joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e4e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x160
mov rsi, rcx
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x158], rax
test dl, dl
jne 0x14002e53d
xor ebx, ebx
cmp qword [rsi + 0x10], 0
jne 0x14002e59c
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14004ce20
mov eax, ebx
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x14004f7d0]
lea r8, str.NtMapViewOfSection
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.14002dd70
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [0x140050ab0]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.14002dd70
mov rax, qword [rsi]
mov r14, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, r14
xor edx, edx
mov r9d, 0x2000
call r13
mov r12, rax
mov rdi, qword [rsi + 0x10]
shl rdi, 6
lea r15, [rdi + 0x60]
mov rcx, r15
call fcn.14002dab0
mov rbx, rax
and rax, 0xfffffffffffff000
lea rdx, [rax + r12]
and ebx, 0xfff
add rdi, 0x105f
and rdi, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, r14
mov r8, rdi
mov r9d, 0x1000
call r13
mov rdi, rax
test rax, rax
jne 0x14002e645
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea r9, str.thunk_base
lea r12, [rsp + 0x40]
mov rcx, r12
mov r8d, 0x188
call fcn.140016b00
mov rcx, r12
call fcn.140016c00
add rdi, rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0x20
lea rcx, [sym.firefox.exe_g_originals]
mov r8d, 0x150
xor edx, edx
call sub.ntdll.dll_memset
lea r9, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
mov r8, r15
call fcn.14002e9e0
mov ebx, eax
test eax, eax
jne 0x14002e518
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov r9d, 0x20
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x14002e518
cmp qword [rsp + 0x38], 0x20
jne 0x14002e518
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsi]
lea rdx, str.g_originals
lea r8, [sym.firefox.exe_g_originals]
mov r9d, 0x150
call fcn.140044c60
mov ebx, eax
jmp 0x14002e518
Function at 0x1400308b0
Capabilities:
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, qword [rsp + 0xb8]
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rbx], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140030993
mov eax, dword [rsp + 0xb0]
mov edi, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0xa0]
mov r10d, dword [rsp + 0x98]
mov r11d, dword [rsp + 0x90]
cmp qword [r8 + 0x18], 7
jbe 0x140030912
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r11d
mov r9d, r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x1400309aa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, qword [rsp + 0x40]
mov qword [rbx], rcx
xor eax, eax
cmp rcx, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004ce20
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov rcx, 0xffffffffffffffff
jmp 0x140030984

Function at 0x1400359e0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.14001a9f0
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140035a4a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140039b30
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 5]
mov ebp, 5
cmp eax, 1
jbe 0x140039b8a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14004ce20
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, r8
mov r15, rdx
mov rbp, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 7
jbe 0x140039be0
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov r14, rax
mov rax, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 7
jbe 0x140039bfb
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove rbp, rax
cmp qword [rsi + 0x18], 7
jbe 0x140039c14
mov rsi, qword [rsi]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x140039cf2
cmp edi, 6
mov r12d, 0x1fffff
mov esi, 0x101c01
cmove esi, r12d
mov r13, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r13
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rsi, qword [rbx + 8]
test eax, eax
je 0x140039d09
add rbx, 8
cmp edi, 6
mov edi, 0x100c43
cmove edi, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rsi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test r14, r14
je 0x140039b64
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
jmp 0x140039b64
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
jne 0x140039cfb
jmp 0x140039b64
Function at 0x140039d20
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140039db7
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x14003bd40
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov ebx, 0x3f0
cmp byte [rcx + 0x6c], 0
jne 0x14003bd96
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004ce20
mov eax, ebx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rdx
mov rdi, rcx
lea rdx, [rcx + 0x60]
lea rcx, [rsp + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 2
call fcn.14003bf00
mov r12, qword [rsp + 0x28]
test r12, r12
je 0x14003bddd
cmp dword [r12], 0
je 0x14003bee8
lea r13, [r12 + 8]
xor r14d, r14d
lea rax, [rdi + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x14003be11
mov ebx, dword [rsp + 0x34]
jmp 0x14003bd70
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x38]
call fcn.140023350
nop word cs:[rax + rax]
nop dword [rax]
add r14, 1
mov eax, dword [r12]
cmp r14, rax
jae 0x14003bee8
mov rbp, r14
shl rbp, 4
test dword [r13 + rbp + 8], 0xc0000020
jne 0x14003be00
add rbp, r13
test rsi, rsi
je 0x14003be34
mov rax, qword [rsi]
cmp qword [rsi + 8], rax
jne 0x14003be80
mov rdx, qword [rbp]
lea rcx, [rsp + 0x38]
call fcn.1400424b0
mov rax, qword [rdi + 0x38]
mov rdx, qword [rdi + 0x40]
cmp rdx, rax
je 0x14003bde3
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x40], ecx
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add qword [rdi + 0x38], 0x44
jmp 0x14003be00
mov r15d, 1
xor ecx, ecx
nop dword [rax + rax]
mov rbx, qword [rbp]
mov rdx, rcx
shl rdx, 6
lea rcx, [rdx + rcx*4]
add rcx, rax
call fcn.140042960
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14003be00
mov ecx, r15d
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, rax
sar rdx, 2
movabs rbx, 0xf0f0f0f0f0f0f0f1
imul rdx, rbx
add r15d, 1
cmp rdx, rcx
ja 0x14003be90
jmp 0x14003be34
mov rcx, r12
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
xor ebx, ebx
jmp 0x14003bd70
Function at 0x140041020
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret

Function at 0x140044740
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140021880
test al, al
je 0x14004476e
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14004478f
mov rcx, rdi
call fcn.140041bd0
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsi + 0x58]
call fcn.140017e80
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x1400447a7
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x1400447c0
mov rcx, rdi
call fcn.140041bd0
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsi + 0x28]
call fcn.14001a980
lea rcx, [rsi + 0x20]
call fcn.14001a980
lea rcx, [rsi + 0x18]
call fcn.14001a980
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140021840
Function at 0x140045000
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140021880
test al, al
je 0x140045022
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret
Function at 0x140045eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x250
mov rdi, rcx
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x248], rax
call fcn.140045b60
mov ebx, 0x1126
test al, al
je 0x140045f08
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14004ce20
mov eax, ebx
add rsp, 0x250
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movaps xmm0, xmmword [0x14004e2b0]
movups xmmword [rsp + 0x238], xmm0
mov word [rsp + 0x228], 0
lea rsi, [rsp + 0x228]
mov rcx, rdi
mov rdx, rsi
call fcn.140046160
mov ebp, eax
mov rcx, rsi
call fcn.140046250
mov ebx, eax
mov rcx, rsi
mov rdx, rsi
call fcn.140046290
mov edi, eax
test bpl, bpl
jne 0x140045f5f
test bl, bl
jne 0x140045f5f
test dil, dil
je 0x14004610a
test bl, bl
je 0x140046111
cmp qword [rsp + 0x240], 7
jbe 0x140045f7a
mov rsi, qword [rsp + 0x228]
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140046141
lea rdi, [rsp + 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
add rsi, 0xffffffffffffffff
cmp qword [rsp + 0x240], 7
jbe 0x140045fbf
mov rcx, qword [rsp + 0x228]
jmp 0x140045fc7
lea rcx, [rsp + 0x228]
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14004610a
lea r12, [rsp + 0x228]
mov r15, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp qword [rsp + 0x240], 7
mov rcx, r12
jbe 0x140046016
mov rcx, qword [rsp + 0x228]
call r15
cmp eax, 0xffffffff
je 0x140046092
test eax, 0x400
jne 0x140046106
mov rcx, qword [rsp + 0x238]
cmp qword [rsp + 0x240], 7
mov rax, r12
jbe 0x140046047
mov rax, qword [rsp + 0x228]
mov rbx, 0xffffffffffffffff
test rcx, rcx
je 0x14004606c
lea rdx, [rax + rcx*2]
add rdx, 0xfffffffffffffffe
cmp word [rax + rcx*2 - 2], 0x5c
jne 0x1400460a6
sub rdx, rax
sar rdx, 1
mov rbx, rdx
mov rdx, rbx
sub rdx, rcx
ja 0x1400460d6
mov qword [rsp + 0x238], rbx
mov word [rax + rbx*2], 0
cmp qword [rsp + 0x238], rsi
ja 0x140046000
jmp 0x1400460ef
call r14
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 3
jb 0x140046029
cmp ebx, 0x7b
je 0x140046029
jmp 0x1400460f4
lea rdi, [rcx + rcx]
mov ebp, 2
sub rbp, rdi
nop word cs:[rax + rax]
nop dword [rax]
test rbp, rbp
je 0x14004606c
add rbp, 2
cmp word [rdx - 2], 0x5c
lea rdx, [rdx - 2]
jne 0x1400460c0
jmp 0x140046063
mov rcx, r12
xor r8d, r8d
call fcn.140016560
cmp qword [rsp + 0x238], rsi
ja 0x140046000
mov ebx, 0x1126
lea rcx, [rsp + 0x228]
call fcn.140011c10
jmp 0x140045ee4
xor ebx, ebx
jmp 0x1400460f4
mov ebx, 0x7b
jmp 0x1400460f4
lea r8, str.._
lea rcx, [rsp + 0x228]
mov r9d, 4
xor edx, edx
call fcn.14002a310
cmp qword [rsp + 0x240], 7
ja 0x140045f72
jmp 0x140045f7a
test dil, dil
mov eax, 0x1126
mov ebx, 0x7b
cmovne ebx, eax
jmp 0x1400460f4
Function at 0x140047cb0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140047cef
call fcn.140020ca0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ce20
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [str.kernel32]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x14005d918], 0
jne 0x140047d2d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14005d918], rax
mov qword [rsp + 0x28], 0
lea rax, [0x14005d968]
mov qword [rsp + 0x30], rax
lea rsi, [0x14005d8f8]
mov qword [rsp + 0x38], rsi
lea rax, [0x14005122b]
mov qword [rsp + 0x40], rax
lea rax, [0x140047e10]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], 0
lea rcx, [0x14005d970]
lea rdx, [0x140047e90]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140047cd6
cmp qword [rsp + 0x28], 0
je 0x140047cd6
mov qword [rsp + 0x28], 0
lea rax, [0x14005d978]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
lea rax, [0x14005121b]
mov qword [rsp + 0x40], rax
lea rax, [0x140047e30]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], 0
lea rcx, [0x14005d980]
lea rdx, [0x140047e90]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140047cd6
cmp qword [rsp + 0x28], 0
jne 0x140047cdb
jmp 0x140047cd6
Function at 0x140048350
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rsi, r9
mov r14, r8
mov r8, rdx
mov rdi, rcx
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0xb8]
call fcn.1400484e0
mov r8d, dword [rdi + 0x18]
and r8d, 1
shl r8, 0x1e
lea rdx, [rsp + 0xa0]
mov rcx, rdi
mov r9d, r8d
call fcn.14004a470
cmp byte [rsp + 0xb0], 0
je 0x1400484d3
call fcn.14004a540
lea rbx, [0x14005d998]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x68]
call fcn.14004ae90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0x98], 0
je 0x1400484d7
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x48], xmm0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x8c]
mov qword [rsp + 0x5c], rax
mov al, byte [rsp + 0x94]
mov byte [rsp + 0x64], al
mov dword [rsp + 0x70], 0
mov byte [rsp + 0x94], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0xb8]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0x38]
mov rcx, rdi
call fcn.140048690
cmp qword [rsi], 0
setne sil
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400484aa
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x1400484aa
lea rdi, [rsp + 0x40]
mov edx, dword [rsp + 0x60]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x64], 0
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
lea rcx, [rsp + 0x68]
call fcn.14000b740
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14004ce20
mov eax, esi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor esi, esi
jmp 0x1400484b4
xor esi, esi
jmp 0x1400484aa
Function at 0x14004ae90
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, dword [rcx + 0x18]
shl ebx, 7
mov edx, ebx
call fcn.14004afd0
test al, al
je 0x14004af8a
mov ecx, ebx
add rcx, qword [rdi + 8]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0x80
mov byte [rsp + 0x54], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14004afa2
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x14004afaf
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
mov cl, byte [rsp + 0x54]
test cl, cl
je 0x14004af48
test rdx, rdx
je 0x14004af48
test rbx, rbx
je 0x14004af48
test eax, eax
je 0x14004af48
add dword [rdi + 0x18], 1
mov qword [rsi], r8
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbx
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], cl
mov byte [rsi + 0x30], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ce20
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x30], 0
jmp 0x14004af72
mov dword [rsp + 0x30], 0
jmp 0x14004af12
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov cl, byte [rsp + 0x54]
jmp 0x14004af44
Function at 0x14004b850
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov qword [rcx], rdx
movaps xmm0, xmmword [0x14004e2f0]
movups xmmword [rcx + 0x10], xmm0
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
lea rcx, [rdx + 1]
call fcn.140009340
lea rcx, [rdi + rbx]
add rcx, 0xffffffffffffffff
mov r14d, eax
mov rax, rcx
xor edx, edx
div r14
mov r13, rax
mov rax, rdi
xor edx, edx
div r14
sub r13, rax
inc r13
je 0x14004b921
mov rdi, rax
imul rdi, r14
xor ebx, ebx
lea r15, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rsi + 8]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8d, 0x40
mov r9, r15
call rbp
test eax, eax
je 0x14004b942
mov r12d, dword [rsp + 0x2c]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x14004b954
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r12d
mov qword [rcx + rax + 8], rdi
add qword [rsi + 0x10], 1
add rbx, 1
add rdi, r14
cmp rbx, r13
jb 0x14004b8db
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004ce20
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x2c], 0
mov rcx, rsi
call fcn.14004b970
jmp 0x14004b921
mov edx, 1
mov rcx, qword [rsp + 0x20]
call fcn.14000da90
test al, al
je 0x14004b94a
mov rax, qword [rsi + 0x10]
jmp 0x14004b8ff
Function at 0x1400033b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400033fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400033fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400033fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400033fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400033fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400033fc
xor al, al
add rsp, 0x28
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov byte [rbx - 0x50], cl
stc
invalid
Function at 0x6f502950
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x6f7534a0]
mov r10, qword [rax]
mov qword [rsp + 0x28], r10
xor r10d, r10d
mov r11, qword [rsp + 0x28]
xor r11, qword [rax]
jne 0x6f502984
mov r9, r8
mov r8, rdx
mov edx, 0xe
add rsp, 0x38
jmp dbg.AES_encrypt
call sym.__stack_chk_fail
nop
nop word [rax + rax]

Function at 0x6f502990
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x6f7534a0]
mov r10, qword [rax]
mov qword [rsp + 0x28], r10
xor r10d, r10d
mov r11, qword [rsp + 0x28]
xor r11, qword [rax]
jne 0x6f5029c5
mov r9d, 0xe
mov r8d, 8
add rsp, 0x38
jmp dbg.AES_setup
call sym.__stack_chk_fail
nop
nop
nop dword [rax]

Function at 0x6f502a00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x6f7534a0]
mov r10, qword [rax]
mov qword [rsp + 0x28], r10
xor r10d, r10d
mov r11, qword [rsp + 0x28]
xor r11, qword [rax]
jne 0x6f502a34
mov r9, r8
mov r8, rdx
mov edx, 0xe
add rsp, 0x38
jmp dbg.AES_decrypt
call sym.__stack_chk_fail
nop
nop word [rax + rax]