joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5887e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5889f5
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x58890d
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x5889e7
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [r8 + 0x10]
add rdx, rax
cmp rbx, rdx
je 0x588881
mov rax, rdx
mov rcx, rsi
call fcn.00466340
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x5888e9
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00588c80
xorps xmm15, xmm15
mov r14, qword [0x00902580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x5889df
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x588913
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x588990
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00588c80
xorps xmm15, xmm15
mov r14, qword [0x00902580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x5889ce
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x5889ca
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00466340
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00465a40
mov rax, rdx
mov ecx, 0x40
call fcn.00465a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463320
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005887e0
Function at 0x5f0ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f104b
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f0ec7
inc rcx
cmp rbx, rcx
jle 0x5f103d
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f0ec4
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00571f60
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x0089f610]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005ecf60
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5f102d
test rdx, rdx
je 0x5f101e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00902580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f0fe9
xor eax, eax
lea rbx, [0x006ac001]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006ac0a7]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e960
jmp 0x5f1010
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0071d788]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e880
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463320
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f0ea0
Function at 0x11e9490
Capabilities:
Terminate process

Disassembly:
invalid
cld
pop r11
jmp 0x11e949d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x11e94ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x11e9495
lea eax, [rcx + 1]
jmp 0x11e94bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x11e94ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x11e94b4
sub eax, 3
jb 0x11e94ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x11e953d
sar eax, 1
movsxd rbp, eax
jb 0x11e9524
jmp 0x11e94fc
add ebx, ebx
jne 0x11e94fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x11e9524
inc ecx
add ebx, ebx
jne 0x11e950a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x11e9524
call r11
adc ecx, ecx
add ebx, ebx
jne 0x11e951d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x11e950c
add ecx, 2
jmp 0x11e9529
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.011e9452
jmp 0x11e949d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xdb7000]
mov eax, dword [rdi]
or eax, eax
je 0x11e959d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xde9ed8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x11e954d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x11e9597
mov qword [rbx], rax
add rbx, 8
jmp 0x11e956d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x11e95e1
cmp al, 0xef
ja 0x11e95c9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x11e95a9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x11e95b8
mov eax, dword [rdi]
add rdi, 4
jmp 0x11e95b8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x11e9635
sub rsp, 0xffffffffffffff80
jmp 0xff8a10
Function at 0x140001104
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov dword [rcx + 0xa0], r9d
lea r11, [rcx + 0x80]
movzx eax, byte [r8]
lea r10, [r8 + 1]
bswap eax
mov dword [r11], eax
mov rdi, rdx
movzx r8d, byte [r10]
mov rsi, rcx
shl r8d, 0x10
mov ebp, r9d
or r8d, eax
mov dword [r11], r8d
movzx eax, byte [r10 + 1]
lea r9, [rsi + 0x88]
shl eax, 8
or eax, r8d
mov dword [r11], eax
movzx ebx, byte [r10 + 2]
or ebx, eax
mov dword [r11], ebx
movzx eax, byte [r10 + 3]
bswap eax
mov dword [r11 + 4], eax
movzx edx, byte [r10 + 4]
shl edx, 0x10
or edx, eax
mov dword [r11 + 4], edx
movzx ecx, byte [r10 + 5]
shl ecx, 8
or ecx, edx
mov dword [r11 + 4], ecx
movzx eax, byte [r10 + 6]
or eax, ecx
mov dword [r11 + 4], eax
movzx eax, byte [rdi + 8]
bswap eax
mov dword [r9], eax
movzx edx, byte [rdi + 9]
shl edx, 0x10
or edx, eax
mov dword [r9], edx
movzx ecx, byte [rdi + 0xa]
shl ecx, 8
or ecx, edx
mov dword [r9], ecx
movzx eax, byte [rdi + 0xb]
or eax, ecx
mov dword [r9], eax
movzx eax, byte [rdi + 0xc]
bswap eax
mov dword [r9 + 4], eax
movzx edx, byte [rdi + 0xd]
shl edx, 0x10
or edx, eax
mov dword [r9 + 4], edx
movzx ecx, byte [rdi + 0xe]
shl ecx, 8
or ecx, edx
mov dword [r9 + 4], ecx
movzx eax, byte [rdi + 0xf]
or eax, ecx
mov dword [r9 + 4], eax
lea r9, [rsi + 0x90]
movzx eax, byte [rdi + 0x10]
bswap eax
mov dword [r9], eax
movzx edx, byte [rdi + 0x11]
shl edx, 0x10
or edx, eax
mov dword [r9], edx
movzx ecx, byte [rdi + 0x12]
shl ecx, 8
or ecx, edx
mov dword [r9], ecx
movzx eax, byte [rdi + 0x13]
or eax, ecx
mov dword [r9], eax
movzx eax, byte [rdi + 0x14]
bswap eax
mov dword [r9 + 4], eax
movzx edx, byte [rdi + 0x15]
mov r8d, ebp
shl edx, 0x10
or edx, eax
mov dword [r9 + 4], edx
movzx ecx, byte [rdi + 0x16]
shl ecx, 8
or ecx, edx
mov rdx, rdi
mov dword [r9 + 4], ecx
movzx eax, byte [rdi + 0x17]
or eax, ecx
mov dword [rsi + 0x98], ebx
mov dword [r9 + 4], eax
mov rcx, rsi
mov eax, dword [rsi + 0x84]
mov dword [rsi + 0x9c], eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
jmp fcn.140013f70

Function at 0x140001aac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001af6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001af6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001af6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001af6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001af6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001af8
xor al, al
add rsp, 0x28
ret

Function at 0x140007fdc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007dcc
Function at 0x14000c798
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000c81f
mov rsi, rbx
cmp word [rax], bp
je 0x14000c7de
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000c7c8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000c7c4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140009aac
mov rdi, rax
test rax, rax
je 0x14000c80c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140002190
mov rbp, rdi
xor ecx, ecx
call fcn.140009a70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016164
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r9d, dword [rcx]
mov ebp, 0xf0f0f0f
mov r8d, dword [rcx + 4]
mov eax, r9d
shr eax, 4
mov rbx, rcx
xor eax, r8d
mov rdi, rdx
and eax, ebp
mov esi, 8
xor r8d, eax
lea rbp, [0x140000000]
shl eax, 4
xor r9d, eax
mov eax, r9d
shr eax, 0x10
xor eax, r8d
movzx ecx, ax
xor r8d, ecx
shl ecx, 0x10
xor r9d, ecx
mov eax, r8d
shr eax, 2
xor eax, r9d
and eax, 0x33333333
xor r9d, eax
shl eax, 2
xor r8d, eax
mov r10d, r8d
shr r10d, 8
xor r10d, r9d
and r10d, 0xff00ff
xor r9d, r10d
shl r10d, 8
xor r10d, r8d
rol r10d, 1
mov r11d, r10d
xor r11d, r9d
and r11d, 0xaaaaaaaa
xor r10d, r11d
xor r11d, r9d
rol r11d, 1
mov r9d, r10d
mov eax, r10d
xor eax, dword [rdi + 4]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
ror r9d, 4
xor r9d, dword [rdi]
lea rdi, [rdi + 0x10]
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x251f0]
or edx, dword [rbp + rax*4 + 0x253f0]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x255f0]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x250f0]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x252f0]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x254f0]
or edx, dword [rbp + r8*4 + 0x257f0]
or edx, dword [rbp + r9*4 + 0x256f0]
xor r11d, edx
mov r9d, r11d
mov eax, r11d
xor eax, dword [rdi - 4]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
ror r9d, 4
xor r9d, dword [rdi - 8]
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x251f0]
or edx, dword [rbp + rax*4 + 0x253f0]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x255f0]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x250f0]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x252f0]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x254f0]
or edx, dword [rbp + r8*4 + 0x257f0]
or edx, dword [rbp + r9*4 + 0x256f0]
xor r10d, edx
sub rsi, 1
jne 0x140016209
mov rsi, qword [rsp + 0x18]
mov ebp, 0xf0f0f0f
mov rdi, qword [rsp + 0x20]
ror r10d, 1
mov edx, r10d
xor edx, r11d
and edx, 0xaaaaaaaa
xor r10d, edx
xor edx, r11d
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, r10d
and eax, 0xff00ff
xor r10d, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, r10d
and eax, 0x33333333
xor r10d, eax
shl eax, 2
xor edx, eax
mov eax, r10d
shr eax, 0x10
xor eax, edx
movzx ecx, ax
xor edx, ecx
shl ecx, 0x10
xor r10d, ecx
mov ecx, r10d
shr ecx, 4
xor ecx, edx
and ecx, ebp
mov rbp, qword [rsp + 0x10]
mov eax, ecx
xor ecx, edx
shl eax, 4
xor eax, r10d
mov dword [rbx + 4], ecx
mov dword [rbx], eax
mov rbx, qword [rsp + 8]
ret
Function at 0x140005b50
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x140038010]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp word [rcx], 0
je 0x140005c5c
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005bd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005bd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005bd3
mov eax, dword [0x14003a1b8]
mov ecx, dword [0x140038cbc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005c77
lea rcx, [0x140039fa8]
lea rdx, str.Could_not_delete_service_updater_path:__ls.
mov r8, rsi
int3
lea rdi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.1400101a0
lea r8, str.updater.ini
mov rcx, rdi
mov rdx, rsi
int3
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400195d0
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rcx, [0x14003a1b8]
int3

Function at 0x140009080
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0xc0], xmm6
mov ebp, r9d
mov rsi, r8
mov rbx, rdx
mov r13, rcx
mov rax, qword [0x140038010]
xor rax, rsp
mov qword [rsp + 0xb8], rax
test r9d, r9d
lea rax, [0x140029010]
lea rcx, [0x140029020]
cmove rcx, rax
lea r9, [rsp + 0x88]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov edi, eax
mov r15, qword [rsp + 0x88]
test eax, eax
jns 0x14000912d
test r15, r15
je 0x1400090ff
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400195d0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
cmp ebp, 1
jne 0x140009158
mov rax, rbx
or rax, rsi
je 0x140009158
test rbx, rbx
cmovne rsi, rbx
lea rcx, [rsp + 0x60]
mov rdx, rsi
int3
movaps xmm0, xmmword [0x14002e720]
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xa0]
int3
Function at 0x14000f22d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000f24b
je 0x14000f256
call 0x14000f2a5
mov bl, 0xc7
lahf
pop rsi
jne 0x14000f236
call 0x14000f24e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000f236
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000f284
je 0x14000f2c2
invalid
je 0x14000f2d3
jne 0x14000f236
lea rax, [0x14000f15c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000aebd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000f374
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000f3cd
je 0x14000f3d3
call 0x14000f3c4
fild qword [rdi - 0x7c]
jmp 0x174f4bb46
jne 0x14000f396
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000f356
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000f230
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000f24b
je 0x14000f256
call 0x14000f2a5
mov bl, 0xc7
lahf
pop rsi
jne 0x14000f236
call 0x14000f24e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000f236
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000f284
je 0x14000f2c2
invalid
je 0x14000f2d3
jne 0x14000f236
lea rax, [0x14000f15c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000aebd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000f374
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000f3cd
je 0x14000f3d3
call 0x14000f3c4
fild qword [rdi - 0x7c]
jmp 0x174f4bb46
jne 0x14000f396
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000f356
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000f240
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000f24b
je 0x14000f256
call 0x14000f2a5
mov bl, 0xc7
lahf
pop rsi
jne 0x14000f236
call 0x14000f24e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000f236
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000f284
je 0x14000f2c2
invalid
je 0x14000f2d3
jne 0x14000f236
lea rax, [0x14000f15c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000aebd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000f374
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000f3cd
je 0x14000f3d3
call 0x14000f3c4
fild qword [rdi - 0x7c]
jmp 0x174f4bb46
jne 0x14000f396
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000f356
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret