joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x491e90
jb 0x491eef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00491be0
aeskeygenassist xmm1, xmm0, 1
call fcn.00491c00
aeskeygenassist xmm1, xmm2, 2
call fcn.00491be0
aeskeygenassist xmm1, xmm0, 2
call fcn.00491c00
aeskeygenassist xmm1, xmm2, 4
call fcn.00491be0
aeskeygenassist xmm1, xmm0, 4
call fcn.00491c00
aeskeygenassist xmm1, xmm2, 8
call fcn.00491be0
aeskeygenassist xmm1, xmm0, 8
call fcn.00491c00
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00491be0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00491c00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00491be0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00491c00
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00491be0
jmp 0x491f5d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00491b40
aeskeygenassist xmm1, xmm2, 2
call fcn.00491ba0
aeskeygenassist xmm1, xmm2, 4
call fcn.00491b40
aeskeygenassist xmm1, xmm2, 8
call fcn.00491ba0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00491b40
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00491ba0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00491b40
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00491ba0
jmp 0x491f5d
aeskeygenassist xmm1, xmm0, 1
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 2
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 4
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 8
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00491b00
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00491b00
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x491f6a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1406b0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406b01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406b0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b006f
add dl, dl
jne 0x1406b0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b00f6
xor eax, eax
add dl, dl
jne 0x1406b00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b01ad
add dl, dl
jne 0x1406b00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406b00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406b007e
mov eax, 1
add dl, dl
jne 0x1406b0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b00fb
sub eax, ebx
mov ebx, 1
jne 0x1406b014c
mov ecx, 1
add dl, dl
jne 0x1406b012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406b0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b015d
cmp eax, 0x7d00
jae 0x1406b019b
cmp eax, 0x500
jb 0x1406b0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b007e
cmp eax, 0x7f
ja 0x1406b019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406b01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406b007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007378
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14034b0dc]
call fcn.140026484
mov rax, qword [0x140346d30]
and dword [rax + 0x2e14], 0
test rbx, rbx
je 0x1400073ed
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1400072c8
lea rdx, [0x140027894]
mov rcx, rbx
mov rdi, rax
call fcn.140013f80
mov rbx, rax
test rax, rax
je 0x1400073ed
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400126f8
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14034b0dc]
call fcn.140026484
lea rcx, [rbx + 0x1e8]
call fcn.140003bd4
xor edx, edx
lea rcx, str.RESIZE
mov r8d, dword [rax]
add rsp, 0x20
pop rbx
jmp fcn.140014058

Function at 0x140013e88
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
lea rcx, [0x14034b0dc]
call fcn.140026484
test rdi, rdi
je 0x140013eb7
and qword [rdi], 0
lea rdx, [0x140027890]
mov rcx, rbx
call fcn.140013f80
mov rbx, rax
test rax, rax
je 0x140013f63
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140013f5a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140013f5a
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140013f5a
mov rcx, rsi
mov rbp, rsi
call fcn.140011d64
mov rsi, rax
test rax, rax
je 0x140013f5a
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140013f47
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call fcn.140011d1c
jmp 0x140013f63
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140013f55
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140013f65
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140014058
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, r8d
lea rcx, [0x14034b0dc]
mov esi, edx
call fcn.140026484
cmp dword [0x140346fc4], 0
lea r11, [0x140346fc0]
jne 0x1400140c8
xor r9d, r9d
mov r10, r11
mov edx, r9d
mov r8d, 8
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r8, 1
jne 0x14001409a
mov dword [r10], edx
inc r9d
add r10, 4
cmp r9d, 0x100
jb 0x140014091
not edi
mov edx, edi
test esi, esi
jle 0x1400140ea
movzx eax, byte [rbx]
inc rbx
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [r11 + rcx*4]
sub esi, 1
jne 0x1400140d0
jmp 0x140014125
mov r8b, byte [rbx]
inc rbx
test r8b, r8b
je 0x140014125
mov r9b, 0x23
cmp r8b, r9b
jne 0x140014109
cmp byte [rbx], r9b
jne 0x140014109
cmp byte [rbx + 1], r9b
cmove edx, edi
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [rbx]
xor rcx, rax
shr edx, 8
inc rbx
xor edx, dword [r11 + rcx*4]
test r8b, r8b
jne 0x1400140f8
mov rbx, qword [rsp + 0x30]
not edx
mov rsi, qword [rsp + 0x38]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x14002365c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x14034b0dc]
call fcn.140026484
call fcn.140011ba8
mov rcx, qword [0x140346fa0]
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x2c]
sub ecx, dword [rsp + 0x24]
movd xmm2, ecx
mov ecx, dword [rsp + 0x28]
sub ecx, dword [rsp + 0x20]
cvtdq2ps xmm2, xmm2
movd xmm1, ecx
lea rcx, [rsp + 0x48]
cvtdq2ps xmm1, xmm1
call fcn.140001408
lea rcx, [rsp + 0x40]
movsd xmm0, qword [rax]
movsd qword [rbx + 8], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x140346fa8]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140346fb0]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x140346fa8], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x143], 0
mov byte [rbx + 0x142], al
call fcn.14002377c
cmp byte [rbx + 0xc8], 0
je 0x140023755
or eax, 0xffffffff
jmp 0x14002375a
call fcn.14000f82c
cmp dword [0x140346b38], eax
je 0x14002376d
mov dword [0x140346b38], eax
call fcn.140023860
add rsp, 0x30
pop rbx
ret
Function at 0x140025984
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea rcx, [0x14034b0dc]
call fcn.140026484
xor ebx, ebx
lea rcx, [0x14002bab0]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [rbx + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400259df
xor al, al
jmp 0x140025a58
mov dword [rsp + 0x60], ebx
lea rbp, [0x140031050]
mov rax, rbx
mov r14d, 0x315ae0
movdqu xmm0, xmmword [rax + rbp]
movdqa xmm1, xmmword [0x14002bf90]
pxor xmm1, xmm0
movdqu xmmword [rax + rbp], xmm1
add rax, 0x10
cmp rax, r14
jb 0x1400259f3
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov r8d, r14d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
movdqu xmm0, xmmword [rbx + rbp]
pxor xmm0, xmmword [0x14002bf90]
movdqu xmmword [rbx + rbp], xmm0
add rbx, 0x10
cmp rbx, r14
jb 0x140025a31
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, sil
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140025a74
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x68
lea rcx, [0x14034b0dc]
call fcn.140026484
xor eax, eax
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x70], rax
lea rdx, [0x14002ba68]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r9d, 0x840e32
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x140025ae8
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x68
lea rcx, [0x14034b0dc]
call fcn.140026484
xor eax, eax
mov dword [rsp + 0x28], 0x28
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov r9d, 0x80f922
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14002ba68]
mov rcx, 0xffffffff80000002
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x68
ret

Function at 0x140025b48
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rcx, [0x14034b0dc]
mov dword [rsp + 0x30], 0x11
call fcn.140026484
xor eax, eax
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x38], rax
lea rdx, [0x14002ba68]
mov qword [rsp + 0x48], rax
mov r9d, 0x96abb6
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x68
ret
Function at 0x140025ca4
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x98
lea rcx, [0x14034b0dc]
call fcn.140026484
call fcn.1400221d4
call fcn.140023918
call fcn.140011bd0
call fcn.140026198
mov rcx, qword [0x140346dc8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x140346dc8]
lea rdx, [rsp + 0x20]
mov r8d, 0x64
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rdx, qword [0x140346d78]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassA]
add rsp, 0x98
ret
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012cb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001125d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x1400117a0
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001c278]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400210a2]
call fcn.140011361
movzx eax, word [0x140019c24]
mov word [rbp + 4], ax
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x28], rax
mov r8d, 1
lea rdx, [rbp + 4]
lea rcx, section..data
call fcn.1400111a9
mov r8d, 0x1ff
lea rdx, section..data
mov rcx, qword [rbp + 0x28]
call fcn.1400111a9
call qword [rbp + 0x28]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140019c00]
call fcn.1400112f8
mov eax, edi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400111a4
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014000
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014020
xor al, al
jmp 0x1400140a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014033
xor al, al
jmp 0x1400140a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001405d
xor al, al
jmp 0x1400140a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014071
xor al, al
jmp 0x1400140a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014083
xor al, al
jmp 0x1400140a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001409f
xor al, al
jmp 0x1400140a1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014da0
xor al, al
jmp 0x140014e21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014db3
xor al, al
jmp 0x140014e21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ddd
xor al, al
jmp 0x140014e21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014df1
xor al, al
jmp 0x140014e21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014e03
xor al, al
jmp 0x140014e21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014e1f
xor al, al
jmp 0x140014e21
mov al, 1
add rsp, 0x38
ret
Function at 0x14001132a
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140011890
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a5]
call fcn.1400113ac
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400118d8
xor edx, edx
lea rcx, str.Failed_to_load_kernel32.dll._n
call fcn.1400113b6
xor eax, eax
jmp 0x140011a1a
lea rcx, [0x14001af70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14001190f
xor edx, edx
lea rcx, str.Failed_to_load_advapi32.dll._n
call fcn.1400113b6
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140011a1a
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e170], rax
lea rdx, str.Process32First
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e178], rax
lea rdx, str.Process32Next
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e180], rax
lea rdx, str.OpenProcess
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e188], rax
lea rdx, str.OpenProcessToken
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e190], rax
lea rdx, str.DuplicateTokenEx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e198], rax
lea rdx, str.CreateProcessWithTokenW
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e1a0], rax
cmp qword [0x14001e170], 0
je 0x1400119fd
cmp qword [0x14001e178], 0
je 0x1400119fd
cmp qword [0x14001e180], 0
je 0x1400119fd
cmp qword [0x14001e188], 0
je 0x1400119fd
cmp qword [0x14001e190], 0
je 0x1400119fd
cmp qword [0x14001e198], 0
je 0x1400119fd
cmp qword [0x14001e1a0], 0
jne 0x140011a15
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140011a1a
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x401990
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4019b2
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.00401860
add rsp, 0x20
pop rbx
ret
Function at 0x4023e0
Capabilities:
Query environment variable

Disassembly:
mov r9d, 1
jmp fcn.00401ef0
Function at 0x404470
Capabilities:
Delete file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edx, dword [rcx + 0x18]
mov rbx, rcx
test edx, edx
jle 0x40448b
mov rax, qword [rcx + 0x80]
call qword [rax + 0x18]
mov edx, dword [rbx + 0x2c]
test edx, edx
jle 0x40449f
mov rax, qword [rbx + 0x80]
mov rcx, rbx
call qword [rax + 0x18]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x4044ad
call sub.msvcrt.dll_fclose
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x4044bb
call sub.msvcrt.dll_fclose
cmp qword [rbx + 0x40], 0
je 0x404561
mov edx, dword [rbx + 0x28]
test edx, edx
jne 0x404553
mov rcx, qword [rbx + 0x38]
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x40]
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x48]
call sub.msvcrt.dll_free
mov eax, dword [rbx + 0x70]
test eax, eax
jle 0x40452f
xor esi, esi
xor edi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x78]
add edi, 1
mov rcx, qword [rax + rsi]
call sub.msvcrt.dll_remove
mov rax, qword [rbx + 0x78]
mov rcx, qword [rax + rsi]
add rsi, 8
call sub.msvcrt.dll_free
cmp dword [rbx + 0x70], edi
jg 0x404500
mov rcx, qword [rbx + 0x78]
call sub.msvcrt.dll_free
mov rax, qword [rbx + 0x80]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x404544
mov rcx, rbx
call rax
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x20]
call sub.msvcrt.dll_free
jmp 0x4044d1
and dword [rbx], 0xfffffffe
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x28]
mov edx, 1
mov rcx, rbx
call fcn.00403850
jmp 0x4044c6

Function at 0x404820
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x00411110]
test rax, rax
je 0x404840
add rsp, 0x28
pop rbx
pop rsi
ret
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rsi
test eax, eax
mov ebx, eax
jne 0x404875
mov rax, qword [0x00411110]
test rax, rax
jne 0x404832
nop
lea rcx, [0x0040dba0]
call fcn.004036c0
mov qword [0x00411110], rax
jmp 0x404832
mov ecx, eax
call fcn.004035f0
mov ecx, ebx
mov qword [0x00411110], rax
mov rdx, rax
call rsi
test eax, eax
jne 0x404853
mov rcx, qword [0x00411110]
call sub.msvcrt.dll_free
mov qword [0x00411110], 0
jmp 0x404860
Function at 0x404fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00411724]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4050f8
mov rax, qword [0x00411728]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x40502c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4050de
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x405010
mov rcx, rsi
call fcn.00405c40
test rax, rax
mov r12, rax
je 0x405130
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00411728]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00405d90
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00411728]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x405113
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4050d7
sub eax, 4
and eax, 0xfffffffb
je 0x4050d7
add rbx, qword [0x00411728]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4050ff
add dword [0x00411724], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x405037
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00404f70
mov rax, qword [0x00411728]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 8]
call fcn.00404f70
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00404f70
nop

Function at 0x4058b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00411a00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004119e0]
test rbx, rbx
je 0x405904
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4058fb
test rsi, rsi
je 0x4058fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4058e0
lea rcx, [0x00411a00]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]