joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042770
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x140079584]
movsxd rax, dword [0x14007955c]
xor edx, edx
cmp eax, 0x7b
ja 0x1400427af
lea rdx, [0x1400786c0]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x14006acc0]
movdqu xmmword [rbp - 0x18], xmm1
mov byte [rbp - 0x28], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
test rdx, rdx
jne 0x140042805
mov word [rbp - 0x37], 0x79
mov dword [rbp - 0x40], 0x656c6553
mov dword [rbp - 0x3c], 0x4b207463
mov byte [rbp - 0x38], 0x65
mov byte [rbp - 0x35], dl
lea rax, [rbp - 0x40]
inc r8
cmp byte [rax + r8], 0
jne 0x1400427f5
lea rdx, [rbp - 0x40]
jmp 0x14004280f
inc r8
cmp byte [rdx + r8], 0
jne 0x140042805
lea rcx, [rbp - 0x28]
call fcn.14004f4d0
cmp edi, 1
jne 0x140042859
mov word [rbp - 0x30], 0x64
movdqa xmm0, xmmword [0x14006b3e0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140042840
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.14004f4d0
mov dword [rbp - 0x40], 0x42fa0000
mov dword [rbp - 0x3c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x40]
call fcn.140030a60
test al, al
je 0x1400428a8
test edi, edi
jne 0x1400428a8
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140042720]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400428e6
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400428e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400428e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400577bc
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140057760
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140046860
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
mov rdi, rcx
cvtss2sd xmm1, xmm2
lea rcx, [rsp + 0x38]
mov rbx, r9
mov rsi, rdx
call fcn.1400425d0
cmp qword [rsp + 0x50], 0xf
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x58]
cmova r8, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140046903
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400468fe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400468fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400577bc
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140057760
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004c9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x14006b340]
lea rdx, [rbp - 0x30]
xor ecx, ecx
mov word [rbp - 0x1d], 0x20
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x444e
mov byte [rbp - 0x1e], 0x53
mov byte [rbp - 0x1b], 0
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140079460], rax
test rax, rax
jne 0x14004ca1d
mov eax, 4
jmp 0x14004cb1a
movdqa xmm0, xmmword [0x14006b420]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
mov word [rbp - 0x35], 0x79
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x40], 0x6164654d
mov dword [rbp - 0x3c], 0x65764f6c
mov word [rbp - 0x38], 0x6c72
mov byte [rbp - 0x36], 0x61
mov byte [rbp - 0x33], 0
mov word [rbp - 0x20], 0x73
mov byte [rbp - 0x1e], 0
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140079400], rax
test rax, rax
je 0x14004cb1a
movdqa xmm0, xmmword [0x14006ac80]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x90], rbx
mov rcx, rax
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rsp + 0x98], rdi
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x140079400]
xor r9d, r9d
mov dword [rsp + 0x30], 0x40
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x140079400]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140079400]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.14004c340
mov rbx, qword [rsp + 0x90]
test al, al
mov ecx, 3
cmove ecx, edi
mov rdi, qword [rsp + 0x98]
mov eax, ecx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140057760
add rsp, 0x80
pop rbp
ret
Function at 0x14004e470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xdd], 0
je 0x14004e498
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x42]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xdc
jb 0x14004e480
mov byte [rcx + 0xdd], 0
mov rax, rcx
ret

Function at 0x14004e4a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4f], 0
mov r8, rcx
je 0x14004e525
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [r9 + rax]
lea ecx, [rdx + 0x42]
xor byte [rax - 2], cl
lea rax, [rax + 0xd]
lea ecx, [rdx + 0x43]
xor byte [rax - 0xe], cl
lea ecx, [rdx + 0x44]
xor byte [rax - 0xd], cl
lea ecx, [rdx + 0x45]
xor byte [rax - 0xc], cl
lea ecx, [rdx + 0x46]
xor byte [rax - 0xb], cl
lea ecx, [rdx + 0x47]
xor byte [rax - 0xa], cl
lea ecx, [rdx + 0x48]
xor byte [rax - 9], cl
lea ecx, [rdx + 0x49]
xor byte [rax - 8], cl
lea ecx, [rdx + 0x4a]
xor byte [rax - 7], cl
lea ecx, [rdx + 0x4b]
xor byte [rax - 6], cl
lea ecx, [rdx + 0x4c]
xor byte [rax - 5], cl
lea ecx, [rdx + 0x4d]
xor byte [rax - 4], cl
add dl, 0x4e
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x4e
jb 0x14004e4c0
mov byte [r8 + 0x4f], 0
mov rax, r8
ret
Function at 0x14004eb10
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14004eba1
xor byte [rcx], 0x42
xor byte [rcx + 1], 0x43
xor byte [rcx + 2], 0x44
xor byte [rcx + 3], 0x45
xor byte [rcx + 4], 0x46
xor byte [rcx + 5], 0x47
xor byte [rcx + 6], 0x48
xor byte [rcx + 7], 0x49
xor byte [rcx + 8], 0x4a
xor byte [rcx + 9], 0x4b
xor byte [rcx + 0xa], 0x4c
xor byte [rcx + 0xb], 0x4d
xor byte [rcx + 0xc], 0x4e
xor byte [rcx + 0xd], 0x4f
xor byte [rcx + 0xe], 0x50
xor byte [rcx + 0xf], 0x51
xor byte [rcx + 0x10], 0x52
xor byte [rcx + 0x11], 0x53
xor byte [rcx + 0x12], 0x54
xor byte [rcx + 0x13], 0x55
xor byte [rcx + 0x14], 0x56
xor byte [rcx + 0x15], 0x57
xor byte [rcx + 0x16], 0x58
xor byte [rcx + 0x17], 0x59
xor byte [rcx + 0x18], 0x5a
xor byte [rcx + 0x19], 0x5b
xor byte [rcx + 0x1a], 0x5c
xor byte [rcx + 0x1b], 0x5d
xor byte [rcx + 0x1c], 0x5e
xor byte [rcx + 0x1d], 0x5f
xor byte [rcx + 0x1e], 0x60
xor byte [rcx + 0x1f], 0x61
xor byte [rcx + 0x20], 0x62
mov byte [rcx + 0x22], 0
ret
Function at 0x140052630
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.140058b30
sub rsp, rax
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor ebp, ebp
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
jne 0x140052682
mov rdx, rbp
jmp 0x14005275b
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.1400511d0
test al, al
je 0x14005267a
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], bpl
jne 0x1400526c0
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
cmp bp, r15w
jae 0x140052738
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140052731
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140052723
cmp rdi, rax
je 0x140052795
inc esi
cmp esi, r15d
jb 0x140052700
mov rdx, rbp
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140052520
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140057760
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140052738
mov edx, dword [rbx + 8]
lea rcx, [rsp + 0x50]
add rcx, rax
je 0x140052738
test edx, edx
je 0x140052738
lea rax, [rsp + 0x50]
mov ebp, edx
sub rcx, rax
lea rdx, [rcx + r13]
jmp 0x14005273b
Function at 0x1400531d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400531f8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14005321e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140053220
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140053279
test ecx, ecx
jle 0x140053259
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140053279
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140053279
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400532a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400532c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400532d8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400532f4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400532f6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140053332
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400533ce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14005336d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400533ae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400533ce
cmp rbx, rax
ja 0x140053380
test rbx, rbx
je 0x1400533ce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140053830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005385d
xor eax, eax
jmp 0x1400539c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140053897
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140053897
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400539c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400539bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400538da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140053905
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400539c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140053974
sub eax, 1
je 0x140053974
cmp eax, 2
jne 0x1400539bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400539c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400539a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400539bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400539c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140057760
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140053c80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140053d53
cmp byte [rcx + 0x71], 0
je 0x140053d53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140053d4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140053d14
sub eax, 1
je 0x140053d18
cmp eax, 2
jne 0x140053d4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140057760
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140053d46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140053d4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140053cfc
xor al, al
jmp 0x140053cfc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140057760
add rsp, 0x60
pop rbx
ret
Function at 0x140055840
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov r8, rdx
cmp word [rcx], ax
jne 0x1400558e6
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400558e6
test rax, rax
je 0x1400558e6
mov edx, dword [rax + 0xd8]
test edx, edx
je 0x1400558d9
mov rdi, qword [rdx + rcx + 0x58]
test rdi, rdi
je 0x1400558d9
sub rcx, r8
movabs rsi, 0x2b992ddfa232
add rdi, rcx
cmp qword [rdi], rsi
jne 0x1400558e6
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140055f70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140056096
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140056096
test rax, rax
je 0x140056096
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x140055ff3
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x1400560a1
lea rbx, [rcx + rdx]
mov esi, dword [rax + 0xb4]
add rsi, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rsi
jae 0x140056084
nop word [rax + rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x140056084
mov eax, dword [rbx]
add rax, rbp
mov qword [rsp + 0x30], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x40], eax
cmp rcx, r8
je 0x14005605d
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x140056074
lea r8, [rsp + 0x30]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140056810
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rsi
jb 0x140056010
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x1400560a1
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140057760
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140057510
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor edi, edi
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
mov ebx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400575a5
test rbx, rbx
je 0x14005756b
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140057555
test eax, eax
jns 0x1400575c6
test rbx, rbx
je 0x1400575cb
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14005768d
test rbx, rbx
jne 0x1400575d2
xor eax, eax
jmp 0x14005768d
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x140057675
nop
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.140046640
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140057613
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400576aa
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14005766b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057666
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400576f3
call fcn.1400577bc
inc edi
cmp edi, dword [rbx]
jb 0x1400575e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140057760
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400576ff
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400576fa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400576fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400577bc
mov rax, rdi
jmp 0x140057688
Function at 0x140058630
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005867a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005867a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005867a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005867a
cmp dword [rcx + 0x84], 0xe
jbe 0x14005867a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005867c
xor al, al
add rsp, 0x28
ret