joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a820
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x140042f00]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x14003a898
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14003a898
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x14003a898
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x14003a898
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x14003a88c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x14003a8a0
add rdx, 0x28
cmp rdx, r10
jne 0x14003a878
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x14003a8b0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x14003a8be
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14003a895
test r8d, r8d
jg 0x14003a8a8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x10001e024
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1000301f8], rdi
je 0x10001e07d
cmp rax, rdi
jne 0x10001e070
mov esi, 1
jmp 0x10001e07d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001e057
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e092
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10001e0f7
mov eax, dword [0x1000301f0]
test eax, eax
jne 0x10001e0ed
mov dword [0x1000301f0], 1
lea r12, [0x100001690]
lea rdi, [0x100001678]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10001e0df
test eax, eax
jne 0x10001e0df
mov rcx, qword [rdi]
test rcx, rcx
je 0x10001e0d4
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10001e0bd
test eax, eax
je 0x10001e0f7
mov eax, 0xff
jmp 0x10001e241
mov dword [0x10002f924], 1
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e11f
lea rdx, [0x100001670]
lea rcx, [0x1000015f8]
call sub.msvcrt.dll__initterm
mov dword [0x1000301f0], 2
test esi, esi
jne 0x10001e12c
xor eax, eax
xchg qword [0x1000301f8], rax
cmp qword [0x100030210], 0
je 0x10001e155
lea rcx, [0x100030210]
call fcn.10001e5dc
test eax, eax
je 0x10001e155
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100030210]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e176
test esi, esi
jne 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e18a
cmp byte [rdi], 0x20
ja 0x10001e18a
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e176
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100008db4
mov dword [0x10002f920], eax
cmp dword [0x10002f904], 0
jne 0x10001e1c9
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10002f924], 0
jne 0x10001e1de
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10002f920]
jmp 0x10001e241
cmp byte [rdi], 0x22
jne 0x10001e1f2
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10001e207
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e168
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.100146000
add rsp, 0x28
jmp 0x10001e024
Function at 0x14000109c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov sil, dl
xor r15d, r15d
lea rdx, [0x1400032bf]
cmp rcx, r15
mov r13d, r8d
cmovne rdx, rcx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_CharUpperA]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx r12d, r15w
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
cmp eax, r13d
jae 0x140001211
lea rdx, [rsp + 0x240]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
cmp eax, r15d
je 0x1400011eb
mov r8d, 0xa
lea r9, [rsp + 0x230]
lea rdx, [rsp + 0x20]
cmp dword [rsp + 0x240], r8d
mov rcx, rbp
cmovb r8d, dword [rsp + 0x240]
mov dword [rsp + 0x240], r8d
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
cmp eax, r15d
je 0x1400011eb
mov eax, dword [rsp + 0x240]
mov edi, r15d
cmp eax, r15d
jbe 0x1400011eb
lea rbx, [rsp + 0x2a]
mov ecx, 1
cmp dword [rsp + 0x230], r15d
jbe 0x1400011e1
cmp word [rbx - 0xa], cx
jne 0x1400011e1
cmp dword [rbx - 6], r15d
je 0x1400011a5
mov r12w, word [rbx]
jmp 0x1400011e1
cmp word [rbx], r12w
jne 0x1400011e1
mov eax, 0x1b
cmp ax, word [rbx]
je 0x140001211
cmp byte [rsp + 0xf0], r15b
je 0x1400011fb
movzx edx, word [rbx]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, r15
jne 0x1400011fb
mov eax, dword [rsp + 0x240]
mov ecx, 1
add edi, ecx
add rbx, 0x14
cmp edi, eax
jb 0x140001189
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000110a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov r11d, edi
lea rax, [r11 + r11*4]
mov al, byte [rsp + rax*4 + 0x2a]
jmp 0x140001214
mov al, sil
mov rbx, qword [rsp + 0x238]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400014a0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
and dword [rcx], 0
mov r15, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rdi, [0x140005020]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1400015e7
mov r11d, 1
xor r9d, r9d
mov bpl, 0x22
add dword [rbx], r11d
movsxd rcx, dword [rbx]
movsxd r10, eax
mov qword [r15 + rcx*8 - 8], rdi
cmp byte [0x140005020], bpl
mov r8d, r11d
cmove r9d, r11d
cmp r11, r10
mov rdx, r11
jge 0x14000156b
mov sil, 0x20
test r9d, r9d
je 0x140001532
cmp byte [rdx + rdi], bpl
jne 0x140001560
xor r9d, r9d
jmp 0x140001560
cmp byte [rdx + rdi], sil
jne 0x140001558
mov byte [rdx + rdi], 0
add rdx, r11
add r8d, r11d
cmp byte [rdx + rdi], sil
je 0x14000153c
movsxd rax, dword [rbx]
movsxd rcx, r8d
add rcx, rdi
mov qword [r15 + rax*8], rcx
add dword [rbx], r11d
cmp byte [rdx + rdi], bpl
cmove r9d, r11d
add rdx, r11
add r8d, r11d
cmp rdx, r10
jl 0x140001522
xor ebp, ebp
cmp dword [rbx], ebp
jle 0x1400015d5
mov rdi, r15
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor r13d, r13d
xor esi, esi
movsxd r12, eax
mov r14, r12
test eax, eax
jle 0x1400015cb
mov rax, qword [rdi]
cmp byte [rax + rsi], 0x22
jne 0x1400015bd
cmp byte [rax + rsi - 1], 0x5c
je 0x1400015bd
lea eax, [r13 + 1]
movsxd rcx, r13d
movsxd r8, r12d
add rcx, qword [rdi]
movsxd rdx, eax
add rdx, qword [rdi]
call fcn.140001450
mov r11, qword [rdi]
mov byte [r11 + r14 - 2], 0
inc rsi
inc r13d
dec r12d
cmp rsi, r14
jl 0x14000158c
inc ebp
add rdi, 8
cmp ebp, dword [rbx]
jl 0x140001574
movsxd rdx, dword [rbx]
mov rcx, qword [r15 + rdx*8 - 8]
cmp byte [rcx], 0
jne 0x1400015e7
lea eax, [rdx - 1]
mov dword [rbx], eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140001604
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14000166a
test rbx, rbx
je 0x14000166a
lea r8, [rsp + 0x20]
lea rdx, [0x1400032c0]
lea rcx, [rsp + 0x130]
mov r9, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x130]
call fcn.1400025f8
test eax, eax
je 0x14000166a
mov eax, 1
jmp 0x14000166c
xor eax, eax
add rsp, 0x240
pop rbx
ret
Function at 0x140001678
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x860
lea rcx, str.psapi.dll
call fcn.140002614
mov rbx, rax
test rax, rax
je 0x140001863
lea rdx, str.EnumProcessModules
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rbp, rbp
je 0x140001863
test rax, rax
je 0x140001863
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001863
and qword [rsp + 0x3b0], 0
lea rcx, [rsp + 0x3b8]
xor edx, edx
mov r8d, 0x4a8
mov edi, 1
call fcn.14000140c
and dword [rsp + 0x880], 0
lea ebx, [rdi + 0x3f]
lea rcx, [rsp + 0x170]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, [rsp + 0x880]
lea rdx, [rsp + 0x3b0]
mov r8d, 0x4b0
mov rcx, rsi
call rbp
test eax, eax
je 0x140001856
mov ebp, dword [rsp + 0x880]
mov rbx, rdi
shr ebp, 3
cmp rdi, rbp
jge 0x140001856
mov rdx, qword [rsp + rbx*8 + 0x3b0]
lea r8, [rsp + 0x60]
mov r9d, 0x104
mov rcx, rsi
call r12
test eax, eax
je 0x1400017e5
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
lea rcx, [rsp + 0x60]
cmp rcx, rax
je 0x1400017e5
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
lea rcx, [rsp + 0x60]
cmp rcx, rax
je 0x1400017e5
lea rcx, [rsp + 0x60]
call fcn.140001604
test eax, eax
jne 0x1400017ed
add rbx, rdi
cmp rbx, rbp
jmp 0x14000177d
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140001811
test al, 6
je 0x140001811
and eax, 0xfffffff9
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x20]
lea rdx, str.ERROR:_System_DLL_was_not_loaded_from__s:_r_n_r_n_s_r_n_r_nProbably_it_is_Malware_
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea r8, str.UsbTreeView
lea rdx, [rsp + 0x1b0]
mov rcx, rax
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140001865
xor eax, eax
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14000193c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x440
mov rdx, rcx
lea r8, [rax + 0x10]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], 0
call qword [sym.imp.USER32.dll_wvsprintfA]
cmp eax, 0x3ff
jle 0x140001976
int3
lea rcx, [rsp + 0x40]
call fcn.1400018d4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x30]
mov eax, ecx
add rsp, 0x440
pop rbx
ret

Function at 0x1400024e4
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xc0
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x9c
call fcn.14000140c
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r11d, dword [rsp + 0x24]
mov r9d, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
xor ecx, ecx
mov r8d, r11d
shl r8d, 8
mov r10d, ecx
mov dword [rbx + 0x2c], eax
movzx eax, word [rsp + 0xb4]
add r8d, r9d
cmp dword [rsp + 0x30], 2
sete r10b
mov dword [rbx + 0x30], eax
mov dword [rbx + 0x24], r11d
mov dword [rbx + 0x28], r9d
mov dword [rbx + 0x34], r8d
mov eax, ecx
mov dword [rbx], r10d
lea edx, [rcx + 1]
cmp r10d, ecx
je 0x1400025af
cmp r11d, 4
sete al
cmp r8d, 0x500
mov dword [rbx + 4], eax
mov eax, ecx
sete al
cmp r8d, 0x501
mov dword [rbx + 8], eax
jl 0x14000258f
cmp r8d, 0x600
mov eax, edx
jl 0x140002591
mov eax, ecx
cmp r8d, 0x600
mov dword [rbx + 0xc], eax
jl 0x1400025a8
cmp r8d, 0x610
mov eax, edx
jl 0x1400025aa
mov eax, ecx
mov dword [rbx + 0x10], eax
jmp 0x1400025d2
cmp r9d, ecx
mov dword [rbx + 0x14], edx
sete al
cmp r9d, edx
mov dword [rbx + 0x18], eax
mov eax, ecx
sete al
mov dword [rbx + 0x1c], eax
mov eax, ecx
cmp r9d, 0x5a
setge al
mov dword [rbx + 0x20], eax
cmp r11d, 5
jge 0x1400025e8
cmp r10d, ecx
jne 0x1400025ea
cmp r11d, 4
jl 0x1400025ea
cmp r9d, edx
jl 0x1400025ea
mov ecx, edx
mov dword [rbx + 0x38], ecx
add rsp, 0xc0
pop rbx
ret

Function at 0x1400025f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140002614
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x130
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [0x140003940]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
add rsp, 0x130
pop rbx
ret
Function at 0x140002a24
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x70
lea rax, [rsp + 0x60]
mov rbx, r8
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
cmp eax, ecx
jne 0x140002aa5
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x98], ecx
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140002aaa
mov eax, 2
add rsp, 0x70
pop rbx
ret

Function at 0x140002e48
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
xor ebx, ebx
mov byte [rax + 0x15], 5
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov byte [rax - 8], bl
mov byte [rax - 7], bl
mov byte [rax - 6], bl
mov byte [rax - 5], bl
mov byte [rax - 4], bl
mov qword [rax], rbx
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rdx, qword [rsp + 0x80]
cmp rdx, rbx
je 0x140002ed3
lea r8, [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x80]
cmp eax, ebx
cmovne ebx, dword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
insd dword [rdi], dx
popfq
invalid
Function at 0x140000364
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140000364
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x30], 0x75726957
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x416d6074
mov dword [rbp - 0x28], 0x626f6c6c
mov byte [rbp - 0x24], 1
call fcn.14000029c
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x20]
cmovae r8, qword [rbp - 0x20]
cmovae rdx, qword [rbp - 0x20]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400003ec
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400003e7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400003f2
call fcn.1400001f4
add rsp, 0x50
pop rbp
ret
call fcn.140000284
int3
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x180a8e000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x180a8e00a
jmp 0x180a9000f
jmp fcn.18073d058
Function at 0x1400059a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
call fcn.1400052c0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140005b22
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x38], 0x45
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x73
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x49
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0x6c
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x38], 0x78
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005b17
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x140005b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x30], 0
call fcn.1400053d0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005dbd
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x48], 0x64
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x48], 0x76
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x48], 0x6c
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x48], 0x67
mov eax, 1
imul rax, rax, 0x1f
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0x1d
mov byte [rsp + rax + 0x48], 0x69
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x48], 0x55
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x48], 0x74
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x48], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x48], 0x46
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x48], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x48], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x48], 0x64
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x48], 0x50
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x48], 0x75
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x48], 0x6c
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x48], 0x61
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x48], 0x41
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x48], 0x50
mov eax, 1
imul rax, rax, 0x21
mov byte [rsp + rax + 0x48], 0x57
mov eax, 1
imul rax, rax, 0x20
mov byte [rsp + rax + 0x48], 0x73
mov eax, 1
imul rax, rax, 0x1a
mov byte [rsp + rax + 0x48], 0x44
mov eax, 1
imul rax, rax, 0x1b
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x48], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x48], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x48], VarBstrFromDisp
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0x19
mov byte [rsp + rax + 0x48], 0x79
mov eax, 1
imul rax, rax, 0x1e
mov byte [rsp + rax + 0x48], 0x63
mov eax, 1
imul rax, rax, 0x22
mov byte [rsp + rax + 0x48], 0
mov eax, 1
imul rax, rax, 0x1c
mov byte [rsp + rax + 0x48], 0x76
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x48], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x48], VarBstrFromDisp
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x48], 0x44
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140005db2
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
add rsp, 0x78
ret