joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402046f0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
lea rax, vtable.SystemInfo::ComputerID::CUIDGenerator.0
mov qword [rcx], rax
cmp qword [rcx + 8], 0
je 0x140204745
mov edx, 0x2710
call fcn.140204180
test al, al
jne 0x14020473b
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rbx + 0x20]
or esi, 0xffffffff
test rdi, rdi
je 0x14020476f
lock dec dword [rdi + 8]
jne 0x14020476f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock dec dword [rdi + 0xc]
jne 0x14020476f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14020478b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140208410
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov ebx, edx
mov rdi, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140207c20]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.14025682c
mov qword [rdi + 8], rax
test rax, rax
jne 0x140208453
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, ebx
mov rcx, rdi
call fcn.140204180
test al, al
je 0x140208446
lea rcx, [rsp + 0x50]
call fcn.1402020f0
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov rbx, rax
call fcn.1402036b0
mov r8, qword [rbx]
test r8, r8
jne 0x14020848e
mov ecx, 0x80004005
call fcn.140001290
int3
mov rax, qword [rax]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1402084a8
add rax, 2
test ecx, ecx
jne 0x140208494
test edx, edx
mov rdx, qword [rsp + 0x40]
setne dil
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402084d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x50]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1402084ee
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140217460
Capabilities:
Encode data using xor

Disassembly:
lea r8, [rcx + 8]
sub rdx, rcx
mov r9d, 4
nop dword [rax]
movzx eax, byte [rdx + r8]
add r8, 4
xor byte [r8 - 4], al
movzx eax, byte [rdx + r8 - 3]
xor byte [r8 - 3], al
movzx eax, byte [rdx + r8 - 2]
xor byte [r8 - 2], al
movzx eax, byte [rdx + r8 - 1]
xor byte [r8 - 1], al
dec r9
jne 0x140217470
mov rax, rcx
ret
Function at 0x140218694
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140442f00]
test rcx, rcx
jne 0x1402185eb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x1402185e4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140218616
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x1402185e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x140442f00], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x140218689
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140218639
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x140442f00]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x140218666
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x140218689
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x140442f00]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x14021866d
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x140218570

Function at 0x14021ad60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14042f50c]
cmp ecx, 0xffffffff
je 0x14021ae25
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14021ae25
mov ecx, dword [0x14042f50c]
mov qword [rsp + 0x20], rbx
xor ebx, ebx
cmp ecx, 0xffffffff
jne 0x14021ad98
mov eax, ebx
jmp 0x14021ada4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14042f50c]
cmp byte [rax + 0x90], bl
je 0x14021ae20
cmp ecx, 0xffffffff
je 0x14021ae20
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14021ae20
mov ecx, dword [0x14042f50c]
cmp ecx, 0xffffffff
jne 0x14021adcc
mov rax, rbx
jmp 0x14021add2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0x88]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14021ae20
mov ecx, dword [0x14042f50c]
cmp ecx, 0xffffffff
je 0x14021adf9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r11d, r11d
lea rdx, [0x1403dfaa8]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], r11b
call fcn.1402510b4
int3
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x14021b950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov ecx, dword [0x14042f50c]
cmp ecx, 0xffffffff
jne 0x14021b97b
xor ebp, ebp
jmp 0x14021b984
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov qword [rsp + 0x50], rbp
test rbp, rbp
je 0x14021bac4
cmp qword [rbp + 0x30], 0
jne 0x14021b9a6
cmp qword [rbp + 0x18], 0
je 0x14021ba9d
jmp 0x14021b9b0
cmp qword [rbp + 0x18], 0
je 0x14021ba06
nop dword [rax]
mov rdi, qword [rbp + 0x18]
mov rax, qword [rdi + 8]
mov qword [rbp + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x14021b9eb
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x18], 0
jne 0x14021b9b0
mov rsi, qword [rbp + 0x28]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x14021b992
mov rdi, rbx
cmp byte [rbx + 0x39], 0
jne 0x14021ba66
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x39], 0
jne 0x14021ba3f
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x39], 0
jne 0x14021ba66
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x39], 0
je 0x14021ba31
jmp 0x14021ba66
mov rax, qword [rbx + 8]
cmp byte [rax + 0x39], 0
jne 0x14021ba63
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x14021ba63
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x39], 0
je 0x14021ba50
mov rbx, rax
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14021ba7e
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x14021ba7e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.14006d4e0
cmp rbx, rsi
jne 0x14021ba12
jmp 0x14021b992
lea rdx, [0x14021a9b0]
lea rcx, [0x140443418]
call fcn.14021ab30
mov ecx, dword [0x14042f50c]
cmp ecx, 0xffffffff
je 0x14021bac4
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rbp, rbp
je 0x14021baee
lock dec dword [rbp + 8]
jne 0x14021baee
mov rax, qword [rbp]
xor edx, edx
mov rcx, rbp
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14021bb70
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
mov rdi, rcx
lea r8, [0x14021bb10]
lea rax, [r9 + 0x40]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call fcn.14025682c
mov rsi, rax
test rax, rax
jne 0x14021bbb4
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbx
add rax, 8
lock inc dword [rax]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14021bbdb
cmp rcx, 0xffffffffffffffff
je 0x14021bbdb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140232df0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r15, r9
mov rax, r8
mov r14, rdx
mov rsi, rcx
mov r12, qword [rbp + 0x250]
mov r13, qword [rbp + 0x258]
mov qword [rsp + 0x40], 7
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400342a0
nop
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140232ec6
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + rdi*2 - 2], 0x5c
je 0x140232ebd
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + rdi*2 - 2], 0x2f
je 0x140232ebd
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + rdi*2 - 2], 0x3a
jne 0x140232ec6
lea rdx, [0x1403557f8]
jmp 0x140232ecd
lea rdx, [0x140341014]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x28]
call fcn.1401fbcf0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x140232f3f
mov qword [r14], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140232f2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x140232f2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14021cd80
mov dword [rsi], ebx
mov qword [rsi + 8], rax
jmp 0x14023300a
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x54]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x54]
mov rcx, r15
call fcn.140034070
mov edx, dword [rbp - 0x80]
bt edx, 0xa
jae 0x140232f75
mov dword [r12], ebx
mov dword [r13], ebx
jmp 0x140232fff
test dl, 0x10
je 0x140232f8c
mov dword [r12], 3
mov dword [r13], 3
jmp 0x140232f9c
mov dword [r12], 2
mov dword [r13], 2
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x54]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x50]
call fcn.140034070
nop
mov edx, dword [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140232b00
mov dword [r12 + 4], eax
cmp qword [rsp + 0x68], 8
jb 0x140232ff6
mov rcx, qword [rsp + 0x50]
call fcn.140250354
mov eax, dword [r12 + 4]
mov dword [r13 + 4], eax
mov dword [rsi], ebx
call fcn.14021cd80
mov qword [rsi + 8], rax
cmp qword [rsp + 0x40], 8
jb 0x14023301c
mov rcx, qword [rsp + 0x28]
call fcn.140250354
mov rax, rsi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402337c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r12, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x140233804
mov rcx, qword [rdx]
jmp 0x140233807
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140233827
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.140233660
jmp 0x140233964
xor r13d, r13d
bt eax, 0xa
jae 0x140233922
cmp qword [rbx + 0x18], 8
jb 0x140233840
mov rdx, qword [rbx]
jmp 0x140233843
mov rdx, rbx
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r13
mov word [rsp + 0x50], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.140034070
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x68], 8
jb 0x1402338c4
mov rcx, qword [rsp + 0x50]
call fcn.140250354
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r13
mov word [rsp + 0x50], r13w
cmp rdi, 0xffffffffffffffff
jne 0x1402338ef
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.140233660
nop
jmp 0x140233964
mov rcx, rbx
call fcn.140232680
test al, al
jne 0x140233919
mov edx, ebp
mov rcx, rbx
call fcn.140232b00
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140233964
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140233935
mov dword [r12], r13d
call fcn.14021cd80
mov qword [r12 + 8], rax
mov edx, ebp
mov rcx, rbx
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x140233950
mov dword [rsp + 0x40], 2
call fcn.140232b00
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsi], rax
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140250fd0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140238a70
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
cmp rcx, rdx
je 0x140238aa8
mov r11d, 0x9e3779b9
movzx ecx, word [r10]
mov r8, r9
mov rax, r9
shr rax, 2
shl r8, 6
add r10, 2
add rax, r8
add rax, r11
add rcx, rax
xor r9, rcx
cmp r10, rdx
jne 0x140238a81
movabs rax, 0x200009c482fb3f8b
mul r9
shr rdx, 0x1c
imul edx, edx, 0x7fffd8ee
sub r9d, edx
lea eax, [r9 + 0x2710]
ret
Function at 0x14023ac30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
mov rdi, qword [0x140436c50]
mov r11, qword [str.alnumalphablankcntrldigitgraphlowerprintpunctspaceunicodeuppervwordxdigit]
mov r10, rdx
sub r11, rdi
mov r9, rcx
sar r11, 4
test r11, r11
jle 0x14023acea
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
nop word [rax + rax]
mov rax, r11
cqo
sub rax, rdx
sar rax, 1
mov rbp, rax
mov rsi, rax
mov rax, r9
add rbp, rbp
mov rbx, qword [rdi + rbp*8 + 8]
mov rcx, qword [rdi + rbp*8]
cmp rcx, rbx
je 0x14023acbd
cmp rax, r10
je 0x14023acb8
movzx edx, word [rcx]
movzx r8d, word [rax]
cmp r8w, dx
ja 0x14023acc2
jb 0x14023acd3
add rcx, 2
add rax, 2
cmp rcx, rbx
jne 0x14023ac95
jmp 0x14023acbd
cmp rcx, rbx
jne 0x14023acd3
cmp rax, r10
je 0x14023acd3
or rax, 0xffffffffffffffff
lea rdi, [rdi + rbp*8 + 0x10]
sub rax, rsi
add r11, rax
jmp 0x14023acd6
mov r11, rsi
test r11, r11
jg 0x14023ac70
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
cmp rdi, qword [str.alnumalphablankcntrldigitgraphlowerprintpunctspaceunicodeuppervwordxdigit]
je 0x14023ad49
mov r8, qword [rdi]
mov rcx, qword [rdi + 8]
mov rax, r10
sub rcx, r8
sub rax, r9
xor rcx, rax
test rcx, 0xfffffffffffffffe
jne 0x14023ad49
cmp r9, r10
je 0x14023ad37
sub r8, r9
nop word [rax + rax]
movzx edx, word [r9]
movzx ecx, word [r8 + r9]
add r9, 2
cmp dx, cx
jne 0x14023ad49
cmp r9, r10
jne 0x14023ad20
lea rax, str.alnumalphablankcntrldigitgraphlowerprintpunctspaceunicodeuppervwordxdigit
sub rdi, rax
sar rdi, 4
mov eax, edi
pop rdi
ret
or eax, 0xffffffff
pop rdi
ret
Function at 0x140240ed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r10d, r10d
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], r9d
mov rbx, rcx
cmp rdx, r8
je 0x140240f16
mov r11d, 0x9e3779b9
nop
movzx ecx, word [rdx]
mov r9, r10
mov rax, r10
shr rax, 2
shl r9, 6
add rdx, 2
add rax, r9
add rax, r11
add rcx, rax
xor r10, rcx
cmp rdx, r8
jne 0x140240ef0
mov rcx, qword [rbx + 8]
movabs rax, 0x200009c482fb3f8b
mul r10
lea rax, [rsp + 0x30]
shr rdx, 0x1c
imul edx, edx, 0x7fffd8ee
sub r10d, edx
add r10d, 0x2710
mov dword [rsp + 0x34], r10d
cmp rax, rcx
jae 0x140240f95
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
cmp rax, rdx
ja 0x140240f95
mov qword [rsp + 0x20], rdi
lea rdi, [rsp + 0x30]
sub rdi, rax
sar rdi, 3
cmp rcx, qword [rbx + 0x10]
jne 0x140240f7b
mov edx, 1
mov rcx, rbx
call fcn.14023b620
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140240f8e
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
mov qword [rdx], rcx
mov rdi, qword [rsp + 0x20]
jmp 0x140240fb9
cmp rcx, qword [rbx + 0x10]
jne 0x140240fa8
mov edx, 1
mov rcx, rbx
call fcn.14023b620
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140240fb9
mov rax, qword [rsp + 0x30]
mov qword [rcx], rax
add qword [rbx + 8], 8
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x38]
cmp rcx, rax
je 0x140241012
add rax, 0xfffffffffffffff8
cmp rax, rcx
je 0x140241012
lea r9, [rax - 4]
nop dword [rax]
mov edx, dword [r9]
cmp dword [r9 + 8], edx
jge 0x140241012
mov edx, dword [rax]
mov r8d, dword [r9 - 4]
sub rax, 8
mov dword [r9 - 4], edx
mov dword [rax + 8], r8d
mov edx, dword [r9 + 8]
mov r8d, dword [r9]
mov dword [r9], edx
sub r9, 8
mov dword [r9 + 0x10], r8d
cmp rax, rcx
jne 0x140240fe0
add rsp, 0x28
ret
Function at 0x14024f080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, 0x483
mov edx, 0x361
mov dword [rbp - 0x59], 0x3610300
mov word [rbp - 0x55], ax
mov eax, 0x486
mov dword [rbp - 0x51], 0x9030903
mov word [rbp - 0x53], ax
mov eax, 0x93e
mov dword [rbp - 0x39], 0x9d709d7
mov word [rbp - 0x4d], ax
mov eax, 0x940
mov dword [rbp - 0x31], 0xa830a83
mov word [rbp - 0x4b], ax
mov eax, 0x949
mov dword [rbp - 0x21], 0xb3e0b3e
mov word [rbp - 0x49], ax
mov eax, 0x94c
mov dword [rbp - 0x1d], 0xb400b40
mov word [rbp - 0x47], ax
mov eax, 0x982
mov dword [rbp - 0x15], 0xb570b57
mov word [rbp - 0x45], ax
mov eax, 0x983
mov dword [rbp - 0x11], 0xb830b83
mov word [rbp - 0x43], ax
mov eax, 0x9be
mov dword [rbp - 5], 0xbd70bd7
mov word [rbp - 0x41], ax
mov eax, 0x9c0
mov dword [rbp + 0xb], 0xcbe0cbe
mov word [rbp - 0x3f], ax
mov eax, 0x9c7
mov word [rbp - 0x3d], ax
mov eax, 0x9cc
mov word [rbp - 0x3b], ax
mov eax, 0xa3e
mov word [rbp - 0x35], ax
mov eax, 0xa40
mov word [rbp - 0x33], ax
mov eax, 0xabe
mov word [rbp - 0x2d], ax
mov eax, 0xac0
mov word [rbp - 0x2b], ax
mov eax, 0xac9
mov word [rbp - 0x29], ax
mov eax, 0xacc
mov word [rbp - 0x27], ax
mov eax, 0xb02
mov word [rbp - 0x25], ax
mov eax, 0xb03
mov word [rbp - 0x23], ax
mov eax, 0xb47
mov word [rbp - 0x19], ax
mov eax, 0xb4c
mov word [rbp - 0x17], ax
mov eax, 0xbbe
mov word [rbp - 0xd], ax
mov eax, 0xbbf
mov word [rbp - 0xb], ax
mov eax, 0xbc1
mov word [rbp - 9], ax
mov eax, 0xbcc
mov word [rbp - 7], ax
mov eax, 0xc01
mov word [rbp - 1], ax
mov eax, 0xc03
mov word [rbp + 1], ax
mov eax, 0xc41
mov word [rbp + 3], ax
mov eax, 0xc44
mov word [rbp + 5], ax
mov eax, 0xc82
mov word [rbp + 7], ax
mov eax, 0xc83
mov word [rbp + 9], ax
mov eax, 0xcc0
mov word [rbp + 0xf], ax
mov eax, 0xcc4
mov word [rbp + 0x11], ax
mov eax, 0xcc7
mov word [rbp + 0x13], ax
mov eax, 0xccb
mov dword [rbp + 0x27], 0xd570d57
mov dword [rbp + 0x2b], 0xf7f0f7f
mov word [rbp + 0x15], ax
mov eax, 0xcd5
mov dword [rbp + 0x3b], 0xffffffff
mov word [rbp + 0x17], ax
mov eax, 0xcd6
mov word [rbp + 0x19], ax
mov eax, 0xd02
mov word [rbp + 0x1b], ax
mov eax, 0xd03
mov word [rbp + 0x1d], ax
mov eax, 0xd3e
mov word [rbp + 0x1f], ax
mov eax, 0xd40
mov word [rbp + 0x21], ax
mov eax, 0xd46
mov word [rbp + 0x23], ax
mov eax, 0xd4c
mov word [rbp + 0x25], ax
mov eax, 0x20d0
mov word [rbp + 0x2f], ax
mov eax, 0x20e1
mov word [rbp + 0x31], ax
mov eax, 0x3099
mov word [rbp + 0x33], ax
mov eax, 0x309a
mov word [rbp + 0x35], ax
mov eax, 0xfe20
mov word [rbp + 0x37], ax
mov eax, 0xfe23
mov word [rbp + 0x39], ax
lea rax, [rbp - 0x57]
cmp dx, cx
jae 0x14024f2d0
add rax, 4
cmp word [rax], cx
jb 0x14024f2c7
sub rax, 2
cmp cx, word [rax]
jb 0x14024f2e3
cmp cx, word [rax + 2]
ja 0x14024f2e3
mov al, 1
jmp 0x14024f2e5
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0xb0
pop rbp
ret
Function at 0x14025d98f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140437340]
jne 0x140250fea
rol rcx, 0x10
test cx, 0xffff
jne 0x140250fe6
repz ret
ror rcx, 0x10
jmp 0x14025d8e8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140444040]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140444138]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14025d96d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140444040]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14025d98f
mov rax, qword [rsp + 0x88]
mov qword [0x140444138], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1404440d8], rax
mov rax, qword [0x140444138]
mov qword [0x140443fb0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1404440c0], rax
mov dword [0x140443fa0], 0xc0000409
mov dword [0x140443fa4], 1
mov rax, qword [0x140437340]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140437348]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140444038], eax
mov ecx, 1
call fcn.140274778
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14035a068]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140444038], 0
jne 0x14025da16
mov ecx, 1
call fcn.140274778
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14025de28
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14025dc98

Function at 0x140268438
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x140268462
call fcn.14025b35c
and dword [rax], 0
call fcn.14025b33c
mov ebx, 0x16
mov dword [rax], ebx
call fcn.14025d8c8
mov eax, ebx
jmp 0x1402684b2
test edx, 0xfffffff9
jne 0x140268445
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14026848b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14025b37c
call fcn.14025b33c
mov eax, dword [rax]
jmp 0x1402684b2
test al, 0x10
jne 0x1402684b0
test al, 1
je 0x1402684b0
test bl, 2
je 0x1402684b0
call fcn.14025b35c
mov dword [rax], 5
call fcn.14025b33c
mov dword [rax], 0xd
jmp 0x140268482
xor eax, eax
add rsp, 0x20
pop rbx
ret