joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008aca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov qword [rbp - 8], rcx
movzx r12d, byte [rdx + 0x18]
mov byte [rdx + 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 2
mov qword [rbp - 0x10], 0
mov r13, qword [rdx + 8]
movzx esi, word [rdx + 0x10]
mov eax, 2
xor edi, edi
xor r14d, r14d
jmp 0x14008ad0c
mov word [rax + rdi*2], r15w
inc rdi
mov qword [rbp - 0x10], rdi
mov rdx, qword [rbx]
mov r15d, esi
test si, si
jne 0x14008adb0
nop dword [rax + rax]
cmp rdx, r13
je 0x14008ae76
lea rcx, [rdx + 1]
mov qword [rbx], rcx
movzx r9d, byte [rdx]
movzx r15d, r9b
test r15b, r15b
jns 0x14008adda
mov r8d, r15d
and r8d, 0x1f
lea rcx, [rdx + 2]
mov qword [rbx], rcx
movzx r10d, byte [rdx + 1]
and r10d, 0x3f
cmp r15b, 0xdf
jbe 0x14008add0
lea rcx, [rdx + 3]
mov qword [rbx], rcx
movzx r15d, byte [rdx + 2]
shl r10d, 6
and r15d, 0x3f
or r15d, r10d
cmp r9b, 0xf0
jb 0x14008adf8
lea rcx, [rdx + 4]
mov qword [rbx], rcx
movzx edx, byte [rdx + 3]
and r8d, 7
shl r8d, 0x12
shl r15d, 6
and edx, 0x3f
or edx, r15d
or edx, r8d
mov r15d, edx
cmp r15d, 0xffff
jbe 0x14008adda
jmp 0x14008ae08
mov word [rbx + 0x10], 0
xor esi, esi
cmp r15w, 0x22
je 0x14008ade6
jmp 0x14008ae40
shl r8d, 6
or r8d, r10d
mov r15d, r8d
xor esi, esi
mov rdx, rcx
cmp r15w, 0x22
jne 0x14008ae40
xor r14b, 1
mov r15d, esi
test si, si
je 0x14008ad20
jmp 0x14008adb0
shl r8d, 0xc
or r15d, r8d
cmp r15d, 0xffff
jbe 0x14008adda
lea r8d, [r15 + 0xff0000]
shr r8d, 0xa
or r8d, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov word [rbx + 0x10], r15w
mov rdx, rcx
mov esi, r15d
mov r15d, r8d
cmp r15w, 0x22
je 0x14008ade6
nop dword [rax]
movzx ecx, r15w
cmp ecx, 0x3b
jne 0x14008ae4f
test r14b, 1
je 0x14008ae72
cmp rdi, qword [rbp - 0x20]
jne 0x14008ad00
lea rcx, [rbp - 0x20]
lea rdx, str.std_src_syspalwindowsos.rs
call fcn.14007c690
mov rax, qword [rbp - 0x18]
jmp 0x14008ad00
mov byte [rbx + 0x18], 1
test rdi, rdi
setne al
or r12b, al
je 0x14008aeaf
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x40]
mov r8, rdi
call fcn.1400825f0
movups xmm0, xmmword [rbp - 0x40]
movups xmm1, xmmword [rbp - 0x30]
mov rax, qword [rbp - 8]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x14008aec9
jmp 0x14008aedb
movabs rax, 0x8000000000000000
mov rcx, qword [rbp - 8]
mov qword [rcx], rax
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14008aedb
mov rcx, qword [rbp - 0x18]
add rdx, rdx
mov r8d, 2
call fcn.140013bf0
mov rax, qword [rbp - 8]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14008bad0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rbp - 4], 0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
lea rax, [rbp - 4]
mov qword [rbp - 0x18], rax
mov rcx, qword [rcx]
lea rax, [0x14008bbb0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x14008bb5f
mov rsi, qword [sym.imp.kernel32.dll_SleepEx]
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call rsi
cmp dword [rbp - 4], 1
jne 0x14008bb30
mov eax, dword [rbp]
mov esi, dword [rbp + 4]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
test eax, eax
cmovne rsi, rcx
jne 0x14008bb72
xor eax, eax
jmp 0x14008bba2
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
mov eax, ecx
and eax, 3
shr rcx, 0x20
cmp eax, 2
jne 0x14008bb92
call fcn.1400938d0
xor ecx, ecx
cmp al, 0xb
setne al
cmove rsi, rcx
jmp 0x14008bba2
cmp rcx, 0xb
setne al
xor edx, edx
cmp ecx, 0xb
cmove rsi, rdx
movzx eax, al
mov rdx, rsi
add rsp, 0x68
pop rsi
pop rbp
ret

Function at 0x14008c040
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14008c134
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp r8, rdx
je 0x14008c0fa
sub r8, rdx
add rdx, qword [rbx + 8]
mov rax, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp r8, rcx
cmovae r8, rcx
mov dword [rbp - 0x28], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x14008c0b5
mov eax, dword [rbp - 0x28]
mov ecx, 2
test rax, rax
jne 0x14008c0cc
jmp 0x14008c0d9
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x14008c0d9
cmp eax, 0x3e5
jne 0x14008c0ea
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x14008c0dd
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14008c0df
test r8, r8
mov ecx, 0x10
mov eax, 1
cmove rax, rcx
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rbx
mov rdx, r8
mov r8, rax
call fcn.1400a6bf0
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x14008c071
mov qword [rbp - 0x28], 0
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400a6b63
int3
Function at 0x140094b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x140094b8c
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x140094b8c
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x140094b8c
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x140094c38
cmp byte [rdx], 0xed
jne 0x140094c41
movzx r12d, byte [rdx + 1]
mov r8d, r12d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x140094c41
movzx r13d, byte [rdx + 2]
cmp rbx, 3
jb 0x140094bd1
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
and r13d, 0x3f
shl r12d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
sub rax, rbx
cmp rax, r8
jb 0x140094d2b
add rdx, 3
mov r15, rdx
and r12d, 0x3c0
or r14d, r13d
or r14d, r12d
add r14d, 0x10000
mov rcx, rsi
mov edx, r14d
call fcn.1400868b0
add rdi, 0xfffffffffffffffd
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
sub rax, rbx
cmp rax, rdi
jb 0x140094d50
mov rcx, qword [rsi + 8]
add rcx, rbx
mov rdx, r15
jmp 0x140094cde
test rdi, rdi
je 0x140094cd0
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x140094c68
add r9, 2
cmp r8, rax
cmovne r8, r9
nop word cs:[rax + rax]
mov r9, r8
cmp r8, rax
je 0x140094cd0
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x140094c60
cmp r10b, 0xe0
jb 0x140094c4a
cmp r10b, 0xed
jne 0x140094c9f
cmp r8, rax
je 0x140094cd0
lea r8, [r9 + 2]
cmp r8, rax
je 0x140094cd0
cmp byte [r9 + 1], 0x9f
ja 0x140094ccc
add r9, 3
mov r8, r9
jmp 0x140094c60
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x140094c60
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x140094c60
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x140094cfe
add rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.1400a6bf0
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x140094cdb
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r15, rdx
mov rdx, rbx
call fcn.1400a6bf0
mov rdx, r15
jmp 0x140094bec
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.1400a6bf0
mov rbx, qword [rsi + 0x10]
jmp 0x140094c29
Function at 0x1400a61a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a61ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a61ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a61ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a61ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a61ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a61ec
xor al, al
add rsp, 0x28
ret
Function at 0xdf6340
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xdf634d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xdf635d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xdf6345
lea eax, [rcx + 1]
jmp 0xdf636b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xdf637e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xdf6364
sub eax, 3
jb 0xdf639e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xdf63ed
sar eax, 1
movsxd rbp, eax
jb 0xdf63d4
jmp 0xdf63ac
add ebx, ebx
jne 0xdf63aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xdf63d4
inc ecx
add ebx, ebx
jne 0xdf63ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xdf63d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xdf63cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xdf63bc
add ecx, 2
jmp 0xdf63d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00df6302
jmp 0xdf634d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x4a1e00
mov dl, 0x59
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xdf6439
cmp rsi, rcx
jae 0xdf6441
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xdf6420
cmp al, 0x8f
ja 0xdf6420
cmp byte [rsi - 2], 0xf
je 0xdf6426
sub al, 0xe8
cmp al, 1
ja 0xdf640a
cmp rsi, rcx
jae 0xdf6441
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xdf6410
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xdf6441
lodsb al, byte [rsi]
jmp 0xdf6420
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9ec000]
mov eax, dword [rdi]
or eax, eax
je 0xdf649e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9f6000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xdf644e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xdf6498
mov qword [rbx], rax
add rbx, 8
jmp 0xdf646e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xdf64e2
cmp al, 0xef
ja 0xdf64ca
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xdf64aa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xdf64b9
mov eax, dword [rdi]
add rdi, 4
jmp 0xdf64b9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xdf6536
sub rsp, 0xffffffffffffff80
jmp 0x471540
Function at 0x1800011d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov esi, r8d
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
call fcn.180001a50
movdqa xmm2, xmmword [0x180019a40]
mov ecx, ebp
mov r8, qword [rbx]
lea rax, [r8 + 0x3fc]
cmp r8, rbx
ja 0x180001236
cmp rax, rbx
jb 0x180001236
mov edx, ebp
nop
mov rax, qword [rbx]
mov dword [rdx + rax], ecx
inc ecx
lea rdx, [rdx + 4]
cmp ecx, 0x100
jl 0x180001220
jmp 0x1800012a9
mov ecx, 8
mov edx, 0x20
lea eax, [rcx - 8]
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movdqu xmmword [r8 + rdx - 0x20], xmm0
lea eax, [rcx - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmmword [r8 + rdx - 0x10], xmm1
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movdqu xmmword [r8 + rdx], xmm0
lea eax, [rcx + 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmmword [r8 + rdx + 0x10], xmm1
add ecx, 0x10
lea rdx, [rdx + 0x40]
lea eax, [rcx - 8]
cmp eax, 0x100
jl 0x180001240
mov ecx, ebp
mov r9d, ebp
mov r10, rbp
lea r14, str.fahasiki
nop dword [rax + rax]
mov r11, qword [rbx]
mov edi, dword [r10 + r11]
xor edx, edx
mov eax, r9d
div esi
movzx eax, byte [rdx + r14]
add eax, edi
add ecx, eax
and ecx, 0x800000ff
jge 0x1800012e9
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rdx, ecx
lea r8, [r11 + rdx*4]
mov edx, dword [r8]
mov dword [r10 + r11], edx
mov dword [r8], edi
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x1800012c0
mov dword [rbx + 0x18], ebp
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1800080d8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x180008147
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008147
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180008147
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180008147
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180008147
cmp dword [rcx + 0x84], 0xe
jbe 0x180008147
cmp dword [rcx + 0xf8], 0
je 0x180008147
mov ecx, ebx
call fcn.1800081f8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180007fd4
nop
cmp dword [rbp + 0x20], 0
je 0x180008195
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800081a0
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800080d8
Function at 0x18000b994
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000b9c4
xor eax, eax
jmp 0x18000ba87
mov rbp, rbx
cmp word [rax], si
je 0x18000b9e9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000b9d0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000b9cc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000b8b4
movsxd r14, eax
test eax, eax
jne 0x18000ba27
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000b9bd
mov rcx, r14
call fcn.180008eec
mov rdi, rax
test rax, rax
jne 0x18000ba40
xor ecx, ecx
call fcn.180008eb0
jmp 0x18000ba1c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000b8b4
test eax, eax
jne 0x18000ba71
mov rcx, rdi
call fcn.180008eb0
jmp 0x18000ba7b
xor ecx, ecx
call fcn.180008eb0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180010a40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180010a68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180010a68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x41e9e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x41e9ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x41e9fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x41e9e5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x41ea15
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x41ea02
sub eax, 3
jb 0x41ea2f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x41ea66
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x41ea56
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x41ea54
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x41ea43
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.0041e9a2
jmp 0x41e9ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2c00
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x41eab2
cmp rsi, rcx
jae 0x41eaba
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x41ea99
cmp al, 0x8f
ja 0x41ea99
cmp byte [rsi - 2], 0xf
je 0x41ea9f
sub al, 0xe8
cmp al, 1
ja 0x41ea83
cmp rsi, rcx
jae 0x41eaba
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x41ea89
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x41eaba
lodsb al, byte [rsi]
jmp 0x41ea99
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1c000]
mov eax, dword [rdi]
or eax, eax
je 0x41eb17
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2ec64]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x41eac7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x41eb11
mov qword [rbx], rax
add rbx, 8
jmp 0x41eae7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0041eb9a], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0041eb9a
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x41eb8a
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x140009420
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140009445
cmp rax, rcx
je 0x14000944b
cmp rdx, 4
jae 0x14000944f
xor eax, eax
xor r8d, r8d
jmp 0x1400094e0
pop rbp
jmp fcn.140002700
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140019380]
movdqa xmm3, xmmword [0x140019390]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140009470
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400094f7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400094e0
pop rbp
ret
Function at 0x1400109e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rsi + 7], esi
movzx r8d, byte [rdx + 0x3a]
test r8b, 1
jne 0x140010a4e
movzx eax, byte [rdx + 0x10]
lea r10d, [rax - 5]
Function at 0x140016cc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016d0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016d0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016d0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016d0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140016d0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140016d0c
xor al, al
add rsp, 0x28
ret
Function at 0x140001030
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x91821
mov rbx, rcx
jne 0x140001087
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001087
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001087
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
test rax, rax
je 0x140001087
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000108c
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001094
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x91821
mov rsi, rcx
je 0x1400010b8
mov eax, 0xc0000001
jmp 0x140001170
xor edi, edi
lea r9, [rsp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
mov ebx, edi
lea ecx, [rdi + 0x42]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000116e
test rbx, rbx
je 0x1400010f0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0x42
mov rbx, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400010e0
test rbx, rbx
je 0x14000116e
mov r8d, dword [rbx]
test r8d, r8d
je 0x140001163
mov edx, edi
shl rdx, 5
test byte [rdx + rbx + 0x10], 1
je 0x14000115c
cmp qword [rdx + rbx + 0x18], 0x200000
jne 0x14000115c
mov ecx, dword [0x140001db0]
mov r9b, byte [0x140001db4]
cmp dword [rdx + rbx + 0x20], ecx
jne 0x14000115c
cmp byte [rdx + rbx + 0x24], r9b
je 0x140001180
inc edi
cmp edi, r8d
jb 0x14000112a
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsi + 8]
mov rax, qword [rdx + rbx + 8]
mov qword [rcx], rax
jmp 0x14000116e
Function at 0x140001190
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x91821
mov rdi, rcx
jne 0x140001255
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001255
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001255
call fcn.14000126c
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.1400014c4
test rax, rax
je 0x140001255
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov rcx, qword [rdi + 0x10]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
cmp byte [rdi + 0x20], 0
movsxd r8, esi
je 0x140001238
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.1400016a4
jmp 0x140001251
lea rdx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x14000125a
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret