joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003748
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 0x44
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.1400035c8
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [0x14000661c]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 2
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x140006620]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str..exe
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
add rsp, 0x80
pop rdi
ret

Function at 0x140003838
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14000387d
xor al, al
jmp 0x1400038df
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x58]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [0x140007288]
cmp dword [rsp + 0x38], 0
je 0x1400038dd
xor al, al
jmp 0x1400038df
mov al, 1
add rsp, 0x40
pop rdi
ret

Function at 0x1400038f8
Capabilities:
Delete file
Set file attributes

Disassembly:
push rdi
sub rsp, 0x490
xor eax, eax
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 0x44
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.1400035c8
lea rcx, [rsp + 0x70]
call fcn.140003748
mov r8d, 0x104
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [0x1400071a8]
test eax, eax
jne 0x14000396f
xor al, al
jmp 0x140003992
mov edx, 2
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [rsp + 0x70]
lea rcx, [0x140006638]
call fcn.140003838
mov al, 1
add rsp, 0x490
pop rdi
ret
Function at 0x140003a08
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x68
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov qword [rsp + 0x30], rax
lea rax, str.Hidden
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140003a96
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
call qword [0x140007288]
add rsp, 0x68
ret

Function at 0x140003f68
Capabilities:
Acquire debug privileges

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x58], 0
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x38], 0
call qword [0x140007378]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [0x1400072c0]
test eax, eax
je 0x140004046
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x64], 2
lea r8, [rsp + 0x5c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x1400072c8]
test eax, eax
je 0x14000403b
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [0x1400072b8]
mov rcx, qword [rsp + 0x40]
call qword [0x140007100]
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov ecx, 0x43a
call qword [0x1400073a8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140004072
mov dword [rsp + 0x4c], 0
jmp 0x1400040c0
xor r9d, r9d
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.140002bfc
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400040a6
mov dword [rsp + 0x4c], 0
jmp 0x1400040c0
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [0x140007360]
xor eax, eax
test eax, eax
jne 0x140003fcf
cmp qword [rsp + 0x30], 0
je 0x1400040d3
mov rcx, qword [rsp + 0x30]
call qword [0x140007100]
mov eax, dword [rsp + 0x4c]
add rsp, 0x70
pop rdi
ret
Function at 0x140004448
Capabilities:
Set file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, 7
mov edx, 0x40000000
mov rcx, qword [rsp + 0x60]
call qword [0x140007108]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x1400044de
mov r9d, dword [rsp + 0x80]
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call fcn.1400043c8
mov byte [rsp + 0x48], al
mov edx, 2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x40]
call qword [0x140007100]
mov al, byte [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x1400044f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov dword [rsp + 0x114], 0
mov dword [rsp], 0
jmp 0x14000452e
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jae 0x140004543
mov eax, dword [rsp]
mov cl, byte [rsp]
mov byte [rsp + rax + 0x10], cl
jmp 0x140004526
mov dword [rsp], 0
jmp 0x140004554
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jae 0x1400045ec
mov eax, dword [rsp]
movzx eax, byte [rsp + rax + 0x10]
mov ecx, dword [rsp + 0x114]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x11c], eax
xor edx, edx
mov eax, dword [rsp]
div dword [rsp + 0x148]
mov eax, edx
mov eax, eax
mov rcx, qword [rsp + 0x140]
movsx eax, byte [rcx + rax]
mov ecx, dword [rsp + 0x11c]
add ecx, eax
mov eax, ecx
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov dword [rsp + 0x114], eax
mov eax, dword [rsp]
movzx eax, byte [rsp + rax + 0x10]
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0x114]
mov ecx, dword [rsp]
mov al, byte [rsp + rax + 0x10]
mov byte [rsp + rcx + 0x10], al
mov eax, dword [rsp + 0x114]
mov cl, byte [rsp + 0x110]
mov byte [rsp + rax + 0x10], cl
jmp 0x14000454c
mov dword [rsp + 0x114], 0
mov eax, dword [rsp + 0x114]
mov dword [rsp], eax
mov dword [rsp + 0x118], 0
jmp 0x14000461e
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
mov eax, dword [rsp + 0x158]
cmp dword [rsp + 0x118], eax
jae 0x14000470a
mov eax, dword [rsp]
inc eax
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov dword [rsp], eax
mov eax, dword [rsp]
movzx eax, byte [rsp + rax + 0x10]
mov ecx, dword [rsp + 0x114]
add ecx, eax
mov eax, ecx
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov dword [rsp + 0x114], eax
mov eax, dword [rsp]
movzx eax, byte [rsp + rax + 0x10]
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0x114]
mov ecx, dword [rsp]
mov al, byte [rsp + rax + 0x10]
mov byte [rsp + rcx + 0x10], al
mov eax, dword [rsp + 0x114]
mov cl, byte [rsp + 0x110]
mov byte [rsp + rax + 0x10], cl
mov eax, dword [rsp + 0x118]
mov qword [rsp + 0x120], rax
mov ecx, dword [rsp]
movzx ecx, byte [rsp + rcx + 0x10]
mov edx, dword [rsp + 0x114]
movzx edx, byte [rsp + rdx + 0x10]
add ecx, edx
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
movzx eax, byte [rsp + rax + 0x10]
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x120]
movsx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x118]
mov rdx, qword [rsp + 0x150]
mov byte [rdx + rcx], al
jmp 0x14000460e
add rsp, 0x138
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140061df0]
mov dword [rax], 1
mov rax, qword [0x140061e00]
mov dword [rax], 1
mov rax, qword [0x140061e10]
mov dword [rax], 1
mov rax, qword [0x140061d40]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140027490
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.140044cc0
sub rsp, rax
xor eax, eax
mov rdx, rcx
lea rbx, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea rsi, [rsp + 0x70]
mov rcx, rbx
call fcn.14003be70
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400274e9
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret
Function at 0x1400439a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140054f50
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140054f50
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140044672
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14006b6e8]
test eax, eax
je 0x14004470a
lea rax, [0x14006b6c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14006b6f0]
mov qword [rbp - 8], rax
jmp 0x1400446ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400446e2
cmp qword [rbp - 0x10], 0
je 0x1400446e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400446a8
lea rax, [0x14006b6c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14004470b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140044810
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140044838
mov eax, 0
jmp 0x140044886
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140044861
mov eax, 0
jmp 0x140044886
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140044881
mov eax, 0
jmp 0x140044886
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14004488c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14004490a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140044901
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140044901
mov rax, qword [rbp - 8]
jmp 0x14004491f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400448d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x7ff7ec564380
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x7ff7ec56458a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x7ff7ec564444
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x7ff7ec564400
mov ecx, dword [r10]
jmp 0x7ff7ec564527
cmp ecx, 0x4e0
jb 0x7ff7ec564527
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7ec564460
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7ec5644b0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x7ff7ec5643e0
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x7ff7ec5643d0
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x7ff7ec5645aa
cmp r8d, r14d
jne 0x7ff7ec5643b0
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x7ff7ec564f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0x10
jb 0x7ff7ec564f8e
mov rcx, qword [rcx]
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x7ff7ec564fa4
test al, 0x10
je 0x7ff7ec564fa4
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x7ff7ec566270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x7ff7ec566314
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x7ff7ec5662d0
mov ecx, dword [r10]
jmp 0x7ff7ec5663f7
cmp ecx, 0x4e0
jb 0x7ff7ec5663f7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7ec566330
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7ec566380
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x7ff7ec5662b0
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x7ff7ec5662a0
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x7ff7ec56a0f0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.kernel32.dll_OpenProcess]
xor r12d, r12d
mov dword [rbp - 0x10], 0x30a1902
mov ecx, r12d
mov dword [rbp - 0xc], 0x1f165f1c
mov r15, rax
mov word [rbp - 8], 0x18
mov byte [rbp - 6], 1
lea eax, [rcx + 0x6c]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 9
jb 0x7ff7ec56a140
lea rcx, [rbp - 0x10]
mov byte [rbp - 6], r12b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
lea rdi, [0x7ff7ec6f4018]
mov esi, r12d
mov r14, rax
mov rbx, rdi
nop
mov rdx, qword [rbx - 8]
mov rcx, r14
call qword [sym.imp.kernel32.dll_GetProcAddress]
inc esi
mov qword [rbx], rax
lea rbx, [rbx + 0x18]
cmp esi, 3
jb 0x7ff7ec56a170
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [rbp - 0x10], 0xf119f102
mov rcx, r12
mov rbx, rax
mov dword [rbp - 0xc], 0xf103f10a
mov dword [rbp - 8], 0xf11c
mov esi, 0xe94
mov byte [rbp - 4], 1
nop word [rax + rax]
movzx eax, cx
sub ax, si
xor word [rbp + rcx*2 - 0x10], ax
inc rcx
cmp rcx, 5
jb 0x7ff7ec56a1c0
lea rdx, [rbp - 0x10]
mov byte [rbp - 4], r12b
mov rcx, rbx
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x7ff7ec56a239
mov dword [rbp - 0x10], 0xf139f122
mov rcx, r12
mov dword [rbp - 0xc], 0xf123f12a
mov dword [rbp - 8], 0xf13c
mov byte [rbp - 4], 1
nop word [rax + rax]
movzx eax, cx
sub ax, si
xor word [rbp + rcx*2 - 0x10], ax
inc rcx
cmp rcx, 5
jb 0x7ff7ec56a210
lea rdx, [rbp - 0x10]
mov byte [rbp - 4], r12b
mov rcx, rbx
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x7ff7ec56a2a1
mov esi, r12d
nop dword [rax]
mov r8, qword [rdi + 8]
lea rax, [rbp + 0x30]
mov rdx, qword [rdi]
mov r9d, 0x40
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
mov rdx, qword [rdi]
mov rcx, r15
mov r9, qword [rdi + 8]
mov r8, rdx
mov qword [rsp + 0x20], r12
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov r9d, dword [rbp + 0x30]
mov rcx, r15
mov r8, qword [rdi + 8]
mov ebx, eax
mov rdx, qword [rdi]
mov qword [rsp + 0x20], r12
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
test ebx, ebx
je 0x7ff7ec56a2a1
inc esi
add rdi, 0x18
cmp esi, 3
jb 0x7ff7ec56a240
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
xor eax, eax
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret