joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f678
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ecx, 0x61
call fcn.140029ab4
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor r13d, r13d
cmp rax, rbx
cmove rbx, r13
test rbx, rbx
je 0x14007f6e0
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x63
call fcn.140029ab4
mov ecx, 0x20
mov rsi, rax
call fcn.140029ab4
mov ecx, 0x21
mov r15, rax
call fcn.140029ab4
mov ecx, 3
mov r14, rax
call fcn.140029ab4
mov rdi, rax
test rsi, rsi
je 0x14007f820
test r15, r15
je 0x14007f820
test r14d, r14d
je 0x14007f820
test rax, rax
je 0x14007f820
or r8d, 0xffffffff
mov ecx, r8d
cmp rsi, rax
jbe 0x14007f748
mov ecx, esi
sub ecx, eax
cmp ecx, r14d
jae 0x14007f820
mov edx, ecx
add rax, rdx
cmp rsi, rax
jne 0x14007f820
lea rcx, [rdx + r15]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov edx, r15d
mov qword [rsp + 0x30], r13
sub edx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r8d
lea r8d, [r9 + 2]
add edx, r14d
call fcn.14008a254
mov r12b, r13b
mov esi, r13d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14007f820
mov eax, dword [rbp + 0x80]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rcx
movzx edx, word [rax + 6]
mov eax, 0x42a
cmp ax, dx
jne 0x14007f7db
test byte [rbp - 0x50], 4
je 0x14007f7db
mov r12b, 1
jmp 0x14007f808
cmp r12b, 1
jne 0x14007f808
mov eax, 0x558
cmp ax, dx
jne 0x14007f808
test qword [rbp - 0x20], 0x4000000
je 0x14007f808
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x14007f808
sub eax, r15d
add eax, ecx
je 0x14007f808
cmp eax, r14d
jb 0x14007f811
inc esi
cmp esi, 0x64
jae 0x14007f820
jmp 0x14007f796
mov edx, eax
mov ecx, 0x64
add rdx, rdi
call fcn.140029bac
test rbx, rbx
je 0x14007f831
lea rcx, [rbp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14007f9b8
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r12d, r12d
mov esi, r12d
lea ecx, [r12 + 0x61]
call fcn.140029ab4
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, rdi
cmove rdi, r12
test rdi, rdi
je 0x14007fa16
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x20
call fcn.140029ab4
mov ecx, 0x21
mov rbx, rax
call fcn.140029ab4
mov ecx, 3
mov r14, rax
call fcn.140029ab4
mov ecx, 0x41ce
mov r15, rax
call fcn.14007a1f0
mov ecx, 0x42
mov ebp, eax
call fcn.140029ab4
test rbx, rbx
je 0x14007fa98
test r14d, r14d
je 0x14007fa98
test r15, r15
je 0x14007fa98
test ebp, ebp
je 0x14007fa98
cmp ebp, eax
jae 0x14007fa98
mov ecx, ebp
call fcn.14007a130
test eax, eax
je 0x14007fa98
cmp eax, r14d
jae 0x14007fa98
mov edx, eax
mov ecx, 0x234
mov esi, eax
call fcn.140029bac
add rsi, r15
mov ecx, 0x186
mov rdx, rsi
call fcn.140029bac
test rdi, rdi
je 0x14007faa7
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rax, rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x14007fad8
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r12d, r12d
mov esi, r12d
lea ecx, [r12 + 0x61]
call fcn.140029ab4
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, rdi
cmove rdi, r12
test rdi, rdi
je 0x14007fb36
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x20
call fcn.140029ab4
mov ecx, 0x21
mov rbx, rax
call fcn.140029ab4
mov ecx, 3
mov rbp, rax
call fcn.140029ab4
mov ecx, 0x42
mov r14, rax
call fcn.140029ab4
mov ecx, 0x235
mov r15, rax
call fcn.140029ab4
test rbx, rbx
je 0x14007fbb8
test ebp, ebp
je 0x14007fbb8
test r14, r14
je 0x14007fbb8
test eax, eax
je 0x14007fbb8
cmp eax, r15d
jae 0x14007fbb8
mov ecx, eax
call fcn.14007a130
test eax, eax
je 0x14007fbb8
cmp eax, ebp
jae 0x14007fbb8
mov edx, eax
mov ecx, 0x236
mov esi, eax
call fcn.140029bac
add rsi, r14
mov ecx, 0x237
mov rdx, rsi
call fcn.140029bac
test rdi, rdi
je 0x14007fbc7
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rax, rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140080e4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, 0x10
mov rsi, rcx
mov edi, ebx
call fcn.14007d45c
mov ebp, eax
test eax, eax
je 0x140080e8a
mov rax, rsi
mov edx, ebp
movzx ecx, word [rax]
lea rax, [rax + 2]
add edi, ecx
xor edi, ecx
dec rdx
jne 0x140080e7a
xor eax, eax
test ebp, ebp
je 0x140080e93
movzx eax, byte [rsi]
shl edi, 0xe
mov ecx, 0x1e0
or edi, eax
shl edi, 2
mov edx, edi
call fcn.140029bac
mov r8, rbp
mov ecx, 0
add r8, r8
je 0x140080ed4
xor eax, eax
mov dl, byte [rax + rsi]
test dl, dl
jne 0x140080ec9
mov al, bl
shr bl, 4
shl al, 4
add bl, al
jmp 0x140080ecb
xor bl, dl
inc ecx
mov eax, ecx
cmp rax, r8
jb 0x140080eb6
movzx edx, bl
mov ecx, 0x1e1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140029bac

Function at 0x140080ef8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x1e1
call fcn.140029ab4
mov ecx, 0x30
mov dl, byte [rbx]
xor dl, al
not dl
mov byte [rbx], dl
inc rbx
dec rcx
jne 0x140080f10
add rsp, 0x20
pop rbx
ret

Function at 0x1400823d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x38], 0x2d747865
lea ecx, [rbx + 0x20]
mov dword [rsp + 0x3c], 0x772d736d
mov dword [rsp + 0x40], 0x6e2d6e69
mov dword [rsp + 0x44], 0x2d736f74
mov dword [rsp + 0x48], 0x6c2d6d74
mov dword [rsp + 0x4c], 0x2d312d31
mov dword [rsp + 0x50], 0x6c642e30
mov dword [rsp + 0x54], 0x6c
call fcn.140029ab4
lea ecx, [rbx + 0x21]
mov rdi, rax
call fcn.140029ab4
test eax, eax
je 0x14008247c
test rdi, rdi
je 0x14008247c
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov edx, eax
call fcn.1400058a4
mov edx, 1
movzx ebx, bl
cmp al, dl
cmove ebx, edx
mov al, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14008330c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
mov ecx, 0x421d
xor edi, edi
call fcn.140029ab4
mov r13, rax
test rax, rax
je 0x140083544
mov ebx, 0x2cc
mov ecx, ebx
call fcn.140029ab4
mov rsi, rax
test rax, rax
jne 0x14008337b
call fcn.14008325c
mov ecx, ebx
call fcn.140029ab4
mov rsi, rax
mov ecx, 0x2cd
call fcn.140029ab4
mov ecx, 0x27
mov r14, rax
call fcn.140029ab4
mov r12, rax
test rsi, rsi
je 0x140083544
cmp eax, 0xffffffff
je 0x140083544
mov rcx, r15
call fcn.14007d45c
test eax, eax
je 0x140083544
mov eax, 0x74006e
mov rcx, r15
mov dword [rbp - 0x59], 0x52005c
mov dword [rbp - 0x55], 0x670065
mov dword [rbp - 0x51], 0x730069
mov dword [rbp - 0x4d], 0x720074
mov dword [rbp - 0x1d], eax
mov dword [rbp - 0x15], eax
mov dword [rbp - 0x49], 0x5c0079
mov dword [rbp - 0x45], 0x61004d
mov dword [rbp - 0x41], 0x680063
mov dword [rbp - 0x3d], 0x6e0069
mov dword [rbp - 0x39], 0x5c0065
mov dword [rbp - 0x35], 0x790053
mov dword [rbp - 0x31], 0x740073
mov dword [rbp - 0x2d], 0x6d0065
mov dword [rbp - 0x29], 0x43005c
mov dword [rbp - 0x25], 0x720075
mov dword [rbp - 0x21], 0x650072
mov dword [rbp - 0x19], 0x6f0043
mov dword [rbp - 0x11], 0x6f0072
mov dword [rbp - 0xd], 0x53006c
mov dword [rbp - 9], 0x740065
mov dword [rbp - 5], 0x53005c
mov dword [rbp - 1], 0x720065
mov dword [rbp + 3], 0x690076
mov dword [rbp + 7], 0x650063
mov qword [rbp + 0xb], 0x5c0073
call fcn.14007d45c
lea rcx, [rbp - 0x59]
mov ebx, eax
call fcn.14007d45c
mov ecx, 1
add ebx, eax
lea eax, [rbx*2 + 4]
mov edx, eax
mov qword [rbp - 0x61], rax
call fcn.140077530
mov rbx, rax
test rax, rax
je 0x140083544
mov r8, qword [rbp - 0x61]
xor edx, edx
mov rcx, rax
call fcn.1400013f0
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.14007d3d4
mov rcx, r15
call fcn.14007d45c
mov rdx, r15
mov rcx, rbx
mov r8d, eax
call fcn.14007d474
mov r15, qword gs:[0x188]
mov r12d, r12d
mov al, byte [r12 + r15]
lea rcx, [rbp - 0x71]
mov rdx, rbx
mov byte [rbp - 0x79], al
mov byte [r12 + r15], dil
call r13
test r14, r14
je 0x14008352c
mov edi, 0x914
mov ecx, edi
call fcn.140029ab4
cmp eax, 0x1770
jb 0x140083521
mov ecx, edi
call fcn.140029ab4
cmp eax, 0x23f0
je 0x140083521
mov ecx, edi
call fcn.140029ab4
lea rcx, [rbp - 0x71]
xor edx, edx
call r14
jmp 0x140083532
lea rcx, [rbp - 0x71]
call rsi
mov al, byte [rbp - 0x79]
mov rcx, rbx
mov dil, 1
mov byte [r12 + r15], al
call fcn.140077564
mov al, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140084f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ecx, 0x421d
call fcn.140029ab4
mov ecx, 0x41f3
mov rsi, rax
call fcn.140029ab4
mov ecx, 0x4334
mov rdi, rax
call fcn.140029ab4
xor ebx, ebx
mov r14, rax
test rsi, rsi
je 0x140085134
test rdi, rdi
je 0x140085134
test rax, rax
je 0x140085134
mov ecx, 0x6e0069
mov eax, 0x740066
lea rdx, [rbp - 0x59]
mov dword [rbp - 0x3d], ecx
mov dword [rbp - 0xd], ecx
lea rcx, [rsp + 0x28]
mov dword [rbp - 0x59], 0x52005c
mov dword [rbp - 0x55], 0x670065
mov dword [rbp - 0x51], 0x730069
mov dword [rbp - 0x4d], 0x720074
mov dword [rbp - 0x49], 0x5c0079
mov dword [rbp - 0x45], 0x61004d
mov dword [rbp - 0x41], 0x680063
mov dword [rbp - 0x39], 0x5c0065
mov dword [rbp - 0x35], 0x6f0053
mov dword [rbp - 0x31], eax
mov dword [rbp - 0x2d], 0x610077
mov dword [rbp - 0x29], 0x650072
mov dword [rbp - 0x25], 0x4d005c
mov dword [rbp - 0x21], 0x630069
mov dword [rbp - 0x1d], 0x6f0072
mov dword [rbp - 0x19], 0x6f0073
mov dword [rbp - 0x15], eax
mov dword [rbp - 0x11], 0x57005c
mov dword [rbp - 9], 0x6f0064
mov dword [rbp - 5], 0x730077
mov dword [rbp - 1], 0x4e0020
mov dword [rbp + 3], 0x5c0054
mov dword [rbp + 7], 0x750043
mov dword [rbp + 0xb], 0x720072
mov dword [rbp + 0xf], 0x6e0065
mov dword [rbp + 0x13], 0x560074
mov dword [rbp + 0x17], 0x720065
mov dword [rbp + 0x1b], 0x690073
mov qword [rbp + 0x1f], 0x6e006f
call rsi
xorps xmm0, xmm0
lea rax, [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x20]
movdqu xmmword [rbp - 0x71], xmm0
mov edx, 0x20019
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
mov dword [rbp - 0x79], 0x240
call rdi
test eax, eax
js 0x140085134
lea ecx, [rbx + 0x10]
call fcn.14007a330
mov rdi, rax
test rax, rax
je 0x14008512c
mov r12d, dword [rax]
mov ecx, 0x878
call fcn.140029ab4
mov r13d, eax
test r12d, r12d
je 0x140085124
lea rsi, [rdi + 8]
movzx eax, word [rsp + 0x20]
cmp word [rsi + 6], ax
jne 0x140085102
movzx ecx, word [rsi]
mov rdx, r13
call fcn.14007a600
cmp al, 1
je 0x14008510f
inc ebx
add rsi, 0x18
cmp ebx, r12d
jae 0x140085124
jmp 0x1400850e8
mov eax, ebx
lea rcx, [rax + rax*2]
movzx edx, byte [rdi + rcx*8 + 0xc]
mov ecx, 0x316
call fcn.140029bac
mov rcx, rdi
call fcn.140077564
mov rcx, qword [rsp + 0x20]
call r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140086020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x640077
mov dword [rsp + 0x34], 0x300066
mov dword [rsp + 0x38], 0x300031
mov dword [rsp + 0x3c], 0x300030
call fcn.140078a80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x1400869d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x77005c
mov dword [rbp + 0x13], 0x660064
mov dword [rbp + 0x17], 0x310030
mov dword [rbp + 0x1b], 0x300030
mov dword [rbp + 0x1f], 0x2e0030
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x140086add
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140087b98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ecx, 0x730079
mov eax, 0x320033
xor edi, edi
mov dword [rbp - 0x15], ecx
mov qword [rbp + 0x27], rcx
lea r15d, [rdi + 1]
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x19]
mov r9b, r15b
mov dword [rbp - 0x19], 0x53005c
mov dword [rbp - 0x11], 0x650074
mov dword [rbp - 0xd], 0x52006d
mov dword [rbp - 9], 0x6f006f
mov dword [rbp - 5], 0x5c0074
mov dword [rbp - 1], 0x790073
mov dword [rbp + 3], 0x740073
mov dword [rbp + 7], 0x6d0065
mov dword [rbp + 0xb], eax
mov dword [rbp + 0xf], 0x77005c
mov dword [rbp + 0x13], 0x6e0069
mov dword [rbp + 0x17], eax
mov dword [rbp + 0x1b], 0x73006b
mov dword [rbp + 0x1f], 0x640067
mov dword [rbp + 0x23], 0x73002e
call fcn.14002f234
test eax, eax
jne 0x140087cf1
mov edx, dword [rbp - 0x29]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x31]
mov dword [rsp + 0x20], edi
call fcn.140005d4c
mov rcx, qword [rbp - 0x21]
movzx ebx, dil
cmp al, r15b
cmove ebx, r15d
call fcn.140077564
cmp bl, r15b
jne 0x140087cf1
mov ebx, dword [rbp - 0x39]
mov r14, qword [rbp - 0x31]
mov ecx, 0x91b
call fcn.140029ab4
mov ecx, 0x91c
mov rsi, rax
call fcn.140029ab4
test r14, r14
je 0x140087cd1
test ebx, ebx
je 0x140087cd1
test rsi, rsi
je 0x140087cd1
cmp eax, 0x1001
jb 0x140087cd1
mov r9d, ebx
mov r8, r14
mov edx, eax
mov rcx, rsi
call fcn.140079e60
test al, al
jne 0x140087ce8
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
call fcn.140087d20
movzx edi, dil
cmp al, r15b
cmove edi, r15d
mov rcx, qword [rbp - 0x31]
call fcn.140077564
mov al, dil
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14008813c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x30], 0
mov rsi, rcx
mov ecx, 0x8f6
mov ebx, edx
call fcn.140029ab4
mov rdi, rax
test rax, rax
je 0x140088235
mov ecx, 0x8fb
call fcn.140029ab4
test eax, eax
jne 0x140088235
and dword [rbp - 0x14], eax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov edx, ebx
mov rcx, rsi
mov dword [rbp - 0x28], 0x7355744e
mov dword [rbp - 0x24], 0x75427265
mov dword [rbp - 0x20], 0x48646c69
mov dword [rbp - 0x1c], 0x4c646e77
mov dword [rbp - 0x18], 0x747369
call fcn.140005ac8
cmp al, 1
jne 0x1400881df
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x1400881df
cmp eax, ebx
jae 0x1400881df
lea rdx, [rdi + rax]
mov ecx, 0x1f2
call fcn.140029bac
and dword [rbp - 0x14], 0
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov edx, ebx
mov rcx, rsi
mov dword [rbp - 0x28], 0x7355744e
mov dword [rbp - 0x24], 0x75517265
mov dword [rbp - 0x20], 0x57797265
mov dword [rbp - 0x1c], 0x6f646e69
mov dword [rbp - 0x18], 0x77
call fcn.140005ac8
cmp al, 1
jne 0x140088235
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140088235
cmp eax, ebx
jae 0x140088235
lea rdx, [rdi + rax]
mov ecx, 0x1f7
call fcn.140029bac
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d3000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400d302c
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140080a0c
Function at 0x100002c04
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
lea r8, [0x1000012b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
jne 0x100002c47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x100002caa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100002ca8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx], 0
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x100002ca1
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100002ca1
mov edx, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 0x80040200
jmp 0x100002caa
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100003560
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100005110]
jne 0x10000357b
rol rcx, 0x10
test cx, 0xffff
jne 0x100003577
ret 0
ror rcx, 0x10
jmp 0x10000386c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100005640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x100005738]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000038f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100005640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100003913
mov rax, qword [rsp + 0x88]
mov qword [0x100005738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000056d8], rax
mov rax, qword [0x100005738]
mov qword [0x1000055b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000056c0], rax
mov dword [0x1000055a0], 0xc0000409
mov dword [0x1000055a4], 1
mov rax, qword [0x100005110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100005118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000012a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100003708
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100003755
cmp rcx, 0xffffffffffffffff
je 0x100003755
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000374d
cmp dword [rcx + 0x3c], edx
jl 0x10000374d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000374d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100003755
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001000
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.del__C:_Users___S__F__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret