joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005590
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
push r15
sub rsp, 0x80
mov rax, qword [0x180037010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [r11 - 0x48], 8
mov qword [r11 - 0x58], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x48], eax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov r15, qword [rcx + 0x60]
test r15, r15
je 0x18000576f
mov qword [r11 - 0x20], r13
mov eax, 0x5a4d
mov r13, qword [r15 + 0x10]
cmp word [r13], ax
jne 0x18000576a
movsxd rax, dword [r13 + 0x3c]
cmp dword [rax + r13], 0x4550
jne 0x18000576a
mov qword [r11 - 0x28], r14
mov r14d, dword [rax + r13 + 0x90]
add r14, r13
cmp dword [r14], 0
je 0x180005765
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov ecx, dword [r14 + 0xc]
add rcx, r13
call fcn.1800092e0
mov r12, rax
test rax, rax
je 0x180005743
mov esi, dword [r14]
add rsi, qword [r15 + 0x10]
mov ebx, dword [r14 + 0x10]
add rbx, qword [r15 + 0x10]
mov rcx, qword [rsi]
test rcx, rcx
js 0x180005735
je 0x180005735
mov rdx, qword [r15 + 0x10]
add rdx, 2
mov qword [rsp + 0x30], rbx
mov rbp, qword [rbx]
add rdx, rcx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x180005685
dec rcx
call fcn.180003700
not eax
mov rcx, r12
mov edx, eax
call fcn.1800093f0
mov rdi, rax
test rbp, rbp
je 0x180005718
test rax, rax
je 0x180005718
cmp rbp, rax
je 0x180005718
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], 8
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
call fcn.18000d458
test eax, eax
js 0x180005718
mov qword [rbx], rdi
lea rax, [rsp + 0x48]
mov r9d, dword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], 8
call fcn.18000d458
add rsi, 8
mov qword [rsp + 0x30], 0
add rbx, 8
mov rcx, qword [rsi]
test rcx, rcx
jns 0x180005665
add r14, 0x14
cmp dword [r14], 0
jne 0x180005632
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000d650
add rsp, 0x80
pop r15
ret
Function at 0x180008e10
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180037010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rcx + r8*2], 0
jne 0x180008e30
dec r8
cmp r8, 0xffffffffffffffff
jne 0x180008e4b
mov eax, 0xffffffff
jmp 0x180008e71
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.180003680
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x180032760]
xor eax, dword [rdx + rcx*4]
not eax
xor edx, edx
mov ecx, eax
call fcn.180009090
test rax, rax
jne 0x180008f1c
mov rax, qword [0x180038e70]
test rax, rax
jne 0x180008ecb
xor edx, edx
mov ecx, 0x84c05e40
call fcn.180009090
mov edx, 0xfa2a9aa9
mov rcx, rax
call fcn.1800093f0
mov qword [0x180038e70], rax
test rax, rax
jne 0x180008ecb
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000d650
add rsp, 0x40
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x28]
call rax
mov r10, qword [0x180038e78]
test r10, r10
jne 0x180008eff
mov edx, 0xa09b055e
mov ecx, 0x84c05e40
call fcn.180009700
mov qword [0x180038e78], rax
mov r10, rax
test rax, rax
je 0x180008eb6
xor eax, eax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000d650
add rsp, 0x40
pop rbx
ret
Function at 0x180009700
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
xor edx, edx
call fcn.180009090
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.1800093f0

Function at 0x180009ab0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x180009b3f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180009b3f
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x180009b3f
xor edi, edi
cmp di, word [rsi + 6]
jae 0x180009b3f
nop word [rax + rax]
movzx ecx, word [rsi + 0x14]
lea rdx, [rdi + rdi*4]
add rcx, rsi
lea rbx, [rcx + rdx*8]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx + 0x18], 0
jne 0x180009b16
dec rcx
lea rdx, [rbx + 0x18]
call fcn.180003700
not eax
cmp eax, 0xa21c1ea3
je 0x180009b5c
movzx eax, word [rsi + 6]
inc edi
cmp edi, eax
jb 0x180009b00
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [r14], rbp
mov eax, dword [rbx + 0x24]
add rax, rbp
mov qword [r14 + 8], rax
mov eax, dword [rbx + 0x28]
mov dword [r14 + 0x10], eax
mov eax, dword [rbx + 0x24]
sub eax, dword [rbx + 0x2c]
mov dword [r14 + 0x14], eax
mov eax, 1
jmp 0x180009b41
Function at 0x18000d335
Capabilities:
Check os version
Execute syscall

Disassembly:
xor al, 0x5a
mov r10, qword gs:[0x60]
cmp word [r10 + 0x118], 0xa
je 0x18000d387
cmp word [r10 + 0x118], 6
je 0x18000d358
jmp 0x18000d3ae
cmp word [r10 + 0x11c], 3
je 0x18000d389
cmp word [r10 + 0x11c], 2
je 0x18000d38b
cmp word [r10 + 0x11c], 1
jne 0x18000d3ae
cmp word [r10 + 0x120], 0x1db1
je 0x18000d38d
jmp 0x18000d3ae
inc eax
inc eax
inc eax
cmp qword [0x180038d08], 0
jne 0x18000d3a3
cmp eax, 0xc390050f
pop r10
mov r10, rcx
jne 0x18000d398
syscall
nop
ret
pop r10
mov r10, rcx
jmp qword [0x180038d08]
ret
Function at 0x18001dc1c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001dc4c
xor eax, eax
jmp 0x18001dd0f
mov rbp, rbx
cmp word [rax], si
je 0x18001dc71
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001dc58
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001dc54
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001db6c
movsxd r14, eax
test eax, eax
jne 0x18001dcaf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001dc45
mov rcx, r14
call fcn.18001ba10
mov rdi, rax
test rax, rax
jne 0x18001dcc8
xor ecx, ecx
call fcn.18001b9d4
jmp 0x18001dca4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001db6c
test eax, eax
jne 0x18001dcf9
mov rcx, rdi
call fcn.18001b9d4
jmp 0x18001dd03
xor ecx, ecx
call fcn.18001b9d4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180022380
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800223a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800223a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001300
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400013bf
lea r8, [rsp + 0x30]
mov rcx, rax
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400013b6
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400013b6
mov rax, qword [rsp + 0x38]
lea r9d, [rbx + 0x10]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400013b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
setne bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001780
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140001590
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [0x1400215c8]
call fcn.140001070
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.advapi32.dll
call fcn.140001070
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.sechost.dll
call fcn.140001070
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.pdh.dll
call fcn.140001070
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.amsi.dll
call fcn.140001070
call fcn.140001300
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rsi, str.dllhost.exe
nop dword [rax + rax]
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor ecx, ecx
lea rax, [rsp + 0x4c]
nop dword [rax]
movzx edx, word [rax + rcx*2]
cmp dx, word [rsi + rcx*2]
jne 0x1400016ad
movzx edx, word [rax + rcx*2 + 2]
cmp dx, word [rsi + rcx*2 + 2]
jne 0x1400016ad
add rcx, 2
cmp rcx, 0xc
jne 0x140001680
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400016f8
lea rdx, [0x1400215c8]
mov rcx, rbx
call fcn.140001070
lea rdx, str.advapi32.dll
mov rcx, rbx
call fcn.140001070
lea rdx, str.sechost.dll
mov rcx, rbx
call fcn.140001070
lea rdx, str.pdh.dll
mov rcx, rbx
call fcn.140001070
lea rdx, str.amsi.dll
mov rcx, rbx
call fcn.140001070
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001660
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._77svc64
call fcn.1400013e0
lea rcx, str._77svc32
call fcn.1400013e0
lea rcx, [0x140021684]
call fcn.140008144
lea rdx, str.Ring3_Rootkit_Unhooked_
lea rcx, [0x1400216a0]
call fcn.140001010
lea rcx, str.pause
call fcn.140008144
xor ecx, ecx
call fcn.140005ec8
int3

Function at 0x140002160
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400021aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400021aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400021aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400021aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400021aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400021ac
xor al, al
add rsp, 0x28
ret
Function at 0x140005ec8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005d33
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005d33
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005d33
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005d33
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005d33
cmp dword [rcx + 0x84], 0xe
jbe 0x140005d33
cmp dword [rcx + 0xf8], 0
je 0x140005d33
mov ecx, ebx
call fcn.140005de4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005bc0
nop
cmp dword [rbp + 0x20], 0
je 0x140005d81
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005d8c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005cc4
Function at 0x14000eedc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000ef0c
xor eax, eax
jmp 0x14000efcf
mov rbp, rbx
cmp word [rax], si
je 0x14000ef31
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000ef18
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000ef14
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000edfc
movsxd r14, eax
test eax, eax
jne 0x14000ef6f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000ef05
mov rcx, r14
call fcn.14000a8a8
mov rdi, rax
test rax, rax
jne 0x14000ef88
xor ecx, ecx
call fcn.140009c30
jmp 0x14000ef64
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000edfc
test eax, eax
jne 0x14000efb9
mov rcx, rdi
call fcn.140009c30
jmp 0x14000efc3
xor ecx, ecx
call fcn.140009c30
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400131dc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400131f2
mov al, 1
jmp 0x140013252
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140013203
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140013250
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000f6e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140013250
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140013250
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140013250
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140013252
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140014ac8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000d524
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140014b52
cmp byte [rbp - 0x21], r15b
je 0x140014b4d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140014b88
call fcn.140009e80
test eax, eax
jne 0x140014b74
cmp byte [rbp - 0x21], r15b
je 0x140014b6c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140014b88
cmp byte [rbp - 0x21], r15b
je 0x140014b85
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000d3a8
test eax, eax
jne 0x140014c28
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000d524
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140014bc7
cmp byte [rbp - 0x21], r15b
je 0x140014bfc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140014bfc
call fcn.140009e80
test eax, eax
jne 0x140014be8
cmp byte [rbp - 0x21], r15b
je 0x140014be1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140014bfc
cmp byte [rbp - 0x21], r15b
je 0x140014bf9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000d3a8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140014c28
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140014c2b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140014c39
mov rcx, rdi
call fcn.140009c30
cmp byte [rbp + 0x3f], r15b
je 0x140014c48
mov rcx, qword [rbp + 0x27]
call fcn.140009c30
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400171b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400171d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400171d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18069f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x18069f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18069f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069f06f
add dl, dl
jne 0x18069f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069f0f6
xor eax, eax
add dl, dl
jne 0x18069f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069f1ad
add dl, dl
jne 0x18069f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18069f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18069f07e
mov eax, 1
add dl, dl
jne 0x18069f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069f0fb
sub eax, ebx
mov ebx, 1
jne 0x18069f14c
mov ecx, 1
add dl, dl
jne 0x18069f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18069f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18069f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18069f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069f15d
cmp eax, 0x7d00
jae 0x18069f19b
cmp eax, 0x500
jb 0x18069f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069f07e
cmp eax, 0x7f
ja 0x18069f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18069f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18069f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001591
Capabilities:
Map section object

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x30]
lea rdx, str.__C:windows_system32_advapi32.dll
mov rcx, rax
call sym.RtlInitUnicodeString
mov dword [rbp - 0x80], 0x30
mov qword [rbp - 0x78], 0
mov dword [rbp - 0x68], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rax, [rbp - 0x90]
mov rdx, rax
lea rcx, str.___Loading_Fake_Image:__wZ_n
call sym.printf
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x80]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], 5
mov r9, rcx
mov r8, rdx
mov edx, 0x100021
mov rcx, rax
call sym.NtOpenFile
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x14000176d
lea rcx, str.___File_Loaded_n
call sym.printf
mov dword [rbp - 8], 0xe
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
mov r9d, 0
mov r8d, 0
mov edx, 0xd
mov rcx, rax
call sym.NtCreateSection
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x140001770
lea rcx, str.___Section_Created_n
call sym.printf
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x48], pe_nt_image_headers64
mov dword [rsp + 0x40], 0x800000
mov dword [rsp + 0x38], 1
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call sym.NtMapViewOfSection
mov rax, qword [rbp - 0x40]
mov rdx, rax
lea rcx, str.___Image_Loaded_at__x_n
call sym.printf
call sym.getchar
mov rax, qword [rbp - 0x38]
mov rcx, rax
call sym.NtClose
mov eax, 1
jmp 0x140001776
nop
jmp 0x140001771
nop
mov eax, 0
add rsp, 0xe0
pop rbp
ret

Function at 0x140001ac0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]