joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014e70
Capabilities:
Terminate process

Disassembly:
cmp dword [0x140022900], 0
jne 0x140013c9f
mov dword [0x140022900], 1
lea rcx, [0x140013c40]
jmp 0x140014680
ret
mov rax, qword [0x140026a20]
cmp qword [0x14001d070], rax
ja 0x140014695
jmp 0x140014e70
lea rdx, [rax + 1]
mov qword [0x140026a20], rdx
lea rdx, [0x1400267a0]
mov qword [rdx + rax*8], rcx
ret
sub rsp, 0x28
mov ecx, 6
call fcn.140014ec0
mov ecx, 1
jmp 0x14000f9c0

Function at 0x140014e90
Capabilities:
Delete file

Disassembly:
jmp 0x140014e90
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140014eb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140014d90
or eax, 0xffffffff
jmp 0x140014eb2
xor eax, eax
add rsp, 0x28
ret

Function at 0x140014ec0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
sub rsp, 0x38
mov ebx, ecx
mov edx, 1
call fcn.140010810
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x140014efa
cmp rsi, 1
je 0x140014ef3
test rsi, rsi
je 0x140014f02
mov ecx, ebx
xor edx, edx
call fcn.140010810
mov ecx, ebx
call rsi
xor eax, eax
jmp 0x140014ffb
or eax, 0xffffffff
jmp 0x140014ffb
mov eax, ebx
lea edx, [eax - 2]
cmp edx, 0xd
ja 0x140014f5d
lea rdx, [0x14001c790]
movsxd rax, eax
jmp qword [rdx + rax*8 - 0x10]
lea rcx, [rsp + 0x37]
mov byte [rcx], 0
nop
nop word [rax + rax]
sub rcx, 1
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
neg edx
add edx, ebx
add edx, 0x30
mov byte [rcx], dl
mov ebx, eax
test eax, eax
jne 0x140014f70
sub rcx, 1
mov byte [rcx], 0x23
sub rcx, 1
mov byte [rcx], 0x20
sub rcx, 1
mov byte [rcx], 0x6c
sub rcx, 1
mov byte [rcx], 0x61
sub rcx, 1
mov byte [rcx], 0x6e
sub rcx, 1
mov byte [rcx], 0x67
sub rcx, 1
mov byte [rcx], 0x69
sub rcx, 1
mov byte [rcx], 0x73
lea rdx, [0x14001d1a0]
call fcn.140010780
lea rcx, str.____terminating_n
lea rdx, [0x14001d1a0]
call fcn.140010780
mov ecx, 1
jmp 0x14000f9c0
add rsp, 0x38
pop rsi
pop rbx
ret

Function at 0x1400153a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov qword [rsp + 0x30], 0
xor edx, edx
cmp eax, 0xffffffff
cmove eax, edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
mov rcx, rbx
mov edx, esi
mov r8d, 1
xor r9, r9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400154a0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x14001f060]
lea rdx, [0x14001a9dc]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test rsi, rsi
je 0x14001550d
mov rcx, rsi
xor edx, edx
mov r8d, 1
call fcn.1400153a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
lea rdx, [0x14001f060]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
je 0x1400156d5
cmp esi, 0x400
jg 0x1400156d5
mov rcx, rbx
lea rdx, [0x14001f860]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
je 0x1400156d5
cmp esi, 0x400
jg 0x1400156d5
lea rcx, [0x140020060]
lea rdx, str._s_s_r_n
lea r8, [0x14001f060]
lea r9, [0x14001f860]
call qword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
lea rcx, str._WIN_
lea rdx, [0x14001f860]
mov r8d, 0x800
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
lea rcx, [0x14001f860]
mov edx, 0xc0000000
mov r8d, 4
call fcn.1400153a0
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x1400156d5
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test r12, r12
je 0x1400156b2
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r12
mov r8d, edi
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400156b2
cmp edi, dword [rsp + 0x2c]
jne 0x1400156b2
mov rcx, r12
lea rdx, str._Rename__r_n
call fcn.1400153f0
test rax, rax
je 0x1400156bd
lea rcx, [rax + 0xa]
lea rdx, [0x14001a9c4]
call fcn.1400153f0
test rax, rax
je 0x140015660
mov edx, edi
lea rcx, [r12 + rdx]
add rdx, r12
movsxd r8, ebx
add rdx, r8
cmp rcx, rax
jbe 0x140015655
nop
nop word [rax + rax]
sub rdx, 1
sub rcx, 1
mov r8b, byte [rcx + 1]
mov byte [rdx + 1], r8b
cmp rcx, rax
ja 0x140015640
sub rax, r12
add rax, 1
mov edx, eax
jmp 0x140015662
mov edx, edi
mov eax, edx
mov eax, eax
lea rcx, [r12 + rax]
lea rdx, [0x140020060]
mov r8d, ebx
call fcn.140015470
mov rcx, rsi
xor edx, edx
xor r8, r8
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r8d, [edi + ebx]
mov rcx, rsi
mov rdx, r12
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400156d5
mov eax, edi
lea rcx, [r12 + rax]
lea rdx, str._Rename__r_n
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x140015660
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140015a30
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x2000
call fcn.14000db00
mov rdi, rax
test rdi, rdi
je 0x140015ab4
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12d, eax
test r12d, r12d
je 0x140015ab8
cmp r12d, 0x1000
ja 0x140015ad1
mov r14d, 1
jmp 0x140015a81
xor r14d, r14d
test r14d, r14d
je 0x140015a94
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.pbcore64.dll_SetVar]
jmp 0x140015aa4
mov rcx, rsi
lea rdx, [0x14001a9a4]
call qword [sym.imp.pbcore64.dll_SetVar]
mov rcx, rdi
call fcn.14000df00
test r14d, r14d
setne al
jmp 0x140015b09
xor al, al
jmp 0x140015b09
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x140015a7e
mov rcx, rdi
call fcn.14000df00
xor al, al
jmp 0x140015b09
mov eax, r12d
lea rdx, [rax + rax]
mov rcx, rdi
call fcn.14000e360
mov rdi, rax
test rdi, rdi
je 0x140015ab4
mov rcx, rbx
mov rdx, rdi
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140015a76
mov rcx, rdi
call fcn.14000df00
xor al, al
add rsp, 0x20
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x140016db0
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x430
mov r8, rcx
lea rdi, [rsp + 0x228]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.14000ccf0
lea rcx, [rsp + 0x20]
call fcn.140016c10
lea rax, [rsp + 0x20]
mov rbx, rax
nop dword [rax]
cmp word [rbx], 0x5c
je 0x140016e12
cmp word [rbx], 0
lea rbx, [rbx + 2]
jne 0x140016e00
xor ebx, ebx
xor esi, esi
jmp 0x140016ea2
lea rax, [rsp + 0x20]
neg rax
add rax, rbx
sar rax, 1
lea r9, [rax + 1]
lea rcx, [rsp + 0x228]
mov edx, 0x104
lea r8, [rsp + 0x20]
call fcn.14000e690
lea rcx, [rsp + 0x228]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140016e84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
add rbx, 2
mov rax, rbx
nop
nop word [rax + rax]
cmp word [rbx], 0x5c
je 0x140016e82
cmp word [rbx], 0
lea rbx, [rbx + 2]
jne 0x140016e70
xor ebx, ebx
jmp 0x140016ea2
cmp byte [0x140022c80], 0
je 0x140016e5e
mov ecx, 1
lea rdx, [rsp + 0x228]
call qword [sym.imp.pbcore64.dll_AddUninstLog]
jmp 0x140016e5e
test rbx, rbx
jne 0x140016e19
mov eax, esi
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret

Function at 0x140016ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140016edd
test eax, 0x10
je 0x140016edd
mov eax, 1
jmp 0x140016edf
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001810
Capabilities:
Encrypt data using rc4 prga
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x28], 0x69
mov byte [rsp + 0x29], 0x84
mov byte [rsp + 0x2a], 0x3c
mov byte [rsp + 0x2b], 0xb
mov byte [rsp + 0x2c], 0x31
mov byte [rsp + 0x2d], 0x25
mov byte [rsp + 0x2e], 0x24
mov byte [rsp + 0x2f], 7
mov byte [rsp + 0x30], 0x39
mov byte [rsp + 0x31], 0xcb
mov dword [rsp + 0x24], 0x81433c25
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x48], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xa
jae 0x1400018c2
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x60], rcx
movzx ecx, byte [rsp + 0x24]
mov rdx, qword [rsp + 0x60]
movzx eax, byte [rdx + rax]
ror al, cl
movzx eax, al
xor eax, dword [rsp + 0x24]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
add eax, 0x361f
imul eax, eax, 0x319f
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140001865
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400018e1
xor eax, eax
jmp 0x140001a36
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140001901
xor eax, eax
jmp 0x140001a36
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x14000192e
xor eax, eax
jmp 0x140001a36
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140001962
xor eax, eax
jmp 0x140001a36
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x20], 0
je 0x140001a2b
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x18], 0
je 0x140001a2b
mov rax, qword [rsp + 0x80]
cmp qword [rax + 8], 0
je 0x140001a2b
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x140001a2b
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x10], 0
jne 0x140001a31
xor eax, eax
jmp 0x140001a36
mov eax, 1
add rsp, 0x78
ret
Function at 0x1401d3ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x88
mov eax, 0x669
mov word [rsp + 0x28], ax
movzx eax, word [0x14021e008]
mov word [rsp + 0x24], ax
movsx eax, word [rsp + 0x24]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffd3b1
je 0x1401d3cd9
jmp 0x1401d3da1
movsx eax, word [rsp + 0x24]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffd3b1
je 0x1401d3d7a
cmp dword [rsp + 0x30], 0x4b41
je 0x1401d3cff
jmp 0x1401d3d9f
movsx eax, word [rsp + 0x24]
sub eax, 0x2e94
movsx ecx, word [0x14021e008]
cmp eax, ecx
jge 0x1401d3d4a
mov byte [rsp + 0x90], 0x32
movzx ecx, byte [rsp + 0x90]
call fcn.1401d3ca0
mov byte [rsp + 0x90], 0x63
mov byte [rsp + 0x90], 0x3a
movsx eax, word [0x14021e008]
add eax, 0x1dbe
mov word [rsp + 0x24], ax
movzx ecx, byte [rsp + 0x90]
call fcn.1401d3ca0
mov byte [rsp + 0x90], 0xb0
movsx eax, word [0x14021e008]
and eax, 0x6d17
mov word [rsp + 0x24], ax
mov byte [rsp + 0x90], 0x60
jmp 0x1401d3d9f
movzx eax, word [rsp + 0x28]
xor eax, 0xb4
mov word [rsp + 0x28], ax
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x2c], al
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
jmp 0x1401d3db0
movsx eax, word [0x14021e008]
shl eax, 5
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x28]
sar eax, 0x20
mov rcx, qword [rsp + 0x40]
movzx ecx, word [rcx]
cmp eax, ecx
jg 0x1401d3e3f
mov byte [rsp + 0x20], 0x13
lea rax, [rsp + 0x24]
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x34], al
cmp byte [rsp + 0x34], 0x13
je 0x1401d3dec
cmp byte [rsp + 0x34], 0x75
je 0x1401d3e2c
jmp 0x1401d3e3f
movabs rax, 0x476a3f15aee28da1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x2d], al
movabs rax, 0xf741937d718a95ba
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
jmp 0x1401d3e3f
movzx eax, byte [rsp + 0x2c]
movzx ecx, byte [rsp + 0x90]
or eax, ecx
mov byte [rsp + 0x2d], al
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x2e], al
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
movsx eax, word [0x14021e008]
add rsp, 0x88
ret

Function at 0x140206f00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140206f4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140206f4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140206f4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140206f4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140206f4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140206f4c
xor al, al
add rsp, 0x28
ret
Function at 0x14020a360
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14020a3cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14020a3cf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14020a3cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14020a3cf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14020a3cf
cmp dword [rcx + 0x84], 0xe
jbe 0x14020a3cf
cmp dword [rcx + 0xf8], 0
je 0x14020a3cf
mov ecx, ebx
call fcn.14020a480
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14020a25c
nop
cmp dword [rbp + 0x20], 0
je 0x14020a41d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14020a428
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14020a360

Function at 0x14020a564
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14020a360
Function at 0x14020cfc0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14020d047
mov rsi, rbx
cmp word [rax], bp
je 0x14020d006
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14020cff0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14020cfec
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14020d9e0
mov rdi, rax
test rax, rax
je 0x14020d034
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140212930
mov rbp, rdi
xor ecx, ecx
call fcn.14020bc88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140212190
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402121b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402121b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140017a18
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
movsxd rax, dword [rsp + 0x40]
mov ecx, 0xa6250a2c
cmp rax, rcx
jne 0x140017a58
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SensApi.dll_IsNetworkAlive]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400daa80]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140017ae8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140017b20
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x140017b28
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140017b22

Function at 0x140017d48
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8a68]
test rax, rax
je 0x140017d78
call rax
mov al, 1
jmp 0x140017ef5
xor eax, eax
mov dword [rbp - 0x30], 0x1f8fda5a
mov dword [rbp - 0x2c], 0x228ce4c1
xor r9d, r9d
mov word [rbp - 0x28], 0x36f8
movabs rsi, 0x10dca5af9
mov byte [rbp - 0x26], al
movabs rdi, 0x8080808080808081
lea r11d, [rax + 0xa]
movabs r10, 0xa89e78dc4
movabs r14, 0x10dca5afa
mov cl, r9b
mov rax, rdi
mul r10
and cl, 7
mov r8, rsi
shl cl, 3
shr r8, cl
mov rcx, r10
shr rdx, 7
add r10, r14
imul rax, rdx, 0xff
sub rcx, rax
mov rax, rdi
mul r11
xor r8b, cl
mov rcx, r11
shr rdx, 7
add r11, 0xa
imul rax, rdx, 0xff
sub rcx, rax
movabs rax, 0x1513cf1b88
xor r8b, cl
xor r8b, r9b
xor byte [rbp + r9 - 0x30], r8b
inc r9
cmp r10, rax
jb 0x140017dc0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x140017ef3
movdqa xmm0, xmmword [0x1400dbd50]
xor r10d, r10d
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xe4228b60
movabs r11, 0x1621997682
mov word [rbp - 0xc], 0xaf
lea ebx, [r10 + 0x15]
mov cl, r10b
mov rax, rdi
mul r11
and cl, 7
mov r8, rsi
shl cl, 3
shr r8, cl
mov rcx, r11
shr rdx, 7
add r11, r14
imul rax, rdx, 0xff
sub rcx, rax
mov rax, rdi
xor r8b, cl
mov rcx, rbx
mul rbx
add rbx, 0x15
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
movabs rax, 0x2c4332ed04
xor r8b, cl
xor r8b, byte [rbp + r10 - 0x20]
xor r8b, r10b
mov byte [rbp + r10 - 0x20], r8b
inc r10
cmp r11, rax
jb 0x140017e69
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xb], 0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400f8a68], rax
test rax, rax
jne 0x140017d6f
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140017f10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1400e6700]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov esi, ecx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140017f8b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140017f78
cmp dword [rsp + 0x28], esi
je 0x140017f7e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140017f64
jmp 0x140017f82
mov ebx, dword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400869c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140018020
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x1400e6700]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.1400b0aa0
xor eax, eax
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400180fc
mov edi, dword [rsp + 0x60]
xor ebx, ebx
mov rdx, rdi
lea rcx, [0x140017fb4]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x1400f8a60], 0
jne 0x1400180e4
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3a98
jl 0x1400180b6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400869c0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400281cc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140028230
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400281f0
mov ecx, dword [r9]
jmp 0x14002830d
cmp ecx, 0x4e0
jb 0x14002830d
lea r10, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [r10]
mov r11d, 0x7fffffff
mov eax, edi
mov r8, r10
add r10, 4
mov edi, dword [r10]
mov edx, edi
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x140028251
lea r10, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [r10]
mov eax, edi
mov r8, r10
mov edx, eax
add r10, 4
mov edi, dword [r10]
xor edx, edi
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x14002829b
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rsi, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x140028c34
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov r8d, 1
mov r10d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9], edx
lea r9, [r9 + 4]
cmp r8, r10
jb 0x140028c47
mov dword [rcx], r10d
ret