + 0x20], 0
push rax
pushf
mov eax, 0xbea1581c
pushf
not eax
add eax, 0xa70b387d
xor eax, 0xb558ff28
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xb3ce7c47
xor eax, 0xd17363dc
rol eax, 0xff
popf
pushf
not eax
add eax, 0xf5172f06
xor eax, 0xe154b0f2
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xad3b7688
xor eax, 0xe168e957
rol eax, 0x5a
popf
jmp 0x14035a590
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14037cf53
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x4e1ed99a
pushf
not eax
add eax, 0x8b54e725
xor eax, 0xfef65186
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x801daa77
xor eax, 0x9fb78c74
rol eax, 0xb6
popf
cmp eax, 4
jne 0x14037cf90
popf
pop rax
jmp 0x14037d13c
cmp eax, 0
jne 0x14037cf9f
popf
pop rax
jmp 0x14037cfdb
cmp eax, 3
jne 0x14037cfae
popf
pop rax
jmp 0x14037d0ef
cmp eax, 1
jne 0x14037cfbd
popf
pop rax
jmp 0x14037d087
cmp eax, 5
jne 0x14037cfcc
popf
pop rax
jmp 0x14037d19a
cmp eax, 2
jne 0x14037cfdb
popf
pop rax
jmp 0x14037d0c1
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14037d02e
push rax
pushf
mov eax, 0x82eb453a
pushf
not eax
add eax, 0xb729d84e
xor eax, 0xf3fcec3c
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xc15a4e08
xor eax, 0xdd791e70
rol eax, 0xb4
popf
jmp 0x14037cf81
push rax
pushf
mov eax, 0x844219c5
pushf
not eax
add eax, 0xc0519e8c
xor eax, 0xd3e34836
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xa4fa9dd7
xor eax, 0x907cb3c1
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xcb80ad68
xor eax, 0xe00ce6f9
rol eax, 0x36
popf
pushf
not eax
add eax, 0xfc054893
xor eax, 0xf1817b0f
rol eax, 0x74
popf
jmp 0x14037cf81
xor eax, eax
jmp 0x14037d19a
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
push rax
not rax
sub rcx, rax
pop rax
sub rcx, 1
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14037d13c
xor eax, eax
jmp 0x14037d19a
mov rax, qword [rsp + 8]
push rax
pushf
mov eax, 0x37a9e67e
pushf
not eax
add eax, 0xb4ba6dae
xor eax, 0xaa3b5b12
rol eax, 0xee
popf
pushf
not eax
add eax, 0xed7c8ec5
xor eax, 0xdc22d865
rol eax, 0x33
popf
pushf
not eax
add eax, 0xf34c05a3
xor eax, 0x876004de
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x9440982e
xor eax, 0xf9a3ea2f
rol eax, 0x4c
popf
jmp 0x14037cf81
add rsp, 0x18
ret
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
cmp byte [0x1400b50dd], 0
mov eax, dword [0x1400b50d8]
movups xmm0, xmmword [str._YK_SI_]
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400b50dc]
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x44], ax
je 0x1400011fd
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400011b6
movdqa xmm0, xmmword [str.7777777777777777O]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b5490]
mov eax, 4
movdqa xmm4, xmmword [0x1400b54e0]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movdqa xmm7, xmmword [0x1400b54b0]
movd xmm6, eax
mov eax, Ordinal_33
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm8
movd xmm8, eax
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1400b54c0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400b54c0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x1400010a0
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x16
jge 0x1400011fd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x16
jl 0x1400011d0
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001210
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c4678]
call fcn.1400068c0
lea rcx, [0x14009b6b0]
add rsp, 0x88
jmp fcn.140098aec
Function at 0x140003de0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r12
push r13
mov eax, 0x1070
call fcn.140098fd0
sub rsp, rax
mov rax, qword [0x1400c30c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r12, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
jne 0x140003e2c
mov rdx, rbp
jmp 0x140003f40
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.140002a90
test al, al
je 0x140003e24
mov qword [rsp + 0x1068], rsi
lea rdx, str.PAGE
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r14
mov qword [rsp + 0x1050], r15
nop
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x140003e70
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r15, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r15, rax
test r14d, r14d
je 0x140003f15
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r15 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003ede
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140003ed0
cmp rdi, rax
je 0x140003eee
inc esi
cmp esi, r14d
jae 0x140003f15
lea rdx, str.PAGE
jmp 0x140003eb0
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140003f15
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x40]
add rdx, rax
je 0x140003f15
test ecx, ecx
je 0x140003f15
lea rax, [rsp + 0x40]
mov ebp, ecx
sub rdx, rax
add rdx, r12
jmp 0x140003f18
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r14, qword [rsp + 0x1058]
mov r15, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140003cd0
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400982e0
add rsp, 0x1070
pop r13
pop r12
pop rbp
ret
Function at 0x140006f00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400c30c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140007017
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140007017
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x140006f79
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x140007022
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x140007005
mov edx, dword [rbx + 4]
test edx, edx
je 0x140007005
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x140006fde
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x140006ff5
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140007b90
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x140006f91
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x140007022
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400982e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400092c0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x1400c30c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000934e
test rbx, rbx
je 0x140009316
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140009300
test eax, eax
jns 0x14000936f
test rbx, rbx
je 0x140009374
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140009472
test rbx, rbx
jne 0x14000937b
xor eax, eax
jmp 0x140009472
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140009452
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x1400093d0
lea rcx, [rsp + 0x28]
call fcn.1400068c0
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x1400093f0
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140009488
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140009448
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009443
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400094d1
call fcn.140098300
inc edi
cmp edi, dword [rbx]
jb 0x140009394
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400982e0
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400094dd
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094d8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400094d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140098300
mov rax, rdi
jmp 0x140009465