joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14025d0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x14027e180]
xor rax, rsp
mov qword [rsp + 8], rax
xor edx, edx
lea r15, [0x14026f820]
mov dword [rsp], edx
mov r8, rcx
movzx edi, byte [rsp + 3]
xor eax, eax
movzx esi, byte [rsp + 2]
movzx ebx, dl
movzx ebp, byte [rsp + 1]
movzx r14d, dl
mov word [rsp + 4], dx
movzx r11d, byte [rsp + 5]
nop dword [rax]
movzx r10d, byte [r8 + rax]
movzx ecx, r10b
xor cl, byte [rax + r15]
or cl, r14b
movzx r14d, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x20]
or cl, bpl
movzx ebp, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x40]
or cl, sil
movzx esi, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x60]
or cl, dil
movzx edi, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x80]
or cl, bl
movzx ebx, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0xa0]
xor r10b, byte [rax + r15 + 0xc0]
or cl, r11b
or r10b, dl
movzx r11d, cl
inc rax
movzx edx, r10b
cmp rax, 0x1f
jb 0x14025d130
movzx ecx, byte [rax + r8]
movzx r9d, byte [rax + r15]
and cl, 0x7f
movzx edx, byte [rax + r15 + 0xa0]
movzx r8d, cl
xor edx, r8d
movzx ecx, r10b
or edx, r11d
xor r9d, r8d
dec edx
or r9d, r14d
dec r9d
or r9d, edx
movzx edx, byte [rax + r15 + 0x80]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x60]
xor edx, r8d
or edx, edi
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x20]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x40]
movzx eax, byte [rax + r15 + 0xc0]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, ecx
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.14026ce80
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret
Function at 0x14025dad0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x1402621e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x14026a9f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x14026aa00
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x14026cd50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14026cd8a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14026cd8f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14026cdd8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140277a40]
cmp byte [rcx + rax], 0
je 0x14026cdd8
dec r8
sub rdx, 1
jne 0x14026cdbe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14026dadc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14026db26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14026db26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14026db26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14026db26
cmp dword [rcx + 0x84], 0xe
jbe 0x14026db26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14026db28
xor al, al
add rsp, 0x28
ret
Function at 0x140003168
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400031b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400031b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400031b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400031b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400031b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400031b4
xor al, al
add rsp, 0x28
ret
Function at 0x140011163
Capabilities:
Terminate process

Disassembly:
jmp 0x140013e10
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x140027169]
call fcn.140011410
nop
mov dword [rbp + 0x44], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp + 8]
mov r8d, 1
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x140013e98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenThreadToken_failed_with_error_code__d__n
call fcn.1400111f4
nop
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x24]
mov edx, 9
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140013edf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetTokenInformation_failed_with_error_code__d__n
call fcn.1400111f4
nop
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
cmp dword [rbp + 0x24], 2
jge 0x140013eee
mov eax, 1
jmp 0x140013efd
xor eax, eax
jmp 0x140013efd
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001df00]
call fcn.14001138e
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.14001120d
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x1400155f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112e4
Capabilities:
Terminate process

Disassembly:
jmp 0x140013f80
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x198]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x140027169]
call fcn.140011410
nop
lea rax, [rbp + 8]
lea rcx, str.cmd__c__whoami__all___C:Windows_bypassuac.txt_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 8]
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x78], 0xffffffffffffffff
cmp dword [rbp + 0x170], 1
jle 0x140014017
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x178]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x58], rax
call fcn.1400110af
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0xffffffffffffffff
jne 0x140014033
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov rcx, qword [rbp + 0x78]
call fcn.1400113d4
nop
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
nop
call fcn.140011163
test eax, eax
je 0x140014053
jmp 0x14001405d
mov rcx, qword [rbp + 0x58]
call fcn.140011253
nop
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001dfa0]
call fcn.14001138e
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.14001120d
lea rsp, [rbp + 0x150]
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400112ee
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016940
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016960
xor al, al
jmp 0x1400169e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016973
xor al, al
jmp 0x1400169e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001699d
xor al, al
jmp 0x1400169e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400169b1
xor al, al
jmp 0x1400169e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400169c3
xor al, al
jmp 0x1400169e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400169df
xor al, al
jmp 0x1400169e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140014830
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011438
movzx eax, al
test eax, eax
jne 0x140014850
mov ecx, 7
call fcn.140011398
nop
mov byte [rsp + 0x20], 0
call fcn.1400113ac
mov byte [rsp + 0x21], al
cmp dword [0x140021868], 1
jne 0x140014874
mov ecx, 7
call fcn.140011398
nop
jmp 0x1400148cc
cmp dword [0x140021868], 0
jne 0x1400148c7
mov dword [0x140021868], 1
lea rdx, [0x14001c660]
lea rcx, [0x14001c330]
call fcn.1400111f9
test eax, eax
je 0x1400148a8
mov eax, 0xff
jmp 0x1400149d1
lea rdx, [0x14001c220]
lea rcx, [section..rdata]
call fcn.1400113a2
mov dword [0x140021868], 2
jmp 0x1400148cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011384
call fcn.140011311
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140014929
mov rcx, qword [rsp + 0x30]
call fcn.140011195
movzx eax, al
test eax, eax
je 0x140014929
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140028020]
nop
call fcn.140011348
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001495d
mov rcx, qword [rsp + 0x38]
call fcn.140011195
movzx eax, al
test eax, eax
je 0x14001495d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113f2
nop
call fcn.140014a80
mov dword [rsp + 0x28], eax
call fcn.1400112ee
movzx eax, al
test eax, eax
jne 0x14001497c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001498b
call fcn.1400113fc
nop
xor edx, edx
mov cl, 1
call fcn.140011186
mov eax, dword [rsp + 0x28]
jmp 0x1400149d1
add rsp, 0x68
ret
Function at 0x14013182b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
mov eax, dword [r15 + 0x54]
lea rdx, [rbp + 0xe0]
jmp 0x1401319a7
xchg rbx, rax
mov qword [rbp + 0xd8], rbx
xchg rbx, rax
jmp 0x14013158b
Function at 0x1400017a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x28], ILCreateFromPathA
mov byte [rsp + 0x29], 0x1d
mov byte [rsp + 0x2a], 0x32
mov byte [rsp + 0x2b], 0x8d
mov byte [rsp + 0x2c], 0x36
mov byte [rsp + 0x2d], 0x71
mov byte [rsp + 0x2e], reloc.SHELL32.dll_ILCombine
mov byte [rsp + 0x2f], 0x63
mov byte [rsp + 0x30], 0xd8
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x40], 0x91e2775a
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xa
jae 0x140001843
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x68], rcx
movzx ecx, byte [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
movzx eax, byte [rdx + rax]
ror al, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x40]
ror eax, 0xb
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400017f5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140001862
xor eax, eax
jmp 0x1400019b7
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140001882
xor eax, eax
jmp 0x1400019b7
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
je 0x1400018af
xor eax, eax
jmp 0x1400019b7
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400018e3
xor eax, eax
jmp 0x1400019b7
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x20], 0
je 0x1400019ac
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x18], 0
je 0x1400019ac
mov rax, qword [rsp + 0x80]
cmp qword [rax + 8], 0
je 0x1400019ac
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x1400019ac
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x10], 0
jne 0x1400019b2
xor eax, eax
jmp 0x1400019b7
mov eax, 1
add rsp, 0x78
ret
Function at 0x14010cc00
Capabilities:
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov word [rsp + 0x20], r9w
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0x78
mov eax, 0x5e97
mov word [rsp + 0x20], ax
movabs rax, 0x24b8cddd9c69a68c
mov qword [rsp + 0x40], rax
movsx eax, word [rsp + 0x20]
add eax, 0xbed
mov word [rsp + 0x20], ax
movzx eax, byte [rsp + 0x90]
movzx ecx, byte [rsp + 0x80]
sub eax, ecx
movzx ecx, byte [rsp + 0x88]
cmp eax, ecx
jge 0x14010cd27
movsx eax, word [rsp + 0x20]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x921
je 0x14010cc76
jmp 0x14010ccef
movabs rax, 0x1932949c965e953e
cmp qword [rsp + 0x40], rax
je 0x14010cce0
movsx eax, word [rsp + 0x20]
xor eax, 0x5576
mov word [rsp + 0x20], ax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x30], eax
call fcn.14010bb20
movsx eax, word [rsp + 0x20]
or eax, 0x7095
mov word [rsp + 0x20], ax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [rsp + 0x34], eax
mov edx, 1
lea rcx, [fcn.14010cc00]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [rsp + 0x38], eax
jmp 0x14010cced
movsx eax, word [rsp + 0x20]
sar eax, 0xb
mov word [rsp + 0x20], ax
jmp 0x14010cd25
movzx r9d, word [rsp + 0x98]
movzx r8d, byte [rsp + 0x88]
movzx edx, byte [rsp + 0x90]
movzx ecx, byte [rsp + 0x90]
call fcn.14010cc00
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x80], al
jmp 0x14010cd73
movzx eax, word [rsp + 0x98]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
je 0x14010cd3c
jmp 0x14010cd64
mov dword [rsp + 0x3c], 0x63c3c877
mov byte [rsp + 0x24], 0x77
lea rax, [rsp + 0x24]
mov qword [rsp + 0x48], rax
movabs rax, 0x78fb31b159ee5666
mov qword [rsp + 0x60], rax
jmp 0x14010cd73
movsx eax, byte [rsp + 0x24]
shl eax, 3
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, 0x4c
add rsp, 0x78
ret
Function at 0x14010cd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov eax, 0x11cf
mov word [rsp + 0x30], ax
mov dword [rsp + 0x34], 0x5f81926d
movsx eax, word [rsp + 0x30]
sub eax, 0x27ce
mov word [rsp + 0x30], ax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0x55d10f29
je 0x14010cebe
cmp dword [rsp + 0x48], 0x5f81926d
je 0x14010cdee
jmp 0x14010cf2c
lea rax, [rsp + 0x34]
mov qword [rsp + 0x40], rax
movsx eax, word [rsp + 0x30]
cmp eax, 0x1a43
jg 0x14010cebc
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
add eax, 0xcd9390f5
cmp eax, dword [rsp + 0x34]
jne 0x14010cebc
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x419c
je 0x14010ce33
jmp 0x14010ce78
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
mov r8d, 2
mov edx, 0x78
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_BackupSeek]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
and eax, 0x4fe89231
mov dword [rsp + 0x34], eax
jmp 0x14010cebc
movzx eax, word [rsp + 0xa0]
mov word [rsp + 0x20], ax
movzx r9d, byte [rsp + 0x90]
movzx r8d, byte [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.14010cd90
mov eax, dword [rsp + 0x34]
xor eax, 0x9e509697
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
jmp 0x14010cf2c
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
movzx eax, word [rsp + 0xa0]
mov word [rsp + 0x20], ax
movzx r9d, byte [rsp + 0x90]
movzx r8d, byte [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.14010cd90
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
movzx ecx, al
mov eax, dword [rsp + 0x38]
shr eax, cl
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x60], rax
movzx eax, word [rsp + 0xa0]
mov word [rsp + 0x50], ax
mov eax, 0x93
add rsp, 0x78
ret

Function at 0x140140070
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401400ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401400ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401400ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401400ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1401400ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401400bc
xor al, al
add rsp, 0x28
ret
Function at 0x14014351c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14014358b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014358b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014358b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014358b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014358b
cmp dword [rcx + 0x84], 0xe
jbe 0x14014358b
cmp dword [rcx + 0xf8], 0
je 0x14014358b
mov ecx, ebx
call fcn.14014363c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140143418
nop
cmp dword [rbp + 0x20], 0
je 0x1401435d9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401435e4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14014351c

Function at 0x140143720
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14014351c
Function at 0x1401467d4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140146804
xor eax, eax
jmp 0x1401468c7
mov rbp, rbx
cmp word [rax], si
je 0x140146829
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140146810
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14014680c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401466f4
movsxd r14, eax
test eax, eax
jne 0x140146867
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401467fd
mov rcx, r14
call fcn.140147268
mov rdi, rax
test rax, rax
jne 0x140146880
xor ecx, ecx
call fcn.140144d2c
jmp 0x14014685c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401466f4
test eax, eax
jne 0x1401468b1
mov rcx, rdi
call fcn.140144d2c
jmp 0x1401468bb
xor ecx, ecx
call fcn.140144d2c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14014c030
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14014c058
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14014c058
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013330
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret