joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002aac
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x70
movdqa xmm0, xmmword [0x18002fef0]
movdqa xmm1, xmmword [0x18002fee0]
mov rbx, qword [0x180037a70]
movdqu xmmword [rax - 0x30], xmm0
mov dword [rax - 0x10], 0x25
movdqa xmm0, xmmword [0x18002fec0]
movdqu xmmword [rax - 0x20], xmm1
mov dword [rax - 0xc], 0xb8
movdqa xmm1, xmmword [0x18002fed0]
movdqu xmmword [rax - 0x58], xmm0
mov dword [rax - 0x38], 0x4c
movdqu xmmword [rax - 0x48], xmm1
mov dword [rax - 0x34], 0x2f
call fcn.180004bc4
mov edx, 0xc9
mov r8d, 2
mov rcx, rbx
call rax
mov edi, dword [rax + 4]
mov esi, dword [rax]
mov ecx, edi
add rsi, rbx
mov ebx, edi
call fcn.1800089b4
xor ecx, ecx
mov r8, rax
test edi, edi
je 0x180002b4d
mov byte [rax], cl
inc rax
sub rbx, 1
jne 0x180002b42
lea r9, [rsi + 0x67]
test r9, r9
je 0x180002b6e
mov rdx, r8
test edi, edi
je 0x180002b6e
sub r9, r8
mov al, byte [r9 + rdx]
mov byte [rdx], al
inc rdx
sub edi, 1
jne 0x180002b60
mov r11d, ecx
mov r9, rcx
mov r10, r8
movabs rbx, 0xcccccccccccccccd
mov edi, 0x7c00
inc r11d
mov rax, rbx
mul r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub r9, rax
mov al, byte [rsp + r9*4 + 0x20]
xor byte [r10], al
inc r10
movsxd r9, r11d
cmp r9, rdi
jb 0x180002b86
mov r9, rcx
mov r10, r8
inc ecx
mov rax, rbx
mul r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub r9, rax
mov al, byte [rsp + r9*4 + 0x48]
xor byte [r10], al
inc r10
movsxd r9, ecx
cmp r9, rdi
jb 0x180002bb6
lea r11, [rsp + 0x70]
mov rax, r8
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18000376c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r12d, r12d
mov r14, rdx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
jne 0x1800037a3
xor eax, eax
jmp 0x180003841
lea rax, [rcx + r8]
mov rsi, r12
mov ebx, dword [rax + 0x20]
mov edx, dword [rax + 0x1c]
add rbx, rcx
mov r8d, dword [rax + 0x24]
add rdx, rcx
mov r15d, dword [rax + 0x18]
add r8, rcx
test r15, r15
je 0x18000382e
mov edi, dword [rbx]
mov r9, r12
add rdi, rcx
cmp byte [r14], r12b
je 0x1800037dc
inc r9
cmp byte [r9 + r14], r12b
jne 0x1800037d3
test rdi, rdi
je 0x18000381e
mov r10d, r12d
test r9, r9
je 0x180003819
mov rbp, r14
mov r11, rdi
sub rbp, rdi
mov al, byte [r11 + rbp]
cmp byte [r11], al
jb 0x180003815
ja 0x18000380d
inc r11
mov rax, r11
sub rax, rdi
cmp rax, r9
jb 0x1800037f2
jmp 0x180003819
mov r10d, 1
jmp 0x180003819
or r10d, 0xffffffff
test r10d, r10d
je 0x18000382e
inc rsi
add rbx, 4
add r8, 2
cmp rsi, r15
jb 0x1800037c6
cmp r12w, word [r8]
jae 0x18000383c
movzx eax, word [r8]
lea rdx, [rdx + rax*4]
mov eax, dword [rdx]
add rax, rcx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x180004bc4
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
jmp 0x180004c11
mov r9, qword [rdx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + 0x48]
movzx ecx, byte [r9]
ror r8d, 0xd
mov eax, r8d
add rax, rcx
cmp cl, 0x61
lea r8, [rax - 0x20]
cmovb r8, rax
inc r9
sub r10, 1
jne 0x180004be3
cmp r8d, 0x6a4abc5b
je 0x180004c19
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180004bd7
xor eax, eax
ret
mov r8, qword [rdx + 0x20]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
mov edx, dword [r9 + r8 + 0x20]
mov ecx, dword [r9 + r8 + 0x24]
add rdx, r8
add rcx, r8
mov r11d, dword [rdx]
add r11, r8
xor r10d, r10d
mov al, byte [r11]
inc r11
ror r10d, 0xd
movsx eax, al
add r10d, eax
mov al, byte [r11]
test al, al
jne 0x180004c45
cmp r10d, 0x3bd09a55
je 0x180004c6c
add rdx, 4
add rcx, 2
jmp 0x180004c39
movzx edx, word [rcx]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
ret

Function at 0x180004e84
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x180004f16
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x180004ef0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004f0f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004f0f
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x180004eff
cmp dword [rdi + 8], 0
je 0x180004f0f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x180004eff
cmp byte [0x180037af8], 0
jne 0x180004f61
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004f4d
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x180037af0], rax
jmp 0x180004f54
mov r10, qword [0x180037af0]
mov eax, 1
mov byte [0x180037af8], al
jmp 0x180004f68
mov r10, qword [0x180037af0]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x180004ef9
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r10
jmp 0x180004eff
Function at 0x180004f80
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov edi, dword [rcx + 8]
lea rax, [rbp + 0x1a0]
xor r15d, r15d
mov qword [rsp + 0x20], rax
mov rsi, rcx
mov qword [rsp + 0x40], r15
mov rcx, qword [rcx]
or edi, 0x2001f
mov r9d, edi
mov dword [rsp + 0x48], r15d
xor r8d, r8d
mov qword [rsp + 0x50], r15
mov r14, rdx
mov qword [rbp + 0x1a0], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x18000509c
mov rcx, qword [rsp + 0x40]
mov ebx, r15d
test rcx, rcx
je 0x180004ffd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rbp + 0x1a0]
and edi, 0x300
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edi
test ebx, ebx
jne 0x18000509c
mov edi, 0x100
jmp 0x18000503c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180004f80
mov ebx, eax
test eax, eax
jne 0x18000509c
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x1a8]
mov dword [rbp + 0x190], edi
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180005022
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000508a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov rdx, r14
mov dword [rsp + 0x48], r15d
mov rcx, rsi
call fcn.180004e84
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800050ac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800054f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov r14, r9
mov r15, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x180005577
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x180005577
call fcn.180004cc4
mov ebx, eax
jmp 0x18000568b
mov r8, r14
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180005598
call fcn.180004cc4
jmp 0x18000567a
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000558e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x480], eax
inc eax
cmp eax, ebx
jae 0x1800055d6
mov ebx, 0x8007000e
jmp 0x18000567c
mov ecx, eax
test eax, eax
je 0x180005608
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800056bd
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180005608
lea rcx, [rsp + 0x50]
call fcn.180008620
jmp 0x180005612
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x18000562a
cmp qword [rsp + 0x50], rdi
je 0x1800055cc
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18000558e
mov ecx, eax
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.180006250
mov ebx, eax
test rsi, rsi
je 0x18000568b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x1800056a2
lea rcx, [rsp + 0x50]
call fcn.1800084a8
nop
mov eax, ebx
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80070216
call fcn.180004ca0
int3
Function at 0x1800075f0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x180007620
call fcn.180007dd8
jmp 0x180007698
mov rsi, rbx
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x180007637
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180007639
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180007692
test ecx, ecx
jle 0x180007673
cmp rbx, rbp
cmovl rbp, rbx
mov r8, rbp
mov rcx, r9
call fcn.18000b0e0
nop
sub rbx, rbp
mov rax, qword [rdi + 0x58]
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
add r14, rbp
test rbx, rbx
jle 0x180007692
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180007692
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18000f7a0
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800076b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800076e1
xor eax, eax
jmp 0x1800077d2
cmp qword [rcx + 0x68], 0
je 0x1800076f2
call fcn.180007e88
jmp 0x1800077d2
mov rbp, rdi
mov rax, qword [rcx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180007709
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000770b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180007741
mov rbx, rdi
cmp rax, rdi
cmovb rbx, rax
mov r8, rbx
mov rcx, r14
call fcn.18000b0e0
nop
add r14, rbx
mov rbp, rdi
sub rbp, rbx
mov rax, qword [rsi + 0x50]
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
mov rbx, rbp
cmp qword [rsi + 0x80], 0
je 0x1800077cc
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000777b
mov rdx, qword [rsi + 0x90]
mov rcx, qword [rsi + 0x88]
mov qword [r8], rcx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
jmp 0x1800077a8
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.18000faa4
add r14, rax
sub rbp, rax
mov rbx, rbp
cmp rax, r15
jne 0x1800077eb
cmp rbp, r15
ja 0x180007783
test rbx, rbx
je 0x1800077cc
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.18000faa4
sub rbx, rax
sub rdi, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x1800077cf
Function at 0x180007b80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x180007ba8
xor eax, eax
jmp 0x180007cca
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x180007be2
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x180007be2
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, esi
mov byte [rdx], sil
jmp 0x180007cca
cmp qword [rbx + 0x80], 0
je 0x180007cc8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180007c1d
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180007c40
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.18000ec08
cmp eax, edi
cmovne edi, esi
jmp 0x180007cc8
lea r8, [rbp + 0x30]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
je 0x180007c8e
sub eax, 1
je 0x180007c8e
cmp eax, 2
jne 0x180007cc8
movsx ecx, byte [rbp - 0x30]
jmp 0x180007c2a
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x180007cb8
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.18000f7a0
cmp r14, rax
jne 0x180007cc8
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
mov eax, esi
jne 0x180007cca
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x180008220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18000827c
cmp byte [rcx + 0x71], 0
je 0x18000827c
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800082c3
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x180008289
sub eax, 1
je 0x18000828d
cmp eax, 2
jne 0x1800082c3
mov byte [rbx + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1800082ba
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.18000f7a0
cmp rdi, rax
jne 0x1800082c3
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000827e
xor al, al
jmp 0x18000827e
Function at 0x1800170a4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180016f44
call fcn.18000ea00
mov dword [rax], 0x16
call fcn.18000e6dc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180016f2c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180016f2c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180016f76
lock or dword [rax + 0x14], 0x10
jmp 0x180016f2c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180016f93
mov rcx, qword [rbp + 0x10]
call fcn.180017298
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180015334
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180018964
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180016fea
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180016f2c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180017056
mov rcx, qword [rbp + 0x10]
call fcn.180015334
cmp eax, 0xffffffff
je 0x18001703d
mov rcx, qword [rbp + 0x10]
call fcn.180015334
cmp eax, 0xfffffffe
je 0x18001703d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180015334
movsxd rdi, eax
lea rsi, [0x180036dd0]
mov rcx, rbx
sar rdi, 6
call fcn.180015334
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180017044
lea rax, [0x1800353c0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180017056
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x18001708c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180017088
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180017088
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180016f2f
jmp 0x180016efc
Function at 0x44d8d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9b, 0xb9
mov esi, r8d
not r11b
bt edi, r14d
clc
jmp 0x44d9c2
mov bl, bpl
ror al, 2
jmp 0x44d8fa
jnp 0x44d8b7
mov r9b, 0xb9
mov esi, r8d
call 0x44d908
loop 0x44d954
lea edx, [rax + rax]
mov r11b, 0xdc
btr rax, r14
sub rsp, 3
xchg r9w, ax
jmp 0x44d96c
lea r11, [rbx + rbx]
neg edx
call fcn.0044dabf
push rcx
invalid
lea r9, [rbx + riz + 0xf2]
lea ecx, [rbx + riz + 0xf2]
lea rbx, [rbx + riz - 0x27]
jmp 0x44d93d
lea rsp, [rsp + 3]
xchg qword [rsp], rbx
mov r10, 0x7a27f175
btc di, ax
mov r9b, byte [rsp]
shr ax, cl
jmp 0x44d953
add byte [rcx - 0x79], cl
imul cl
mov cl, 0xf4
invalid
ror bl, 0
bswap r10
sub rsp, 0x1f
je 0x44d9f5
jne 0x44d9df
out dx, al
jo 0x44d9b9
xor dword [rax - 0x31], reloc.KERNEL32.dll_CloseHandle
movabs dword [reloc.KERNEL32.dll_CloseHandle], eax
jl 0x44da09
mov cx, bp
xchg dword [rsp + 7], edi
mov word [rsp + 0xb], r13w
jmp 0x44da6d
invalid
mov cx, bp
xchg dword [rsp + 7], edi
mov word [rsp + 0xb], r13w
mov byte [rsp + 0x17], r14b
jmp 0x44da36
rol dword [rax + reloc.KERNEL32.dll_CloseHandle], 0x87
ret 0xf48
neg r11
jle 0x44da47
shr di, cl
clc
push r11w
mov ecx, r15d
jmp 0x44da8e
mov di, 0x4a2a
mov rsi, rsp
lea rsp, [rsp + 7]
ror bl, 0
jmp 0x44da20
shr di, cl
clc
jmp 0x44da51
push r11w
mov ecx, r15d
lea rsp, [rsp + 2]
jmp 0x44da78
mov byte [rsp + 0x17], r14b
mov di, 0x4a2a
jmp 0x44da3a
lea rsp, [rsp + 0x18]
dec bl
rdtsc
mov r9d, dword [rsp]
setnp cl
jmp 0x44da95
lea rsp, [rsp + 2]
jmp 0x44da78
mov edx, dword [rsp]
xchg al, r11b
xchg rcx, rax
xchg r11b, r14b
mov r10d, dword [rsp]
jmp 0x44e022
xor bl, 0x14
mov cx, 0x2026
bsf r10w, r8w
jmp 0x44db78
jge 0x44ddb0
mov r11, qword [rsp]
setno r9b
call fcn.0044daf1
push rbp
rol ebx, cl
xchg dl, cl
jmp 0x44dbb9
jmp 0x44db8b
xchg bl, dil
jmp 0x44dc90
mov rdi, 0x255442c4
inc edi
mov r11w, word [rsp + 2]
lea r9, [rdi + r14]
jmp 0x44dba3
dec r13
seto sil
bswap ecx
mov rcx, rdx
neg dx
jno 0x44dba1
push rbp
rol ebx, cl
xchg dl, cl
mov rdi, 0x255442c4
inc edi
jmp 0x44dbc2
mov r11, 0xffffffff821ea435
lea rax, [rax*8]
jmp 0x44dc53
mov dx, bx
xchg r9, r10
mov r11w, word [rsp]
jmp 0x44dbfa
lea r14, [rsp + rsi]
mov rbx, qword [rsp]
call fcn.0044dc73
invalid
mov dx, bx
xchg r9, r10
mov r11w, word [rsp]
mov r11, 0xffffffff821ea435
lea rax, [rax*8]
lea rsp, [rsp + 2]
not bpl
jmp 0x44dc1d
lea rsp, [rsp + 8]
not bpl
push dx
js 0x44dc39
jns 0x44dc10
neg dl
xchg si, ax
xchg rdi, r10
jmp 0x44dd28
neg dl
xchg si, ax
xchg rdi, r10
jmp 0x44dbd9
mov r11, qword [rsp]
setno r9b
mov dx, 0x9c0d
sub r8b, bl
inc rdi
jae 0x44dd20
jb 0x44dce0
not esi
jmp 0x44de20
add r11, rdi
mov r9d, dword [rsp]
mov r14, qword [rsp]
mov r10d, r15d
jmp 0x44de62
bswap r9
mov ax, r9w
xchg r14, rbx
jmp 0x44de0a
setge al
mov rsp, r15
push r11
ret
rol bl, 0
mov rsi, 0xffffffffb7f42b67
mov edx, dword [rsp]
xchg r11d, edx
setp sil
mov cx, r15w
jmp 0x44daa9
Function at 0x573e60
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, bl
mov eax, 0xeb132e68
xchg dword [rsp + 8], r9d
xchg dword [rsp + 0xb], ecx
jmp 0x573e7f
setp r12b
xchg di, ax
jmp 0x573e4a
mov al, 0x84
pop word [rsp + 3]
mov word [rsp], r12w
xchg dx, r8w
jmp 0x573ebe
lea rax, [rsi + r13]
xchg byte [rsp + 0xd], r11b
pop rsi
mov sil, spl
mov r13, 0xffffffff8a748bfa
mov qword [rsp], rbx
jmp 0x573e69
Function at 0x1400138f0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x14003bab8]
test rcx, rcx
je 0x14001395a
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001394d
mov rcx, qword [0x14003bab8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14003bab8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14003e2d0], 1
jne 0x140013a04
mov r14, qword [0x14002bbe0]
mov qword [rsp + 0x50], r14
movups xmm8, xmmword [0x14002bbd0]
movaps xmmword [rsp + 0x40], xmm8
movups xmm7, xmmword [0x14002bbc0]
movaps xmmword [rsp + 0x30], xmm7
movups xmm6, xmmword [0x14002bbb0]
movaps xmmword [rsp + 0x20], xmm6
lea r15, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
lea r12, [0x14003bad0]
mov rbx, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax + rax]
mov rcx, r12
call rbx
cmp eax, 0xffffffff
je 0x140013a04
and eax, 0x10
je 0x140013a04
mov ecx, 0x64
call rsi
mov qword [rsp + 0x50], r14
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r15
call rdi
dec ebp
jne 0x1400139d0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400151a0
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret