joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180029830
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a8040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x18002986d
xor al, al
jmp 0x1800298bc
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x18002987e
xor al, al
jmp 0x1800298bc
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800298a5
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800298a5
mov al, 1
jmp 0x1800298bc
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002b710
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002b710
add rsp, 0x60
pop rbx
ret

Function at 0x180029b40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800a8040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x180029b71
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x180029c2a
nop word [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x180029b9b
add rbx, 0x8000000
jmp 0x180029c21
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180029c2a
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180029c06
cmp rcx, 0x10000
jb 0x180029c06
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180029c2c
add rbx, 0x10000
jmp 0x180029c21
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180029c21
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180029b80
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002b710
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180029c50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800a8040]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x180029d38
nop dword [rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x180029cab
sub rbx, 0x8000000
jmp 0x180029d2f
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180029d38
cmp dword [rsp + 0x40], 0x10000
jne 0x180029d13
cmp qword [rsp + 0x38], 0x10000
jb 0x180029d13
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180029d3a
sub rbx, 0x10000
jmp 0x180029d2f
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180029c90
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002b710
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180029e40
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx - 0x7ff80000]
mov r9, rcx
cmp rcx, 0x7ff80000
ja 0x180029e5e
mov ebx, 0x80000
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x7ff80000]
cmp r9, 0xffffffff80000000
jb 0x180029e7a
mov rdi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180029e91
cmp byte [rcx + 1], 0x25
jne 0x180029ed5
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180029e9d
cmp al, 0xe9
jne 0x180029ed5
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, r9
cmp rcx, r9
jae 0x180029ec0
cmp rcx, 0xffffffff80000000
jae 0x180029eb7
lea rdi, [rcx + 0x7ff80000]
jmp 0x180029ed5
mov rdi, 0xfffffffffff80000
jmp 0x180029ed5
lea rbx, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180029ed5
mov ebx, 0x80000
mov rax, qword [0x1800d7df8]
mov rcx, qword [0x1800d7e08]
test rax, rax
jne 0x180029ef7
test rcx, rcx
je 0x180029f0e
mov rax, rcx
mov qword [0x1800d7df8], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x180029f0e
cmp rdx, rbx
jb 0x180029f0e
cmp rdx, rdi
jbe 0x180029fc8
mov qword [0x1800d7df8], rcx
mov rax, rcx
test rcx, rcx
je 0x180029f52
mov rdx, rcx
test rcx, rcx
je 0x180029f3c
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180029f3c
cmp rcx, rbx
jb 0x180029f3c
cmp rcx, rdi
jbe 0x180029fc8
mov rax, qword [rax + 8]
mov qword [0x1800d7df8], rax
mov rdx, rax
mov rcx, rax
test rax, rax
jne 0x180029f20
movzx eax, r9w
mov r8, rdi
sub r9, rax
mov rdx, rbx
mov rcx, r9
call fcn.180029d60
test rax, rax
je 0x18002a00b
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x1800d7df8], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x1800d7e08]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x1800d7e08], rax
nop word [rax + rax]
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x180029fb0
mov qword [rax + 0x10], r8
mov rdx, qword [rax + 0x10]
cmp rdx, rbx
jb 0x18002a00b
cmp rdx, rdi
ja 0x18002a00b
mov rcx, qword [rdx + 0x48]
movdqa xmm0, xmmword [0x180098e60]
mov qword [rax + 0x10], rcx
mov rax, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800428a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x1800428e7
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x1800428d0
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x1800429e7
cmp r8, 8
jb 0x1800429c3
mov rdx, r8
lea r10, [r11 + 4]
and rdx, 0xfffffffffffffff8
mov rcx, r9
sub rcx, r11
xorps xmm4, xmm4
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r10 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r10 - 4]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r10 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rbx, rdx
jb 0x180042940
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x1800429e7
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x1800429d0
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x180042a00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x180042b54
cmp r9, 4
jb 0x180042a4a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x180042a30
xor r11d, r11d
test r9, r9
je 0x180042b54
cmp r9, 0x40
jb 0x180042b33
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x180042a7c
cmp rdx, r8
jae 0x180042b33
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x180042a91
cmp rdx, r10
jae 0x180042b33
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rdi
jb 0x180042ac0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp r11, r9
jae 0x180042b54
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180042b40
add rsp, 8
ret

Function at 0x180042b60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rdx
test r8, r8
je 0x180042c71
cmp r8, 4
jb 0x180042ba3
mov rdx, r8
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r9]
add r9, 4
xor dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x180042b90
xor r10d, r10d
test r8, r8
je 0x180042c71
cmp r8, 0x40
jb 0x180042c55
lea rdx, [rcx - 1]
lea rax, [r9 - 1]
add rdx, r8
add rax, r8
cmp rcx, rax
ja 0x180042bd5
cmp rdx, r9
jae 0x180042c55
mov r11, r8
mov qword [rsp], rbx
and r11, 0xffffffffffffffc0
mov rdx, r9
lea rax, [rcx + 0x10]
sub rdx, rcx
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, r11
jb 0x180042bf0
mov rbx, qword [rsp]
cmp r10, r8
jae 0x180042c71
sub r9, rcx
lea rdx, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x180042c60
add rsp, 8
ret
Function at 0x180072e4c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180072e7c
xor eax, eax
jmp 0x180072f3f
mov rbp, rbx
cmp word [rax], si
je 0x180072ea1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180072e88
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180072e84
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180072d6c
movsxd r14, eax
test eax, eax
jne 0x180072edf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180072e75
mov rcx, r14
call fcn.18006c9a4
mov rdi, rax
test rax, rax
jne 0x180072ef8
xor ecx, ecx
call fcn.18006c968
jmp 0x180072ed4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180072d6c
test eax, eax
jne 0x180072f29
mov rcx, rdi
call fcn.18006c968
jmp 0x180072f33
xor ecx, ecx
call fcn.18006c968
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180073824
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18007383a
mov al, 1
jmp 0x18007389a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18007384b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180073898
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800783d4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180073898
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180073898
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180073898
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18007389a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800767f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18006ad88
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180076899
cmp ebx, dword [rsp + 0x30]
je 0x180076892
test esi, esi
je 0x180076892
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18007686d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18007687a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180076857
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18007687e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18007689b
mov eax, 1
jmp 0x18007689b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18007ab80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18007aba8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18007aba8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1424f9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1424f91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1424f9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424f906f
add dl, dl
jne 0x1424f9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424f90f6
xor eax, eax
add dl, dl
jne 0x1424f90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424f91ad
add dl, dl
jne 0x1424f90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424f90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424f90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424f90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1424f90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1424f907e
mov eax, 1
add dl, dl
jne 0x1424f9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424f9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1424f90fb
sub eax, ebx
mov ebx, 1
jne 0x1424f914c
mov ecx, 1
add dl, dl
jne 0x1424f912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1424f913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1424f9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1424f907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1424f9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1424f9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1424f915d
cmp eax, 0x7d00
jae 0x1424f919b
cmp eax, 0x500
jb 0x1424f9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1424f907e
cmp eax, 0x7f
ja 0x1424f919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1424f907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1424f91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1424f907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
lea rcx, str.Advapi32
mov dword [rsp + 0x20], r8d
mov dword [rsp + 0x24], r8d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x34], r9d
mov qword [rsp + 0x38], rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call rax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140031540
add rsp, 0x58
ret

Function at 0x140001170
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x680
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x670], rax
xor ebp, ebp
mov qword [rsp + 0x20], 0x238
mov r12, r8
mov dword [rsp + 0x28], ebp
mov r15, rdx
mov qword [rsp + 0x30], rbp
mov r13, rcx
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r8d, 0x20c
mov dword [rsp + 0x48], ebp
lea rcx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400012d1
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400012cc
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
lea rdi, [rsp + 0x260]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp edx, 0x208
jae 0x140001275
mov rsi, rbp
test edx, edx
je 0x14000125d
mov rdi, rbp
mov esi, edx
mov ebx, edx
nop dword [rax + rax]
movzx ecx, word [rsp + rdi + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rdi + 0x260], ax
lea rdi, [rdi + 2]
sub rbx, 1
jne 0x140001240
lea rax, [rsi + rsi]
cmp rax, 0x410
jae 0x140001318
mov word [rsp + rax + 0x260], bp
lea rax, [rsp + 0x260]
mov rdi, r13
sub rdi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140001296
add rax, 2
test ecx, ecx
jne 0x140001283
test edx, edx
jne 0x1400012b6
mov r8d, dword [rsp + 0x28]
mov ecx, 0x1fffff
mov dword [r15], r8d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12], rax
test rax, rax
je 0x1400012cc
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001204
test r14, r14
je 0x1400012da
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r15], ebp
je 0x1400012eb
cmp qword [r12], rbp
setne bpl
mov eax, ebp
jmp 0x1400012ed
xor eax, eax
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140031540
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x680
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140031668
int3
Function at 0x140031f3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140031f86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140031f86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140031f86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140031f86
cmp dword [rcx + 0x84], 0xe
jbe 0x140031f86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140031f88
xor al, al
add rsp, 0x28
ret
Function at 0x180c1e268
Capabilities:
Decompress data using aplib

Disassembly:
call 0x180c1e3ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180c1e299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c1e27f
add dl, dl
jne 0x180c1e2a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c1e306
xor eax, eax
add dl, dl
jne 0x180c1e2b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c1e3bd
add dl, dl
jne 0x180c1e2c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c1e2d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c1e2e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c1e2ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180c1e2fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180c1e28e
mov eax, 1
add dl, dl
jne 0x180c1e316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c1e323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c1e30b
sub eax, ebx
mov ebx, 1
jne 0x180c1e35c
mov ecx, 1
add dl, dl
jne 0x180c1e33e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c1e34b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c1e333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c1e28e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180c1e378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c1e385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c1e36d
cmp eax, 0x7d00
jae 0x180c1e3ab
cmp eax, 0x500
jb 0x180c1e3a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c1e28e
cmp eax, 0x7f
ja 0x180c1e3ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c1e28e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180c1e3e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180c1e28e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001354
Capabilities:
Create device object

Disassembly:
push rbx
sub rsp, 0x70
lea rax, [0x1400012e0]
mov rbx, rcx
mov qword [rcx + 0x68], rax
lea rdx, [0x140001bb0]
lea rax, [0x1400012b0]
mov qword [rcx + 0x70], rax
lea rax, [0x1400012b0]
mov qword [rcx + 0x80], rax
lea rax, [0x1400012d0]
mov qword [rcx + 0xe0], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140001be0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x80]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
js 0x140001443
mov rax, qword [rsp + 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
or dword [rax + 0x30], 0x10
mov rax, qword [rsp + 0x80]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
js 0x140001435
lea rdx, [0x140001b80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x60]
call section..text
xor eax, eax
jmp 0x140001445
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
add rsp, 0x70
pop rbx
ret