joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3246978
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.0323d994
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.0323d994
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x3246ac8
cmp rax, 0xffffffffffffffff
je 0x3246ac8
xor edi, edi
test rbp, rbp
jle 0x3246a73
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.03239628
mov rbx, rax
test rax, rax
jne 0x3246a00
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x3246a69
mov edx, 0x8000
mov ecx, r14d
call fcn.03238d14
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.0323e3f8
cmp eax, 0xffffffff
je 0x3246a49
cdqe
sub rbp, rax
test rbp, rbp
jg 0x3246a10
mov edx, r15d
mov ecx, r14d
call fcn.03238d14
jmp 0x3246a69
cmp byte [rsi + 0x38], dil
je 0x3246a60
cmp dword [rsi + 0x34], 5
jne 0x3246a60
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x3246a69
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.0323958c
jmp 0x3246adc
jns 0x3246adc
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.0323d994
cmp rax, 0xffffffffffffffff
jne 0x3246a94
cmp byte [rsi + 0x30], dil
je 0x3246adc
mov edi, dword [rsi + 0x2c]
jmp 0x3246adc
mov ecx, r14d
call fcn.0324112c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x3246adc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x3246adc
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x3246ad5
mov eax, dword [rsi + 0x2c]
jmp 0x3246ada
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.0323d994
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x3247b10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x3247b38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x3247b38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400044c0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400044d0]
mov dword [rax], 1
mov rax, qword [0x1400044e0]
mov dword [rax], 1
mov rax, qword [0x1400044b0]
mov dword [rax], 1
mov rax, qword [0x140004380]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1400044a0]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140004460]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140004440]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140004330]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001550
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0xe0]
call dbg.__main
lea rdx, [rbp - 0x70]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x70], 0x68
lea rax, [rbp - 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.powershell.exe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x1400015e4
mov eax, 1
jmp 0x140001657
mov r9d, 0x30
lea r8, str.Notification
lea rdx, str.You_are_hacked
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x90]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xe8
pop rdi
pop rbp
ret

Function at 0x140001940
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x1400020d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140007100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140002124
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000211b
test r12, r12
je 0x14000211b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002100
lea rcx, [0x140007100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002350
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140002360
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x140002370
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400023b5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x1400023ac
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400023b7
add rax, 0x28
cmp rax, r9
jne 0x140002398
xor eax, eax
ret

Function at 0x140002460
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140004380]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400024d9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400024d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400024d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400024cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400024d9
add r8, 0x28
cmp r8, r9
jne 0x1400024b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x1400025c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140004380]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000262f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14000262f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x14000262d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002624
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002638
add rax, 0x28
cmp rax, r9
jne 0x140002610
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x140002650
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x140004380]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400026c8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400026c8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400026c8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400026c8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x1400026bc
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1400026d0
add rdx, 0x28
cmp rdx, r10
jne 0x1400026a8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x1400026e0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1400026ee
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400026c5
test r8d, r8d
jg 0x1400026d8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x14003173c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400317b4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400317b4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400317b4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400317a8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400317c6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031796
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400317b6

Function at 0x140033300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003334a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003334a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003334a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003334a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003334a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003334c
xor al, al
add rsp, 0x28
ret

Function at 0x14003c094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bdf8

Function at 0x140045fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045fd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045fd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14074c055
Capabilities:
Encode data using xor

Disassembly:
ja 0x140862084
test r14, r14
mov r14w, 0x656f
mov r14, qword [rsp + 0x28]
jge 0x1407f23d6
call 0x1407f23d1
push rbx
sbb bl, byte [rbx - 0x74b70c75]
movabs eax, dword [0x94115b7d4bba4ca4]
adc esp, dword [rax + 0x3a19d17d]
outsd dx, dword [rsi]
xchg ecx, eax
clc
cmp edi, eax
invalid
add dl, byte [rdi - 0x5e]
out dx, eax
xchg esi, eax
mov edx, 0xf096767a
pop rbp
iretd
mov ah, 0x7a
push 0x6c
sub byte [rbx], ah
jns 0x1407f2358
rcr r11, 1
xchg byte [rax + 0x27], dh
mov ebx, 0xf3179cb
push 4
xchg byte [rdi + 0x7a7dfca9], ah
enter 0x6ef, 0x57
jns 0x1407f23d1
push qword [rsp + 0x38]
popfq
je 0x1407f23f8
cmp byte [rbp + 0x24648d48], bl
call fcn.1408ce58c
lea rsp, [rsp + 0x48]
call fcn.1408ce58c
mov edi, 0xe8afa3d3
jne 0x1407f23b1
mov r10b, 0xd8
mov ebp, 0x3b2d234
invalid
invalid
xor rdi, rdi
push r14
call fcn.1403bc5b0
mov edi, 0x9c574151
movabs r15, 0x138809203f5c264e
push r13
not r15
mov qword [rsp + 0x18], 0xe5091b
movabs r13, 0x272a4d3e59607b0d
movsx r13d, r15b
call fcn.14075e9b8
invalid
Function at 0x140001000
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
invalid
invalid
invalid
out 0x9f, eax
invalid

Function at 0x140001078
Capabilities:
Create process memory minidump

Disassembly:
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
and byte [rdx], al
add byte [rax], al
add bh, bh
adc eax, 0x2933d
mov rbx, rax
lea rcx, [rax - 1]
dec qword [rax - 0x7d]
stc
std
ja 0x1400010ef
mov rcx, qword gs:[0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, dword [rcx + 0x48]
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x44], rdi
mov dword [rsp + 0x4c], esi
mov rcx, qword gs:[0x30]
mov edx, dword [rcx + 0x40]
lea rcx, [rsi - 1]
invalid
invalid
invalid
xchg edi, eax

Function at 0x140001080
Capabilities:
Create process memory minidump

Disassembly:
and byte [rdx], al
add byte [rax], al
add bh, bh
adc eax, 0x2933d

Function at 0x140001460
Capabilities:
Get geographical location

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 0x7ffffffe
lea rcx, str.English
call fcn.14001bd18
add rax, rax
mov edi, 2
cmovne rdi, rax
call fcn.14000b280
lea r8, [rdi + 0x22]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lock inc dword [rax + 8]
lea rbx, [rax + 0x10]
xor esi, esi
mov qword [rax], rsi
lea rcx, [rbx + 0x10]
mov r8, rdi
mov qword [rbx + 8], rcx
lea rdx, str.English
mov qword [rbx], rdi
call fcn.14001b590
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov qword [0x14003cee0], rbx
call fcn.14000b280
lea edx, [rsi + 0xc]
mov r8d, 0xcc
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lock inc dword [rax + 8]
lea r8, [rax + 0x10]
mov qword [rax], rsi
lea rax, [r8 + 0x10]
mov qword [r8], 0xaa
mov qword [r8 + 8], rax
lea r9d, [rsi + 0x55]
mov word [rax], si
mov edx, 0x1001
mov qword [0x14003cee8], r8
mov ecx, 0x400
mov r8, qword [r8 + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jbe 0x140001663
mov rbx, qword [0x14003cee8]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
mov ecx, dword [rbx + 8]
shr rdx, 1
test rcx, rcx
jne 0x140001557
mov eax, esi
jmp 0x14000155f
inc rdx
call fcn.14001bd18
lea rcx, [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rbx], rcx
mov word [rcx + rax], si
cmp dword [0x14003cec0], esi
jne 0x14000158c
lea rcx, str.TaskbarCreated
nop dword [rax]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x14003cec0], eax
call fcn.14000b280
mov edx, 0xc
mov rcx, rax
lea r8d, [rdx + 0x2c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lock inc dword [rax + 8]
lea rbx, [rax + 0x10]
lea rdi, [0x1400117e0]
mov qword [rbx + 8], 2
mov qword [rax], rdi
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0x40
call fcn.14000b280
invalid
or al, 0
invalid
Function at 0x1400016e0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 3
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rcx, [0x140032f90]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call fcn.14000dce0
xor edi, edi
lea rcx, str.kernel32.dll
cmp eax, 0x600
mov r8d, edi
mov esi, 0xc00
cmovae r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x1400017a6
lea rdx, str.SetSearchPathMode
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001776
mov ecx, 0x8001
call qword [0x14002a970]
lea rdx, str.SetDefaultDllDirectories
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
ror byte [rdi], 0x84
invalid
add byte [rax], al
invalid
mov ecx, esi
call qword [0x14002a970]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r9d, 4
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400017ef
and dword [rsp + 0x48], 0xffff7ffc
lea r8, [rsp + 0x48]
mov r9d, 4
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
call fcn.14000dce0
cmp eax, 0x600
jb 0x1400018b7
nop
call fcn.14000dce0
cmp eax, 0x600
lea rcx, [0x140033418]
cmovae edi, esi
xor edx, edx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x1400018b7
lea rdx, str.RtlSetUnhandledExceptionFilter
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x1400018ae
lea rcx, [0x140001120]
nop dword [rax]
call fcn.14000dce0
cmp eax, 0x600
jb 0x140001797
lea rax, str.Install__a_href_https:__support.microsoft.com_kb_2533623__KB2533623__a_.
xorps xmm0, xmm0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov r8d, 0x45a
lea rdx, str.Security_update_is_not_installed_
xor ecx, ecx
movdqu xmmword [rsp + 0x38], xmm0
call fcn.140007900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x140001970
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x140001120]
nop
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]

Function at 0x140007080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x1400070a1
mov eax, 0xff
call fcn.140002680
xor byte [rsi], al
jne 0x140007091
pop rsi
pop rbx
ret
Function at 0x14000da80
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r12, r8
lea rdx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
mov qword [rsp + 0x20], rax
mov rdx, rax
test r12, r12
je 0x14000dabf
mov qword [r12], rdi
nop
test rax, rax
je 0x14000dcc5
mov qword ss:[rsp + 0xb8], rbp
mov qword [rsp + 0x70], r13
xor r13b, r13b
mov qword [rsp + 0x60], r15
test rbx, rbx
jne 0x14000daea
mov rax, rdi
jmp 0x14000dafc
mov edx, 0x7ffffffe
mov rcx, rbx
call fcn.14001bd18
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x48]
lea r15, [rax + rax]
mov qword [rsp + 0x28], r15
mov ebp, edi
mov qword [rsp + 0x30], rbx
test ecx, ecx
jle 0x14000dca4
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], r14
mov r14, rdx
mov rbx, qword [r14]
movabs rsi, 0x2400000100000000
test rbx, rbx
je 0x14000dc42
mov edx, 0x7ffffffe
mov rcx, rbx
call fcn.14001bd18
lea rcx, [rax + rax]
cmp rcx, 4
jb 0x14000dc3e
movzx eax, word [rbx]
cmp ax, 0x2f
je 0x14000db6a
nop
cmp ax, 0x2d
jne 0x14000dc3e
movzx eax, word [rbx + 2]
lea rdi, [rcx - 2]
add rbx, 2
cmp ax, 0x2d
jne 0x14000db83
add rbx, 2
cmp ax, ax
cmovne rdi, rcx
sub rdi, 2
cmp rdi, r15
jb 0x14000dc3e
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], r15
call fcn.14000c460
test al, al
je 0x14000dc3e
mov rax, r15
mov r13b, 1
shr rax, 1
lea rcx, [rax + rax]
movzx eax, word [rcx + rbx]
test ax, ax
je 0x14000dbec
cmp eax, 0x3d
ja 0x14000dc3e
bt rsi, rax
jae 0x14000dc3e
test r12, r12
je 0x14000dc9a
lea rax, [rcx + 2]
lea rsi, [rbx + rax]
sub rdi, rax
jmp 0x14000dc33
test r12, r12
je 0x14000dc9a
mov ecx, dword ds:[rsp + 0x48]
lea eax, [rbp + 1]
cmp ecx, eax
jle 0x14000dc42
mov rsi, qword [r14 + 8]
movzx eax, word [rsi]
cmp eax, 0x2f
ja 0x14000dc22
movabs rdx, 0xa00100000000
bt rdx, rax
jb 0x14000dc42
mov edx, 0x7ffffffe
mov rcx, rsi
call fcn.14001bd18
lea rdi, [rax + rax]
test rdi, rdi
je 0x14000dc3e
cmp word [rsi], 0
jne 0x14000dc51
mov ecx, dword [rsp + 0x48]
inc ebp
add r14, 8
cmp ebp, ecx
jge 0x14000dc9a
jmp 0x14000db25
call fcn.14000b280
lea r8, [rdi + 0x22]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lock inc dword [rax + 8]
lea rbx, [rax + 0x10]
xor ebp, ebp
mov qword [rax], rbp
lea rcx, [rbx + 0x10]
mov r8, rdi
mov qword [rbx + 8], rcx
mov rdx, rsi
mov qword [rbx], rdi
call fcn.14001b590
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
mov word [rdx + rcx], bp
mov qword [r12], rbx
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x60]
movzx eax, r13b
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140019f40
add rsp, 0x80
pop r12
pop rdi
pop rbx
ret
Function at 0x14000e560
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
lea rax, str.runas
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x804500
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x50], 5
mov qword [r11 - 0x70], rcx
lea rcx, [rsp + 0x20]
mov qword [r11 - 0x68], rdx
mov qword [r11 - 0x60], r8
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140019f40
add rsp, 0xa8
ret
Function at 0x140010f20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbp, r8
mov qword [rsp + 0x30], rdi
mov rsi, rcx
mov qword [rsp + 0x38], r14
mov r14, rdx
mov r9, qword [rax + 0x60]
mov rax, qword [r9 + 0x20]
mov rdi, qword [rax + 0x68]
test rdi, rdi
je 0x140010fa7
mov edx, 0x7ffffffe
mov rcx, rdi
call fcn.14001bd18
add rax, rax
je 0x140010fa7
shr rax, 1
xor ebx, ebx
lea r8, [rdi + rax*2]
cmp rdi, r8
je 0x140010fa9
nop dword [rax]
movzx edx, word ds:[rdi]
lea eax, [rdx - 0x61]
cmp ax, 0x19
lea ecx, [rdx - 0x20]
cmova ecx, edx
imul ebx, ebx, 0x1003f
add rdi, 2
add ebx, ecx
cmp rdi, r8
jne 0x140010f80
jmp 0x140010fa9
xor ebx, ebx
call fcn.14000dce0
cmp eax, 0x600
mov qword [rsi + 8], r14
mov ecx, 0x3c8
mov edx, 0x3d0
cmovae ecx, edx
mov dword [rsi], ecx
movzx eax, word [rbp + 4]
mov dword [rsi + 0x10], eax
call fcn.14000dce0
mov r14, qword ss:[rsp + 0x38]
mov rdi, qword [rsp + 0x30]
cmp eax, 0x601
jb 0x140010ffc
or dword [rsi + 0x14], 0x20
movups xmm0, xmmword [rbp]
movups xmmword [rsi + 0x3b8], xmm0
xor dword [rsi + 0x3b8], ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret