joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008fe80
Capabilities:
Read file on windows

Disassembly:
jmp 0x14008fe80
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x38
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor r13b, r13b
mov qword [rdi], 0
call fcn.14000434f
cmp eax, 1
jle 0x14008fec2
mov rax, qword [rsp + 0xb8]
cmp dword [rax + 0x40], 0xfffffffc
je 0x140090117
cmp dword [0x140191994], 0
je 0x14008ffa0
mov rax, qword [rsp + 0xb0]
lea r8, [rax - 1]
cmp r8, 1
ja 0x14008fef4
xor eax, eax
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r15d, dword [rsp + 0xa0]
test r15d, r15d
je 0x14008ff91
cmp qword [rsp + 0xb0], 0xfffffffffffffffa
je 0x1400900fb
cmp qword [rsp + 0xb0], 0
je 0x1400900c4
cmp dword [rsp + 0xa8], 0
je 0x14008ffa0
mov r12d, r14d
mov ecx, r12d
call fcn.1400041a6
mov ecx, r12d
call fcn.1400026bc
test r13b, r13b
je 0x14008ffa0
mov rcx, rbp
mov edx, esi
mov r8d, r12d
call fcn.140002018
movsxd rbx, eax
mov qword [rdi], rbx
cmp eax, 0xffffffff
je 0x14008fee1
lea rcx, [0x14014e280]
mov edx, 2
mov r8d, r12d
xor r9d, r9d
call fcn.14000213a
mov byte [rbx + rbp], 0xa
mov eax, 1
inc qword [rdi]
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp qword [rsp + 0xb0], 0
je 0x1400900c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xb8]
mov qword [rdi], 0
test rax, rax
je 0x14008ffd0
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x230]
test rax, rax
jne 0x14008ffd5
mov eax, 0x20000
cmp rsi, rax
jbe 0x140090082
cmp qword [rsp + 0xb0], 0
je 0x140090082
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14009000e
mov rax, qword [rsp + 0xb8]
mov r12, qword [rax + 0x230]
test r12, r12
jne 0x140090014
mov r12d, 0x20000
mov rax, rsp
mov r13, r12
mov rcx, rbx
mov rdx, rbp
mov r8d, r12d
lea r9, [rsp + 0x30]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400900a9
movsxd r9, dword [rsp + 0x30]
add rbp, r9
add qword [rdi], r9
sub rsi, r9
mov r8, qword [rsp + 0xb8]
test r8, r8
je 0x140090069
mov r8, qword [rsp + 0xb8]
mov r8, qword [r8 + 0x230]
test r8, r8
jne 0x14009006f
mov r8d, 0x20000
cmp rsi, r8
cmovbe r12, rsi
test rsi, rsi
je 0x1400900a9
cmp r9, r13
je 0x140090014
jmp 0x1400900a9
mov rax, rsp
mov rcx, rbx
mov rdx, rbp
mov r8d, esi
lea r9, [rsp + 0x30]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rdx, dword [rsp + 0x30]
mov qword [rdi], rdx
mov edx, 1
test eax, eax
cmovne eax, edx
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r13b, 1
call fcn.1400019fb
mov r12d, eax
movsxd r14, r12d
cmp dword [0x140191994], 0
je 0x14008ff45
test r15d, r15d
je 0x14008ff45
cmp dword [rsp + 0xa8], 0
jne 0x14008ff2d
jmp 0x14008ff45
mov r13b, 1
mov r14, rbx
cmp dword [rsp + 0xa8], 0
jne 0x14008ff2d
mov r12d, ebx
jmp 0x14008ff45
mov eax, 1
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b98e0
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x48
mov rbx, rcx
mov qword [rsp + 0x40], 0
mov rdx, qword [rbx + 0x80]
mov rbp, qword [rbx + 0x78]
test rdx, rdx
je 0x1400b9911
sub rbp, rdx
jmp 0x1400b9918
mov rax, qword [rbx + 0x70]
sub rbp, rax
mov r15, rbp
add r15, qword [rbx + 0x1f0]
movsx edi, byte [rbx + 0x266]
cmp edi, 1
je 0x1400b99af
cmp edi, 3
je 0x1400b99af
test rbp, rbp
je 0x1400b99a8
test rdx, rdx
jne 0x1400b9945
mov rdx, qword [rbx + 0x70]
cmp dword [rbx + 0x228], 0xb
jne 0x1400b9983
mov eax, edi
and eax, 0xfffffffe
cmp eax, 4
jne 0x1400b9983
mov rax, qword [rbx + 0x70]
mov qword [rbx + 0x78], rax
cmp edi, 5
je 0x1400b9de3
mov rcx, rbx
mov r8, rbp
mov r9d, 1
call fcn.1400b95c0
mov r15, qword [rbx + 0x1f0]
jmp 0x1400b9999
mov rcx, rbx
mov r8, rbp
call fcn.140002469
cmp eax, 0xffffffff
je 0x1400b9f0c
xor eax, eax
test eax, eax
jne 0x1400b9d65
movsx edi, byte [rbx + 0x266]
and byte [rbx + 0x27c], 0xbf
lea edx, [rdi - 1]
cmp edx, 7
ja 0x1400b9d76
lea rsi, [0x140000000]
movzx eax, word [rsi + rdx*2 + 0x14e904]
lea rax, [rsi + rax + 0xb99d4]
jmp rax
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 8
mov edx, 2
lea r8, str.for_wseq.c
mov r9d, 0x108f
call fcn.1400035df
test byte [rbx + 0x27d], 8
je 0x1400b9dd0
mov rcx, qword [rbx + 0x198]
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400b9ef6
and byte [rbx + 0x27d], 0xf7
test ebp, ebp
je 0x1400b9dd0
mov eax, ebp
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
mov r8, rbp
call fcn.140002469
cmp eax, 0xffffffff
je 0x1400b9dfa
xor eax, eax
jmp 0x1400b997a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a0], eax
mov eax, 0x26
jmp 0x1400b997a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a0], eax
mov ebp, 0x26
jmp 0x1400b9db2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a0], eax
mov eax, 0x26
jmp 0x1400b9999
Function at 0x1400beb70
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400beb70
push rdi
sub rsp, 0x150
xor edi, edi
mov rax, qword [0x14016fb98]
mov edx, 0x100
xor rax, rsp
pxor xmm0, xmm0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x140], edi
mov byte [rsp + 0x144], dil
movups xmmword [rsp + rdx + 0x30], xmm0
movups xmmword [rsp + rdx + 0x20], xmm0
movups xmmword [rsp + rdx + 0x10], xmm0
movups xmmword [rsp + rdx], xmm0
sub rdx, 0x40
jne 0x1400bebad
cmp qword [0x14018f720], 0
je 0x1400beda2
lea rcx, [0x14018f720]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x14016fbe0], 0xffffffffffffffff
je 0x1400bed72
lea rcx, str.SYSTEMROOT
lea rdx, [rsp + 0x40]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400bec21
mov edx, 0x105
lea rcx, [rsp + 0x40]
lea r8, str._system32_
call fcn.140003305
mov edx, 0x105
lea rcx, [rsp + 0x40]
lea r8, str.msvcrt.dll
call fcn.140003305
mov ecx, 1
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
cmp qword [rsp + 0x38], 0
je 0x1400bed4a
mov edx, 1
mov eax, 0x10
mov qword [rsp + 0x30], rbx
mov rbx, rax
mov qword [rsp + 0x28], rsi
mov rsi, rdx
mov qword [rsp + 0x20], r12
lea r12, [0x140000000]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [r12 + rbx + 0x16fbe8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400becf7
mov qword [r12 + rbx + 0x16fbe0], rax
inc rsi
add rbx, 0x10
cmp rsi, 0x32
jl 0x1400bec7e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
lea rcx, [0x14018f720]
mov qword [0x14016fbe0], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x1400becf1
mov eax, edi
add rsp, 0x150
pop rdi
ret
call fcn.140003bcf
nop
mov rcx, qword [r12 + rbx + 0x16fbe0]
test rcx, rcx
je 0x1400bed22
cmp rcx, rsi
jge 0x1400bec9e
shl rcx, 4
mov rcx, qword [r12 + rcx + 0x16fbe0]
mov qword [r12 + rbx + 0x16fbe0], rcx
jmp 0x1400bec9e
mov r8, qword [0x14016fbf0]
test r8, r8
je 0x1400bec9e
lea rcx, str.Warning:_Missing__s_function_during_Intel_Library_Wrapper_initialization._n
mov rdx, qword [r12 + rbx + 0x16fbe8]
call r8
nop
jmp 0x1400bec9e
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400bec58
mov edi, 0xffffffff
jmp 0x1400becba
lea rcx, [0x14018f720]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x1400becf1
xor eax, eax
add rsp, 0x150
pop rdi
ret
lea rcx, [0x14018f720]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
jmp 0x1400bebd4
Function at 0x1400bf410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400bf410
push rbx
sub rsp, 0x30
mov r10, rax
mov r9, r10
mov r8, rdx
and r9, 0xfff
and r8, 0xfff
movdqu xmm4, xmmword [0x140152540]
neg r9d
neg r8d
add r9d, 0x1000
add r8d, 0x1000
movdqu xmm3, xmmword [0x140152550]
cmp r9d, 0x10
jl 0x1400bf45c
cmp r8d, 0x10
jge 0x1400bf4b0
movzx eax, byte [r10]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
lea ebx, [rax + 0x20]
movzx ecx, byte [rdx]
cmovbe eax, ebx
lea r11d, [rcx - 0x41]
cmp r11d, 0x19
lea ebx, [rcx + 0x20]
cmovbe ecx, ebx
cmp eax, ecx
jne 0x1400bf5d3
test eax, eax
je 0x1400bf599
inc r10
inc rdx
dec r8d
dec r9d
jne 0x1400bf554
mov r9d, 0x1000
test r8d, r8d
jne 0x1400bf456
mov r8d, 0x1000
movups xmmword [rsp + 0x20], xmm6
movdqu xmm1, xmmword [r10]
movdqu xmm2, xmmword [rdx]
movdqu xmm0, xmmword [0x140152560]
movdqa xmm5, xmm1
pcmpgtb xmm5, xmm3
pcmpgtb xmm0, xmm1
pand xmm5, xmm0
pand xmm5, xmm4
pxor xmm0, xmm0
movdqu xmm6, xmmword [0x140152560]
paddb xmm1, xmm5
movdqa xmm5, xmm2
pcmpgtb xmm6, xmm2
pcmpgtb xmm5, xmm3
pcmpeqb xmm0, xmm1
pand xmm5, xmm6
pand xmm5, xmm4
paddb xmm2, xmm5
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x1400bf57d
pmovmskb eax, xmm0
test eax, eax
jne 0x1400bf5db
add r9d, 0xfffffff0
add r10, 0x10
add rdx, 0x10
add r8d, 0xfffffff0
cmp r9d, 0x10
jl 0x1400bf541
cmp r8d, 0x10
jge 0x1400bf4b5
nop word [rax + rax]
movups xmm6, xmmword [rsp + 0x20]
jmp 0x1400bf45c
test r8d, r8d
jne 0x1400bf56e
mov r8d, 0x1000
cmp r9d, 0x10
jge 0x1400bf4aa
jmp 0x1400bf45c
cmp r9d, 0x10
jl 0x1400bf45c
jmp 0x1400bf456
bsf r8d, eax
pmovmskb eax, xmm0
movups xmm6, xmmword [rsp + 0x20]
mov ecx, r8d
test eax, eax
je 0x1400bf5a1
bsf eax, eax
cmp eax, r8d
jae 0x1400bf5a1
xor eax, eax
add rsp, 0x30
pop rbx
ret
movzx eax, byte [rcx + r10]
movzx r10d, byte [rcx + rdx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x30
pop rbx
ret
sub eax, ecx
add rsp, 0x30
pop rbx
ret
movups xmm6, xmmword [rsp + 0x20]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400bf4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400bf410
push rbx
sub rsp, 0x30
mov r10, rax
mov r9, r10
mov r8, rdx
and r9, 0xfff
and r8, 0xfff
movdqu xmm4, xmmword [0x140152540]
neg r9d
neg r8d
add r9d, 0x1000
add r8d, 0x1000
movdqu xmm3, xmmword [0x140152550]
cmp r9d, 0x10
jl 0x1400bf45c
cmp r8d, 0x10
jge 0x1400bf4b0
movzx eax, byte [r10]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
lea ebx, [rax + 0x20]
movzx ecx, byte [rdx]
cmovbe eax, ebx
lea r11d, [rcx - 0x41]
cmp r11d, 0x19
lea ebx, [rcx + 0x20]
cmovbe ecx, ebx
cmp eax, ecx
jne 0x1400bf5d3
test eax, eax
je 0x1400bf599
inc r10
inc rdx
dec r8d
dec r9d
jne 0x1400bf554
mov r9d, 0x1000
test r8d, r8d
jne 0x1400bf456
mov r8d, 0x1000
movups xmmword [rsp + 0x20], xmm6
movdqu xmm1, xmmword [r10]
movdqu xmm2, xmmword [rdx]
movdqu xmm0, xmmword [0x140152560]
movdqa xmm5, xmm1
pcmpgtb xmm5, xmm3
pcmpgtb xmm0, xmm1
pand xmm5, xmm0
pand xmm5, xmm4
pxor xmm0, xmm0
movdqu xmm6, xmmword [0x140152560]
paddb xmm1, xmm5
movdqa xmm5, xmm2
pcmpgtb xmm6, xmm2
pcmpgtb xmm5, xmm3
pcmpeqb xmm0, xmm1
pand xmm5, xmm6
pand xmm5, xmm4
paddb xmm2, xmm5
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x1400bf57d
pmovmskb eax, xmm0
test eax, eax
jne 0x1400bf5db
add r9d, 0xfffffff0
add r10, 0x10
add rdx, 0x10
add r8d, 0xfffffff0
cmp r9d, 0x10
jl 0x1400bf541
cmp r8d, 0x10
jge 0x1400bf4b5
nop word [rax + rax]
movups xmm6, xmmword [rsp + 0x20]
jmp 0x1400bf45c
test r8d, r8d
jne 0x1400bf56e
mov r8d, 0x1000
cmp r9d, 0x10
jge 0x1400bf4aa
jmp 0x1400bf45c
cmp r9d, 0x10
jl 0x1400bf45c
jmp 0x1400bf456
bsf r8d, eax
pmovmskb eax, xmm0
movups xmm6, xmmword [rsp + 0x20]
mov ecx, r8d
test eax, eax
je 0x1400bf5a1
bsf eax, eax
cmp eax, r8d
jae 0x1400bf5a1
xor eax, eax
add rsp, 0x30
pop rbx
ret
movzx eax, byte [rcx + r10]
movzx r10d, byte [rcx + rdx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x30
pop rbx
ret
sub eax, ecx
add rsp, 0x30
pop rbx
ret
movups xmm6, xmmword [rsp + 0x20]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400bf554
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400bf410
push rbx
sub rsp, 0x30
mov r10, rax
mov r9, r10
mov r8, rdx
and r9, 0xfff
and r8, 0xfff
movdqu xmm4, xmmword [0x140152540]
neg r9d
neg r8d
add r9d, 0x1000
add r8d, 0x1000
movdqu xmm3, xmmword [0x140152550]
cmp r9d, 0x10
jl 0x1400bf45c
cmp r8d, 0x10
jge 0x1400bf4b0
movzx eax, byte [r10]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
lea ebx, [rax + 0x20]
movzx ecx, byte [rdx]
cmovbe eax, ebx
lea r11d, [rcx - 0x41]
cmp r11d, 0x19
lea ebx, [rcx + 0x20]
cmovbe ecx, ebx
cmp eax, ecx
jne 0x1400bf5d3
test eax, eax
je 0x1400bf599
inc r10
inc rdx
dec r8d
dec r9d
jne 0x1400bf554
mov r9d, 0x1000
test r8d, r8d
jne 0x1400bf456
mov r8d, 0x1000
movups xmmword [rsp + 0x20], xmm6
movdqu xmm1, xmmword [r10]
movdqu xmm2, xmmword [rdx]
movdqu xmm0, xmmword [0x140152560]
movdqa xmm5, xmm1
pcmpgtb xmm5, xmm3
pcmpgtb xmm0, xmm1
pand xmm5, xmm0
pand xmm5, xmm4
pxor xmm0, xmm0
movdqu xmm6, xmmword [0x140152560]
paddb xmm1, xmm5
movdqa xmm5, xmm2
pcmpgtb xmm6, xmm2
pcmpgtb xmm5, xmm3
pcmpeqb xmm0, xmm1
pand xmm5, xmm6
pand xmm5, xmm4
paddb xmm2, xmm5
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x1400bf57d
pmovmskb eax, xmm0
test eax, eax
jne 0x1400bf5db
add r9d, 0xfffffff0
add r10, 0x10
add rdx, 0x10
add r8d, 0xfffffff0
cmp r9d, 0x10
jl 0x1400bf541
cmp r8d, 0x10
jge 0x1400bf4b5
nop word [rax + rax]
movups xmm6, xmmword [rsp + 0x20]
jmp 0x1400bf45c
test r8d, r8d
jne 0x1400bf56e
mov r8d, 0x1000
cmp r9d, 0x10
jge 0x1400bf4aa
jmp 0x1400bf45c
cmp r9d, 0x10
jl 0x1400bf45c
jmp 0x1400bf456
bsf r8d, eax
pmovmskb eax, xmm0
movups xmm6, xmmword [rsp + 0x20]
mov ecx, r8d
test eax, eax
je 0x1400bf5a1
bsf eax, eax
cmp eax, r8d
jae 0x1400bf5a1
xor eax, eax
add rsp, 0x30
pop rbx
ret
movzx eax, byte [rcx + r10]
movzx r10d, byte [rcx + rdx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x30
pop rbx
ret
sub eax, ecx
add rsp, 0x30
pop rbx
ret
movups xmm6, xmmword [rsp + 0x20]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400f3dd0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400f3dd0
mov rax, rcx
neg rcx
test rax, 7
je 0x1400f3ded
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400f3e48
test al, 7
jne 0x1400f3de0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400f3e01
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400f3e72
test dh, dh
je 0x1400f3e6c
shr rdx, 0x10
test dl, dl
je 0x1400f3e66
test dh, dh
je 0x1400f3e60
shr rdx, 0x10
test dl, dl
je 0x1400f3e5a
test dh, dh
je 0x1400f3e54
shr edx, 0x10
test dl, dl
je 0x1400f3e4e
test dh, dh
jne 0x1400f3e01
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x140001070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rcx
lea rdx, str.DeviceAfdEndpoint
lea rcx, [rbp - 0x70]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], 0x4f
lea rax, [rbp - 0x70]
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x70], rax
lea r9, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x4c], 0x340f00
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], 0x20
xor eax, eax
mov dword [rsp + 0x38], 3
mov edx, 0xc0140000
mov dword [rsp + 0x30], 3
mov rcx, rbx
mov dword [rsp + 0x28], eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x48], 0x4f646641
mov dword [rbp - 0x44], 0x506e6570
mov dword [rbp - 0x40], 0x656b6361
mov dword [rbp - 0x3c], 0x585874
mov qword [rbp - 0x38], 0x10011000
mov dword [rbp - 0x30], 2
mov dword [rbp - 0x2c], 1
mov dword [rbp - 0x28], 6
mov dword [rbp - 0x24], 0x16
mov dword [rbp - 0x20], 0x44005c
mov dword [rbp - 0x1c], 0x760065
mov dword [rbp - 0x18], 0x630069
mov dword [rbp - 0x14], 0x5c0065
mov dword [rbp - 0x10], 0x630054
mov qword [rbp - 0xc], 0x70
mov word [rbp - 4], 0
mov byte [rbp - 2], 0
movups xmmword [rbp - 0x80], xmm0
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], 0x40
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140002d60
mov rbx, qword [rsp + 0x128]
add rsp, 0x110
pop rbp
ret
Function at 0x1400011c0
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], esi
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, esi
mov dword [rsp + 0x40], eax
nop dword [rax]
nop word [rax + rax]
mov edx, eax
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140001280
cmp eax, 0xc0000023
jne 0x140001286
nop
mov eax, dword [rsp + 0x40]
jmp 0x140001230
test eax, eax
je 0x1400012a2
lea rcx, str._ERROR__Could_not_NtQuerySystemInformation._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [rbx]
test r8, r8
je 0x1400012d9
mov rdx, qword [rsp + 0x48]
mov r9d, eax
lea rax, [rbx + 0x20]
nop dword [rax]
cmp qword [rax - 8], r9
jne 0x1400012cb
cmp qword [rax], rdx
je 0x1400012f1
inc esi
add rax, 0x28
movsxd rcx, esi
cmp rcx, r8
jb 0x1400012c0
lea rcx, str._ERROR__Could_not_find_current_threads_KTHREAD._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdx
call qword [sym.imp.ntdll.dll_NtClose]
movsxd rax, esi
lea rax, [rax + rax*4]
mov rax, qword [rbx + rax*8 + 0x10]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140002d60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400019f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov edx, 0x1000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1000
mov rdx, rax
mov r8d, 0x1000
mov ecx, 0x40
mov rbp, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x80000000
mov esi, eax
lea ecx, [rbx + rdx]
test edx, ecx
jne 0x140001a6c
cmp ebx, 0xc0000004
je 0x140001a6c
xor eax, eax
jmp 0x140001ae0
mov rcx, rbp
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [rsp + 0x20]
mov ecx, 0x40
add ebx, 0x100
movsxd rdx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov r14, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r8, qword [r14]
xor edx, edx
test r8, r8
je 0x140001ad9
lea rcx, [r14 + 0x18]
nop dword [rax]
cmp qword [rcx + 8], rdi
jne 0x140001acb
cmp qword [rcx], rsi
je 0x140001b02
inc edx
add rcx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x140001ac0
xor eax, eax
mov r14, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140002d60
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
movsxd rax, edx
lea rcx, [rax + rax*4]
mov rax, qword [r14 + rcx*8 + 0x10]
jmp 0x140001adb
Function at 0x140001e40
Capabilities:
Make suspicious ntfscontrolfile call
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, qword [rcx + 0x98]
xor ebp, ebp
mov rbx, rcx
mov esi, ebp
test rdi, rdi
je 0x140001e93
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea rsi, [rdi + 0xd0]
mov rdx, qword [rbx + 0x88]
lea r8, [rsp + 0x50]
add rdx, 0x58
mov rcx, rbx
call fcn.140001d30
mov rax, qword [rbx + 0x88]
xor r9d, r9d
add rax, 0x48
mov qword [rsp + 0x40], rbp
mov qword [rsi + 8], rax
xor r8d, r8d
mov qword [rsi], rax
xor edx, edx
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x24], 0xffffffffffffffff
mov dword [rsi + 0x20], 1
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x10], rax
lea rax, [rsp + 0x68]
mov rcx, qword [rbx + 0xb8]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x1000
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rdx, qword [rbx + 0x88]
lea r8, [rsp + 0x60]
add rdx, 0x49
mov rcx, rbx
call fcn.140001d30
test eax, eax
jne 0x14000201e
mov rdx, qword [rbx + 0x88]
lea r8, [rsp + 0x58]
add rdx, 0x5b
mov rcx, rbx
call fcn.140001d30
test eax, eax
jne 0x14000201e
mov rcx, qword [rsp + 0x50]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001f63
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001f78
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbx + 0x10]
xor r9d, r9d
mov rcx, qword [rbx + 0x88]
xor r8d, r8d
add rcx, 0xc
mov dword [rsp + 0x88], 0xc
mov dword [rsp + 0x8c], 0xffffffff
xor edx, edx
mov dword [rsp + 0x90], 0x101
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0xc
mov byte [rax], 0xd
mov rax, qword [rbx + 0x18]
mov dword [rax + 0x10], 0x119ff8
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 0xb8], rax
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov qword [rbx + 0xc8], rcx
jmp 0x140002020
xor eax, eax
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140002d60
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140003620
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000366a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000366a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000366a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000366a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000366a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000366c
xor al, al
add rsp, 0x28
ret