joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004e20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140004e48
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140004ebc
test rax, rax
jle 0x140004e9c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140004ebc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004ebc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140005820
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400058a4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1402eeed0]
cmp byte [rcx + rax], 0
je 0x1400058a4
dec r8
sub rdx, 1
jne 0x14000588a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140005be8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140005938
mov ebx, eax
test eax, eax
jne 0x140005c18
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140005c7b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005c72
test al, 0x10
je 0x140005c72
bt eax, 0xa
jae 0x140005c6b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140005c8c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140005c67
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140005c67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x140005c72
and dword [rsp + 0x3c], 0
jmp 0x140005c77
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006790
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400067da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400067da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400067da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400067da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400067da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400067dc
xor al, al
add rsp, 0x28
ret
Function at 0x1404573aa
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rbx + r9 - 0x708fcd36]
add r9, 0x10
mov qword ss:[rcx], rbx
jmp fcn.14046eb73
mov qword [rsp], r9
jmp 0x14045e3fe
mov edx, 0x55156631
lea r9, [0x140443448]
mov edx, 0xb38853a3
movzx edx, byte [r8]
push 0x2dbac292
shl word [rsp + 3], 0xe9
xor edx, eax
and edx, 0xff
mov edx, dword [r9 + rdx*4]
ror dword [rsp + 3], 0xc7
shr eax, 8
xor eax, edx
push 0xffffffffaea29ea5
inc r8
push 0x6e322781
xor eax, 0xdd1b628f
dec rdi
lea rsp, [rsp + 0x18]
jne 0x14045e40a
mov r9d, 0xd7301a96
call fcn.140466b09
call fcn.14045d3da
mov ecx, 0x8c240bbc
ror ecx, cl
mov si, word [rbx]
setae cl
jae 0x140484d8d
shr rcx, 0xa6
or cx, word [rbx + rcx*8 + 2]
add rbx, 2
call fcn.140448bae
mov eax, 0x24029117
rol ax, 0xc1
lea rsi, [rsi + rax*2 - 0x4804445f]
movsx edx, ax
movzx edx, byte [rsi + rax*2 - 0x4804445e]
shr eax, 0xad
jae 0x14046dd10
add rbx, 2
sal r10w, cl
call fcn.140450f9d
mov esi, 0x2209bd39
mov r9, qword [rbx + rsi - 0x2209bd39]
lea rsi, [rsi + rsi*2 + 0x411d813b]
mov rsi, qword [r9]
push 0x443b6109
mov qword [rbx], rsi
push 0x768aca9a
lea rsp, [rsp + 0x10]
jmp fcn.14045713f
js 0x14044bec7
xor dl, bpl
xor dl, 0x22
lea rax, [rax + rax*2 + 0x548fc010]
inc rax
xor al, ah
dec dl
not eax
ror dl, 1
lea rax, [rax + rax*8 - 0x396a0bd1]
inc dl
xor bpl, dl
jmp fcn.140476214
Function at 0x382fc10
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x382fc1d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x382fc2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x382fc15
lea eax, [rcx + 1]
jmp 0x382fc3b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x382fc4e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x382fc34
sub eax, 3
jb 0x382fc6e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x382fcbd
sar eax, 1
movsxd rbp, eax
jb 0x382fca4
jmp 0x382fc7c
add ebx, ebx
jne 0x382fc7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x382fca4
inc ecx
add ebx, ebx
jne 0x382fc8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x382fca4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x382fc9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x382fc8c
add ecx, 2
jmp 0x382fca9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0382fbd2
jmp 0x382fc1d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x3421000]
mov eax, dword [rdi]
or eax, eax
je 0x382fd1d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x343fbd4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x382fccd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x382fd17
mov qword [rbx], rax
add rbx, 8
jmp 0x382fced
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x382fd61
cmp al, 0xef
ja 0x382fd49
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x382fd29
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x382fd38
mov eax, dword [rdi]
add rdi, 4
jmp 0x382fd38
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0382fde0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0382fde0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x382fdd0
sub rsp, 0xffffffffffffff80
jmp 0x4014b0
Function at 0x1400025e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000262e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000262e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000262e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000262e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000262e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002630
xor al, al
add rsp, 0x28
ret

Function at 0x140008060
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007e8c
Function at 0x140013540
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140013568
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140013568
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400010f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x5a4d
mov ebp, r8d
mov r14d, edx
mov rdi, rcx
cmp word [rcx], ax
jne 0x1400011ef
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400011ef
mov ecx, 0x8664
cmp word [rax + 4], cx
jne 0x1400011ef
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400011ef
cmp dword [rax + 0x84], 0
jbe 0x1400011ef
cmp dword [rax + 0x8c], 0
je 0x1400011ef
mov ecx, dword [rax + 0x88]
add rcx, rdi
je 0x1400011ef
mov ebx, dword [rcx + 0x20]
xor r11d, r11d
mov r15d, dword [rcx + 0x24]
add rbx, rdi
mov r12d, dword [rcx + 0x1c]
add r15, rdi
mov esi, dword [rcx + 0x18]
add r12, rdi
test esi, esi
je 0x1400011ef
nop word [rax + rax]
mov r10d, dword [rbx]
mov r9d, r14d
add r10, rdi
xor eax, eax
nop dword [rax + rax]
movsx ecx, byte [rax + r10]
movzx edx, cl
lea ecx, [rdx - 0x61]
cmp ecx, 0x19
lea r8d, [rdx - 0x20]
cmova r8d, edx
xor r9d, r8d
rol r9d, 8
add r9d, r8d
test r8d, r8d
je 0x1400011de
inc rax
cmp rax, 0xffffffffffffffff
jne 0x1400011b0
cmp r9d, ebp
je 0x14000120c
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x1400011a0
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
movzx ecx, word [r15 + r11*2]
mov eax, dword [r12 + rcx*4]
add rax, rdi
jmp 0x1400011f1
Function at 0x140021ae8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140021b32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140021b32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140021b32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140021b32
cmp dword [rcx + 0x84], 0xe
jbe 0x140021b32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140021b34
xor al, al
add rsp, 0x28
ret

Function at 0x1400254fc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002535b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002535b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002535b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002535b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002535b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002535b
cmp dword [rcx + 0xf8], 0
je 0x14002535b
mov ecx, ebx
call fcn.140025418
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400251e8
nop
cmp dword [rbp + 0x20], 0
je 0x1400253a9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400253b4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400252ec
Function at 0x1400360c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140036147
mov rsi, rbx
cmp word [rax], bp
je 0x140036106
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400360f0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400360ec
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140033740
mov rdi, rax
test rax, rax
je 0x140036134
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140023270
mov rbp, rdi
xor ecx, ecx
call fcn.140031b04
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c210
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003c238
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003c238
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1430ca710
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1430ca71a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1430ca743
pop rbp
sub rbp, 0x33
sub rbp, 0x30ca710
sub rsp, 0x20
jmp 0x1430ca762
mov rax, 0x30ca710
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc8cad3a5
xor byte [rax], dl
inc rax
dec rcx
jne 0x1430ca781
jmp 0x1430ca798
in eax, dx
sub al, 0x4c
sub al, 0x99
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
in eax, dx
and al, 0x64
lodsd eax, dword [rsi]
movsb byte [rdi], byte [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
in eax, dx
movsb byte [rdi], byte [rsi]
in eax, dx
invalid
Function at 0x140002ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140538240]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rcx + 0x50]
movabs rax, 0x6666666666666667
mov rbx, qword [rcx + 0x48]
mov rdx, rdi
sub rdx, rbx
mov rsi, rcx
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x140002b33
xor al, al
jmp 0x140002c31
mov qword [rsp + 0x68], rbp
cmp rbx, rdi
je 0x140002bff
xor ebp, ebp
mov edx, dword [rbx + 8]
lea r9, [rsp + 0x38]
mov rcx, qword [rbx]
mov r8d, 0x40
mov dword [rsp + 0x38], ebp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140002c6a
mov r8, qword [rbx + 0x10]
mov r10, qword [rbx + 0x18]
cmp r8, r10
je 0x140002bd8
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8 + 0x10]
mov r9d, ebp
mov eax, edx
test dl, dl
je 0x140002ba8
sub eax, 1
je 0x140002ba0
cmp eax, 1
jne 0x140002bae
mov r9d, 0x90
jmp 0x140002bae
mov r9d, 0xcc
jmp 0x140002bae
mov r9d, 0xf1
test dl, dl
jne 0x140002bb6
mov dl, 2
jmp 0x140002bb9
add dl, 0xff
movzx eax, byte [r8]
mov byte [r8 + 1], al
mov rax, qword [r8 + 8]
mov byte [r8], r9b
mov byte [r8 + 0x10], dl
add r8, 0x18
mov byte [rax], r9b
cmp r8, r10
jne 0x140002b80
mov edx, dword [rbx + 8]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140002c4e
add rbx, 0x28
cmp rbx, rdi
jne 0x140002b43
mov rbx, qword [rsi + 0x48]
mov rdi, qword [rsi + 0x50]
cmp rbx, rdi
je 0x140002c2a
nop dword [rax]
lea rcx, [rbx + 0x10]
call fcn.140014ff0
add rbx, 0x28
cmp rbx, rdi
jne 0x140002c10
mov rax, qword [rsi + 0x48]
mov qword [rsi + 0x50], rax
mov rbp, qword [rsp + 0x68]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14015af10
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.1400021e0
lea rdx, [0x1403abde0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
call fcn.140002310
lea rdx, [0x1403abc98]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14000dfc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140538240]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov r8d, 0x12c
lea rcx, [rsp + 0x24]
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000e044
nop dword [rax]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x14000e070
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000e020
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14015af10
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000e04f
Function at 0x14000e760
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140538240]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movzx ecx, byte [0x1403a55c8]
mov r9, rax
movups xmm0, xmmword [str.mOhONDmF35._r__:_____O]
mov byte [rsp + 0x38], cl
xor ecx, ecx
cmp dword [0x140538250], 2
movsd xmm1, qword [0x1403a55c0]
movups xmmword [rsp + 0x20], xmm0
movsd qword [rsp + 0x30], xmm1
jl 0x14000e939
movdqa xmm0, xmmword [str.77777777777777778888888888888888]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1403a6090]
mov eax, 4
movdqa xmm4, xmmword [0x1403a6120]
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [0x1403a60d0]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1403a60f0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1403a60f0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x14000e820
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x19
jge 0x14000e97d
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x19
jl 0x14000e950
lea rdx, [rsp + 0x20]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
call rax
test eax, eax
jne 0x14000e9ad
cmp byte [rsp + 0x50], al
je 0x14000e9ad
cmp byte [rsp + 0x51], al
je 0x14000e9c2
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14015af10
add rsp, 0x98
ret
mov ecx, 0xfffffac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000e9d0
Capabilities:
Get memory capacity
Get system information on windows
Terminate process

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140538240]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movsd xmm1, qword [0x1403a6050]
movsd xmm0, qword [0x1403a6058]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
mov rcx, qword [rsp + 0x28]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000ea25
cvtsi2sd xmm1, rcx
jmp 0x14000ea3a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
divsd xmm1, xmm0
movsd xmm0, qword [0x1403a6048]
comisd xmm0, xmm1
jae 0x14000ea79
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x80], 1
jbe 0x14000ea79
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14015af10
add rsp, 0xa8
ret
mov ecx, 0xfffffac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000eac0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x500
mov rax, qword [0x140538240]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
xor r14d, r14d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14000eb98
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000eb98
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000eb93
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14000eb70
cmp edx, 0x9bc5a608
je 0x14000ec6b
test r8d, r8d
jne 0x14000eb50
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000ebad
cmp qword [rax + 0x30], r14
jne 0x14000eb20
mov rax, r14
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14000ec54
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14000ec54
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000ec4f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14000ec30
cmp edx, 0x85cca27e
je 0x14000ec87
test r8d, r8d
jne 0x14000ec10
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x14000eca1
cmp qword [rax + 0x30], r14
jne 0x14000ebe0
jmp 0x14000eca1
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14000ebb0
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
lea rdx, [rsp + 0x20]
mov rcx, rbp
call r14
test eax, eax
je 0x14000ecf5
cmp qword [rsp + 0x68], 0
jne 0x14000ece9
cmp qword [rsp + 0x70], 0
jne 0x14000ece9
cmp qword [rsp + 0x78], 0
jne 0x14000ece9
cmp qword [rsp + 0x80], 0
jne 0x14000ece9
cmp qword [rsp + 0x88], 0
jne 0x14000ece9
cmp qword [rsp + 0x90], 0
je 0x14000ecf5
mov ecx, 0xfffffac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.14015af10
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret