joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001328b
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x100014b2a
jmp 0x100013a95
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x10001086d
test eax, eax
je 0x10000ee37
jmp 0x1000134d8
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.1000111ea
jmp 0x100010205
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x100014b2a
jmp 0x100013a95
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x10000ede4
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x100015534
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x100015361
jmp 0x10001086d
mov rcx, qword [rsp + 0x70]
call fcn.100014e42
jmp 0x100010aac
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x1000110ab
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x100012628
jmp 0x100015440
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1000134d8
jmp 0x1000145cf
jmp 0x10000ede4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x100015361
Function at 0x100013290
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x100014b2a
jmp 0x100013a95
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x10001086d
test eax, eax
je 0x10000ee37
jmp 0x1000134d8
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.1000111ea
jmp 0x100010205
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x100014b2a
jmp 0x100013a95
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x10000ede4
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x100015534
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x100015361
jmp 0x10001086d
mov rcx, qword [rsp + 0x70]
call fcn.100014e42
jmp 0x100010aac
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x1000110ab
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x100012628
jmp 0x100015440
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1000134d8
jmp 0x1000145cf
jmp 0x10000ede4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x100015361

Function at 0x100014947
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x100013fa9
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x100014aee
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x10000f902
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
Function at 0x100017f50
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub rsp, 0x68
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, dword [rsp + 0x28]
xor edx, edx
cmp eax, edx
cmovl ecx, edx
mov eax, ecx
add rsp, 0x68
ret

Function at 0x100018680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov ebx, r8d
mov rdi, rdx
test r8d, r8d
jne 0x10001869f
mov al, 1
jmp 0x1000187d9
mov rax, qword [rcx + 0x10]
and dword [rsp + 0x28], 0
and qword [rsp + 0x98], 0
and qword [rsp + 0xb0], 0
and qword [rsp + 0xb8], 0
mov qword [rsp + 0x78], rax
movzx eax, word [rcx + 0x18]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
add ax, ax
lea rcx, [rsp + 0x60]
mov edx, 0x12019f
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], ax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x90], 0x30
mov dword [rsp + 0xa8], 0x40
mov dword [rsp + 0x20], 1
mov qword [rsp + 0xa0], rax
call qword [sym.imp.ntdll.dll_NtOpenFile]
cmp eax, 0xc000000f
je 0x100018732
cmp eax, 0xc0000034
jne 0x100018780
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 5
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x60]
mov edx, 0x12019f
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jns 0x100018788
xor al, al
jmp 0x1000187d9
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x60]
or qword [rsp + 0x68], 0xffffffffffffffff
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
setns al
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x1000188a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1b0
and dword [rsp + 0x20], 0
mov rbx, rdx
xor edx, edx
mov rsi, r8
mov rdi, rcx
lea r8d, [rdx + 0x3c]
lea rcx, [rsp + 0x24]
mov rbp, r9
call sub.ntdll.dll_memset
and dword [rsp + 0x60], 0
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, 0x144
call sub.ntdll.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x40]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x10001890b
xor al, al
jmp 0x100018967
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov r8d, 0x148
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x100018907
mov ecx, dword [rsp + 0x28]
test rdi, rdi
je 0x100018932
mov dword [rdi], ecx
test rsi, rsi
je 0x100018941
mov eax, dword [rsp + 0x8c]
mov qword [rsi], rax
test rbx, rbx
je 0x10001894d
mov eax, dword [rsp + 0x2c]
mov qword [rbx], rax
test rbp, rbp
je 0x100018965
mov rax, qword [rsp + 0x48]
xor edx, edx
sub rax, qword [rsp + 0x40]
div rcx
mov qword [rbp], rax
mov al, 1
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x100018e68
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
sub rsp, 0x1b0
or dword [rax + 0x14], 0xffffffff
mov ebx, ecx
mov dword [rax + 0x10], 0xffffd8f0
mov esi, 1
jmp 0x100018e9b
lea rdx, [rsp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
xor eax, eax
lock cmpxchg dword [0x10008865c], esi
jne 0x100018e8b
mov r8, qword [0x100085128]
cmp r8, 0xffffffffffffffff
jne 0x100018f54
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x100018edf
lock add dword [0x10008865c], 0xffffffff
xor eax, eax
jmp 0x100018f8d
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov r8d, 0x148
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x100018ed0
mov eax, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x48]
imul r8, rax
sub rcx, qword [rsp + 0x40]
mov rax, 0xfffffffffffffffe
cmp rcx, r8
cmovb r8, rcx
cmp r8, 0xffffffffffffffff
cmove r8, rax
cmp r8, 0x19000
ja 0x100018f39
xor r8d, r8d
jmp 0x100018f4d
movabs rax, 0xcccccccccccccccd
mul r8
shr rdx, 3
sub r8, rdx
mov qword [0x100085128], r8
cmp rbx, r8
ja 0x100018ed0
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
test rax, rax
je 0x100018f85
sub qword [0x100085128], rbx
lock add dword [0x10008865c], 0xffffffff
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rsi
ret
Function at 0x100018fa4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
or dword [rax + 0x14], 0xffffffff
mov dword [rax + 0x10], 0xffffd8f0
mov rax, qword gs:[0x30]
mov rdi, rcx
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov r8, rdi
call qword [sym.imp.ntdll.dll_RtlSizeHeap]
mov esi, 1
mov rbx, rax
jmp 0x100018ff5
lea rdx, [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
xor eax, eax
lock cmpxchg dword [0x10008865c], esi
jne 0x100018fe8
mov rcx, qword [0x100085128]
cmp rcx, 0xffffffffffffffff
je 0x10001901a
mov eax, ebx
add rcx, rax
mov qword [0x100085128], rcx
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lock add dword [0x10008865c], 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x100023a4c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
movzx r8d, word [rcx]
xor ebx, ebx
mov rax, rcx
mov edx, ebx
jmp 0x100023a74
add rax, 2
inc edx
cmp word [rax], bx
jne 0x100023a5f
add rax, 2
inc edx
mov r8w, word [rax]
cmp r8w, bx
jne 0x100023a5f
lea eax, [rdx + rdx + 2]
mov r9d, 7
lea r8, [0x10000bb38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea ecx, [r9 - 5]
lea rdx, [0x10000bb50]
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
cmp eax, ebx
setge al
add rsp, 0x30
pop rbx
ret
Function at 0x10003c2a4
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0xd0
xor ebx, ebx
lea rax, [0x10000bc60]
mov dil, dl
mov qword [rsp + 0x50], rax
mov qword [r11 - 0x68], rbx
mov dword [r11 - 0x60], ebx
mov qword [r11 - 0x58], rbx
mov dword [r11 - 0x50], ebx
lea rax, [0x1000017d8]
mov qword [r11 - 0x78], rax
mov rax, qword [0x1000882a8]
lea r8, [r11 + 0x20]
mov qword [r11 - 0x70], rax
mov rax, qword [0x100088340]
mov dword [rsp + 0x6c], ebx
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov r9d, 0x80
mov word [r11 - 0x48], bx
mov byte [r11 - 0x45], bl
mov qword [r11 - 0x40], rbx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x28], rbx
mov byte [r11 - 0x1f], bl
mov qword [rsp + 0x20], rbx
call fcn.100030580
cmp al, bl
je 0x10003c47f
cmp qword [rsp + 0xb8], rbx
je 0x10003c354
lea rcx, [0x10000c050]
jmp 0x10003c47a
lea rax, [rsp + 0x108]
mov esi, 4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8, rbx
mov r9d, esi
mov qword [rsp + 0x20], rax
call fcn.1000263a0
cmp al, bl
je 0x10003c473
cmp dword [rsp + 0x108], esi
jne 0x10003c473
cmp dil, bl
jne 0x10003c3de
lea rax, [rsp + 0x108]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r9d, esi
mov r8, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x444b4843
call fcn.1000269f8
cmp al, bl
je 0x10003c47f
cmp dword [rsp + 0x108], esi
je 0x10003c465
jmp 0x10003c47f
call fcn.100017f50
mov edi, eax
cmp eax, ebx
je 0x10003c47f
lea rcx, [rdi + 0x10]
cmp qword [rsp + 0xb0], rcx
jb 0x10003c47f
xor eax, eax
mov esi, ebx
mov ebp, ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x444b4843
lea rax, [rsp + 0x108]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov r8d, ebp
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1000269f8
cmp al, bl
je 0x10003c47f
cmp dword [rsp + 0x108], 0x10
jne 0x10003c47f
inc esi
add ebp, edi
cmp esi, 2
jb 0x10003c424
lea rcx, [rsp + 0x50]
call fcn.100024af8
mov al, 1
jmp 0x10003c48b
lea rcx, [0x10000c080]
call sub.ntdll.dll_DbgPrint
lea rcx, [rsp + 0x50]
call fcn.100024af8
xor al, al
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret

Function at 0x10003ed7c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
xor ecx, ecx
mov r8d, 1
add rdx, 0x40
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
lea rdx, [rdi + 0x41]
mov r8d, 1
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
lea rdx, [rsp + 0x30]
mov r8d, 4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov r8d, 8
mov rdx, rdi
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
movzx r8d, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
add r8d, r8d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov rbx, qword [rsp + 0x38]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10003ee0c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rdx, rcx
mov ebx, 0x18
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
cmp byte [0x100088659], 2
jb 0x10003ee44
bt dword [rdi + 0x30], 0xa
jb 0x10003ee49
mov ebx, 0x16
lea rdx, [rdi + 0x20]
mov r8d, ebx
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov rbx, qword [rsp + 0x30]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x10004280c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x100085100]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rax, qword gs:[0x30]
mov r9d, ecx
xor r8d, r8d
mov rcx, qword [rax + 0x60]
mov rbx, rdx
lea rax, [rsp + 0x38]
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0xb]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlFindMessage]
test eax, eax
jns 0x100042864
xor al, al
jmp 0x100042904
mov r9, qword [rsp + 0x38]
test byte [r9 + 2], 1
je 0x100042876
add r9, 4
jmp 0x1000428ac
or rcx, 0xffffffffffffffff
add r9, 4
xor eax, eax
mov rdi, r9
lea r8, [rsp + 0x30]
mov edx, 0x3e8
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x10004285d
lea r9, [rsp + 0x40]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
repne scasw ax, word [rdi]
lea r8, [rsp + 0x30]
mov edx, 0x64
not rcx
lea eax, [rcx + rcx]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_RtlUnicodeToOemN]
test eax, eax
js 0x10004285d
mov eax, dword [rsp + 0x30]
xor edx, edx
xor ecx, ecx
add eax, 0xfffffffe
je 0x100042902
cmp byte [rcx + rbx], 0x25
jne 0x1000428f3
cmp byte [rcx + rbx + 1], 0x30
je 0x1000428fe
inc edx
inc rcx
cmp edx, eax
jae 0x100042902
jmp 0x1000428e6
mov byte [rdx + rbx], 0
mov al, 1
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1000807a0
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret
Function at 0x100047abc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rdi, rcx
movzx ecx, word [rcx + 0x1c]
mov rsi, r9
mov ebp, r8d
mov r11d, 0x20
movzx r10d, r12w
movzx eax, word [rdi + 0x1a]
sub r11w, cx
and ax, dx
shr edx, cl
xor r10w, ax
cmp r11w, r12w
jg 0x100047aef
movzx ebx, r10w
shl rbx, 4
add rbx, qword [rdi + 0x10]
cmp qword [rbx + 8], r12
jne 0x100047b3b
movzx ecx, word [rdi + 0x1e]
shl ecx, 2
call fcn.100018e68
mov qword [rbx + 8], rax
cmp rax, r12
jne 0x100047b31
xor al, al
jmp 0x100047b81
mov dword [rbx], r12d
movzx eax, word [rdi + 0x1e]
mov dword [rbx + 4], eax
mov eax, dword [rbx + 4]
cmp dword [rbx], eax
jne 0x100047b64
movzx edx, word [rdi + 0x1e]
mov rcx, qword [rbx + 8]
add edx, eax
shl edx, 2
call fcn.100019054
cmp rax, r12
je 0x100047b2d
mov qword [rbx + 8], rax
movzx eax, word [rdi + 0x1e]
add dword [rbx + 4], eax
mov ecx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], ebp
mov rcx, qword [rbx + 8]
inc dword [rbx]
mov edx, dword [rbx]
mov qword [rsi], rcx
mov rcx, qword [rsp + 0x50]
mov dword [rcx], edx
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1000807a0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100085100]
jne 0x1000807bb
rol rcx, 0x10
test cx, 0xffff
jne 0x1000807b7
ret 0
ror rcx, 0x10
jmp 0x1000807c8
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rsi, [0x100087da0]
mov rcx, rsi
call sub.ntdll.dll_RtlCaptureContext
mov rdi, qword [0x100087e98]
lea rdx, [rsp + 0x70]
mov rcx, rdi
xor r8d, r8d
call sub.ntdll.dll_RtlLookupFunctionEntry
test rax, rax
je 0x10008083b
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_RtlVirtualUnwind
mov r11, qword [0x100087e98]
jmp 0x100080857
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x100087e98], r11
mov qword [0x100087e38], rax
mov rax, qword [0x100085100]
mov qword [0x100087e20], rbx
mov qword [0x100087d10], r11
mov dword [0x100087d04], 1
mov ebx, 0xc0000409
lea rcx, [0x1000013a0]
mov dword [0x100087d00], ebx
mov qword [rsp + 0x40], rax
mov rax, qword [0x100085108]
mov qword [rsp + 0x48], rax
call sub.ntdll.dll_RtlUnhandledExceptionFilter
mov edx, ebx
or rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1000807c8
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100085100]
jne 0x1000807bb
rol rcx, 0x10
test cx, 0xffff
jne 0x1000807b7
ret 0
ror rcx, 0x10
jmp 0x1000807c8
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rsi, [0x100087da0]
mov rcx, rsi
call sub.ntdll.dll_RtlCaptureContext
mov rdi, qword [0x100087e98]
lea rdx, [rsp + 0x70]
mov rcx, rdi
xor r8d, r8d
call sub.ntdll.dll_RtlLookupFunctionEntry
test rax, rax
je 0x10008083b
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_RtlVirtualUnwind
mov r11, qword [0x100087e98]
jmp 0x100080857
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x100087e98], r11
mov qword [0x100087e38], rax
mov rax, qword [0x100085100]
mov qword [0x100087e20], rbx
mov qword [0x100087d10], r11
mov dword [0x100087d04], 1
mov ebx, 0xc0000409
lea rcx, [0x1000013a0]
mov dword [0x100087d00], ebx
mov qword [rsp + 0x40], rax
mov rax, qword [0x100085108]
mov qword [rsp + 0x48], rax
call sub.ntdll.dll_RtlUnhandledExceptionFilter
mov edx, ebx
or rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002bb60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002bb6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002bb7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002bb65
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002bb95
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002bb82
sub eax, 3
jb 0x14002bbaf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002bbe6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002bbd6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002bbd4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002bbc3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002bb22
jmp 0x14002bb6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002bc32
cmp rsi, rcx
jae 0x14002bc3a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002bc19
cmp al, 0x8f
ja 0x14002bc19
cmp byte [rsi - 2], 0xf
je 0x14002bc1f
sub al, 0xe8
cmp al, 1
ja 0x14002bc03
cmp rsi, rcx
jae 0x14002bc3a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002bc09
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002bc3a
lodsb al, byte [rsi]
jmp 0x14002bc19
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x29000]
mov eax, dword [rdi]
or eax, eax
je 0x14002bca3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2cf94]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002bc47
jns 0x14002bc7c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002bc86
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002bc9d
mov qword [rbx], rax
add rbx, 8
jmp 0x14002bc67
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002bcfb
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret