joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400102b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret
Function at 0x1400174e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, r9b
mov rdi, r8
movzx r11d, al
mov rbx, rdx
and r11b, 0x1f
shr eax, 5
mov r10, rcx
and eax, 0x80000003
jge 0x14001751a
dec eax
or eax, 0xfffffffc
inc eax
movzx ecx, al
movzx ebp, r11b
mov r9d, dword [r8 + rcx*4]
mov ecx, 0x20
sub cl, r11b
movzx edx, cl
xor ecx, ecx
test r11b, r11b
bswap r9d
cmove edx, ecx
sub rbx, r10
movzx esi, dl
lea r11d, [rcx + 4]
nop word [rax + rax]
inc al
lea r10, [r10 + 4]
and al, 3
movzx ecx, al
mov r8d, dword [rdi + rcx*4]
mov ecx, esi
bswap r8d
mov edx, r8d
shr edx, cl
mov ecx, ebp
shl r9d, cl
or edx, r9d
mov r9d, r8d
bswap edx
xor edx, dword [rbx + r10 - 4]
mov dword [r10 - 4], edx
sub r11, 1
jne 0x140017550
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14001be14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001be5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001be5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001be5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001be5e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001be5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001be60
xor al, al
add rsp, 0x28
ret

Function at 0x140024050
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140023e4c
Function at 0x14002bcc8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002bcf8
xor eax, eax
jmp 0x14002bdbb
mov rbp, rbx
cmp word [rax], si
je 0x14002bd1d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002bd04
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002bd00
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14002bbe8
movsxd r14, eax
test eax, eax
jne 0x14002bd5b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14002bcf1
mov rcx, r14
call fcn.140027b84
mov rdi, rax
test rax, rax
jne 0x14002bd74
xor ecx, ecx
call fcn.140027b48
jmp 0x14002bd50
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14002bbe8
test eax, eax
jne 0x14002bda5
mov rcx, rdi
call fcn.140027b48
jmp 0x14002bdaf
xor ecx, ecx
call fcn.140027b48
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14002ef8c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140027f5c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14002f02d
cmp ebx, dword [rsp + 0x30]
je 0x14002f026
test esi, esi
je 0x14002f026
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14002f001
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14002f00e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14002efeb
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14002f012
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14002f02f
mov eax, 1
jmp 0x14002f02f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400337ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140053380]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140033843
cmp word [rdx], r13w
jne 0x140033843
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140033848
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14003396d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14003398e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140033881
mov rdx, r9
mov word [rbx], cx
jmp 0x1400338a8
cmp r9, r8
jae 0x1400338b8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140033862
jmp 0x14003396d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140033962
cmp dword [rsp + 0x80], esi
je 0x140033962
lea r8, [0x140053380]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14003393a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14003390a
mov word [rbx], r13w
jmp 0x14003396a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140033917
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14003396a
cmp word [rsp + 0x70], r13w
jne 0x140033947
cmp rbx, r14
je 0x140033904
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14003370c
cmp word [rsp + 0x70], r13w
je 0x14003396d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140053380]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140033967
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14003396d
Function at 0x14003427c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14003370c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14003370c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400343cc
cmp rax, 0xffffffffffffffff
je 0x1400343cc
xor edi, edi
test rbp, rbp
jle 0x140034377
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400282bc
mov rbx, rax
test rax, rax
jne 0x140034304
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14003436d
mov edx, 0x8000
mov ecx, r14d
call fcn.140024de4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400311fc
cmp eax, 0xffffffff
je 0x14003434d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140034314
mov edx, r15d
mov ecx, r14d
call fcn.140024de4
jmp 0x14003436d
cmp byte [rsi + 0x38], dil
je 0x140034364
cmp dword [rsi + 0x34], 5
jne 0x140034364
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14003436d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140027b48
jmp 0x1400343e0
jns 0x1400343e0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14003370c
cmp rax, 0xffffffffffffffff
jne 0x140034398
cmp byte [rsi + 0x30], dil
je 0x1400343e0
mov edi, dword [rsi + 0x2c]
jmp 0x1400343e0
mov ecx, r14d
call fcn.14002c8a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400343e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400343e0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400343d9
mov eax, dword [rsi + 0x2c]
jmp 0x1400343de
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14003370c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140035210
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140035238
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140035238
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003910
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003944
cmp word [rcx], 0x5a4d
jne 0x140003944
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003944
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003944
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003850
test eax, eax
jne 0x140003960
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400038c0
test rax, rax
je 0x140003955
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004109
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret
Function at 0x140003d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebx, dword [0x1400085e0]
test ebx, ebx
je 0x140003d70
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x24], 0xb3b6a378
mov dword [rsp + 0x28], 0xb3b65d76
mov dword [rsp + 0x2c], 0x4752a664
mov dword [rsp + 0x30], 0x47522f46
mov dword [rsp + 0x34], 0x47522f26
mov dword [rsp + 0x38], 0x47522f2a
mov dword [rsp + 0x3c], 0x47522f2e
call fcn.140003d30
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x140003fa0
xor r10d, r10d
nop dword [rax]
mov ecx, dword [rsp + 0x30]
mov r8, rax
lea eax, [rcx - 0x47522f0a]
mov eax, dword [r8 + rax]
mov eax, dword [r8 + rax + 0x88]
test eax, eax
je 0x140003e23
lea r10, [r8 + rax]
mov ecx, dword [rsp + 0x24]
mov eax, dword [r10 + 0xc]
sub ecx, 0x47522f0a
add rax, r8
mov r9d, dword [rax]
or r9d, 0x20202020
cmp r9d, ecx
jne 0x140003e23
mov r9d, dword [rax + 4]
mov ecx, dword [rsp + 0x28]
or r9d, 0x20202020
lea eax, [rcx - 0x47522f0a]
cmp r9d, eax
je 0x140003e2f
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x140003dc8
test r10, r10
je 0x140003fa0
mov eax, dword [rsp + 0x34]
mov edi, dword [r10 + 0x18]
sub eax, 0x47522f0a
mov ebp, dword [rax + r10]
mov eax, dword [rsp + 0x38]
sub eax, 0x47522f0a
add rbp, r8
mov r9d, dword [rax + r10]
mov eax, dword [rsp + 0x3c]
sub eax, 0x47522f0a
add r9, r8
mov r11d, dword [rax + r10]
add r11, r8
test edi, edi
je 0x140003f76
lea r13, [0x1400085e4]
xor r10d, r10d
lea r12, [r13 - 4]
lea rsi, [r12 - 4]
jmp 0x140003eb1
add r10d, 1
add r9, 4
add r11, 2
cmp r10d, edi
jae 0x140003f80
cmp ebx, 0x1f3
ja 0x140003f80
mov edx, dword [r9]
mov eax, dword [rsp + 0x2c]
add rdx, r8
lea ecx, [rax - 0x47522f0a]
movzx r14d, word [rdx]
cmp r14d, ecx
jne 0x140003e90
cmp byte [rdx], 0
je 0x140003f90
add eax, 0x68144fbc
cmp byte [rdx + 1], 0
mov ecx, 1
mov r15d, 1
je 0x140003f10
nop dword [rax]
movzx r15d, word [rdx + r15]
mov r14d, eax
ror r14d, 8
add eax, r15d
lea r15d, [rcx + 1]
add eax, r14d
cmp byte [rdx + r15], 0
mov rcx, r15
jne 0x140003ef0
mov edx, ebx
shl rdx, 3
lea rcx, [rdx + r13]
mov dword [rcx], eax
movzx eax, word [r11]
mov eax, dword [rbp + rax*4]
mov dword [rcx + 4], eax
test ebx, ebx
je 0x140003f6e
lea eax, [rbx - 1]
add rdx, r12
lea rax, [r12 + rax*8 + 4]
jmp 0x140003f66
movd xmm0, dword [rdx + 4]
movd xmm1, ecx
mov rcx, qword [rax]
sub rax, 8
sub rdx, 8
punpckldq xmm0, xmm1
mov qword [rdx + 0xc], rcx
movq qword [rax + 8], xmm0
cmp rsi, rax
je 0x140003f6e
mov ecx, dword [rdx + 8]
cmp ecx, dword [rax + 4]
jb 0x140003f40
add ebx, 1
jmp 0x140003e90
xor ebx, ebx
nop dword [rax + rax]
mov dword [0x1400085e0], ebx
jmp 0x140003d5a
mov eax, 0xb8add0f6
jmp 0x140003f10
xor eax, eax
jmp 0x140003d5f
Function at 0x140004010
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140003fb0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004464
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000ea18]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000ea14]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400044b2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400044aa
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004599
inc ebx
add rax, 0x28
jmp 0x14000448a
mov rcx, r12
call fcn.140004c91
mov rbp, rax
test rax, rax
jne 0x1400044d1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004400
movsxd rbx, ebx
mov rax, qword [0x14000ea18]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004d3f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000ea18]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004533
mov rax, qword [0x14000ea18]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004400
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004593
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004593
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000ea18]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004593
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004400
inc dword [0x14000ea14]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400049c0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14000ea80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000ea60]
test rbx, rbx
je 0x140004a0c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004a06
test eax, eax
jne 0x140004a06
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x1400049de
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004bc0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004be3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004be3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140004be4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004c1e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004c15
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004c20
inc r8d
add rax, 0x28
jmp 0x140004bfc
xor eax, eax
ret

Function at 0x140004c91
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14000abd0]
mov r8, rcx
mov rcx, r9
call fcn.140004bc0
test eax, eax
je 0x140004cbd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004be4
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000c540
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x1020
call fcn.140022320
sub rsp, rax
cmp word [rcx], 0
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000c705
call fcn.14000c730
mov rcx, rbx
call fcn.140026054
mov rcx, rbx
mov r14, rax
call fcn.14000c764
test al, al
je 0x14000c628
mov rcx, rbx
call fcn.14000c730
test al, al
je 0x14000c5d6
lea rax, [r14 + 4]
cmp rbp, rax
jbe 0x14000c705
mov r8d, 4
lea rdx, [0x140035db0]
mov rcx, rsi
call fcn.140027814
lea rcx, [rsi + 8]
mov rdx, rbx
call fcn.140026038
mov al, 1
jmp 0x14000c707
mov edi, 0x5c
cmp word [rbx], di
jne 0x14000c705
cmp word [rbx + 2], di
jne 0x14000c705
lea rax, [r14 + 6]
cmp rbp, rax
jbe 0x14000c705
lea r8d, [rdi - 0x58]
mov rcx, rsi
lea rdx, [0x140035db0]
call fcn.140027814
lea rcx, [rsi + 8]
lea rdx, [0x140035dc0]
call fcn.140026038
lea rcx, [rsi + 0xe]
lea rdx, [rbx + 2]
jmp 0x14000c5ca
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x14000c705
movzx eax, word [rbx]
mov edi, 0x5c
cmp eax, edi
je 0x14000c6ca
cmp eax, 0x2f
je 0x14000c6ca
mov edx, 0x800
lea rcx, [rsp + 0x20]
call fcn.14000bfd4
lea rcx, [rsp + 0x20]
call fcn.140026054
lea rcx, [rax + 4]
add rcx, r14
cmp rbp, rcx
jbe 0x14000c705
lea r8d, [rdi - 0x58]
mov rcx, rsi
lea rdx, [0x140035db0]
call fcn.140027814
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x20]
call fcn.140026038
cmp word [rbx], 0x2e
jne 0x14000c6b7
movzx eax, word [rbx + 2]
cmp eax, edi
je 0x14000c6b3
cmp eax, 0x2f
jne 0x14000c6b7
add rbx, 4
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.140010afc
jmp 0x14000c5cf
lea rax, [r14 + 6]
cmp rbp, rax
jbe 0x14000c705
mov r8d, 4
lea rdx, [0x140035db0]
mov rcx, rsi
call fcn.140027814
lea rcx, [rsi + 8]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140027814
lea rcx, [rsi + 0xc]
jmp 0x14000c5c7
xor al, al
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x14000d474
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, r9
mov r10b, bl
cmp r8d, 1
jbe 0x14000d4a8
lea rcx, [rdx + 1]
lea r8d, [rdi - 1]
xor r10b, byte [rcx]
inc rcx
sub r8, 1
jne 0x14000d49c
cmp r10b, byte [rdx]
jne 0x14000d4e4
mov r8, rdi
or ecx, 0xffffffff
call fcn.1400060a0
lea rdx, [0x140045030]
not eax
mov rcx, rdx
cmp dword [rcx + 4], eax
jne 0x14000d4cd
cmp dword [rcx], edi
je 0x14000d4da
inc ebx
add rcx, 0xc
cmp ebx, 6
jae 0x14000d4e4
jmp 0x14000d4c4
lea rcx, [rbx + rbx*2]
mov eax, dword [rdx + rcx*4 + 8]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret