joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x140003e43
sbb eax, eax
or eax, 1
jmp 0x1400041f2
xor eax, eax
jmp 0x1400041f2
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x140007785
test eax, eax
jne 0x140008be5
jmp 0x14000845c
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000316c
jmp 0x1400089e4
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jb 0x14000576f
jmp 0x140008ab0
movzx eax, word [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x1a8]
sub rcx, rax
jmp 0x1400044d2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jae 0x140008ab0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x28], ax
jmp 0x1400055b0
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0
jmp 0x14000857f
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x140006bdd
mov rax, qword [rsp + 0x80]
jmp 0x140004907
inc rax
test dl, dl
jne 0x1400044d2
jmp 0x140003795
jmp 0x140005753
Function at 0x140004ecc
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x24], 0
jmp 0x140007e5c
mov dword [rsp + 0x28], 0
jmp 0x14000558b
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x1400050c2
cmp qword [rsp + 0x38], 0
jne 0x140007f96
jmp 0x1400092b1
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x14000497e
jmp 0x14000442f
cmp qword [rsp + 0x38], 0
je 0x140008c94
jmp 0x140004bf5
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
jmp 0x140007e33
mov eax, 1
jmp 0x140002e0a
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
jne 0x140007e33
jmp 0x140004771
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
jne 0x140006c8b
jmp 0x140002966
mov dword [rsp + 0x28], 1
jmp 0x14000558b
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x48]
jmp 0x14000458b
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
je 0x14000891f
jmp 0x140006576
mov eax, 1
jmp 0x140002e0a
mov dword [rsp + 0x2c], 1
jmp 0x1400030c8
mov dword [rsp + 0x24], 1
jmp 0x140007e5c
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 8]
cmp qword [rax], rcx
jne 0x140005a21
jmp 0x140008215
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
je 0x140004771
jmp 0x140004c95
mov eax, 1
jmp 0x140002e0a
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x140002edd
jmp 0x140004ef3
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
jne 0x14000789a
jmp 0x140004ec1
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
je 0x140007ded
jmp 0x140004771
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
jne 0x1400081f8
jmp 0x140004c48
mov dword [rsp + 0x2c], 0
jmp 0x1400030c8
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x14008500e]
jmp 0x140007e33
Function at 0x1400063aa
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140006015
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
add byte [rax], al
add byte [rax - 0x75], cl
or dword [rdi], ecx
mov bh, 0x49
adc al, 0x48
lea eax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140002a22
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jge 0x140006ff6
jmp 0x140002c90
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x1400055e8

Function at 0x1400077e2
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x140007733
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x140004407
Function at 0x14000785a
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
and eax, 1
test eax, eax
jne 0x140003193
jmp 0x14000822c
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
mov ecx, 0xc1
call qword [0x14007e8b7]
xor eax, eax
jmp 0x14000712a
mov ecx, 0xc1
call qword [0x14007e9ff]
xor eax, eax
jmp 0x14000712a
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x100]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x140009654
jmp 0x14000475f
test eax, eax
je 0x1400047d0
jmp 0x140003747
xor eax, eax
jmp 0x14000712a
mov ecx, 0xc1
call qword [0x14007fec6]
xor eax, eax
jmp 0x14000712a
xor eax, eax
jmp 0x14000712a
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
add rax, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0x108]
call fcn.1400035f5
jmp 0x140004693
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov edx, 0x40
mov rcx, qword [rsp + 0x108]
call fcn.1400035f5
jmp 0x140009019
add rsp, 0xe8
pop rdi
pop rsi
ret
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
jmp 0x140005bbe
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x48], 0
jmp 0x140002973
mov ecx, 0xc1
call qword [0x1400845d5]
xor eax, eax
jmp 0x14000712a
test eax, eax
je 0x140004711
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400050fb
jmp 0x140008e09
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 4]
cmp eax, 0x8664
jne 0x1400032ba
jmp 0x140002910
Function at 0x1400085a1
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x24], 0
jmp 0x140007e5c
mov dword [rsp + 0x28], 0
jmp 0x14000558b
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x1400050c2
cmp qword [rsp + 0x38], 0
jne 0x140007f96
jmp 0x1400092b1
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x14000497e
jmp 0x14000442f
cmp qword [rsp + 0x38], 0
je 0x140008c94
jmp 0x140004bf5
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
jmp 0x140007e33
mov eax, 1
jmp 0x140002e0a
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
jne 0x140007e33
jmp 0x140004771
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
jne 0x140006c8b
jmp 0x140002966
mov dword [rsp + 0x28], 1
jmp 0x14000558b
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x48]
jmp 0x14000458b
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
je 0x14000891f
jmp 0x140006576
mov eax, 1
jmp 0x140002e0a
mov dword [rsp + 0x2c], 1
jmp 0x1400030c8
mov dword [rsp + 0x24], 1
jmp 0x140007e5c
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 8]
cmp qword [rax], rcx
jne 0x140005a21
jmp 0x140008215
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
je 0x140004771
jmp 0x140004c95
mov eax, 1
jmp 0x140002e0a
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x140002edd
jmp 0x140004ef3
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
jne 0x14000789a
jmp 0x140004ec1
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
je 0x140007ded
jmp 0x140004771
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
jne 0x1400081f8
jmp 0x140004c48
mov dword [rsp + 0x2c], 0
jmp 0x1400030c8
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x14008500e]
jmp 0x140007e33
Function at 0x140015b20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rsi, rcx
movzx ecx, word [rcx + 0x1c]
movzx r11d, r15w
mov r14, r9
mov ebp, r8d
mov r10d, 0x20
movzx eax, word [rsi + 0x1a]
sub r10w, cx
and ax, dx
shr edx, cl
xor r11w, ax
test r10w, r10w
jg 0x140015b52
mov rdi, qword [rsi + 0x10]
movzx ebx, r11w
add rbx, rbx
mov rcx, qword [rdi + rbx*8 + 8]
test rcx, rcx
jne 0x140015bab
movzx ecx, word [rsi + 0x1e]
shl rcx, 2
call fcn.1400040dc
mov qword [rdi + rbx*8 + 8], rax
mov rcx, rax
test rax, rax
je 0x140015bcf
mov dword [rdi + rbx*8], r15d
movzx r8d, word [rsi + 0x1e]
mov dword [rdi + rbx*8 + 4], r8d
mov eax, r15d
jmp 0x140015bb3
mov eax, dword [rdi + rbx*8]
mov r8d, dword [rdi + rbx*8 + 4]
cmp eax, r8d
jne 0x140015be3
movzx edx, word [rsi + 0x1e]
add edx, r8d
shl edx, 2
call fcn.140004314
mov rcx, rax
test rax, rax
jne 0x140015bd3
xor al, al
jmp 0x140015bfd
mov qword [rdi + rbx*8 + 8], rax
movzx eax, word [rsi + 0x1e]
add dword [rdi + rbx*8 + 4], eax
mov eax, dword [rdi + rbx*8]
mov dword [rcx + rax*4], ebp
mov al, 1
mov rcx, qword [rdi + rbx*8 + 8]
inc dword [rdi + rbx*8]
mov edx, dword [rdi + rbx*8]
mov qword [r14], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rcx], edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400359c0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140098070]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [rsp + 0x2a0]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.REGISTRYMACHINESYSTEMCurrentControlSetControlSession_Manager
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Session_Manager
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
test eax, eax
js 0x140035a64
mov eax, dword [rsp + 0x2a8]
lea r8, str.BootExecute
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x50]
mov r9d, 7
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14008d590
add rsp, 0x270
pop rbx
ret

Function at 0x140039ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x18], 0xc
mov r9, rdx
jbe 0x140039ef0
mov r10, qword [rcx + 0x10]
movzx r8d, byte [r10 + 9]
movzx edx, word [r10 + 0xa]
lea eax, [rdx + r8*2]
cmp eax, dword [rcx + 0x18]
ja 0x140039ef0
test r8b, r8b
je 0x140039ef0
add rdx, r10
mov rcx, r9
jmp fcn.140002914
lea rdx, [0x14008fb54]
mov rcx, r9
jmp fcn.140002980
Function at 0x14003d3f8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov r8d, 1
add rdx, 0x40
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
lea rdx, [rdi + 0x41]
mov r8d, 1
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov r8d, 8
mov rdx, rdi
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
movzx r8d, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
add r8d, r8d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x38]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003d4a4
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rdx, rcx
mov ebx, 0x18
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
cmp byte [0x14009b641], 2
jb 0x14003d4e4
test dword [rdi + 0x30], 0x400
jne 0x14003d4e9
mov ebx, 0x16
lea rdx, [rdi + 0x20]
mov r8d, ebx
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140060538
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [r9], 0
test rdx, rdx
jne 0x14006054d
lea rdx, str._MFT
jmp 0x140060613
mov eax, 1
cmp rdx, rax
jne 0x140060563
lea rdx, str._MFTMirr
jmp 0x140060613
cmp rdx, 2
jne 0x140060575
lea rdx, str._LogFile
jmp 0x140060613
cmp rdx, 3
jne 0x140060587
lea rdx, [0x1400921f8]
jmp 0x140060613
cmp rdx, 4
jne 0x140060596
lea rdx, str._AttrDef
jmp 0x140060613
cmp rdx, 5
jne 0x1400605a5
lea rdx, [0x14009012c]
jmp 0x140060613
cmp rdx, 6
jne 0x1400605b4
lea rdx, str._Bitmap
jmp 0x140060613
cmp rdx, 7
jne 0x1400605c3
lea rdx, str._Boot
jmp 0x140060613
cmp rdx, 8
jne 0x1400605d2
lea rdx, str._BadClus
jmp 0x140060613
cmp rdx, 9
jne 0x1400605f2
cmp cl, 2
mov rcx, r8
jb 0x1400605e9
lea rdx, str._Secure
jmp 0x140060616
lea rdx, [0x140091eb8]
jmp 0x140060616
cmp rdx, 0xa
jne 0x140060601
lea rdx, str._UpCase
jmp 0x140060613
cmp rdx, 0xb
jne 0x14006061b
cmp cl, 2
jb 0x14006061b
lea rdx, [0x140092240]
mov rcx, r8
jmp fcn.140002980
mov byte [r9], al
ret

Function at 0x14007de80
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rsp + 0x50]
mov rbx, r8
test eax, eax
je 0x14007deb7
cmp eax, 2
jne 0x14007debc
cmp r9d, 4
jne 0x14007debc
mov r8d, edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
cmp eax, dword [rbx]
sete al
jmp 0x14007dec2
test r9d, r9d
je 0x14007dec0
xor al, al
jmp 0x14007dec2
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140002780
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x1400027ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400027ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027cc
xor al, al
add rsp, 0x28
ret
Function at 0x180001010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov rbp, rdx
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtMapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
mov qword [rsp + 0x58], 0x1000
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], 0x8000000
xor r8d, r8d
mov edx, 0xe
mov dword [rsp + 0x20], 0x40
mov rcx, rsi
mov qword [rsp + 0x50], 0x1000
mov rdi, rax
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rsi]
xor r9d, r9d
mov dword [rsp + 0x48], 4
mov rdx, rax
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x38], 2
mov r8, rbp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800013b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180001120
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xc8]
mov rbx, rcx
mov r15, qword [rsp + 0xc0]
lea rcx, str.ntdll
mov rsi, r9
mov qword [rsp + 0x50], 0x1000
mov r12, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtMapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x48], 0x20
xor ebp, ebp
mov dword [rsp + 0x40], ebp
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov r8, rsi
mov qword [rsp + 0x30], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call rax
mov rcx, r14
call fcn.1800013d0
mov rcx, qword [r12]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
cmp r14, 0x40
jb 0x18000123f
movdqa xmm2, xmmword [0x1800032d0]
lea rcx, [r15 + 0x20]
mov rdx, r14
and rdx, 0xffffffffffffffc0
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
add ebp, 0x40
lea rcx, [rcx + 0x40]
movdqa xmm1, xmm2
movsxd rax, ebp
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rcx - 0x50], xmm0
movdqu xmm0, xmmword [rcx - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp rax, rdx
jb 0x1800011f0
movsxd rax, ebp
cmp rax, r14
jae 0x180001261
add rax, r15
nop word [rax + rax]
xor byte [rax], 0x17
lea rax, [rax + 1]
inc ebp
movsxd rdx, ebp
cmp rdx, r14
jb 0x180001250
mov ecx, 0x13f3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [r12]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
test r14, r14
je 0x18000128d
movsxd r8, r14d
xor edx, edx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800013b0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40173f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov ecx, dword [rbp + 0x10]
call fcn.0040161d
mov qword [rbp - 8], rax
mov edx, dword [rbp + 0x20]
mov rax, qword [rbp - 8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x4017a9
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.____Error_allocating_memory_in_process:__ld__n
call fcn.00401560
mov r9d, dword [rbp + 0x20]
mov r8, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
je 0x4017de
mov edx, dword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
cmp rdx, rax
je 0x4017f5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.____Error_writing_data_to_process:__ld_n
call fcn.00401560
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
add rsp, 0x50
pop rbp
ret

Function at 0x401872
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
lea rcx, str.ntdll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.CsrClientCallServer
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4018b5
mov eax, 0xffffffff
jmp 0x40196c
mov byte [rbp - 0xe], 0x33
mov byte [rbp - 0xd], 0xc0
mov byte [rbp - 0xc], 0x89
mov byte [rbp - 0xb], 0x41
mov byte [rbp - 0xa], 0x34
mov byte [rbp - 9], 0xc3
lea rdx, [rbp - 0x14]
mov rax, qword [rbp - 8]
mov r9, rdx
mov r8d, 0x40
mov edx, 6
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
je 0x401967
cmp dword [rbp + 0x10], 0
jne 0x401925
mov rax, qword [rbp - 8]
mov r8d, 6
mov rdx, rax
lea rcx, [0x0040b060]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 8]
mov edx, dword [rbp - 0xe]
mov dword [rax], edx
movzx edx, word [rbp - 0xa]
mov word [rax + 4], dx
jmp 0x40193e
mov rax, qword [rbp - 8]
mov r8d, 6
lea rdx, [0x0040b060]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov edx, dword [rbp - 0x14]
lea rcx, [rbp - 0x14]
mov rax, qword [rbp - 8]
mov r9, rcx
mov r8d, edx
mov edx, 6
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov eax, 0
jmp 0x40196c
mov eax, 0xffffffff
add rsp, 0x40
pop rbp
ret