joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f9b84
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800f996f
xor ecx, ecx
call qword [0x180134100]
test rax, rax
je 0x1800f996f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800f996f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800f996f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800f996f
cmp dword [rcx + 0x84], 0xe
jbe 0x1800f996f
cmp dword [rcx + 0xf8], 0
je 0x1800f996f
mov ecx, ebx
call fcn.1800f9a8c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800f96dc
nop
cmp dword [rbp + 0x20], 0
je 0x1800f99bd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800f99c8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800f9900

Function at 0x1800fb17c
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.1800e2040
mov rax, qword [rbp - 0x58]
mov edi, 0xfde9
cmp dword [rax + 0xc], edi
jne 0x1800fb1c7
xor ebx, ebx
cmp byte [rbp - 0x48], bl
je 0x1800fb1fb
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1800fb1fb
call fcn.18010e1ac
xor ebx, ebx
test eax, eax
jne 0x1800fb1e9
cmp byte [rbp - 0x48], bl
je 0x1800fb1e2
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, 1
jmp 0x1800fb1fb
cmp byte [rbp - 0x48], bl
je 0x1800fb1f9
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, ebx
mov r9d, edi
mov qword [rbp - 0x30], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x28], rbx
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x20], rbx
mov rcx, rsi
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov byte [rbp - 8], bl
call fcn.1800eaef8
mov esi, eax
test eax, eax
je 0x1800fb237
call fcn.1800df380
or edi, 0xffffffff
mov dword [rax], esi
jmp 0x1800fb290
mov r9d, edi
mov qword [rbp - 0x60], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x58], rbx
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], rbx
mov rcx, r14
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov byte [rbp - 0x38], bl
call fcn.1800eaef8
mov edi, eax
test eax, eax
je 0x1800fb273
call fcn.1800df380
mov dword [rax], edi
or edi, 0xffffffff
jmp 0x1800fb282
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x20]
call fcn.1800ff6a8
mov edi, eax
cmp byte [rbp - 0x38], bl
je 0x1800fb290
mov rcx, qword [rbp - 0x50]
call fcn.180100634
cmp byte [rbp - 8], bl
je 0x1800fb29e
mov rcx, qword [rbp - 0x20]
call fcn.180100634
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180109ee0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x180109f12
call fcn.1800df380
mov dword [rax], socket
call fcn.1800bc6f4
jmp 0x18010a031
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18010a031
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18010a031
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x180109f41
lock or dword [rcx + 0x14], 0x10
jmp 0x18010a031
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x180109f55
call fcn.180113ae8
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.180104fb0
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1801095f0
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x18010a01f
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x180109fea
mov rcx, rsi
call fcn.180104fb0
cmp eax, edi
je 0x180109fd5
mov rcx, rsi
call fcn.180104fb0
cmp eax, 0xfffffffe
je 0x180109fd5
mov rcx, rsi
call fcn.180104fb0
movsxd rbx, eax
lea r14, [0x1801716c0]
mov rcx, rsi
sar rbx, 6
call fcn.180104fb0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x180109fdc
lea rdx, [0x1801694e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180109fea
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x18010a00e
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x18010a00e
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x18010a00e
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x18010a034
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x180279a9f
Capabilities:
Encode data using xor

Disassembly:
push rsi
rcr r11b, cl
mov dl, byte [rdx]
out dx, eax
movabs eax, dword [0x4047752b22499e84]
invalid
cwde
sahf
invalid
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.1805582af
push rsi
cdq
cdq
lea ebx, [rbp + 0x5c]
jb 0x180279a3f
sahf
sub ebx, dword [rbp + rcx*4 + 0x62d36627]
jb 0x180279a7f
sub al, 0x1e
invalid

Function at 0x1802c5589
Capabilities:
Packed with generic packer

Disassembly:
or dl, 0x82
jno 0x1803685b6

Function at 0x1802e3cc3
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x10]
call fcn.180652b66
mov r12b, 0x86
mov ah, 0x86
xor byte [rdx], dh
pop rbx
lodsb al, byte [rsi]
test eax, 0xb6179cd4
cmp ch, byte ss:[rax + 0xe09fe23]
mov esp, 0xba41b934
mov bh, 1
mov dh, dh
xchg ecx, eax
jns 0x1802e3ccf
cmpsb byte [rsi], byte [rdi]
mov dl, 0x60
mov ch, 0xc5
invalid

Function at 0x1803085be
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
xor edx, 0x243e3174
neg dl
test rdx, 0x35f42a41
je fcn.1802c9a85
mov rdx, qword [rsp + 8]
jno 0x18038dee4
call fcn.1802e2779
Function at 0x18035bb20
Capabilities:
Encode data using xor

Disassembly:
push r12
and r9, 0x501e3b06
mov qword [rsp + 0x28], 0x64eda54b
mov r12, r9
neg r9w
movzx r12, r9b
sub r9d, 0x7ada7b38
push r10
mov r9, qword [rsp + 0x28]
movabs r10, 0x18fb490a23dc4d19
lea r10, [r10 + r12*4 + 0x17957207]
xor r12b, 0x31
mov r10b, 0x66
cmp r12d, 0x292247da
lea r10, [r10*4 + 0x798b5276]
cmovl r10, r12
jge 0x18035bb5d
mov r12, qword [rsp + 8]
call fcn.180439711

Function at 0x18035c7bf
Capabilities:
Encode data using xor

Disassembly:
call 0x18053b0f3
mov ds, ebp
xor edi, dword [ecx]
mov eax, 0x96e24ca6
invalid
invalid
jb 0x1802f2393
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.180595ddc
jo 0x18035c785
and byte [rbp + 0x24648d48], bl
xor al, ch
or byte [rsi - 0x508fffdd], dl
and dword [rsi + 0x31e06c96], ebp
jbe 0x18035c7c8
div dword [rsi + 0x3e]
jae 0x18035c7a7
mov dword [r13 - 0x33], r14d
and dword [rcx - 0x33], ebp
invalid

Function at 0x1803b37bd
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rsp + 0x18]
neg r11
and r11w, r11w
not r11
xor r11b, 0x5b
mov r11, qword [rsp + 0x28]
je 0x1803b37c5
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
call fcn.1805582af
mov dword [rbx - 0x43], ecx
out 0xbc, al
jrcxz 0x1803b37fd
mov dh, reloc.WS2_32.dll_socket
popfq
invalid
rol ch, cl
sbb ah, ch
sub edx, dword [rsi - 0x49]
sub dil, dl
xlatb
mov al, 0x4e
call 0x169ce4c3a
sbb bh, bh
jge 0x1803b3810
mov dl, reloc.WS2_32.dll_socket
and dh, byte [rcx + 0x28251ad6]
out dx, eax
in eax, 0x5a
xchg esp, eax
invalid

Function at 0x1803ee8f6
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0x7fbd2969
push 0x767d05c4
push rcx
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.180595ddc
push rbp
pushfq
movabs rbp, 0x43c769de48274c8e
or bp, 0xeb1
add bp, bp
mov qword [rsp + 0x10], 0xffffffffb6de1a73
xor bpl, 0x91
xor ebp, 0x60b04832
push rbp
add byte [rsp], 0xfa
jg 0x1803ee935
movzx ebp, byte [rsp]
mov rbp, qword [rsp + 0x10]
neg word [rsp]
call fcn.18005ec8d
pop rdx
or r8b, al
jg 0x1803ee97d
or eax, 0xb85c1080
invalid
jrcxz 0x1803ee9f2
push rdx
add al, 0x40
invalid
movsd dword [rdi], dword [rsi]
invalid

Function at 0x1804195b1
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1805582af
cdq
stosd dword [rdi], eax
ror dword [rbx + 0x10f1c91c], cl
push rbp
mov al, 0x7d
xor eax, 0xd0f749f2
fistp qword [rbx - 0x24cebbb1]
jge 0x1804195c8
cmpsb byte [rsi], byte [rdi]
invalid

Function at 0x180444361
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x30]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1805c6960
test byte [rcx], dl
add dh, byte [rsi - 0x31]
push 0xffffffffef11fac8
invalid

Function at 0x180446545
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
call fcn.1806125e0
fsubr dword [rsi + riz*8]
stosd dword [rdi], eax
mov cs, ebp
mov edi, ecx
or eax, 0x2d6fee34
invalid
Function at 0x180483b8e
Capabilities:
Encode data using xor

Disassembly:
push r15
pushfq
movabs r15, 0xd56481f5bc928e6
neg r15
mov r15, qword [rsp + 8]
push rsi
or eax, 0x4cdff749
mov edi, dword [rsp + 8]
push qword [rsp]
popfq
lea rsp, [rsp + 0x28]
call fcn.180666dcd
or byte [rbx + rbp*8 - 0x52356054], bl
mov al, 0xcf
outsd dx, dword [rsi]
xor byte [rbx + 0xe], bl
test eax, 0xdc08f98f
sbb rax, 0xffffffffb36b4f72
jb 0x180483b99
rep outsb dx, byte cs:[rsi]
fnstsw word [rax - 0x6d7cbfaf]
sub edx, dword [rbx]
add al, 0xca
ret 0x1768

Function at 0x18048b33a
Capabilities:
Encode data using xor

Disassembly:
neg dword [rsp + 0x18]
neg byte [rsp + 0x18]
xor byte [rsp + 0x18], 0xce
jns 0x18048b33e
mov byte [rsp + 0x18], 0x8b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1805d1a78

Function at 0x1805582af
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
not rsi
bswap esi
push rdi
movsx rsi, r9w
movzx rsi, si
push rbp
mov rbp, r11
movzx ebp, r11w
push rdx
movzx edx, bx
push rax
lahf
push r9
xchg dh, dh
push rbx
push r8
push rcx
mov dh, 0x46
not bh
push r12
push r13
cwd
push r10
push r11
mov rbx, rax
cdq
movzx rbx, r14w
pushfq
push r15
cwde
push r14
bsr si, r13w
movabs rsi, 0
rdtsc
cdq
cbw
push rsi
sar edx, cl
movzx rbp, dx
rcl bpl, 0x70
mov r8, qword [rsp + 0x90]
sbb edx, esi
rol dx, 0x33
xor r8d, 0x43e51484
bswap r8d
rcr bpl, 0xa
btr r11d, 0xa
rol r8d, 1
movsx rax, r10w
mov ah, 0xe5
lahf
inc r8d
movsx r11, r11w
not r8d
add r8d, 0x1fa65e89
btr bp, 0x1b
movzx rbp, r9w
cwde
lea r8, [r8 + rsi]
movabs rdx, 0x100000000
add r8, rdx
rcl dx, cl
mov rbp, rsp
bt bx, cx
rdtsc
sub rsp, 0x180
setne r11b
and rsp, 0xfffffffffffffff0
ror bl, 0x42
or ah, 0xc
mov r11, r8
movabs rax, 0
btc ebx, 0xdb
sbb dl, r10b
sub r11, rax
bts rdx, r11
clc
sub bh, 0x65
lea rbx, [0x1805583ab]
bswap edx
sub r8, 4
cmovg dx, r12w
cmc
rol dh, cl
mov edx, dword [r8]
xor edx, r11d
clc
jmp 0x18055ec82
sub edx, 0x72d963aa
stc
ror edx, 2
jmp 0x1805ec53e
jmp rbx
inc edx
jmp 0x180645f04
ror edx, 2
push r11
xor dword [rsp], edx
xchg r11, r11
neg r11
pop r11
movsxd rdx, edx
stc
add rbx, rdx
jmp 0x1805644dc

Function at 0x180776616
Capabilities:
Encode data using xor

Disassembly:
seto dil
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x18], 0x175c632d
xor dword [rsp + 0x18], 0x483a4aa2
call fcn.1806eeb50
pop rdx
mov ch, 0x77
invalid
Function at 0x18087920c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, 0x72d963aa
stc
ror edx, 2
jmp 0x1807e990b
inc edx
jmp 0x18083b1b8
ror edx, 2
push r11
xor dword [rsp], edx
xchg r11, r11
neg r11
pop r11
movsxd rdx, edx
stc
add rbx, rdx
jmp 0x1808d0739
push rsi
not rsi
bswap esi
push rdi
movsx rsi, r9w
movzx rsi, si
push rbp
mov rbp, r11
movzx ebp, r11w
push rdx
movzx edx, bx
push rax
lahf
push r9
xchg dh, dh
push rbx
push r8
push rcx
mov dh, 0x46
not bh
push r12
push r13
cwd
push r10
push r11
mov rbx, rax
cdq
movzx rbx, r14w
pushfq
push r15
cwde
push r14
bsr si, r13w
movabs rsi, 0
rdtsc
cdq
cbw
push rsi
sar edx, cl
movzx rbp, dx
rcl bpl, 0x70
mov r8, qword [rsp + 0x90]
sbb edx, esi
rol dx, 0x33
xor r8d, 0x43e51484
bswap r8d
rcr bpl, 0xa
btr r11d, 0xa
rol r8d, 1
movsx rax, r10w
mov ah, 0xe5
lahf
inc r8d
movsx r11, r11w
not r8d
add r8d, 0x1fa65e89
btr bp, 0x1b
movzx rbp, r9w
cwde
lea r8, [r8 + rsi]
movabs rdx, 0x100000000
add r8, rdx
rcl dx, cl
mov rbp, rsp
bt bx, cx
rdtsc
sub rsp, 0x180
setne r11b
and rsp, 0xfffffffffffffff0
ror bl, 0x42
or ah, 0xc
mov r11, r8
movabs rax, 0
btc ebx, 0xdb
sbb dl, r10b
sub r11, rax
bts rdx, r11
clc
sub bh, 0x65
lea rbx, [0x180879308]
bswap edx
sub r8, 4
cmovg dx, r12w
cmc
rol dh, cl
mov edx, dword [r8]
xor edx, r11d
clc
jmp 0x1807e1262
jmp rbx
Function at 0x140011276
Capabilities:
Terminate process

Disassembly:
jmp 0x1400140f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011311
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015440
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015460
xor al, al
jmp 0x1400154e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015473
xor al, al
jmp 0x1400154e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001549d
xor al, al
jmp 0x1400154e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400154b1
xor al, al
jmp 0x1400154e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400154c3
xor al, al
jmp 0x1400154e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400154df
xor al, al
jmp 0x1400154e1
mov al, 1
add rsp, 0x38
ret
Function at 0xa70e30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xa70e3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xa70e4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xa70e35
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0xa70e65
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xa70e52
sub eax, 3
jb 0xa70e7f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xa70eb6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0xa70ea6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0xa70ea4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xa70e93
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.00a70df2
jmp 0xa70e3d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x293400
mov dl, 0x6b
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xa70f02
cmp rsi, rcx
jae 0xa70f0a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xa70ee9
cmp al, 0x8f
ja 0xa70ee9
cmp byte [rsi - 2], 0xf
je 0xa70eef
sub al, 0xe8
cmp al, 1
ja 0xa70ed3
cmp rsi, rcx
jae 0xa70f0a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xa70ed9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xa70f0a
lodsb al, byte [rsi]
jmp 0xa70ee9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x669000]
mov eax, dword [rdi]
or eax, eax
je 0xa70f67
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x671000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xa70f17
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xa70f61
mov qword [rbx], rax
add rbx, 8
jmp 0xa70f37
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xa70fab
cmp al, 0xef
ja 0xa70f93
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xa70f73
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xa70f82
mov eax, dword [rdi]
add rdi, 4
jmp 0xa70f82
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xa70fff
sub rsp, 0xffffffffffffff80
jmp 0x467200
Function at 0x140001030
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x85b3e12
mov rbx, rcx
jne 0x140001087
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001087
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [0x140002068]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001087
call fcn.14000172d
test rax, rax
je 0x140001087
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [0x140002058]
xor eax, eax
jmp 0x14000108c
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001094
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x85b3e12
mov rsi, rcx
je 0x1400010b8
mov eax, 0xc0000001
jmp 0x140001165
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x30]
mov edi, ebx
lea ecx, [rbx + 0x42]
call fcn.140001733
cmp eax, 0xc0000004
jne 0x140001163
test rdi, rdi
je 0x1400010f0
xor edx, edx
mov rcx, rdi
call qword [0x140002018]
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call qword [0x140002010]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x42
mov rdi, rax
call fcn.140001733
cmp eax, 0xc0000004
je 0x1400010e0
test rdi, rdi
je 0x140001163
mov r8d, dword [rdi]
test r8d, r8d
je 0x140001158
lea rcx, [rdi + 8]
mov rdx, qword [rcx]
and rdx, 0xfffffffffffffffe
test byte [rcx], 1
je 0x14000114d
cmp qword [rcx + 8], 0x200000
jne 0x14000114d
cmp dword [rcx + 0x10], 0x546e6f43
je 0x140001175
inc ebx
add rcx, 0x18
cmp ebx, r8d
jb 0x14000112e
xor edx, edx
mov rcx, rdi
call qword [0x140002018]
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi + 8]
mov qword [rax], rdx
jmp 0x140001163

Function at 0x140001180
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x85b3e12
mov rdi, rcx
jne 0x140001245
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001245
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [0x140002068]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001245
call fcn.14000125c
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [0x140002058]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.1400014a4
test rax, rax
je 0x140001245
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov rcx, qword [rdi + 0x10]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
cmp byte [rdi + 0x20], 0
movsxd r8, esi
je 0x140001228
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.140001674
jmp 0x140001241
lea rdx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [0x140002060]
xor eax, eax
jmp 0x14000124a
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rcx + 0xe55fa41], cl
sub dword [rcx - 0x80], esi
retf 0xccba
xor eax, 0x240b36a0
or esp, dword ss:[rcx + rbp]
invalid
invalid
invalid
invalid
xor eax, dword [rcx - 0x49]
push 0x73d91965
jae 0x14003f6e6
jo 0x14003f653
invalid
and edx, dword [rbp + 0x3dbabf3b]
pop rbx
cmp ch, byte [rdi - 0x53cb3b1d]
imul edx, dword [rax + 0x18436647], 0x4a
invalid
hlt
loopne 0x14003f677
invalid
mov al, 0x81
xor dword [rbx], ebp
sub esi, dword [rax + 0xcfbad60]
sti
or al, 0xc4
sti
or al, 0xc4
movsb byte [rdi], byte [rsi]
sahf
push rbx
cmp ch, byte [rbx]
adc dword ds:[rsi], edx
mov dh, 0x1b
outsb dx, byte [rsi]
mov esp, 0x31cfc039
sbb eax, 0x253fc243
invalid
and eax, 0x59205c9f
lodsb al, byte [rsi]
sbb qword [0xe11bea1a], rdi
add al, 0xf3
invalid
invalid
push rsp
xchg ebp, eax
cwde
hlt
invalid
invalid