joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029b026
Capabilities:
Get file size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x140
mov qword [rbp + 0x10], rcx
mov byte [rbp - 0x140], 0x6c
mov byte [rbp - 0x13f], 0x6f
mov byte [rbp - 0x13e], 0x67
mov byte [rbp - 0x13d], 0x2e
mov byte [rbp - 0x13c], 0x74
mov byte [rbp - 0x13b], 0x78
mov byte [rbp - 0x13a], 0x74
mov byte [rbp - 0x139], 0
lea rax, [rbp - 0x140]
sub r11, r11
sub rsp, 0x40
mov rcx, rax
movabs rdx, 0xc0000000
mov r8, 1
mov r9, r11
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], r11
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
add rsp, 0x40
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14029b1bd
mov qword [rbp - 0x28], rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x28]
mov rdx, 0
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
add rsp, 0x20
mov qword [rbp - 0x40], rax
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
call fcn.14029b000
add rsp, 0x20
mov qword [rbp - 0x30], rax
add rax, qword [rbp - 0x40]
mov qword [rbp - 0x38], rax
sub r10, r10
sub rsp, 0x30
mov rcx, qword [rbp - 0x28]
mov rdx, r10
mov r8, 4
mov r9, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r10
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
add rsp, 0x30
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14029b1ab
mov qword [rbp - 0x20], rax
sub r10, r10
sub rsp, 0x30
mov rcx, rax
mov rdx, 0xf001f
mov r8, r10
mov r9, r10
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
add rsp, 0x30
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14029b199
mov qword [rbp - 0x18], rax
add rax, qword [rbp - 0x40]
mov rdi, rax
mov rsi, qword [rbp + 0x10]
mov rcx, qword [rbp - 0x30]
rep movsb byte [rdi], byte [rsi]
mov qword [rbp - 0x10], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
leave
ret
Function at 0x14029b292
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x100
mov byte [rbp - 0x100], 0x6c
mov byte [rbp - 0xff], 0x6f
mov byte [rbp - 0xfe], 0x67
mov byte [rbp - 0xfd], 0x2e
mov byte [rbp - 0xfc], 0x74
mov byte [rbp - 0xfb], 0x78
mov byte [rbp - 0xfa], 0x74
mov byte [rbp - 0xf9], 0
lea rax, [rbp - 0x100]
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
add rsp, 0x20
mov byte [rbp - 0x100], 0x2d
mov byte [rbp - 0xff], 0x2d
mov byte [rbp - 0xfe], 0x2d
mov byte [rbp - 0xfd], 0x2d
mov byte [rbp - 0xfc], 0x2d
mov byte [rbp - 0xfb], 0x2d
mov byte [rbp - 0xfa], 0x2d
mov byte [rbp - 0xf9], 0x2d
mov byte [rbp - 0xf8], 0x2d
mov byte [rbp - 0xf7], 0x2d
mov byte [rbp - 0xf6], 0x2d
mov byte [rbp - 0xf5], 0x2d
mov byte [rbp - 0xf4], 0x2d
mov byte [rbp - 0xf3], 0x2d
mov byte [rbp - 0xf2], 0x2d
mov byte [rbp - 0xf1], 0x2d
mov byte [rbp - 0xf0], 0xd
mov byte [rbp - 0xef], 0xa
mov byte [rbp - 0xee], 0
lea rax, [rbp - 0x100]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b026
add rsp, 0x20
test rax, rax
je 0x14029b4f3
mov byte [rbp - 0x100], 0x48
mov byte [rbp - 0xff], 0x79
mov byte [rbp - 0xfe], 0x70
mov byte [rbp - 0xfd], 0x65
mov byte [rbp - 0xfc], 0x72
mov byte [rbp - 0xfb], 0x69
mov byte [rbp - 0xfa], 0x6f
mov byte [rbp - 0xf9], 0x6e
mov byte [rbp - 0xf8], 0x20
mov byte [rbp - 0xf7], 0x4c
mov byte [rbp - 0xf6], 0x6f
mov byte [rbp - 0xf5], 0x67
mov byte [rbp - 0xf4], 0x66
mov byte [rbp - 0xf3], 0x69
mov byte [rbp - 0xf2], 0x6c
mov byte [rbp - 0xf1], 0x65
mov byte [rbp - 0xf0], 0xd
mov byte [rbp - 0xef], 0xa
mov byte [rbp - 0xee], 0
lea rax, [rbp - 0x100]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b026
add rsp, 0x20
test rax, rax
je 0x14029b4f3
mov byte [rbp - 0x100], 0x2d
mov byte [rbp - 0xff], 0x2d
mov byte [rbp - 0xfe], 0x2d
mov byte [rbp - 0xfd], 0x2d
mov byte [rbp - 0xfc], 0x2d
mov byte [rbp - 0xfb], 0x2d
mov byte [rbp - 0xfa], 0x2d
mov byte [rbp - 0xf9], 0x2d
mov byte [rbp - 0xf8], 0x2d
mov byte [rbp - 0xf7], 0x2d
mov byte [rbp - 0xf6], 0x2d
mov byte [rbp - 0xf5], 0x2d
mov byte [rbp - 0xf4], 0x2d
mov byte [rbp - 0xf3], 0x2d
mov byte [rbp - 0xf2], 0x2d
mov byte [rbp - 0xf1], 0x2d
mov byte [rbp - 0xf0], 0xd
mov byte [rbp - 0xef], 0xa
mov byte [rbp - 0xee], 0
lea rax, [rbp - 0x100]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b026
add rsp, 0x20
test rax, rax
je 0x14029b4f3
sub rsp, 0x20
call fcn.14029b1c3
add rsp, 0x20
test rax, rax
je 0x14029b4f3
mov rax, 1
leave
ret
sub rax, rax
leave
ret
Function at 0x14029b867
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
push r12
push r13
push r14
push r15
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov r12, 3
mov r13, 1
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.14029b9d9
add rsp, 0x20
rol eax, 8
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x18]
call fcn.14029b9fd
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x20]
mov r8, r13
call fcn.14029b9ae
add rsp, 0x20
inc r13
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.14029b9d9
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.14029b982
add rsp, 0x20
mov r15, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.14029b9d9
add rsp, 0x20
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.14029b9d9
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.14029b982
add rsp, 0x20
dec r15
jne 0x14029b919
cmp r12, 0x2b
jne 0x14029b892
pop rbx
pop r15
pop r14
pop r13
pop r12
leave
ret

Function at 0x14029bbfc
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push r12
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x10]
mov r12, 4
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x18]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
mov dword [rbp - 0x10], ecx
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x28]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x20]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x30]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
bswap eax
mov dword [rdx], eax
add rdx, 4
dec r12
jne 0x14029bc22
pop rbx
pop r12
leave
ret
Function at 0x14029c350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x120
push rsi
push rdi
mov qword [rbp + 0x10], rcx
mov byte [rbp - 0x120], 0x42
mov byte [rbp - 0x11f], 0x72
mov byte [rbp - 0x11e], 0x75
mov byte [rbp - 0x11d], 0x74
mov byte [rbp - 0x11c], 0x65
mov byte [rbp - 0x11b], 0x66
mov byte [rbp - 0x11a], 0x6f
mov byte [rbp - 0x119], 0x72
mov byte [rbp - 0x118], 0x63
mov byte [rbp - 0x117], 0x69
mov byte [rbp - 0x116], 0x6e
mov byte [rbp - 0x115], 0x67
mov byte [rbp - 0x114], 0x20
mov byte [rbp - 0x113], 0x4b
mov byte [rbp - 0x112], 0x65
mov byte [rbp - 0x111], 0x79
mov byte [rbp - 0x110], 0
lea rax, [rbp - 0x120]
lea rax, [rbp - 0x120]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b026
add rsp, 0x20
test rax, rax
je 0x14029c50e
sub rsp, 0x20
call fcn.14029b1c3
add rsp, 0x20
test rax, rax
je 0x14029c50e
lea rdi, [rbp - 0x18]
mov rcx, 0x10
mov al, 0
mov byte [rdi], al
inc rdi
dec rcx
jne 0x14029c422
sub rsp, 0x20
mov rcx, 0
mov rdx, 0x14ae10
mov r8, 0x3000
mov r9, 4
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
add rsp, 0x20
test rax, rax
je 0x14029c517
mov qword [rbp - 8], rax
mov rdi, rax
mov rsi, qword [rbp + 0x10]
mov rcx, 0x14ae10
shr rcx, 3
rep movsq qword [rdi], qword [rsi]
lea rax, [rbp - 0x18]
sub rsp, 0x20
mov rcx, 0x14ae10
mov rdx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x10]
mov r9, rax
call fcn.14029c202
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, 0x14ae10
call fcn.14029d3d4
add rsp, 0x20
test rax, rax
jne 0x14029c4e9
mov rsi, qword [rbp - 8]
mov rdi, qword [rbp + 0x10]
mov rcx, 0x14ae10
shr rcx, 3
rep movsq qword [rdi], qword [rsi]
lea rax, [rbp - 0x18]
sub rsp, 0x20
mov rcx, rax
call fcn.14029c51e
add rsp, 0x20
test rax, rax
je 0x14029c517
jmp 0x14029c478
sub rsp, 0x20
mov rcx, qword [rbp - 8]
mov rdx, 0
mov r8, 0x8000
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
add rsp, 0x20
test rax, rax
je 0x14029c517
mov rax, 1
jmp 0x14029c51a
sub rax, rax
pop rdi
pop rsi
leave
ret
Function at 0x14029ca41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rax, rax
leave
ret
push rbp
mov rbp, rsp
sub rsp, 0x128
push rsi
push rdi
push rbx
mov qword [rbp + 0x10], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + 0x3c]
add rax, rdx
add rax, 4
add rax, 0x14
lea rax, [rax + 0x70]
add rax, 8
mov eax, dword [rax]
add rax, rdx
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x120], 0x49
mov byte [rbp - 0x11f], 0x6d
mov byte [rbp - 0x11e], 0x70
mov byte [rbp - 0x11d], 0x6f
mov byte [rbp - 0x11c], 0x72
mov byte [rbp - 0x11b], 0x74
mov byte [rbp - 0x11a], 0x20
mov byte [rbp - 0x119], 0x54
mov byte [rbp - 0x118], 0x61
mov byte [rbp - 0x117], 0x62
mov byte [rbp - 0x116], 0x6c
mov byte [rbp - 0x115], 0x65
mov byte [rbp - 0x114], 0x3a
mov byte [rbp - 0x113], 0
lea rax, [rbp - 0x120]
lea rax, [rbp - 0x120]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b026
add rsp, 0x20
test rax, rax
je 0x14029ca3c
sub rsp, 0x20
call fcn.14029b1c3
add rsp, 0x20
test rax, rax
je 0x14029ca3c
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
call fcn.14029b1ec
add rsp, 0x20
test rax, rax
je 0x14029cb7f
lea r8, [rbp - 0x18]
mov rcx, 0x14
mov al, 0
mov byte [r8], al
inc r8
dec rcx
jne 0x14029cb38
mov rbx, qword [rbp - 0x20]
lea rsi, [rbp - 0x18]
mov rdi, rbx
mov rcx, 0x14
repe cmpsb byte [rsi], byte [rdi]
je 0x14029cb78
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, rbx
call fcn.14029cb87
add rsp, 0x20
test rax, rax
je 0x14029cb7f
add rbx, 0x14
jmp 0x14029cb47
mov eax, 1
jmp 0x14029cb82
sub rax, rax
pop rbx
pop rdi
pop rsi
leave
ret
Function at 0x14029cff2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x138
push rbx
push rdi
push rsi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
sub rax, rax
mov rdx, qword [rbp + 0x10]
mov ax, word [rdx + 2]
mov qword [rbp - 0x130], rax
add rdx, 0x14
mov rax, qword [rdx + 0x18]
mov qword [rbp - 0x128], rax
mov esi, dword [rdx + 0x38]
mov qword [rbp - 0x120], rdx
lea rbx, [rbp - 0x18]
sub rsp, 0x20
mov rcx, qword [rbp - 0x128]
mov rdx, rsi
mov r8, 4
mov r9, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x20
test rax, rax
je 0x14029d1d9
mov byte [rbp - 0x118], 0x53
mov byte [rbp - 0x117], 0x65
mov byte [rbp - 0x116], 0x74
mov byte [rbp - 0x115], 0x20
mov byte [rbp - 0x114], 0x49
mov byte [rbp - 0x113], 0x6d
mov byte [rbp - 0x112], 0x61
mov byte [rbp - 0x111], 0x67
mov byte [rbp - 0x110], 0x65
mov byte [rbp - 0x10f], 0x20
mov byte [rbp - 0x10e], 0x77
mov byte [rbp - 0x10d], 0x72
mov byte [rbp - 0x10c], 0x69
mov byte [rbp - 0x10b], 0x74
mov byte [rbp - 0x10a], 0x61
mov byte [rbp - 0x109], 0x62
mov byte [rbp - 0x108], 0x6c
mov byte [rbp - 0x107], 0x65
mov byte [rbp - 0x106], 0x3a
mov byte [rbp - 0x105], 0
lea rax, [rbp - 0x118]
lea rax, [rbp - 0x118]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b026
add rsp, 0x20
test rax, rax
je 0x14029d1d9
sub rsp, 0x20
call fcn.14029b1c3
add rsp, 0x20
test rax, rax
je 0x14029d1d9
sub rsp, 0x20
mov rcx, qword [rbp - 0x128]
call fcn.14029b1ec
add rsp, 0x20
test rax, rax
je 0x14029d1d9
mov rdx, qword [rbp - 0x120]
lea rbx, [rdx + 0x70]
mov eax, dword [rdx + 0x6c]
mov rdx, 8
mul rdx
add rax, rbx
mov qword [rbp - 0x10], rax
mov rax, 0x28
mov rdx, qword [rbp - 0x130]
mul rdx
add rax, qword [rbp - 0x10]
mov rbx, qword [rbp + 0x18]
sub rax, rbx
mov qword [rbp - 8], rax
mov rdi, qword [rbp - 0x128]
mov rsi, qword [rbp + 0x18]
mov rcx, qword [rbp - 8]
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rbp - 0x130]
mov rbx, qword [rbp - 0x10]
sub rsp, 0x20
mov rcx, rbx
mov rdx, qword [rbp - 0x128]
mov r8, qword [rbp + 0x18]
call fcn.14029d1e1
add rsp, 0x20
test rax, rax
je 0x14029d1d9
add rbx, 0x28
dec rsi
jne 0x14029d1a7
mov rax, qword [rbp - 0x128]
jmp 0x14029d1dc
sub rax, rax
pop rsi
pop rdi
pop rbx
leave
ret
Function at 0x14029d28d
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
push rbx
push r12
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x10]
mov ebx, dword [rdx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x14029d2cc
mov rax, 0x40
mov qword [rbp - 0x110], rax
jmp 0x14029d33d
mov ebx, dword [rdx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x14029d2ed
mov rax, 0x20
mov qword [rbp - 0x110], rax
jmp 0x14029d33d
mov ebx, dword [rdx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x14029d30e
mov rax, 4
mov qword [rbp - 0x110], rax
jmp 0x14029d33d
mov ebx, dword [rdx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x14029d32f
mov rax, 2
mov qword [rbp - 0x110], rax
jmp 0x14029d33d
mov rax, 1
mov qword [rbp - 0x110], rax
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov ebx, dword [rdx + 8]
lea r12, [rbp - 0x108]
sub rsp, 0x20
mov rcx, rax
mov rdx, rbx
mov r8, qword [rbp - 0x110]
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x20
test rax, rax
je 0x14029d39a
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
sub rsp, 0x20
mov rcx, rax
call fcn.14029b1ec
add rsp, 0x20
test rax, rax
je 0x14029d39a
mov rax, 1
jmp 0x14029d39d
sub rax, rax
pop r12
pop rbx
leave
ret

Function at 0x14029d3a2
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov ax, word [rcx]
cmp ax, 0x5a4d
jne 0x14029d3cf
mov eax, dword [rcx + 0x3c]
add rcx, rax
mov eax, dword [rcx]
cmp eax, 0x4550
jne 0x14029d3cf
add rcx, 4
mov rax, rcx
leave
ret
sub rax, rax
leave
ret

Function at 0x14029d417
Capabilities:
Terminate process

Disassembly:
sub rsp, 8
sub rsp, 0x20
call fcn.14029d448
add rsp, 0x20
test rax, rax
je 0x14029d433
add rsp, 8
jmp rax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x14000a739
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000a757
je 0x14000a762
call 0x14000a7b1
mov bl, 0xc7
lahf
pop rsi
jne 0x14000a742
call 0x14000a75a
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000a742
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000a790
je 0x14000a7ce
invalid
je 0x14000a7df
jne 0x14000a742
lea rax, [0x14000a668]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400063c9]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000a880
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000a8d9
je 0x14000a8df
call 0x14000a8d0
fild qword [rdi - 0x7c]
jmp 0x174f47052
jne 0x14000a8a2
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000a862
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000a744
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000a757
je 0x14000a762
call 0x14000a7b1
mov bl, 0xc7
lahf
pop rsi
jne 0x14000a742
call 0x14000a75a
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000a742
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000a790
je 0x14000a7ce
invalid
je 0x14000a7df
jne 0x14000a742
lea rax, [0x14000a668]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400063c9]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000a880
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000a8d9
je 0x14000a8df
call 0x14000a8d0
fild qword [rdi - 0x7c]
jmp 0x174f47052
jne 0x14000a8a2
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000a862
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000a754
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000a757
je 0x14000a762
call 0x14000a7b1
mov bl, 0xc7
lahf
pop rsi
jne 0x14000a742
call 0x14000a75a
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000a742
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000a790
je 0x14000a7ce
invalid
je 0x14000a7df
jne 0x14000a742
lea rax, [0x14000a668]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400063c9]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000a880
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000a8d9
je 0x14000a8df
call 0x14000a8d0
fild qword [rdi - 0x7c]
jmp 0x174f47052
jne 0x14000a8a2
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000a862
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000a770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000a757
je 0x14000a762
call 0x14000a7b1
mov bl, 0xc7
lahf
pop rsi
jne 0x14000a742
call 0x14000a75a
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000a742
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000a790
je 0x14000a7ce
invalid
je 0x14000a7df
jne 0x14000a742
lea rax, [0x14000a668]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400063c9]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000a880
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000a8d9
je 0x14000a8df
call 0x14000a8d0
fild qword [rdi - 0x7c]
jmp 0x174f47052
jne 0x14000a8a2
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000a862
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret