joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4417e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44194a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4417f8
cmp edx, ecx
jne 0x441938
nop dword [rax]
test rsi, rsi
jne 0x441938
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441854
nop
call fcn.004611e0
xorps xmm15, xmm15
mov r14, qword [0x01fccc40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004416e0
mov rcx, qword [0x01a4b158]
mov rdx, qword [0x01a4b150]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x441933
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x441928
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x01a4d990]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x01a4d990], rbx
nop
mov edx, 1
lea rsi, [0x01a4d998]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x441917
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x010a6f59]
mov ebx, 0x28
call fcn.004352a0
mov rcx, rax
mov rax, rsi
call fcn.0045f7c0
call fcn.00433900
lea rax, [0x010a10ca]
mov ebx, 0x23
call fcn.004352a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004417e0
Function at 0x44cfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44d118
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44cfdc
test r8b, r8b
jne 0x44cfdc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44cfef
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44d0d8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44d0c6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44d0bc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44d043
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44d086
mov eax, 1
cmp rax, rbx
ja 0x44d075
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045f880
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44d0b4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44d07d
mov r8d, eax
mov eax, r10d
jmp 0x44d048
mov rcx, rbx
call fcn.0045f7c0
xor eax, eax
mov rcx, rax
call fcn.0045f7c0
mov eax, r8d
mov rcx, rbx
call fcn.0045f880
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44d10e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44d0d1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44cff5
mov eax, edx
mov rcx, rbx
call fcn.0045f7c0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045f7c0
nop
int3
Function at 0x4533e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453499
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x004534e0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045d020
xorps xmm15, xmm15
mov r14, qword [0x01fccc40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045d160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004533e0
Function at 0x45f260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01fcd2e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x01fcc2bc], 0
je 0x45f296
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01fcd820]
aesenc xmm0, xmmword [0x01fcd830]
aesenc xmm0, xmmword [0x01fcd840]
movq rax, xmm0
ret
jmp 0x4097a0
Function at 0x140001000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x130
mov rax, qword gs:[0x60]
mov esi, ecx
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test ecx, ecx
jne 0x140001039
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rsi
ret
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x148], rdi
test rbx, rbx
je 0x1400010fd
mov ebp, 0x104
nop word [rax + rax]
mov rdi, qword [rbx + 0x50]
test rdi, rdi
je 0x1400010f1
cmp word [rbx + 0x48], bp
jae 0x1400010f1
mov r8, rbp
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140001510
xor r9d, r9d
cmp word [rdi], r9w
je 0x1400010d1
xor r10d, r10d
mov r11, rdi
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rax + r11]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r10 + 0x20], cl
mov rdi, qword [rbx + 0x50]
mov r10d, r9d
lea rax, [r9 + r9]
cmp word [rax + rdi], 0
jne 0x1400010a0
mov rcx, rdi
mov byte [rsp + r9 + 0x20], 0
call fcn.1400013d0
cmp eax, esi
je 0x140001120
lea rcx, [rsp + 0x20]
call fcn.1400013d0
cmp eax, esi
je 0x140001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001060
xor eax, eax
mov rbp, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rsi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400010ff
Function at 0x140001130
Capabilities:
Access peb ldr_data
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov r15d, edx
mov rdi, rcx
test rcx, rcx
je 0x1400011ce
test edx, edx
je 0x1400011ce
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400011ce
mov esi, dword [rax + rcx + 0x88]
xor ebp, ebp
mov eax, dword [rax + rcx + 0x8c]
add rsi, rcx
mov ebx, ebp
mov dword [rsp + 0x280], eax
mov r12d, dword [rsi + 0x20]
mov r13d, dword [rsi + 0x1c]
add r12, rcx
mov edx, dword [rsi + 0x24]
add r13, rcx
add rdx, rcx
mov qword [rsp + 0x290], rdx
cmp dword [rsi + 0x14], ebx
jbe 0x1400011ce
mov eax, ebx
mov ecx, dword [r12 + rax*4]
movzx eax, word [rdx + rax*2]
add rcx, rdi
mov r14d, dword [r13 + rax*4]
add r14, rdi
call fcn.1400013d0
cmp eax, r15d
je 0x1400011eb
mov rdx, qword [rsp + 0x290]
inc ebx
cmp ebx, dword [rsi + 0x14]
jb 0x1400011a0
xor eax, eax
mov rbx, qword [rsp + 0x288]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r14, rsi
jb 0x140001389
mov eax, dword [rsp + 0x280]
add rax, rsi
cmp r14, rax
jae 0x140001389
mov r15d, 0x104
lea rcx, [rsp + 0x20]
mov r8d, r15d
xor edx, edx
call fcn.140001510
mov rbx, 0xffffffffffffffff
mov edi, ebp
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], dil
jne 0x140001230
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.1400014a0
mov ecx, ebp
lea rax, [rsp + 0x20]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], cl
jne 0x140001250
test rbx, rbx
je 0x140001280
lea rdx, [rsp + 0x20]
cmp byte [rdx], 0x2e
je 0x140001276
inc ecx
inc rdx
movsxd rax, ecx
cmp rax, rbx
jb 0x140001262
jmp 0x140001280
movsxd rax, ecx
mov edi, ecx
mov byte [rsp + rax + 0x20], bpl
mov eax, edi
lea rsi, [rsp + 0x21]
add rsi, rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x140001354
cmp qword [rbx + 0x50], rbp
je 0x140001342
cmp word [rbx + 0x48], r15w
jae 0x140001342
mov r8, r15
lea rcx, [rsp + 0x130]
xor edx, edx
call fcn.140001510
mov rax, qword [rbx + 0x50]
mov r9d, ebp
cmp word [rax], bp
je 0x140001313
mov r10, rbp
mov rcx, rbp
nop dword [rax]
movzx r8d, byte [rcx + rax]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r10 + 0x130], cl
mov rax, qword [rbx + 0x50]
mov r10d, r9d
lea rcx, [r9 + r9]
cmp word [rcx + rax], bp
jne 0x1400012e0
mov eax, r9d
mov byte [rsp + rax + 0x130], bpl
mov rcx, qword [rbx + 0x50]
call fcn.1400013d0
cmp eax, 0x7040ee75
je 0x140001350
lea rcx, [rsp + 0x130]
call fcn.1400013d0
cmp eax, 0x7040ee75
je 0x140001350
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400012a4
jmp 0x140001354
mov rbp, qword [rbx + 0x20]
mov edx, 0x5fbff0fb
mov rcx, rbp
call fcn.140001130
mov rdi, rax
test rax, rax
je 0x140001389
mov rcx, rsi
call fcn.1400013d0
lea rcx, [rsp + 0x20]
mov ebx, eax
call rdi
mov rcx, rax
mov edx, ebx
call fcn.140001130
jmp 0x1400011d0
mov rax, r14
jmp 0x1400011d0
Function at 0x1400013d0
Capabilities:
Hash data using djb2

Disassembly:
movsx edx, byte [rcx]
mov eax, 0x1505
test edx, edx
je 0x1400013f0
nop dword [rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400013e0
ret

Function at 0x140001540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
test r8b, 0xf
jne 0x14000166d
mov r15, rbx
shr r15, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
mov rdi, rax
test rax, rax
je 0x14000166d
lea rsi, [r13 + 0xf0]
test r15, r15
je 0x140001659
mov qword [rsp + 0x60], rbp
mov rbx, rsi
mov qword [rsp + 0x68], r12
lea rbp, [rax + 0xf]
lea r12, [rsi + 0xf]
sub rbx, rax
nop dword [rax]
mov r8d, 0x10
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.1400014a0
mov r9, r14
mov r8, rdi
mov edx, 0xe
mov rcx, r13
call fcn.1400016d0
cmp rdi, r12
ja 0x140001612
cmp rbp, rsi
jb 0x140001612
mov rax, rdi
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140001600
jmp 0x140001622
movdqu xmm1, xmmword [rdi]
movdqu xmm0, xmmword [rsi]
pxor xmm1, xmm0
movdqu xmmword [rdi], xmm1
mov r8d, 0x10
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400014a0
add rdi, 0x10
add rbp, 0x10
sub rbx, 0x10
add r14, 0x10
sub r15, 1
jne 0x1400015c0
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x70]
xor al, al
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1400032f0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbx
push rdi
sub rsp, 0x248
xor edi, edi
mov qword [rax + 0x10], rdi
mov ebx, edi
mov qword [rax + 0x18], rdi
mov dword [rax + 8], edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140003331
mov dword [rax], 0x32
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x1400033a6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140001510
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0xe]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [0x140005080]
call fcn.140001400
test eax, eax
je 0x1400034b0
xor ecx, ecx
mov ebx, 0x5a
call fcn.140001000
mov rcx, rax
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x268]
movzx edx, bx
call fcn.1400034c0
test eax, eax
je 0x1400034b0
movss xmm0, dword [0x140005008]
mulss xmm0, dword [0x140004100]
mov rdx, qword [0x1400050d8]
mov ecx, dword [0x1400050d0]
cvttss2si rax, xmm0
imul eax, eax, 0x2710
neg rax
mov qword [rsp + 0x278], rax
call fcn.140003990
lea rdx, [rsp + 0x278]
xor ecx, ecx
call fcn.1400039b2
call fcn.1400035a0
mov edx, dword [rsp + 0x260]
lea r8, [rsp + 0x270]
mov rcx, qword [rsp + 0x268]
call fcn.140003020
test eax, eax
je 0x1400034b0
mov rcx, qword [rsp + 0x270]
call fcn.140002f00
xor eax, eax
add rsp, 0x248
pop rdi
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x248
pop rdi
pop rbx
ret
Function at 0x1400110af
Capabilities:
Create thread

Disassembly:
jmp 0x1400277a0
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x158]
mov qword [rbp + 8], 0
cmp dword [rbp + 0x120], 0
jne 0x1400277e6
lea rax, [0x14003b130]
mov qword [rbp + 8], rax
jmp 0x140027800
cmp dword [rbp + 0x120], 1
jne 0x1400277fc
lea rax, [0x14003b180]
mov qword [rbp + 8], rax
jmp 0x140027800
xor eax, eax
jmp 0x14002785f
mov qword [rbp + 0x28], 0
jmp 0x140027815
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 8]
cmp qword [rbp + 0x28], rax
jae 0x14002785a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
lea r8, [0x1400278a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rbp + 0x28]
mov qword [rcx + rdx*8], rax
jmp 0x14002780a
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400114b0
Capabilities:
Create thread
Get system information on windows

Disassembly:
jmp 0x1400194b0
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x270], rax
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
lea rax, [rbp + 0x28]
mov qword [rbp + 0x30], rax
xor eax, eax
test eax, eax
jne 0x1400194e7
mov qword [rbp + 0x58], 0
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], rax
xor eax, eax
test eax, eax
jne 0x1400194fd
lea rcx, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0xd4], eax
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0xd4]
mov edx, eax
xor ecx, ecx
call fcn.1400110a5
test eax, eax
jne 0x140019555
mov eax, 1
jmp 0x1400196c4
xor ecx, ecx
call fcn.1400110af
test eax, eax
jne 0x14001956a
mov eax, 1
jmp 0x1400196c4
mov eax, dword [rbp + 0xf4]
mov edx, eax
mov ecx, 1
call fcn.1400110a5
test eax, eax
jne 0x14001958a
mov eax, 1
jmp 0x1400196c4
mov ecx, 1
call fcn.1400110af
test eax, eax
jne 0x1400195a2
mov eax, 1
jmp 0x1400196c4
lea rcx, [rbp + 0x28]
call fcn.1400118ac
test eax, eax
je 0x1400195d9
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x28]
lea r8, [0x1400110cd]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov qword [rbp + 0x118], 0
mov rax, qword [0x14003b080]
mov qword [rbp + 0x118], rax
jmp 0x140019609
mov rax, qword [rbp + 0x118]
mov rax, qword [rax + 0x8000]
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
je 0x140019628
mov rax, qword [rbp + 0x118]
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.14001180c
jmp 0x1400195f4
mov qword [rbp + 0x138], 0
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x138], rax
jmp 0x140019655
mov rax, qword [rbp + 0x138]
mov rax, qword [rax + 0x7d00]
mov qword [rbp + 0x138], rax
cmp qword [rbp + 0x138], 0
je 0x14001969d
lea rax, [rbp + 0x218]
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x138]
mov rdx, rax
mov rcx, qword [rbp + 0x258]
call fcn.1400111cc
mov qword [rbp + 0x268], rax
mov edx, 1
mov rcx, qword [rbp + 0x268]
call fcn.1400115d2
jmp 0x140019640
call fcn.140011780
mov edx, 0xffffffff
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call fcn.1400118a7
mov ecx, 1
call fcn.1400118a7
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x270]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x140011564
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002b810
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002b830
xor al, al
jmp 0x14002b8b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002b843
xor al, al
jmp 0x14002b8b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002b86d
xor al, al
jmp 0x14002b8b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002b881
xor al, al
jmp 0x14002b8b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002b893
xor al, al
jmp 0x14002b8b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002b8af
xor al, al
jmp 0x14002b8b1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001169f
Capabilities:
Terminate process

Disassembly:
jmp 0x140028fb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001172b
Capabilities:
Move file

Disassembly:
jmp 0x140017c80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov ecx, 0x7fd7
call fcn.140011951
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140017cc3
xor eax, eax
jmp 0x140017d06
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 5
mov r8d, eax
mov rdx, qword [rbp + 0x100]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [rbp + 8]
call fcn.14001155a
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001173f
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x140013d90
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
mov rbp, rsp
mov rdi, rsp
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x108]
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 4
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 5
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax + 4]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 6
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 7
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax + 0xc]
mov dword [rdx + rcx], eax
cmp dword [rbp + 0x110], 0x100
jne 0x140013e91
mov rax, qword [rbp + 0x108]
add rax, 0x10
mov qword [rbp + 0x108], rax
lea rax, str.expand_32_byte_kexpand_16_byte_k
mov qword [rbp + 8], rax
jmp 0x140013e9c
lea rax, [0x140031bc0]
mov qword [rbp + 8], rax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 8
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 9
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax + 4]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 0xa
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 0xb
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
mov eax, dword [r8 + rax + 0xc]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 8]
mov eax, dword [r8 + rax]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 8]
mov eax, dword [r8 + rax + 4]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 8]
mov eax, dword [r8 + rax + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 8]
mov eax, dword [r8 + rax + 0xc]
mov dword [rdx + rcx], eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret