joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016ea0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x34], 0
mov edx, 0x64
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140017085
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx]
cmp eax, ecx
je 0x140016f8d
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 4]
mov ecx, ecx
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x10]
mov qword [rdx + rcx*8], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov eax, eax
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + rax*8]
cmp rax, 0xffffffffffffffff
je 0x140016f66
mov dword [rsp + 0x40], 1
jmp 0x140016f6e
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
inc eax
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 4], eax
jmp 0x140017074
cmp dword [rsp + 0x34], 0x3e8
jae 0x140017074
mov dword [rsp + 0x20], 0
mov r9d, 0x32
xor r8d, r8d
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax]
cmp dword [rsp + 0x30], eax
jae 0x14001705a
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x10]
mov qword [rdx + rcx*8], rax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + rax*8]
cmp rax, 0xffffffffffffffff
je 0x140017046
mov dword [rsp + 0x44], 1
jmp 0x14001704e
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x38], eax
jmp 0x140017074
mov ecx, 0x102
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
jmp 0x140016f8d
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140017090
mov ecx, 0x102
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rsp + 0x38], 0
jne 0x1400170b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x1400170b3
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x14001a558
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push r12
push r13
sub rsp, 0x28
mov rax, qword [rsp + 0x80]
xor ebp, ebp
mov rbx, rcx
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x30], rax
mov rax, r9
mov word [rcx + 0x18], bp
mov qword [rcx + 8], rax
mov eax, dword [rsp + 0x70]
mov dword [rcx + 0x40], ebp
mov dword [rcx + 0x1c], eax
mov eax, dword [rsp + 0x60]
mov r12d, 0x8000
mov dword [rcx + 0x3c], eax
cmp byte [rsp + 0x88], bpl
jne 0x14001a5ce
lea rcx, [rdx + 0x8000]
mov r8d, r12d
call sub.msvcrt.dll_memcpy
mov rcx, rbx
mov word [rbx + 0x44], bp
mov dword [rbx + 0x48], ebp
call fcn.14001aa10
mov rdx, qword [rbx + 0x20]
mov r13d, 2
mov word [rbx + 0x54], r12w
mov dword [rbx + 0x4c], r12d
mov dword [rbx + 0x38], ebp
add rdx, r12
mov ecx, ebp
mov r8d, r13d
movzx eax, byte [rdx]
shl ecx, 5
inc rdx
xor ecx, eax
and ecx, 0x7fff
dec r8
mov dword [rbx + 0x38], ecx
jne 0x14001a5fb
cmp byte [rsp + 0x88], bpl
je 0x14001a676
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x28]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
dec r9
jne 0x14001a624
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x30]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
dec r9
jne 0x14001a64f
jmp 0x14001a68c
mov rcx, rbp
mov rdx, r12
mov rax, qword [rbx + 0x28]
mov word [rcx + rax], bp
add rcx, r13
dec rdx
jne 0x14001a67c
mov edx, 0x43
mov rcx, rbx
lea r8d, [rdx - 0x3b]
call fcn.14001a700
mov edx, 0x4b
mov rcx, rbx
lea r8d, [rdx - 0x43]
call fcn.14001a700
mov rcx, rbx
call fcn.14001bbf0
add ax, r13w
movzx ecx, ax
mov rax, qword [rsp + 0x90]
mov dword [rax], ecx
cmp byte [rsp + 0x88], bpl
je 0x14001a6e4
mov rcx, qword [rbx + 0x20]
mov r8, r12
lea rdx, [rcx + 0x8000]
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 0x40]
neg eax
sbb eax, eax
and eax, 3
add rsp, 0x28
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x14001f890
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x140025100]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov dword [rsp + 0x160], 0
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x38], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x180]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
cmp rax, 1
jbe 0x14001fae6
mov r8, qword [rsp + 0x180]
mov edx, 0x105
lea rcx, [rsp + 0x50]
call fcn.1400053e0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001facb
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x50]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
movsx eax, byte [rsp + rax + 0x4f]
cmp eax, 0x5c
je 0x14001f98b
lea r8, [0x140002a30]
mov edx, 0x105
lea rcx, [rsp + 0x50]
call fcn.14001f5e0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14001f98b
mov eax, dword [rsp + 0x44]
and eax, 0xffff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x160], 1
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x160], 0
jne 0x14001fac9
mov eax, dword [rsp + 0x188]
and eax, 0
test eax, eax
je 0x14001f9db
mov qword [rsp + 0x28], 0
lea rax, [0x14001f7b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x190]
mov r8d, 2
lea rdx, [0x1400029dc]
lea rcx, [rsp + 0x50]
call fcn.14001fb90
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x14001fa43
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x50]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov byte [rsp + rax + 0x4f], 0
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_strrchr]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001fa35
mov dword [rsp + 0x160], 1
jmp 0x14001fa3e
mov rax, qword [rsp + 0x38]
mov byte [rax + 1], 0
jmp 0x14001fac4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 3
je 0x14001fa5b
cmp dword [rsp + 0x30], 2
