joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003cf44
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x1f0
mov rax, qword [0x1000700c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
cmp dword [rcx], 2
mov rbx, rcx
jne 0x10003d15f
cmp dword [rcx + 0x10], 0
jle 0x10003d15f
mov r9d, dword [rcx + 0x14]
xor edi, edi
xor esi, esi
and dword [rsp + 0x5c], esi
lea r13d, [rdi + 0x10]
lea r8, str._08x
lea rcx, [rsp + 0x80]
xor ebp, ebp
mov rdx, r13
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x54], rsi
mov dword [rsp + 0x64], r9d
mov dword [rsp + 0x60], ebp
call fcn.10000a254
test eax, eax
js 0x10003cfe8
lea r8, [rsp + 0x80]
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
lea rcx, [rsp + 0x50]
call fcn.10000adc0
mov ebp, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x54]
mov edi, dword [rsp + 0x50]
jmp 0x10003cfea
xor al, al
test al, al
je 0x10003d001
cmp edi, dword [rbx]
jne 0x10003d001
cmp rsi, qword [rbx + 4]
jne 0x10003d001
cmp ebp, dword [rbx + 0x10]
je 0x10003d15f
mov r9d, dword [rbx + 0x14]
lea r8, [0x10005be28]
lea rcx, [rsp + 0xc0]
mov rdx, r13
call fcn.10000a254
test eax, eax
js 0x10003d15f
mov r9d, dword [rbx + 0x10]
lea r8, [0x100055cf0]
lea rcx, [rsp + 0xa0]
mov rdx, r13
call fcn.10000a254
test eax, eax
js 0x10003d15f
mov rax, qword [rbx + 4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
imul rax, rax, 0x2710
mov dword [rsp + 0x68], eax
shr rax, 0x20
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x10003d15f
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x10003d15f
lea rax, [rsp + 0xe0]
lea r8, [rsp + 0x50]
xor r9d, r9d
xor edx, edx
mov ecx, 0x800
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
jle 0x10003d15f
lea rax, [0x1000541b8]
lea rdx, str.Windows_Search_Service
xor ecx, ecx
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x98], rax
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x10003d15f
and qword [rsp + 0x40], 0
mov ecx, 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], 0
lea edx, [rcx - 2]
lea r8d, [rcx - 3]
mov rcx, rbx
mov r9d, 0x800003f7
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.100001250
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret
Function at 0x10003e714
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov edi, r9d
mov rsi, r8
mov r12d, edx
mov rbx, rcx
call sub.KERNEL32.dll_GetLastError
mov r13d, eax
test r12b, 2
je 0x10003e74f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebp, 1
test bpl, r12b
je 0x10003e80f
cmp qword [rbx + 0xc0], 0
je 0x10003e80f
test edi, edi
jne 0x10003e784
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
mov rdi, rcx
mov ecx, dword [rbx + 0xc8]
add edi, edi
mov edx, 0x7ffe2
lea eax, [rcx + rdi]
cmp eax, edx
jbe 0x10003e7f1
cmp edi, edx
jbe 0x10003e7a3
cmp ecx, 0x10
je 0x10003e7af
xor ebp, ebp
mov rcx, rbx
call fcn.10003eb1c
test ebp, ebp
jne 0x10003e7f1
lea rdx, str.d:w7rtmendusermssearch2common_tracer_tracmain.h
lea rcx, [rsp + 0x40]
mov r9d, 0x80070057
mov r8d, 0xe6
call fcn.100031080
lea rcx, [rsp + 0x20]
mov r8d, 0x20
mov rdx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005db70]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
mov ecx, dword [rbx + 0xc8]
mov r8d, edi
mov rdx, rsi
add rcx, qword [rbx + 0xc0]
call sub.msvcrt.dll_memcpy
add dword [rbx + 0xc8], edi
test r12b, 8
je 0x10003e830
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x10005c13c]
mov r8, rsi
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
test r12b, 4
je 0x10003e851
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x10005c13c]
mov r8, rsi
add rcx, 0x30
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, r13d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
Function at 0x10003eb1c
Capabilities:
Copy file
Delete file

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbx, rcx
mov edx, dword [rcx + 0x50]
sub edx, dword [rcx + 0x48]
mov r8, qword [rcx + 0x48]
add rcx, 0x60
call fcn.10003d8c4
lea r8, [0x10005c130]
mov edx, 1
lea rcx, [rbx + 0x60]
call fcn.10003d948
mov edx, dword [rbx + 0x38]
sub edx, dword [rbx + 0x30]
mov r8, qword [rbx + 0x30]
lea rcx, [rbx + 0x60]
call fcn.10003d948
lea r8, str..xml
mov edx, 4
lea rcx, [rbx + 0x60]
call fcn.10003d948
lea rdx, [0x10005c170]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.10003e87c
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10003ebc3
cmp rcx, 0xffffffffffffffff
je 0x10003ebc3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x10003ebe2
mov eax, dword [rbx + 0xcc]
test eax, eax
je 0x10003ebe2
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor r8d, r8d
mov rdx, qword [rbx + 0x78]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [rbx + 0xa8]
cmp dword [rbx + 0xac], eax
jne 0x10003ec90
mov eax, dword [rbx + 0xac]
test eax, eax
jne 0x10003ec13
xor esi, esi
jmp 0x10003ec40
mov ecx, dword [rbx + 0xb0]
mov rsi, rcx
imul rsi, rsi, 0x53
add rsi, qword [rbx + 0xb8]
dec eax
mov dword [rbx + 0xac], eax
lea eax, [rcx + 1]
xor edx, edx
div dword [rbx + 0xa8]
mov dword [rbx + 0xb0], edx
mov edx, dword [rbx + 0x50]
sub edx, dword [rbx + 0x48]
mov r8, qword [rbx + 0x48]
lea rcx, [rbx + 0x60]
call fcn.10003d8c4
lea r8, [0x10005c130]
mov edx, 1
lea rcx, [rbx + 0x60]
call fcn.10003d948
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov r8, rsi
lea rcx, [rbx + 0x60]
call fcn.10003d948
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r9, qword [rbx + 0x90]
mov eax, dword [rbx + 0xa8]
cmp dword [rbx + 0xac], eax
je 0x10003ed07
mov edx, dword [rbx + 0xb4]
imul rdx, rdx, 0x53
mov rax, qword [rbx + 0xb8]
mov byte [rdx + rax], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r9
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
cmp ecx, 0x52
ja 0x10003eceb
mov r8d, ecx
mov ecx, dword [rbx + 0xb4]
imul rcx, rcx, 0x53
add rcx, qword [rbx + 0xb8]
mov rdx, r9
call sub.msvcrt.dll_memcpy
inc dword [rbx + 0xac]
mov eax, dword [rbx + 0xb4]
inc eax
xor edx, edx
div dword [rbx + 0xa8]
mov dword [rbx + 0xb4], edx
mov rdx, qword [rbx + 0xc0]
lea rdi, [rdx + 0x10]
lea rcx, [rdx + 0x80000]
cmp rdi, rcx
jae 0x10003ed32
sub rcx, rdi
dec rcx
shr rcx, 2
inc rcx
mov eax, 0x200020
rep stosd dword [rdi], eax
movdqu xmm0, xmmword [str._r_n__LOG_]
movdqu xmmword [rdx + 0x7fff0], xmm0
mov dword [rbx + 0xc8], 0x10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1000476c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x10004778e
test rdx, rdx
je 0x10004778e
xor r9d, r9d
lea rdx, [0x10005c740]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x10004770f
xor ebx, ebx
jmp 0x10004771e
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x10005c740]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x100047745
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x100047783
test rax, rax
je 0x100047783
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x10004777d
cmp dword [rax], ecx
jne 0x10004777d
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x100047774
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x100047774
xor eax, eax
jmp 0x100047779
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10004777f
xor esi, esi
mov eax, esi
jmp 0x100047790
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x100047874
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1000700c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x1000726dc]
test eax, eax
jne 0x100047979
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000478d7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x1000726dc], eax
sub ecx, r8d
je 0x100047959
cmp ecx, r8d
jne 0x100047979
cmp edx, 5
jne 0x100047947
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x100047940
sub ecx, r8d
je 0x10004792b
cmp ecx, r8d
je 0x100047915
lea eax, [rdx + 0xf]
jmp 0x100047973
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x100047973
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x100047926
mov eax, 4
jmp 0x100047973
cmp edx, 4
ja 0x100047991
mov ecx, 2
mov eax, ecx
mov dword [0x1000726dc], ecx
cmp edx, 4
jne 0x100047979
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x100047970
cmp ecx, 0xa
je 0x100047970
cmp ecx, 0x5a
jne 0x100047979
mov eax, r8d
mov dword [0x1000726dc], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.100001250
add rsp, 0x158
ret
mov eax, 0x20
jmp 0x100047973
Function at 0x10004845c
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [0x100070110]
mov rbx, qword [0x100070120]
mov rdi, qword [0x100070118]
mov rsi, qword [0x100070100]
lea eax, [rdx - 1]
mov r11d, r8d
mov r10d, edx
lea r8, [rcx + rax*4]
test edx, edx
je 0x1000484d6
mov edx, r11d
mov eax, r11d
shr rax, 0x10
movzx ecx, al
mov eax, r11d
mov r11d, dword [rdi + rcx*4]
shr rax, 8
movzx eax, al
xor r11d, dword [rbx + rax*4]
mov rax, rdx
shr rax, 0x18
xor r11d, dword [rsi + rax*4]
movzx eax, dl
xor r11d, dword [r9 + rax*4]
xor r11d, dword [r8]
sub r8, 4
add r10d, 0xffffffff
jne 0x100048498
mov eax, r11d
shr rax, 0x10
movzx ecx, al
mov eax, r11d
mov edx, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
shr rax, 8
movzx eax, al
mov ecx, r11d
xor edx, dword [rbx + rax*4]
mov rbx, qword [rsp + 8]
shr rcx, 0x18
xor edx, dword [rsi + rcx*4]
mov rsi, qword [rsp + 0x10]
movzx ecx, r11b
xor edx, dword [r9 + rcx*4]
xor edx, r11d
mov eax, edx
ret
Function at 0x140005c9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005ce6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005ce6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005ce6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005ce6
cmp dword [rcx + 0x84], 0xe
jbe 0x140005ce6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005ce8
xor al, al
add rsp, 0x28
ret

Function at 0x2caf350
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x2caf35d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x2caf36d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x2caf355
lea eax, [rcx + 1]
jmp 0x2caf37b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x2caf38e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x2caf374
sub eax, 3
jb 0x2caf3ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x2caf3fd
sar eax, 1
movsxd rbp, eax
jb 0x2caf3e4
jmp 0x2caf3bc
add ebx, ebx
jne 0x2caf3ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x2caf3e4
inc ecx
add ebx, ebx
jne 0x2caf3ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x2caf3e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x2caf3dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x2caf3cc
add ecx, 2
jmp 0x2caf3e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.02caf312
jmp 0x2caf35d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2880000]
mov eax, dword [rdi]
or eax, eax
je 0x2caf459
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x28b8ed4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x2caf409
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x2caf453
mov qword [rbx], rax
add rbx, 8
jmp 0x2caf429
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x2caf49d
cmp al, 0xef
ja 0x2caf485
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x2caf465
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x2caf474
mov eax, dword [rdi]
add rdi, 4
jmp 0x2caf474
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x2caf4f1
sub rsp, 0xffffffffffffff80
jmp 0x46ce40
Function at 0x140130000
Capabilities:
Access peb ldr_data
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
xchg rdx, r11
mov qword [rsp + 0x10], r11
jmp 0x140130115
add rcx, r11
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401301e7
nop dword [rax]
movsx eax, al
jmp 0x14013012a
mov edx, 0x2d3bd1c2
lea rax, [r10 + r9*4]
mov ecx, dword [rax + r11]
jmp 0x140130017
mov r10, qword [rax + 0x18]
mov rax, qword [r10 + 0x10]
xchg r10, rsi
mov rsi, qword [rax]
xchg r10, rsi
mov r11, qword [r10 + 0x30]
je 0x140130091
jne 0x140130091
jo 0x1401304b6
test edx, 0x8d950cda
mov edi, 0x7735ea38
ror r9d, 0x97
ja 0x140130abd
rol r12d, 0x71
rol r12d, 0x10
je 0x140131010
call rcx
add ebp, 0x345a7e79
movabs r9, 0x5abdc6d5040417eb
rcl r11d, 0x1f
ror ecx, 0x75
cpuid
lea r14d, [rbx + 0xb51d]
ret
jmp 0x1401300aa
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
mov r10d, dword [rbx + r11 + 0x20]
nop word [rax + rax]
mov r9d, r8d
je 0x1401300f4
jne 0x1401300f4
lea r9d, [rdx + 0x5a9e]
bswap r9
test r12d, 0xcb61c8c4
test rcx, rdx
jmp rcx
jmp 0x140130033
xchg r11, rdx
mov qword [rsp + 8], rcx
nop
push r9
mov qword [rsp], rbp
nop
jmp 0x140130141
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jmp 0x1401301d5
mov qword [rsp - 8], rbx
sub rsp, 8
nop
je 0x14013018d
jne 0x14013018d
pop rbp
call rax
lea ebx, [rbx - 0x5691]
dec r10
js 0x140130459
test ebp, 0x687865c0
lea r8d, [rdi - 0x1672]
je 0x1401309dc
jle 0x140130730
ret
jmp 0x1401301a9
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r8d, r15d
jmp 0x140130045
jne 0x14013002b
cmp edx, 0xf89acd5d
je 0x1401301ef
inc r8d
jmp 0x1401300c5
mov ecx, dword [rbx + r11 + 0x24]
xorps xmm0, xmm0
add rcx, r11
xchg r10, rsi
jne 0x140130203
je 0x140130203
movabs r8, 0x422fc1000001f4e9
lea ecx, [rbx + 0xac7f]
ret
jmp 0x1401303fc
mov r8d, 0x18
xchg r12, r9
mov qword [rsp + 0x448], r9
xchg r12, r9
xchg r13, r8
mov qword [rsp + 0x440], r8
jne 0x14013024e
je 0x14013024e
lea r9d, [rbp + 0xbaae]
rcl r15d, 0x9e
rcr r10d, 0xd2
jne 0x140130747
pushf
movabs r14, 0x3040e60000014ee9
jmp rax
jmp 0x1401303a1
mov qword [rsp + 0x458], r10
xchg r10, rsi
mov qword [rsp + 0x450], rdi
jmp 0x140130212
add dword [rax], eax
add cl, ch
add byte [rax], al
add byte [rax], al
invalid
add byte [rbx + rdi - 0x2f], cl
invalid

Function at 0x140130b48
Capabilities:
Access peb ldr_data
Execute syscall
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
movabs byte [0xf42c391ccc14168], al
mov bh, 0x14
push rcx
Function at 0x14001d640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14001d69a
mov dl, byte [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x140103008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.140042a30
lea rdx, [0x1400f4258]
mov rcx, r14
call fcn.140042cc0
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14001d6da
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140103008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1400cfa30]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, r15
call qword [0x140103008]
movzx r9d, byte [r15 + 0x17]
mov ebx, r9d
and ebx, 0x7f
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
cmovs rbx, r8
test rbx, rbx
je 0x14001d7a9
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x14001d78e
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14001d792
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x14001d75e
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
mov edx, r9d
and dl, 0x7f
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, dl
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x14001d739
jmp 0x14001d7a9
xor edi, edi
jmp 0x14001d76a
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x140103008]
jmp 0x14001d757
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x14001d68a
call fcn.140060988
jmp 0x14001d68a

Function at 0x140025ac0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1400e3028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1400f4fa8]
test rdi, rdi
jne 0x140025b63
mov ecx, 0x48
call fcn.14006094c
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.14006094c
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1400f4fa8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140025b85
mov rcx, rax
call fcn.14007ac08
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140025b90
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140061c90
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x140025b90
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1400e3028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.14002b160
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x140025d79
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x1400d20c8]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x140025dce
lea rdx, [0x1400d2118]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025de1
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [0x140103008]
mov r12, rax
movsxd r13, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r13, r13
mov qword [rsp + 0x28], rbx
je 0x140025de9
shl r13, 3
movabs rax, 0x5555555555555551
cmp r13, rax
jae 0x140025dc9
lea rdi, [r13*2]
add rdi, r13
mov rcx, rdi
call fcn.14006094c
mov rsi, rax
mov qword [rsp + 0x30], rax
add rax, rdi
mov qword [rsp + 0x40], rax
xor r14d, r14d
mov rdi, qword [r12 + r14]
mov rcx, rdi
call fcn.14007ac08
mov rbx, rax
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x140025dc9
cmp rbx, 0xb
jae 0x140025ce1
mov byte [rsi + 0x17], bl
lea r15, [rsi + rbx*2]
mov rcx, rsi
test rbx, rbx
jne 0x140025d17
jmp 0x140025d25
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.14006094c
mov rcx, rax
mov qword [rsi], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbp
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rbx
lea r15, [rcx + rbx*2]
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.140063700
mov word [r15], 0
add rsi, 0x18
add r14, 8
cmp r13, r14
jne 0x140025ca8
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140025910
movups xmmword [rdi], xmm6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140025d6f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x140025d9f
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140061c90
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp rsi, rdi
je 0x140025dbf
lea rbx, [rsi - 0x18]
cmp byte [rsi - 1], 0
jns 0x140025db7
mov rcx, qword [rsi - 0x18]
call fcn.140060988
mov rsi, rbx
cmp rbx, rdi
jne 0x140025da4
mov rcx, rdi
call fcn.140060988
jmp 0x140025d79
call fcn.140074570
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140025c44
xor r12d, r12d
jmp 0x140025c47
xor esi, esi
jmp 0x140025d41
Function at 0x1400286b0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140028770
mov eax, dword [rsi]
mov dword [0x1400e4f68], eax
test al, 1
jne 0x1400286d1
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x1400f4fe8]
test rcx, rcx
jne 0x1400286eb
mov rcx, qword [0x1400f4fc0]
test rcx, rcx
je 0x14002870f
jmp 0x140028731
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400f4fe8], 0
mov rcx, qword [0x1400f4fc0]
test rcx, rcx
jne 0x140028731
and byte [0x1400e4f68], 0xfe
mov ecx, 0x18
call fcn.14006094c
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1400f4fc0], rax
mov rdx, qword [rsi + 8]
call fcn.140025220
cmp dword [rsi + 0x14], 0
jne 0x140028756
mov rcx, qword [0x1400f4fc0]
cmp byte [rcx + 0x17], 0
jns 0x140028750
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.1400a7280