joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000eda0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x1020
call fcn.140025670
sub rsp, rax
xor r14d, r14d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp word [rcx], r14w
je 0x14000ef4f
call fcn.14000ef78
mov rcx, rbx
call fcn.14002a618
mov rcx, rbx
mov rbp, rax
call fcn.14000efa8
test al, al
je 0x14000ee84
mov rcx, rbx
call fcn.14000ef78
test al, al
je 0x14000ee38
lea rax, [rbp + 4]
cmp rdi, rax
jbe 0x14000ef4f
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.14001424c
mov rdx, rbx
mov r8, rdi
mov rcx, rsi
call fcn.140014208
mov al, 1
jmp 0x14000ef51
cmp word [rbx], 0x5c
jne 0x14000ef4f
cmp word [rbx + 2], 0x5c
jne 0x14000ef4f
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x14000ef4f
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.14001424c
mov r8, rdi
lea rdx, [0x14003ad58]
mov rcx, rsi
call fcn.140014208
lea rdx, [rbx + 2]
jmp 0x14000ee26
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x14000ef4f
cmp word [rbx], 0x5c
je 0x14000ef19
cmp word [rbx], 0x2f
je 0x14000ef19
mov edx, 0x800
lea rcx, [rsp + 0x20]
call fcn.14000e7f8
lea rcx, [rsp + 0x20]
call fcn.14002a618
lea rcx, [rax + 4]
add rcx, rbp
cmp rdi, rcx
jbe 0x14000ef4f
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.14001424c
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140014208
cmp word [rbx], 0x2e
jne 0x14000ee23
cmp word [rbx + 2], 0x5c
je 0x14000ef10
cmp word [rbx + 2], 0x2f
jne 0x14000ee23
add rbx, 4
jmp 0x14000ee23
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x14000ef4f
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.14001424c
mov r8, rdi
mov word [rsp + 0x24], r14w
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140014208
jmp 0x14000ee23
xor al, al
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x14000feb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, r9
mov r10b, bl
cmp r8d, 1
jbe 0x14000feec
lea rcx, [rdx + 1]
lea r8d, [rdi - 1]
xor r10b, byte [rcx]
inc rcx
sub r8, 1
jne 0x14000fee0
cmp r10b, byte [rdx]
jne 0x14000ff28
mov r8, rdi
or ecx, 0xffffffff
call fcn.1400071f0
lea rdx, [0x14004b060]
not eax
mov rcx, rdx
cmp dword [rcx + 4], eax
jne 0x14000ff11
cmp dword [rcx], edi
je 0x14000ff1e
inc ebx
add rcx, 0xc
cmp ebx, 6
jae 0x14000ff28
jmp 0x14000ff08
lea rcx, [rbx + rbx*2]
mov eax, dword [rdx + rcx*4 + 8]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140012da4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r10, qword [0x140055680]
xor ebx, ebx
movzx ebp, r9b
mov r14b, r8b
mov rdi, rdx
mov rsi, rcx
test r10, r10
jne 0x140012e43
cmp byte [0x140055678], bl
jne 0x140012e43
lea rcx, str.Crypt32.dll
call fcn.1400144d4
mov qword [0x140055670], rax
test rax, rax
je 0x140012e2c
lea rdx, str.CryptProtectMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140055670]
lea rdx, str.CryptUnprotectMemory
mov qword [0x140055680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140055688], rax
jmp 0x140012e33
mov rax, qword [0x140055688]
mov r10, qword [0x140055680]
mov byte [0x140055678], 1
jmp 0x140012e4a
mov rax, qword [0x140055688]
mov rcx, rdi
mov r8d, ebp
and rcx, 0xfffffffffffffff0
test r14b, r14b
je 0x140012e9d
test r10, r10
je 0x140012eba
mov edx, ecx
mov rax, r10
mov rcx, rsi
call qword [0x14003a508]
test eax, eax
jne 0x140012ed5
lea rdx, str.CryptProtectMemory_failed
lea rbx, [0x14004e538]
mov rcx, rbx
call fcn.14000870c
mov rcx, rbx
call fcn.140008984
mov edx, 2
mov rcx, rbx
call fcn.140008704
jmp 0x140012ed5
test rax, rax
je 0x140012eba
mov edx, ecx
mov rcx, rsi
call qword [0x14003a508]
test eax, eax
jne 0x140012ed5
lea rdx, str.CryptUnprotectMemory_failed
jmp 0x140012e77
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test rdi, rdi
je 0x140012ed5
lea ecx, [rax + 0x4b]
add cl, bl
xor byte [rbx + rsi], cl
inc rbx
cmp rbx, rdi
jb 0x140012ec5
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001444c
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
and dword [rbp + 0x18], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x18]
and dword [rsp + 0x48], 0
mov r9d, 0x220
and dword [rsp + 0x40], 0
mov r8d, 0x20
and dword [rsp + 0x38], 0
mov dl, 2
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov word [rbp + 0x1c], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp + 0x10], eax
test eax, eax
je 0x1400144cb
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp + 0x10]
test eax, eax
setne al
add rsp, 0x60
pop rbp
ret

Function at 0x1400144d4
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1020
call fcn.140025670
sub rsp, rax
mov rbx, rcx
mov edx, 0x800
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400144fe
xor eax, eax
jmp 0x140014521
mov r9d, 0x800
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000f0d4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add rsp, 0x1020
pop rbx
ret
Function at 0x140014e84
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx], edi
jbe 0x140014f26
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140015030]
and dword [rsp + 0x20], 0
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x140014efc
lea rdx, str.CreateThread_failed
lea rcx, [0x14004e538]
call fcn.14000870c
lea rcx, [0x14004e538]
call fcn.140008984
lea edx, [rsi + 2]
lea rcx, [0x14004e538]
call fcn.140008704
mov qword [rbx + rdi*8 + 8], rsi
inc dword [rbx + 0x208]
mov edx, dword [0x140055698]
test edx, edx
je 0x140014f1c
mov rcx, qword [rbx + rdi*8 + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc edi
cmp edi, dword [rbx]
jb 0x140014ea0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001ff2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdx, rcx
lea r8, [0x14003bd30]
mov rcx, qword [0x14004e480]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400200aa
mov rcx, qword [0x14004e480]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x1400200aa
mov rcx, qword [0x14004e480]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400200aa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400200aa
and qword [rsp + 0x58], 0
mov edx, edi
mov ecx, 2
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400200a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14002009a
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.1400273f0
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x140020091
mov rsi, qword [rsp + 0x48]
lea ecx, [rax + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
test rax, rax
je 0x14002003e
and qword [rsp + 0x50], 0
lea rax, [0x14003bd00]
lea rdx, [rsp + 0x50]
mov qword [rbx], rax
mov rcx, rsi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 8], rax
jmp 0x140020040
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003a508]
test rbx, rbx
je 0x140020091
mov eax, dword [rbx + 0x10]
and dword [rbx + 0x10], 0
test eax, eax
jne 0x14002007d
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x58]
mov r8d, 0xffffff
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x14002007d
mov dword [rbx + 0x10], eax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [0x14003a508]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x58]
jmp 0x1400200ac
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140020524
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400208bc
Capabilities:
Delete file

Disassembly:
push rbx
mov eax, 0x1070
call fcn.140025670
sub rsp, rax
xor ebx, ebx
cmp word [0x14005dd42], bx
je 0x140020964
lea rcx, [0x14005dd42]
call fcn.14000f68c
mov rdx, qword [str.RarSFX]
lea r8d, [rbx + 6]
mov rcx, rax
call fcn.140015fa4
test eax, eax
jne 0x140020964
lea rcx, [0x14005cd40]
call fcn.140020524
mov r8d, 0x800
lea rdx, [0x14005dd42]
lea rcx, [rsp + 0x60]
call fcn.14001424c
lea rcx, [rsp + 0x60]
call fcn.14002a618
xor edx, edx
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
call fcn.140026560
lea eax, [rbx + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
add rsp, 0x1070
pop rbx
ret
Function at 0x1400023a0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
mov r14, r8
push r13
mov r13, rdx
push r12
push rbp
push rdi
mov rdi, rcx
mov rcx, rdx
push rsi
mov rsi, r9
push rbx
sub rsp, 0x48
call fcn.140013a40
mov rbx, qword [0x14001a170]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
cmp dword [rax + 0xf4], 0
je 0x140002412
lea rdx, [0x140017a20]
mov ecx, 1
call qword [rax + 0x1b0]
mov r12, rax
test rax, rax
jne 0x140002415
mov rax, qword [rbx]
mov ecx, 1
mov rax, qword [rax + 0x8c2]
mov edx, dword [rax + 0x68]
call fcn.14000faf0
jmp 0x1400025a5
xor r12d, r12d
xor ebp, ebp
mov r15d, 0x40
mov rax, qword [rdi + 8]
cmp word [rax + 2], bp
jbe 0x1400024e4
movzx edx, bp
mov rcx, qword [rdi]
imul rax, rdx, 0x28
lea rax, [rcx + rax + 0x14]
cmp dword [rax + 0x10], 0
mov qword [rdi + 0x10], rax
jne 0x140002448
inc ebp
jmp 0x14000241d
mov r8d, dword [rax + 0x24]
mov eax, 1
mov ecx, r8d
and ecx, 0xe0000000
je 0x1400024ac
mov eax, 0x10
cmp ecx, 0x20000000
je 0x1400024ac
mov eax, 2
cmp ecx, 0x40000000
je 0x1400024ac
mov eax, 0x20
cmp ecx, 0x60000000
je 0x1400024ac
mov eax, 8
cmp ecx, 0x80000000
je 0x1400024ac
mov eax, pe_nt_image_headers64
cmp ecx, 0xa0000000
je 0x1400024ac
cmp ecx, 0xc0000000
mov eax, 4
cmovne eax, r15d
bt r8d, 0x1a
jae 0x1400024b6
or ah, 2
shl rdx, 4
add rdx, qword [rdi + 0x3c]
mov ecx, 2
mov r9, qword [rdx + 8]
mov dword [rsp + 0x20], eax
mov r8, qword [rdx]
or rdx, 0xffffffffffffffff
call fcn.14000f2c0
test eax, eax
jne 0x140002444
jmp 0x1400025a5
mov r9, qword [rdi + 0x4c]
test r9, r9
jne 0x1400024f2
xor r15d, r15d
jmp 0x140002518
mov dword [rsp + 0x20], 2
mov r8, qword [rdi + 0x44]
or rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.14000f2c0
test eax, eax
jne 0x1400024ed
jmp 0x1400025a5
inc r15d
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0xc]
cmp eax, r15d
jbe 0x140002571
mov ebp, r15d
mov rdx, qword [rdi + 0x20]
imul rbp, rbp, 0x12
lea rcx, [rdx + rbp]
cmp dword [rcx], 0
jne 0x140002546
imul rax, rax, 0x12
mov ecx, dword [rcx + 4]
add rax, rcx
lea rcx, [rdx + rax]
mov r8d, dword [rsp + 0x38]
mov rdx, r13
call fcn.14000eed0
test eax, eax
jne 0x140002515
add rbp, qword [rdi + 0x20]
mov rax, qword [rdi + 0x3c]
movzx edx, word [rbp + 0xc]
mov ecx, dword [rbp + 8]
shl rdx, 4
add rcx, qword [rax + rdx - 0x10]
jne 0x1400025a9
mov edx, dword [rsp + 0xb0]
mov ecx, 0x14
call fcn.14000f840
mov edx, 2
mov r12, rax
mov rcx, rax
call fcn.14000f5c0
mov rcx, r12
mov rdx, r13
call fcn.14000f6f0
mov rcx, r12
call fcn.14000f8f0
xor eax, eax
jmp 0x14000260d
mov rdx, qword [rdi + 8]
mov r9w, word [rdx + 2]
xor edx, edx
jmp 0x1400025c5
mov r8, qword [rax]
cmp r8, rcx
jbe 0x1400025cd
inc rdx
add rax, 0x10
cmp r9w, dx
ja 0x1400025b6
jmp 0x1400025a5
add r8, qword [rax + 8]
cmp rcx, r8
jae 0x1400025be
imul rdx, rdx, 0x28
mov rax, qword [rdi]
lea rax, [rax + rdx + 0x14]
mov qword [rdi + 0x10], rax
test byte [rax + 0x27], 0x20
je 0x1400025a5
mov r8, rsi
mov rdx, r14
call fcn.140002620
test r12, r12
je 0x140002608
mov rax, qword [rbx]
mov rcx, r12
call qword [rax + 0x1b8]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000be80
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140012d50
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140012d50
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140012d50
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000bf41
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140012d50
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000c430
cmp eax, 0xa6caa1c5
jne 0x14000bf2d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140012d50
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140012d50
mov rcx, r13
inc rsi
call fcn.14000c430
cmp eax, 0xffe885ef
jne 0x14000bed1
jmp 0x14000befe
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140012d9a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140012d98
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140012d90
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140012d90
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140012d6e
xor eax, eax
ret

Function at 0x14000bfb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x14001a170]
push r12
xor r8d, r8d
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x84a]
test rax, rax
je 0x14000c065
mov r8d, dword [rbx + 0x800]
test r8d, r8d
jne 0x14000c065
movsxd rdx, dword [rax + 0x3c]
xor ecx, ecx
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
mov edi, dword [rdx + 0x20]
mov r10d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x24]
mov ebp, dword [rdx + 0x18]
xor edx, edx
add r10, rax
add rdi, rax
add rsi, rax
cmp ebp, ecx
jbe 0x14000c05e
mov r9d, dword [rdi + rcx*4]
cmp word [rax + r9], 0x775a
jne 0x14000c059
test rdx, rdx
movzx r9d, word [rsi + rcx*2]
jne 0x14000c02f
mov edx, dword [r10 + r9*4]
add rdx, rax
jmp 0x14000c059
mov r9d, dword [r10 + r9*4]
mov r11, rdx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rdx
cmp rdx, r9
mov r9d, r12d
cmova r9d, r11d
test r8d, r8d
je 0x14000c056
cmp r8d, r9d
jbe 0x14000c059
mov r8d, r9d
inc rcx
jmp 0x14000c00b
mov dword [rbx + 0x800], r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000c3e0
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000c42d
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000c3fc
test r9b, r9b
jne 0x14000c40f
ret
mov r11, r10
sub r11, rcx
cmp edx, r11d
jbe 0x14000c42d
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x14000c41e
test r8d, r8d
je 0x14000c41e
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000c3ef
ret
Function at 0x14000c430
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000c446
imul eax, eax, 0x21
add eax, edx
jmp 0x14000c435
ret

Function at 0x14000def0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000def4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x14001a1c0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000df72
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000df87
cmp esi, 4
jne 0x14000df87
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000df38
pop rbx
pop rsi
ret

Function at 0x14000e4a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14000e4d6
mov esi, edx
test edx, edx
jne 0x14000e4dd
xor eax, eax
jmp 0x14000e5ca
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x14000e4d6
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.14000c3e0
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x14000e5c2
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x14000e568
mov rax, qword [rsp + 0x38]
jmp 0x14000e5ca
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x14000e561
call fcn.140013a40
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x14001a170]
mov rax, qword [rax]
mov rax, qword [rax + 0x138]
test rax, rax
je 0x14000e4d6
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x14000e561
jmp 0x14000e4d6
mov rbx, rax
jmp 0x14000e515
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012d50
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140012d50
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140012d50
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140012d50
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000bf41
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140012d50
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000c430
cmp eax, 0xa6caa1c5
jne 0x14000bf2d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140012d50
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140012d50
mov rcx, r13
inc rsi
call fcn.14000c430
cmp eax, 0xffe885ef
jne 0x14000bed1
jmp 0x14000befe
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140012d9a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140012d98
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140012d90
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140012d90
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140012d6e
xor eax, eax
ret
Function at 0x140001190
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.payload.exe:
lea rcx, [0x1400454e0]
call fcn.140001ae0
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.140001ae0
lea rdx, str._failed__
mov rcx, rax
call fcn.140001ae0
mov edx, dword [rsp + 0x20]
mov rcx, rax
call fcn.140005900
mov dl, 0x29
mov rcx, rax
call fcn.140001810
lea rdx, [0x140003c30]
mov rcx, rax
call fcn.140005ad0
nop
cmp qword [0x140045288], 0
je 0x140001210
mov rcx, qword [0x140045288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [0x140045280], 0
je 0x14000123a
mov edx, 1
mov rcx, qword [0x140045280]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140045280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001340
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rdi
sub rsp, 0x110
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rsp + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.140001260
nop
mov r8, 0xffffffffffffffff
mov dx, 0x5c
lea rcx, [rsp + 0xe0]
call fcn.14000ac20
inc rax
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.14000a290
lea rdx, str.payloadtarget.exe
lea rcx, [rsp + 0xe0]
call fcn.140006070
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rcx, [rsp + 0xe0]
call fcn.140008dc0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000142f
lea rcx, [0x1400314b0]
call fcn.140001190
nop
mov rax, qword [rsp + 0x50]
mov qword [0x140045280], rax
mov rax, qword [rsp + 0x58]
mov qword [0x140045288], rax
lea rcx, [rsp + 0xe0]
call fcn.140005180
nop
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14000f440
add rsp, 0x110
pop rdi
ret