jne 0x14001fab1
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x50]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov byte [rsp + rax + 0x4f], 0
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_strrchr]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001faa6
mov dword [rsp + 0x160], 1
jmp 0x14001faaf
mov rax, qword [rsp + 0x38]
mov byte [rax + 1], 0
jmp 0x14001fac4
mov dword [rsp + 0x160], 1
mov dword [rsp + 0x40], 0
jmp 0x14001f98b
jmp 0x14001fae4
mov eax, dword [rsp + 0x44]
and eax, 0xffff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x40], 0
jmp 0x14001faf9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140021740
add rsp, 0x170
pop rdi
ret
Function at 0x140020a50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov rax, qword [0x140025100]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x40], 0
mov dword [rsp + 0xd0], 0
mov dword [rsp + 0x3c], 0
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 0x7f
rep stosb byte [rdi], al
cmp dword [rsp + 0x38], 0
je 0x140020bc9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, 0x80
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140020bc9
cmp dword [rsp + 0x3c], 0
je 0x140020bbc
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x38], 0
je 0x140020bba
cmp dword [rsp + 0x3c], 0
je 0x140020bba
mov eax, dword [rsp + 0xf8]
cmp dword [rsp + 0x40], eax
jae 0x140020b4f
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x30]
movzx edx, byte [rdx]
mov byte [rcx + rax], dl
mov eax, dword [rsp + 0xd0]
inc eax
mov dword [rsp + 0xd0], eax
mov rax, qword [rsp + 0x30]
movsx eax, byte [rax]
cmp eax, 0xa
jne 0x140020b94
mov eax, dword [rsp + 0x3c]
dec eax
imul eax, eax, 0xffffffff
mov dword [rsp + 0xd4], eax
mov dword [rsp + 0x38], 0
mov r9d, 1
xor r8d, r8d
mov edx, dword [rsp + 0xd4]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x140020bab
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x3c]
dec eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
jmp 0x140020b05
jmp 0x140020bc4
mov dword [rsp + 0x38], 0
jmp 0x140020ab6
mov eax, dword [rsp + 0xf8]
cmp dword [rsp + 0xd0], eax
jne 0x140020bf2
mov eax, dword [rsp + 0xd0]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x100]
mov byte [rcx + rax], 0
jmp 0x140020c05
mov eax, dword [rsp + 0xd0]
mov rcx, qword [rsp + 0x100]
mov byte [rcx + rax], 0
mov rdx, qword [rsp + 0x100]
mov ecx, dword [rsp + 0xf8]
call fcn.140020590
cmp qword [rsp + 0x108], 0
je 0x140020c35
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0xd0]
mov dword [rax], ecx
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140021740
add rsp, 0xe0
pop rdi
ret
Function at 0x140020c60
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0xffffffffffffffff
je 0x140020dfc
xor edx, edx
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x140020dde
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140020dc0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x50], 0
je 0x140020da2
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140020da0
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x20000004
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], 0
jmp 0x140020dbe
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x20000003
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020ddc
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x20000002
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020dfa
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x20000009
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020e0a
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x20000001
mov rax, qword [rsp + 0x50]
add rsp, 0x68
ret
Function at 0x14002148c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140025a58], rbx
je 0x1400214d8
cmp rax, rbx
jne 0x1400214cb
mov ebx, 1
mov esi, ebx
jmp 0x1400214dd
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400214b0
mov ebx, 1
mov eax, dword [0x140025a50]
cmp eax, ebx
jne 0x1400214f3
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140021550
mov eax, dword [0x140025a50]
test eax, eax
jne 0x14002154a
mov dword [0x140025a50], ebx
lea r13, [0x140001470]
lea rdi, [0x140001458]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r13
jae 0x14002153c
test eax, eax
jne 0x140021540
mov rcx, qword [rdi]
test rcx, rcx
je 0x140021531
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14002151a
test eax, eax
je 0x140021550
mov eax, 0xff
jmp 0x140021621
mov dword [0x14002544c], ebx
mov eax, dword [0x140025a50]
cmp eax, ebx
jne 0x140021577
lea rdx, [0x140001450]
lea rcx, [0x140001440]
call sub.msvcrt.dll__initterm
mov dword [0x140025a50], 2
test esi, esi
jne 0x140021584
xor eax, eax
xchg qword [0x140025a58], rax
cmp qword [0x140025a60], 0
je 0x1400215ad
lea rcx, [0x140025a60]
call fcn.140021ebc
test eax, eax
je 0x1400215ad
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x140025a60]
mov r8, qword [0x140025430]
mov rdx, qword [0x140025438]
mov ecx, dword [0x140025428]
call fcn.140005d50
mov dword [0x140025448], eax
cmp dword [0x14002542c], 0
jne 0x1400215dd
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14002544c], 0
jne 0x1400215f2
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140025448]
jmp 0x140021621
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.140021fd0
add rsp, 0x28
jmp 0x14002148c
Function at 0x140021740
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140025100]
jne 0x14002175b
rol rcx, 0x10
test cx, 0xffff
jne 0x140021757
ret 0
ror rcx, 0x10
jmp 0x14002208c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140025500]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400255f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140022111
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140025500]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140022133
mov rax, qword [rsp + 0x88]
mov qword [0x1400255f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140025598], rax
mov rax, qword [0x1400255f8]
mov qword [0x140025470], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140025580], rax
mov dword [0x140025460], 0xc0000409
mov dword [0x140025464], 1
mov rax, qword [0x140025100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140025108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400014d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140021768
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x140025100]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400217e5
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140021805
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1400014a0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140021740
add rsp, 0x540
pop rbx
ret

Function at 0x140021f28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
test rcx, rcx
je 0x140021f75
cmp rcx, 0xffffffffffffffff
je 0x140021f75
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140021f6d
cmp dword [rcx + 0x3c], edx
jl 0x140021f6d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140021f6d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140021f75
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000436c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400043b8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400043b0
cmp dword [rcx + 0x3c], edx
jl 0x1400043b0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400043b0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400043b8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140006c2c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x140016608]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ecx, 0x20a
xor edi, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140006cc8
mov r8d, 0x104
lea rcx, str._systemroot__system32windowspowershell_v1.0powershell_ise.exe
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
ja 0x140006cb9
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x140006cb9
mov rcx, rax
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003d70
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret

Function at 0x140007424
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x140007538
Capabilities:
Write file on windows

Disassembly:
test rdx, rdx
je 0x1400075c3
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x140016cb0]
mov ebx, r8d
mov rsi, rdx
test ebx, ebx
je 0x1400075b4
and dword [rax + 8], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
nop dword [rax + rax]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
btr eax, 0xf
mov rdx, rsi
mov rcx, rdi
cmp eax, 2
jne 0x1400075a4
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop dword [rax + rax]
jmp 0x1400075b4
lea r8d, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140008180
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140016608]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r9d, 0x20
lea r8, [rsp + 0x20]
mov edi, 0x404
mov ebx, 0xc04
mov ecx, edi
lea edx, [r9 - 0x18]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
je 0x1400081e2
mov r8d, 3
lea rdx, [0x140011bbc]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x1400081e2
movzx ebx, di
movzx eax, bx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140003d70
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140008338
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140016608]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x140016f20]
test eax, eax
jne 0x14000843c
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400083a7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x30]
xor eax, eax
mov edx, dword [rsp + 0x24]
mov dword [0x140016f20], eax
sub ecx, 1
je 0x140008418
cmp ecx, 1
jne 0x14000843c
cmp edx, 5
jne 0x140008406
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400083ff
sub eax, ecx
je 0x1400083e5
cmp eax, ecx
je 0x1400083db
lea eax, [rdx + 0xf]
jmp 0x14000845a
mov edx, 0x10
lea ecx, [rdx - 0xf]
jmp 0x1400083ed
mov edx, 8
lea ecx, [rdx - 6]
xor eax, eax
cmp word [rsp + 0x134], cx
cmovae eax, edx
or eax, 4
jmp 0x14000845a
mov eax, 4
jmp 0x14000845a
cmp edx, 4
ja 0x140008455
mov ecx, 2
mov eax, ecx
mov dword [0x140016f20], ecx
cmp edx, 4
jne 0x14000843c
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x14000842f
cmp ecx, 0xa
je 0x14000842f
cmp ecx, 0x5a
jne 0x14000843c
mov ecx, 1
mov eax, ecx
mov dword [0x140016f20], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140003d70
add rsp, 0x158
ret
mov eax, 0x20
mov dword [0x140016f20], eax
jmp 0x14000843c

Function at 0x14000876c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
lea rdx, [0x14000f1a8]
mov rbx, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
test rax, rax
jne 0x14000879b
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadResource]