joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f8cd0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rdi, rdx
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x1c], 1
jne 0x1401f8d1d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9, qword [rbx + 0x9a0]
lea r8, [0x1401f8d80]
add r9, 0x40000
mov rdx, rdi
mov rcx, rbx
call fcn.1401fc080
jmp 0x1401f8d2d
cmp dword [rbx + 0x3c], 2
je 0x1401f8d2d
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbx + 0x3c], 1
jne 0x1401f8d3d
mov ecx, dword [rbx + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbx + 0x3c], 2
je 0x1401f8d58
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14002c020
lea rdx, [0x1403c9248]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1401f9130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x21c8], 0
mov rsi, r8
mov rax, rdx
mov rbx, rcx
je 0x1401f9183
mov r9, qword [rcx + 0x21c8]
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rax
cmp rax, rsi
jne 0x1401f9183
mov rcx, qword [rbx + 0x21c8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
mov rax, rdi
je 0x1401f918a
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401f9d80
Capabilities:
Terminate process

Disassembly:
cmp qword [rcx + 0x1048], 0
je 0x1401f9d76
mov rcx, qword [rcx + 0x1048]
jmp 0x1401f9d80
ret
push rbx
sub rsp, 0x80
mov rbx, rcx
mov qword [rsp + 0xa0], rdi
add rcx, 0x10
mov edi, edx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x1c], 1
jne 0x1401f9f5b
lea rcx, [rbx + 0x290]
mov qword [rsp + 0x98], rsi
xor edx, edx
mov byte [rbx + 9], 1
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
call fcn.1400cbf60
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14009b860
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x388], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x328], rax
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x330], rax
call fcn.1400cbf60
mov rcx, rax
mov qword [rbx + 0x250], rax
call sub.KERNEL32.dll_GetThreadId
lea r8, [rbx + 0x25c]
mov dword [rbx + 0x258], eax
lea rdx, [rbx + 0x258]
lea rcx, [rbx + 0x250]
lea r9d, [rsi + 0x18]
call fcn.1401f8bb0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea rdx, [rbx + 0x290]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x160], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x170], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbx + 0x180], eax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call fcn.14009b830
lea rcx, [rbx + 0x188]
lea r8, [rsp + 0x50]
lea edx, [rsi + 0x18]
call fcn.14009b630
mov qword [rbx + 0x248], rax
lea rcx, [rbx + 0x760]
mov rax, qword [rbx + 0x388]
lea rdx, str.Simulated_exception__d.
mov r8d, edi
mov qword [rbx + 0x278], rax
call fcn.1401fbe40
cmp qword [rbx], 0
mov rsi, qword [rsp + 0x98]
je 0x1401f9f6b
mov rax, qword [rbx]
xor edx, edx
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x178]
mov rax, qword [rbx]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x110]
test al, 1
je 0x1401f9f44
mov rax, qword [rbx]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x168]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x178]
jmp 0x1401f9f6b
cmp dword [rbx + 0x3c], 2
je 0x1401f9f6b
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbx + 0x3c], 1
mov rdi, qword [rsp + 0xa0]
jne 0x1401f9f83
mov ecx, dword [rbx + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbx + 0x10]
add rsp, 0x80
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140001230
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov ebx, edx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov r10d, dword [r8 + 0x20]
add rdi, rcx
mov esi, dword [r8 + 0x24]
add r10, rcx
mov r8d, dword [r8 + 0x14]
add rsi, rcx
test r8d, r8d
je 0x1400012d2
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
mov edx, 0x811c9dc5
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x1400012a7
inc rax
movzx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000183
movzx ecx, byte [rax]
test cl, cl
jne 0x140001292
cmp edx, ebx
je 0x1400012c7
inc r9d
add r10, 4
cmp r9d, r8d
jb 0x140001280
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rsi + r9*2]
mov eax, dword [rdi + rcx*4]
add rax, r11
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400032f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000333a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000333a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000333a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000333a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000333a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000333c
xor al, al
add rsp, 0x28
ret

Function at 0x140009a9c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000988c
Function at 0x14000d2b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d2e4
xor eax, eax
jmp 0x14000d3a7
mov rbp, rbx
cmp word [rax], si
je 0x14000d309
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d2f0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d2ec
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d204
movsxd r14, eax
test eax, eax
jne 0x14000d347
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d2dd
mov rcx, r14
call fcn.14000e2e0
mov rdi, rax
test rax, rax
jne 0x14000d360
xor ecx, ecx
call fcn.14000b908
jmp 0x14000d33c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d204
test eax, eax
jne 0x14000d391
mov rcx, rdi
call fcn.14000b908
jmp 0x14000d39b
xor ecx, ecx
call fcn.14000b908
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400127b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400127d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400127d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14005d9c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x140154d78], rbx
je 0x14005da29
cmp rax, rbx
jne 0x14005da1c
mov edi, 1
mov r14d, edi
jmp 0x14005da2e
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14005da00
mov edi, 1
mov eax, dword [0x140154d80]
cmp eax, edi
jne 0x14005da46
mov esi, 0x1f
mov ecx, esi
call fcn.1401f4000
jmp 0x14005dab7
mov eax, dword [0x140154d80]
test eax, eax
jne 0x14005daac
mov dword [0x140154d80], edi
lea r12, [0x1400010a0]
lea rbx, [0x140001088]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x14005da9e
test eax, eax
jne 0x14005daa2
mov rsi, qword [rbx]
test rsi, rsi
je 0x14005da93
mov rcx, rsi
mov rax, qword [fcn.14005e6a0]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14005da70
test eax, eax
je 0x14005dab2
mov eax, 0xff
jmp 0x14005dc11
mov dword [0x1401544f4], edi
mov esi, 0x1f
mov eax, dword [0x140154d80]
cmp eax, edi
jne 0x14005dade
lea rdx, [0x140001080]
lea rcx, [section..text]
call sub.msvcrt.dll__initterm
mov dword [0x140154d80], 2
test r14d, r14d
jne 0x14005daed
mov rax, r15
xchg qword [0x140154d78], rax
cmp qword [0x140154d98], r15
je 0x14005db24
lea rcx, [0x140154d98]
call fcn.14005e510
test eax, eax
je 0x14005db24
mov rbx, qword [0x140154d98]
mov rcx, rbx
mov rax, qword [fcn.14005e6a0]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14005db3d
mov eax, 0xff
jmp 0x14005dc11
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14005dbc2
cmp word [rcx], r15w
je 0x14005db56
test edx, edx
jne 0x14005dbc2
movzx eax, word [rcx]
sub ax, di
cmp ax, si
ja 0x14005db6c
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14005db56
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14005ab54
mov dword [0x1401544f0], eax
cmp dword [0x140154510], r15d
jne 0x14005dbab
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1401544f4], r15d
jne 0x14005dbc0
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1401544f0]
jmp 0x14005dc11
cmp word [rcx], 0x22
jne 0x14005dbd6
mov eax, r15d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14005db46
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.14005e5a4
add rsp, 0x28
jmp 0x14005d9c0
Function at 0x14005dec8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]

Function at 0x14005e3fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005e448
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005e440
cmp dword [rcx + 0x3c], edx
jl 0x14005e440
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14005e440
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14005e448
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14005e5a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [section..data]
and qword [rbp + 0x18], 0
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jne 0x14005e65f
lea rcx, [rbp + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcessId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
mov eax, eax
shl rax, 0x18
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
lea rcx, [rbp + 0x10]
mov eax, eax
xor rax, qword [rbp + 0x10]
xor rax, rcx
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shl rax, 0x20
movabs rcx, 0xffffffffffff
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
mov qword [section..data], rax
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x140154008], rax
add rsp, 0x20
pop rbp
ret
Function at 0x14006e7fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
xor ebx, ebx
mov rbp, rdx
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov dword [r11 + 8], ebx
mov qword [r11 - 0x58], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14006e854
xor eax, eax
jmp 0x14006e8ce
mov esi, 1
cmp dword [rsp + 0x80], esi
jne 0x14006e8c2
mov ecx, 0x2000
mov dword [rsp + 0x90], 0x1000
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14006e850
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x90]
mov r8, rax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x14006e8b3
cmp word [rdi], bx
jne 0x14006e8b5
mov esi, ebx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x14006e8ce
cmp dword [rsp + 0x80], ebx
seta bl
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006f398
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.14006ef44
jmp 0x14006f403
lea rdx, [rsp + 0x70]
call fcn.14006f398
xor ecx, ecx
test eax, eax
mov ebx, eax
jne 0x14006f45e
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x40], 0x100
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
lea rcx, [rsp + 0x48]
test eax, eax
je 0x14006f3f9
call fcn.14006dd54
mov rdx, rsi
mov rcx, rdi
call fcn.14006e3a8
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.14006dd54
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14005dc70
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006f62c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rdi
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x20], rax
mov rbx, r9
mov rsi, r8
mov rax, rdx
xor edi, edi
mov qword [rbp], rdi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 8], rdi
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
jne 0x14006f6ad
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14006f831
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14006f831
xor r9d, r9d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov rbx, rax
test rax, rax
jne 0x14006f6e5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14006f827
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14006f827
mov rdx, rax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14006f6c7
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov rsi, r14
mov r12d, eax
movabs r13, 0xffffffffffffff0
cmp byte [r12 + r14], dil
je 0x14006f783
lea esi, [rax + 1]
cmp esi, 0x400
ja 0x14006f752
mov ebx, esi
mov ecx, esi
call fcn.1400707ac
test al, al
je 0x14006f752
lea rax, [rsi + 0xf]
cmp rax, rbx
ja 0x14006f73f
mov rax, r13
and rax, 0xfffffffffffffff0
call fcn.14005efb0
sub rsp, rax
lea rsi, [rsp + 0x30]
jmp 0x14006f762
mov ebx, esi
mov edx, esi
lea rcx, [rbp]
call fcn.14006dab0
mov rsi, rax
test rsi, rsi
jne 0x14006f771
mov ebx, 0x8007000e
jmp 0x14006f827
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov byte [r12 + rsi], dil
test rsi, rsi
je 0x14006f812
or r12, 0xffffffffffffffff
mov r14, r12
inc r14
cmp byte [rsi + r14], dil
jne 0x14006f793
inc r14d
movsxd rbx, r14d
add rbx, rbx
cmp rbx, 0x400
ja 0x14006f7d9
mov rcx, rbx
call fcn.1400707ac
test al, al
je 0x14006f7d9
lea rax, [rbx + 0xf]
cmp rax, rbx
ja 0x14006f7c6
mov rax, r13
and rax, 0xfffffffffffffff0
call fcn.14005efb0
sub rsp, rax
lea rbx, [rsp + 0x30]
jmp 0x14006f7e8
mov rdx, rbx
lea rcx, [rbp]
call fcn.14006dab0
mov rbx, rax
test rbx, rbx
je 0x14006f812
mov word [rbx], di
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov r9d, r12d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
neg eax
sbb rdi, rdi
and rdi, rbx
mov r8d, dword [rbp + 0x80]
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.14006f4a0
mov ebx, eax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
lea rcx, [rbp]
call fcn.14006cf00
mov eax, ebx
mov rcx, qword [rbp + 0x20]
xor rcx, rbp
call fcn.14005dc70
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400701e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp word [rdx], 0
mov r14, rdx
mov rbx, rcx
jne 0x14007020d
mov rax, rcx
jmp 0x140070299
cmp word [rcx], 0
je 0x140070297
cmp word [rbx], 0
mov rdi, rbx
mov rsi, r14
je 0x14007027f
cmp word [rsi], 0
je 0x1400702b4
movzx ecx, word [rdi]
movzx eax, word [rsi]
cmp ecx, eax
jne 0x14007027f
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rcx, rbp
sub rax, rsi
sub rcx, rdi
xor rax, rcx
test rax, 0xfffffffffffffffe
jne 0x14007027f
jmp 0x140070274
add rdi, 2
add rsi, 2
movzx ecx, word [rsi]
movzx eax, word [rdi]
cmp eax, ecx
je 0x140070279
cmp rdi, rbp
jb 0x140070262
cmp word [rdi], 0
jne 0x140070223
cmp word [rsi], 0
je 0x1400702b4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rbx, rax
cmp word [rax], 0
jne 0x140070217
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x140070299
Function at 0x140070844
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [0x140155000]
mov r15d, 1
test r15b, al
jne 0x14007089e
or eax, r15d
mov dword [0x140155000], eax
call fcn.140070740
mov dword [0x140155004], eax
mov eax, dword [rsp]
sub rsp, 0x10
lea rsi, [rsp + 0x20]
mov eax, dword [rsi]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualQuery]
test rax, rax
jne 0x1400708cb
xor eax, eax
jmp 0x140070998
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemInfo]
mov eax, dword [rbp + 0x3c]
mov ecx, dword [0x140154fc4]
lea edi, [rax - 1]
mov r14d, eax
mov edx, 0x11000
not rdi
and rdi, rsi
sub rdi, rax
cmp ecx, r15d
mov eax, 0x2000
cmove eax, edx
movsxd rsi, eax
add rsi, rbx
cmp rdi, rsi
jb 0x1400708c4
cmp ecx, r15d
je 0x140070978
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualQuery]
test rax, rax
je 0x1400708c4
add rbx, qword [rbp + 0x20]
test dword [rbp + 0x28], 0x1000
je 0x140070911
test dword [rbp + 0x2c], 0x100
mov rbx, qword [rbp + 8]
je 0x140070948
mov eax, r15d
jmp 0x140070998
cmp rdi, rbx
jb 0x1400708c4
cmp rbx, rsi
mov r9d, 4
mov r8d, 0x1000
cmovb rbx, rsi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualAlloc]
mov ecx, dword [0x140154fc4]
jmp 0x14007097b
mov rbx, rdi
cmp ecx, r15d
mov r8d, 0x104
lea r9, [rbp]
mov rdx, r14
mov rcx, rbx
cmove r8d, r15d
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualProtect]
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.14005dc70
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r15
pop r14
pop rbp
ret