joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014ce90
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movups xmmword [rbp - 0x68], xmm4
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rsi, r8
mov edi, r9d
xor edx, edx
mov dword [rbp - 0x3c], edx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x50], rdx
lea rcx, [0x1402db8a8]
call fcn.140004550
mov rbx, rax
mov rcx, rbx
call fcn.1400773a0
mov qword [rbp - 0x60], rbx
lea rcx, [0x1402db8a8]
call fcn.140004550
mov r14, rax
mov rcx, r14
call fcn.1400773a0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x74], rcx
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x7c], rdx
mov r8, rsi
mov qword [rbp - 0x84], r8
mov r9d, edi
mov dword [rbp - 0x6c], r9d
lea rcx, [rbp - 0xb0]
call fcn.140005180
mov rcx, qword [rbp - 0x74]
mov rdx, qword [rbp - 0x7c]
mov r8, qword [rbp - 0x84]
mov r9d, dword [rbp - 0x6c]
call sub.KERNEL32.dll_CreatePipe
mov esi, eax
lea rcx, [rbp - 0xb0]
call fcn.1400051d0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor edx, edx
mov qword [rbp - 0x58], rdx
mov dword [rbp - 0x3c], 1
test esi, esi
setne sil
movzx esi, sil
mov rbx, qword [rbp - 0x50]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 8], rbx
mov rcx, qword [rbp + 0x18]
mov rdx, r14
call fcn.140004850
mov r15, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
mov qword [rbx + 8], r15
mov rcx, qword [rbp + 0x10]
mov rdx, rbx
call fcn.140004850
call fcn.1400031e2
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140173210
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x48]
test rcx, rcx
jne 0x140173245
xor ecx, ecx
jmp 0x140173251
add rcx, 0xc
mov qword [rbp - 0x40], rcx
mov rcx, qword [rbp - 0x40]
test rdx, rdx
jne 0x14017325a
xor edx, edx
jmp 0x140173266
add rdx, 0xc
mov qword [rbp - 0x48], rdx
mov rdx, qword [rbp - 0x48]
xor r10d, r10d
cmp byte [rbp + 0x30], 0
setne r10b
test rax, rax
jne 0x14017327b
xor r11d, r11d
jmp 0x140173287
add rax, 0xc
mov qword [rbp - 0x50], rax
mov r11, qword [rbp - 0x50]
mov dword [rsp + 0x20], r10d
mov eax, dword [rbp + 0x38]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r11
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140005180
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.KERNEL32.dll_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.1400051d0
xor eax, eax
test esi, esi
setne al
movzx eax, al
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140197150
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
cmp edx, 0xffffffff
jne 0x140197164
mov edi, 0xd5313557
jmp 0x14019718b
mov ecx, edx
call fcn.140197080
mov rdx, rax
lea rcx, [0x1403cf098]
lea r8, [0x1403d2dd8]
call fcn.140080440
mov rcx, rax
call fcn.140197010
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rsi
pop rdi
ret
Function at 0x1401e2eb0
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1401e2eee
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x1401e2ed3
xor r10d, r10d
jmp 0x1401e2ed7
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x1401e2ebb
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x1401e64f0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.14000107c
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1401e6560
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov edi, edx
mov ebx, r8d
call fcn.14000107c
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 0xc
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, ebx, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1401eada0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401eadd4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401eadb6
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x1401eadf0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401eae24
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401eae06
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1400110eb
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001c6f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400340f2]
call fcn.1400118c5
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001c747
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001c853
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001c7ec
cmp qword [rbp + 0x28], 0
jle 0x14001c7ec
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001c78c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011839
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001c842
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001c842
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400114b5
Capabilities:
Terminate process

Disassembly:
jmp 0x14001fdf0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400115dc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x14001c8d0
push rbp
push rdi
sub rsp, 0x518
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xda
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002d028]
xor rax, rbp
mov qword [rbp + 0x4d0], rax
mov byte [rbp + 0x4b4], 0
lea rcx, [0x1400340f5]
call fcn.1400118c5
mov edx, 0x110
lea rcx, [rbp + 0x10]
call fcn.1400115eb
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.shellcode_hex.txt
lea rcx, [rbp + 0x10]
call fcn.140011811
nop
lea rcx, [rbp + 0x158]
call fcn.1400118b1
nop
lea rcx, [rbp + 0x10]
call fcn.14001103c
movzx eax, al
test eax, eax
je 0x14001ca17
mov edx, 0xf8
lea rcx, [rbp + 0x1a0]
call fcn.1400115d7
mov edx, 1
lea rcx, [rbp + 0x1a0]
call fcn.14001172b
nop
lea rcx, [rbp + 0x10]
call fcn.140011055
lea rcx, [rbp + 0x1b0]
mov rdx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp + 0x478]
lea rcx, [rbp + 0x1a0]
call fcn.14001182a
mov qword [rbp + 0x4c8], rax
mov rdx, qword [rbp + 0x4c8]
lea rcx, [rbp + 0x158]
call fcn.14001125d
lea rcx, [rbp + 0x478]
call fcn.1400111a9
lea rcx, [rbp + 0x158]
call fcn.140011776
xor edx, edx
mov ecx, 2
div rcx
mov byte [rbp + 0x4b4], 1
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x10]
call fcn.1400114b0
nop
lea rcx, [rbp + 0x1a0]
call fcn.14001119a
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x2b8], rax
cmp byte [rbp + 0x4b4], 0
jne 0x14001ca40
lea rcx, str.size
call fcn.14001117c
mov r8d, dword [rbp + 0x138]
mov rdx, qword [rbp + 0x2b8]
lea rcx, [rbp + 0x158]
call fcn.1400114c4
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 0x138]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x2d8], rax
mov r8, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2d8]
call fcn.1400113fc
call qword [rbp + 0x2d8]
nop
lea rcx, [rbp + 0x158]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x10]
call fcn.140011177
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140026f68]
call fcn.140011726
mov eax, edi
mov rcx, qword [rbp + 0x4d0]
xor rcx, rbp
call fcn.1400113f7
lea rsp, [rbp + 0x4e8]
pop rdi
pop rbp
ret
Function at 0x140011604
Capabilities:
Parse pe header

Disassembly:
jmp 0x140020920
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140020940
xor al, al
jmp 0x1400209c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140020953
xor al, al
jmp 0x1400209c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002097d
xor al, al
jmp 0x1400209c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140020991
xor al, al
jmp 0x1400209c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400209a3
xor al, al
jmp 0x1400209c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400209bf
xor al, al
jmp 0x1400209c1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400118a7
Capabilities:
Write file on windows

Disassembly:
jmp 0x140017450
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14002d028]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400340f2]
call fcn.1400118c5
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x1400174b6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400174bd
mov al, 1
jmp 0x140017617
call fcn.140011267
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011267
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.140011749
movzx eax, al
test eax, eax
je 0x140017518
xor al, al
jmp 0x140017617
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14001757d
cmp dword [rbp + 0x194], 1
je 0x140017588
cmp dword [rbp + 0x194], 3
je 0x140017606
jmp 0x140017615
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400175d8
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400175d8
xor al, al
jmp 0x140017617
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400175f3
mov dword [rbp + 0x194], 1
jmp 0x1400175fd
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140017617
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140017617
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400277b0]
call fcn.140011726
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.1400113f7
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140064561
Capabilities:
Execute syscall

Disassembly:
mov rax, rcx
xor rcx, rcx
mov r10, rax
xor eax, eax
mov eax, dword [0x14038be50]
syscall
ret

Function at 0x140064d68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140064db2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140064db2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140064db2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140064db2
cmp dword [rcx + 0x84], 0xe
jbe 0x140064db2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140064db4
xor al, al
add rsp, 0x28
ret
Function at 0x141020b98
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141020ba2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141020bcb
pop rbp
sub rbp, 0x33
sub rbp, 0x1020b98
sub rsp, 0x20
jmp 0x141020bea
mov rax, 0x1020b98
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff8713eb0c
xor byte [rax], dl
inc rax
dec rcx
jne 0x141020c09
jmp 0x141020c20
test ebp, r12d
xchg dword [rbp + 0xc0c0c30], eax
invalid
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140006b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov esi, ecx
mov rcx, qword [0x140022b00]
mov qword [rsp + 0x98], 0
movaps xmm0, xmmword [0x1400151c0]
movups xmmword [rsp + 0xa8], xmm0
mov dword [rsp + 0x98], 0x6e65706f
mov byte [rsp + 0x9c], 0
mov qword [rsp + 0x78], 0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x78], 0x656c6966
mov byte [rsp + 0x7c], 0
mov qword [rsp + 0x58], 0
movaps xmm0, xmmword [0x1400151d0]
movups xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x58], 0x646e6977
mov word [rsp + 0x5c], 0x776f
mov byte [rsp + 0x5e], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 1
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], 0x2c
xor edx, edx
mov r8b, 1
mov r9d, 1
call fcn.140004430
xor ecx, ecx
call fcn.14000a6a0
mov rdi, rax
add rdi, 0x1e
nop dword [rax + rax]
xor ecx, ecx
call fcn.14000a6a0
cmp rax, rdi
jle 0x140006be0
call sub.mpeng.dll_MpUtilsExportFunctions
cmp esi, 3
je 0x140006c0a
cmp esi, 2
je 0x140006c05
cmp esi, 1
jne 0x140006c0f
call sub.mpeng.dll_MpUpdateTSModeEx
call sub.mpeng.dll_MpUnblockPlatform
call sub.mpeng.dll_MpAmsiScan
xor eax, eax
add rsp, 0xb8
pop rdi
pop rsi
ret

Function at 0x140009298
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400093c8
Function at 0x14002ae80
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x14002aec7
test byte [rcx + 0x1c], 4
je 0x14002aec7
cmp byte [rcx + 0x19], 5
jb 0x14002aec7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140082b80]
mov edx, 0x14
call fcn.140001010
lea rcx, [0x14009a0f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002af0c
cmp dword [rbx + 0x2c], eax
jne case.default.0x14002b08d
lea rcx, [0x14009a008]
call fcn.14003388c
jmp case.default.0x14002b08d
cmp eax, 2
jne 0x14002af7b
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002b08d
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne case.default.0x14002b08d
mov rax, qword [str.___t_]
cmp rax, r14
je case.default.0x14002b08d
test byte [rax + 0x1c], 4
je case.default.0x14002b08d
cmp byte [rax + 0x19], 2
jb case.default.0x14002b08d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
call fcn.140001030
jmp case.default.0x14002b08d
cmp eax, 3
jne case.default.0x14002b08d
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002afcf
mov rax, qword [str.___t_]
cmp rax, r14
je 0x14002afcf
test byte [rax + 0x1c], 4
je 0x14002afcf
cmp byte [rax + 0x19], 2
jb 0x14002afcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
call fcn.140001030
cmp dword [rbx + 0x660], 0
je 0x14002b02a
cmp dword [rbx + 0x65c], 0
je 0x14002b033
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002b02a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14002b02a
test byte [rcx + 0x1c], 4
je 0x14002b02a
cmp byte [rcx + 0x19], 2
jb 0x14002b02a
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x140082b80]
call fcn.140001250
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002b08d
cmp qword [rbx + 0x668], 0
je case.default.0x14002b08d
lea rcx, [0x14009a180]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14003b73c
lea rcx, [0x14009a180]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.14006264c
lea rcx, [0x14009a0f0]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
int3
mov al, 0x36
mov ah, 0xfd
shl byte [rsi + 0x140a41f5], 0x6f
sbb dword [rbp + 0x4b], edi
jge 0x14011505f
jge 0x14011505f
lodsb al, byte [rsi]
out dx, eax
invalid
and dh, byte [rax - 0x22f5090a]
in al, 0x99
cld
push rsi
mov eax, 0x25b26632
adc esp, dword [rdi]
sti
jmp [rbp + 0x2a]
jbe 0x140115014
invalid
Function at 0x2fc4ca930
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cb332
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ef108]
test eax, eax
je 0x2fc4cb3ca
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ef110]
mov qword [rbp - 8], rax
jmp 0x2fc4cb3ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cb3a2
cmp qword [rbp - 0x10], 0
je 0x2fc4cb3a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cb368
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cb3cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cb4d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cb4f8
mov eax, 0
jmp 0x2fc4cb546
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cb521
mov eax, 0
jmp 0x2fc4cb546
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cb541
mov eax, 0
jmp 0x2fc4cb546
mov eax, 1
add rsp, 0x20
pop rbp
ret