joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140150d30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x48
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rbx, rcx
mov rcx, qword [rcx + 8]
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x140150d72
mov r8, qword [rbx + 0x20]
lea rdx, str.Started_monitoring__ls...
mov ecx, 1
call fcn.140170d40
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140150db8
xor dil, dil
jmp 0x140150de4
cmp dword [rsp + 0x60], esi
setne dil
test dil, dil
je 0x140150de4
mov r8, qword [rbx + 0x20]
lea rdx, str.State__ls_is_set__initial_
mov ecx, 1
call fcn.140170d40
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x38], rax
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x30]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140150ec6
cmp eax, 1
jne 0x140150e00
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140150e61
xor al, al
jmp 0x140150e68
cmp dword [rsp + 0x60], esi
setne al
cmp al, dil
je 0x140150ea2
mov rcx, qword [rbx + 0x18]
movzx edi, al
test al, al
je 0x140150e87
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.State__ls_is_set
jmp 0x140150e94
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, str.State__ls_is_reset
mov r8, qword [rbx + 0x20]
mov ecx, 1
call fcn.140170d40
mov r9, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
mov edx, 1
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140150e00
mov r8, qword [rbx + 0x20]
lea rdx, str.Stopped_monitoring__ls
mov ecx, 1
call fcn.140170d40
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbx
ret
Function at 0x140155ea0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xe0], rax
movzx ebx, cx
movabs rax, 0x5c003a003f
mov qword [rsp + 0x50], rax
mov word [rsp + 0x50], cx
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140155f95
lea rdx, [0x1403562b0]
lea rcx, [rsp + 0x60]
call fcn.1402b9aac
movzx ecx, bx
test eax, eax
jne 0x140155f3a
call fcn.140157960
mov rbx, rax
jmp 0x140155f69
call fcn.1402bcdac
movzx ebx, ax
mov ecx, 0x2a0
call fcn.1402b968c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140155f66
movzx edx, bx
mov rcx, rax
call fcn.140157040
mov rbx, rax
jmp 0x140155f69
mov rbx, rdi
test rbx, rbx
je 0x140155f95
mov ecx, 0x118
call fcn.1402b968c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140155f90
mov rdx, rbx
mov rcx, rax
call fcn.1401559e0
mov rdi, rax
mov rax, rdi
jmp 0x140155f97
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x140157410
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r8d, edx
mov r9, rcx
xor r8d, 0xdeadbeef
cmp edx, 4
jl 0x140157458
mov r10d, edx
shr r10, 2
mov eax, r10d
neg eax
lea edx, [rdx + rax*4]
imul eax, dword [r9], 0x5bd1e995
imul r8d, r8d, 0x5bd1e995
add r9, 4
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r8d, ecx
dec r10
jne 0x140157431
dec edx
je 0x14015747a
dec edx
je 0x14015746f
dec edx
jne 0x140157488
movzx eax, byte [r9 + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [r9 + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [r9]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x140157960
Capabilities:
Get volume information via ioctl

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsd xmm0, qword [0x140347f40]
movsd qword [rsp + 0x58], xmm0
mov eax, dword [0x140347f48]
mov dword [rsp + 0x60], eax
movzx eax, word [0x140347f4c]
mov word [rsp + 0x64], ax
call fcn.1402bcdac
movzx ebp, ax
mov word [rsp + 0x60], ax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140157a36
lea ecx, [rbx + 0x60]
call fcn.1402b968c
mov rdi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140157a3a
mov rcx, rdi
call fcn.1402177e0
xor eax, eax
jmp 0x140157a6a
call fcn.1401578d0
mov ecx, 0x128
call fcn.1402b968c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140157a67
mov r9, rdi
mov r8, rsi
movzx edx, bp
mov rcx, rax
call fcn.1401574c0
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14015b990
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, vtable.HitmanPro35::RemnantKeyScanThread.0
mov qword [rcx + 8], rdx
mov rbx, rcx
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x10000
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], 0x8000
call fcn.1402b9c60
mov ecx, 0x10000
mov qword [rbx + 0x40], rax
call fcn.1402b9c60
mov ecx, 0x10000
mov qword [rbx + 0x48], rax
call fcn.1402b9c60
mov ecx, 0x10000
mov qword [rbx + 0x50], rax
call fcn.1402b9c60
lea r8, [0x14015bae0]
mov qword [rbx + 0x58], rax
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14015c840
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
lea rdx, [0x140357fa8]
call fcn.1402bf008
mov rsi, rax
test rax, rax
je 0x14015c98f
mov r9, rax
mov ebp, 1
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x70]
call fcn.1402bf314
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x20]
call fcn.1402bf314
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 3]
lea rcx, [rsp + 0x68]
call fcn.1402bf314
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x78]
call fcn.1402bf314
lea ecx, [rbp + 0x57]
call fcn.1402b968c
mov rdi, rax
mov qword [rsp + 0x30], rax
xor ecx, ecx
test rax, rax
je 0x14015c961
lea rax, vtable.BloomFilter.0
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x20], rcx
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rcx
mov ecx, 0xa5a5a5a5
mov eax, dword [rsp + 0x68]
test eax, eax
cmovne ecx, eax
mov dword [rdi + 0x48], ecx
movsd xmm0, qword [rsp + 0x78]
movsd qword [rdi + 0x50], xmm0
mov rax, qword [rdi + 0x38]
cmp rax, 0
cmove rax, rbp
mov qword [rdi + 0x38], rax
mov rcx, rdi
call fcn.14015cb80
mov rcx, rdi
call fcn.14015c9a0
mov rbx, qword [rdi + 0x30]
shr rbx, 3
mov rcx, rbx
call fcn.1402b9c60
mov qword [rdi + 0x20], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1402c22a0
nop
jmp 0x14015c964
mov rdi, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rdi + 0x40], rcx
mov r8, qword [rdi + 0x30]
shr r8, 3
mov r9, rsi
mov rdx, rbp
mov rcx, qword [rdi + 0x20]
call fcn.1402bf314
mov rcx, rsi
call fcn.1402bb844
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015deb0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x6d0
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rbp, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea r8, [0x140347f58]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call fcn.1402bbbd8
lea r8, [rsp + 0x2a0]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402b96f8
lea r8, [0x14034e8b4]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402bbbd8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14015e078
mov qword [rsp + 0x6e8], rbx
mov qword [rsp + 0x6f0], rdi
nop dword [rax]
test byte [rsp + 0x50], 0x10
je 0x14015e049
movzx edx, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7e]
cmp dx, word [0x140347c20]
jne 0x14015df9b
cmp cx, word [0x140347c22]
je 0x14015e049
cmp dx, word [0x14034e8ac]
jne 0x14015dfc2
cmp cx, word [0x14034e8ae]
jne 0x14015dfc2
movzx eax, word [rsp + 0x80]
cmp ax, word [0x14034e8b0]
je 0x14015e049
lea rcx, [rsp + 0x7c]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14015dfd0
lea rdx, [rsp + 0x2a0]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14015dfe6
add eax, 2
add ecx, eax
movsxd rdi, ecx
lea rcx, [rdi + rdi]
call fcn.1402b9c60
lea r8, [rsp + 0x2a0]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x38], rax
call fcn.1402b96f8
lea r8, [rsp + 0x7c]
mov rdx, rdi
mov rcx, rbx
call fcn.1402bbbd8
movzx eax, byte [0x14042c16e]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov byte [rsp + 0x20], al
call fcn.1400e2a70
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14015df70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x6f0]
mov rbx, qword [rsp + 0x6e8]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.1402b9610
mov rbp, qword [rsp + 0x6f8]
add rsp, 0x6d0
pop rsi
ret
Function at 0x140160680
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [0x14042e268], 0
jne 0x140160717
lea rcx, str.Cryptdll.dll
call fcn.140148f90
mov rbx, rax
test rax, rax
je 0x140160717
lea rdx, str.MD5Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042e268], rax
lea rdx, str.MD5Update
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042e258], rax
lea rdx, str.MD5Final
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042e260], rax
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140160735
xor al, al
jmp 0x14016087d
lea rax, [rsp + 0xd0]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140160741
mov qword [rsp + 0x38], 0
test ebx, ebx
jne 0x140160766
lea rax, [0x140348ca0]
mov qword [rsp + 0x30], rax
jmp 0x140160790
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x30]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140200570
nop
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400f9c50
mov rcx, rax
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call fcn.1402d8fb8
mov rbx, rax
cmp dword [rsp + 0x38], 0
jle 0x1401607de
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
test rbx, rbx
je 0x14016072e
call fcn.14018c730
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14016072e
lea rcx, [rsp + 0x60]
call qword [0x14042e268]
mov r8d, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call qword [0x14042e258]
lea rcx, [rsp + 0x60]
call qword [0x14042e260]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1401fd6c0
mov r8d, 0x7b
mov rcx, rdi
call fcn.1402002b0
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.1401ff260
movsxd rdx, dword [rdi + 0xc]
mov rax, qword [rdi]
mov ecx, 0x7d
mov word [rax + rdx*2], cx
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.140200570
mov al, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140165a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp - 0x50], rax
xor esi, esi
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140208850
mov r11, qword [rbp - 0x40]
test al, al
je 0x140165bc1
mov eax, dword [rbp - 0x48]
cmp eax, 0x4000
jl 0x140165bc1
mov r10, r11
mov ecx, 0x5a4d
cmp word [r11], cx
jne 0x140165bc1
mov dword [rbp - 0x28], 0x6972645c
mov dword [rbp - 0x24], 0x73726576
mov dword [rbp - 0x20], 0x6374655c
mov dword [rbp - 0x1c], 0x736f685c
mov word [rbp - 0x18], 0x7374
mov byte [rbp - 0x16], sil
mov r9d, 0x1000
lea ebx, [rax - 0x400]
cmp ebx, r9d
jle 0x140165b4e
nop
mov r8, r10
mov eax, esi
lea rdx, [rbp - 0x28]
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
cmp cl, byte [rdx]
jne 0x140165b43
cmp eax, 0x12
je 0x140165bc1
inc eax
inc rdx
movsxd rcx, eax
cmp rcx, 0x13
jb 0x140165b20
inc r10
inc r9d
cmp r9d, ebx
jl 0x140165b10
lea rax, [0x140348ca0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rsi
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.140165c00
mov rcx, rdi
test al, al
je 0x140165b9e
mov edx, dword [rbp - 0x54]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x54]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x60]
mov rcx, qword [rdi]
call fcn.1402bd21c
mov edx, dword [rbp - 0x54]
mov rcx, rdi
call fcn.140200570
jmp 0x140165baa
mov rdx, qword [0x14041a158]
call fcn.1401fd6c0
mov bl, 1
cmp dword [rbp - 0x58], 0
jle 0x140165bbb
mov rcx, qword [rbp - 0x60]
call fcn.1402b9c20
mov r11, qword [rbp - 0x40]
jmp 0x140165bc3
xor bl, bl
test r11, r11
je 0x140165bd7
mov r8, r11
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14016a120
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 5
jne 0x14016a162
test al, al
jne 0x14016a156
mov ebx, 0x15f
jmp 0x14016a17d
cmp edx, 1
jne 0x14016a17d
mov ebx, 0x15f
jmp 0x14016a17d
cmp ecx, 6
jne 0x14016a17d
test al, al
jne 0x14016a172
mov ebx, 0x160
jmp 0x14016a17d
mov eax, 0x161
cmp edx, 1
cmove ebx, eax
xor ecx, ecx
movzx edx, bx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14016a2de
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 8]
cmp ebp, dword [rcx + 8]
jne 0x14016a2da
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14016a2da
mov rcx, rax
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14016a200
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rdi + 0x90]
call fcn.1402177e0
mov ecx, 0x10
call fcn.1402b968c
mov ecx, 0x20
mov qword [rdi + 0x90], rax
mov qword [rax], rsi
call fcn.1402b968c
test rax, rax
je 0x14016a240
mov r8d, ebp
mov rdx, r14
mov rcx, rax
call fcn.1400d2a00
mov rsi, rax
mov rax, qword [rdi + 0x90]
mov qword [rax + 8], rsi
mov rax, qword [rdi + 0xa0]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x90]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
add r8, 0x1b8
mov rcx, rbx
movups xmm0, xmmword [r8]
movups xmmword [rdx + 0x1b8], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rdx + 0x1c8], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rdx + 0x1d8], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rdx + 0x1e8], xmm1
mov eax, dword [r8 + 0x40]
mov dword [rdx + 0x1f8], eax
movzx eax, word [r8 + 0x44]
mov word [rdx + 0x1fc], ax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x38]
mov al, 1
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x14016a2c5
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14016a2f0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, al
shr ax, 8
movzx ecx, al
cmp edx, 5
jne 0x14016a321
test al, al
je 0x14016a316
cmp ecx, 1
jne 0x14016a340
mov eax, 0x15f
add rsp, 0x20
pop rbx
ret
cmp edx, 6
jne 0x14016a340
test al, al
jne 0x14016a335
mov eax, 0x160
add rsp, 0x20
pop rbx
ret
mov eax, 0x161
cmp ecx, 1
cmove ebx, eax
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14016b380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x98]
test rax, rax
je 0x14016b55d
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov r8d, 0xf
mov rbx, qword [rax + 0x10]
mov dword [rsp + 0x20], 0x414e4544
mov dword [rsp + 0x24], 0x445f494c
lea rcx, [rbx + 3]
mov dword [rsp + 0x28], 0x50415441
mov word [rsp + 0x2c], 0x454c
mov byte [rsp + 0x2e], 0x58
call fcn.1402c4b40
test eax, eax
jne 0x14016b3f9
mov al, 1
jmp 0x14016b55f
xor edx, edx
mov rcx, rbx
lea edi, [rdx + 0x3b]
mov r8d, edx
mov r9d, edx
mov r10d, edx
mov r11d, edx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
add r8d, eax
movzx eax, byte [rcx - 3]
add r11d, eax
movzx eax, byte [rcx - 2]
add r10d, eax
movzx eax, byte [rcx - 1]
add r9d, eax
dec rdi
jne 0x14016b410
lea eax, [r9 + r10]
add eax, r11d
add r8d, eax
cmp r8d, 0x67d9
je 0x14016b3f2
mov r10d, edx
mov r11d, edx
mov r8d, edx
mov r9d, edx
mov edi, edx
mov esi, edx
mov ecx, 8
nop dword [rax]
movzx eax, byte [rbx + rcx]
add rcx, 2
add r10d, eax
not al
movzx eax, al
add r8d, eax
movzx eax, byte [rbx + rcx - 1]
add r11d, eax
not al
movzx eax, al
add r9d, eax
cmp rcx, 0x1b6
jl 0x14016b460
cmp rcx, 0x1b7
jge 0x14016b4a2
movzx edi, byte [rcx + rbx]
movzx eax, dil
not al
movzx esi, al
lea eax, [r11 + r10]
add eax, edi
cmp eax, 0xac47
jne 0x14016b4c0
lea eax, [r9 + r8]
add eax, esi
cmp eax, 0x1010a
je 0x14016b3f2
mov r10d, edx
mov r9d, edx
mov r11d, edx
lea r8, [rbx + 8]
mov edi, 0x198
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, ecx
add r11d, ecx
xor ecx, 0xaa
xor eax, 0x55
add r9d, ecx
add r10d, eax
dec rdi
jne 0x14016b4d2
cmp r11d, 0xaab2
jne 0x14016b512
cmp r10d, 0xc0f6
jne 0x14016b512
cmp r9d, 0xd572
je 0x14016b3f2
mov r8d, edx
mov r9d, edx
mov r10d, 0x1a0
nop
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov eax, ecx
add r9d, ecx
xor ecx, 0xaa
xor eax, 0x55
add r8d, ecx
add edx, eax
dec r10
jne 0x14016b520
cmp r9d, 0xabf8
jne 0x14016b55d
cmp edx, 0xc6a0
jne 0x14016b55d
cmp r8d, 0xd7c0
je 0x14016b3f2
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14016b650
Capabilities:
Encode data using xor

Disassembly:
cmp qword [rcx + 0x98], 0
jne 0x14016b650
xor al, al
ret
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
xor r8d, r8d
mov rbx, rcx
mov rdx, qword [rax + 8]
mov r10d, r8d
mov r9d, r8d
mov rax, qword [rdx + 0x10]
mov r11d, 0x15b
add rax, 0x14
nop dword [rax + rax]
movzx edx, byte [rax]
inc rax
mov ecx, edx
add r8d, edx
xor edx, 0xaa
xor ecx, 0x55
add r9d, edx
add r10d, ecx
dec r11
jne 0x14016b680
cmp r8d, 0x97f4
jne 0x14016b74f
cmp r10d, 0x9463
jne 0x14016b74f
cmp r9d, 0xc542
jne 0x14016b74f
lea rcx, [rbx + 0x78]
lea rdx, str.Win64_Bootkit.MBR.Gapz
call fcn.1401fd6c0
mov rax, qword [rbx + 0x98]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
movzx eax, byte [rdx + 0x13]
movzx ecx, byte [rdx + 0x12]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0x11]
shl rcx, 8
add rax, rcx
movzx ecx, byte [rdx + 0x10]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0xf]
shl rcx, 8
add rax, rcx
movzx ecx, byte [rdx + 0xe]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0xd]
shl rcx, 8
add rcx, rax
movzx eax, byte [rdx + 0xc]
mov dword [rbx + 0x88], 1
shl rcx, 8
add rcx, rax
mov al, 1
mov qword [rbx + 0xa8], rcx
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14016b760
Capabilities:
Move file

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
xor bl, bl
lea rdi, [rcx + 8]
mov rcx, rdi
call fcn.1401bce00
lea r8, str..hitmanpro
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1401fdf70
nop
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14016b854
mov rcx, rdi
call fcn.1402085e0
mov rsi, rax
test rax, rax
je 0x14016b854
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x48], rax
mov ebx, 0x13
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.1402077c0
mov rdi, qword [rsp + 0x40]
test al, al
je 0x14016b81c
mov eax, dword [rsp + 0x3c]
inc eax
movsxd rdx, eax
mov r9d, ebx
lea r8, str.127.0.0.1_localhost
mov rcx, rdi
call fcn.1402bb6a0
mov byte [rdi + 0x13], 0
mov dword [rsp + 0x38], ebx
jmp 0x14016b820
mov ebx, dword [rsp + 0x38]
mov rax, qword [rsi]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov bl, 1
test rdi, rdi
je 0x14016b854
mov r8, rdi
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rsp + 0x30], 0
jle 0x14016b865
mov rcx, qword [rsp + 0x28]
call fcn.1402b9c20
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret