joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002330
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004640]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000234f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002358
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002510
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8d, 0x2c
mov ecx, 2
lea rdx, str._stack_smashing_detected_:_terminated_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140002540
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140002ae0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, qword [0x140004710]
lea rsi, section..rdata
mov rax, qword [rbx]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, rcx
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea r10, [rsp + 0x148]
mov r11, rdx
lea rbp, [rsp + 0x48]
mov rdx, rax
mov byte [rax + r10], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx + 0x28]
mov byte [rax + rbp - 1], dl
cmp rax, 0x100
jne 0x140002b2b
mov r12, r10
xor esi, esi
xor r13d, r13d
mov edi, 0x100
movzx eax, byte [r12]
movzx edx, byte [rbp + rsi]
inc rsi
add eax, r13d
add eax, edx
cdq
idiv edi
movsxd rcx, edx
mov rdx, r12
inc r12
mov r13, rcx
add rcx, r10
call fcn.140002ac0
cmp rsi, 0x100
jne 0x140002b55
lea rdi, [r9 + r11]
xor ebp, ebp
xor r12d, r12d
cmp rdi, r9
je 0x140002be5
lea eax, [rbp + 1]
cdq
idiv esi
movsxd r13, edx
movzx eax, byte [rsp + r13 + 0x148]
lea rcx, [r10 + r13]
mov rbp, r13
add eax, r12d
cdq
idiv esi
movsxd r14, edx
lea rdx, [r10 + r14]
mov r12, r14
call fcn.140002ac0
mov cl, byte [rsp + r14 + 0x148]
add cl, byte [rsp + r13 + 0x148]
movzx ecx, cl
mov al, byte [rsp + rcx + 0x148]
xor byte [r9], al
inc r9
jmp 0x140002b90
mov rax, qword [rsp + 0x248]
sub rax, qword [rbx]
je 0x140002bf7
call fcn.140002510
mov rax, r11
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140002da0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x20]
mov rsi, rcx
test rbx, rbx
je 0x140002de3
cmp word [rbx + 0x48], 0
je 0x140002de1
mov rcx, qword [rbx + 0x50]
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsicmp
test eax, eax
jne 0x140002ddc
mov rbx, qword [rbx + 0x20]
jmp 0x140002de3
mov rbx, qword [rbx]
jmp 0x140002dba
xor ebx, ebx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140002df0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
cmp word [rcx], 0x5a4d
mov rbx, rcx
mov rbp, rdx
jne 0x140002e71
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140002e71
mov edi, dword [rdx + 0x88]
xor esi, esi
add rdi, rcx
mov r12d, dword [rdi + 0x20]
mov r13d, dword [rdi + 0x14]
add r12, rcx
cmp esi, r13d
jae 0x140002e6f
mov edx, dword [r12 + rsi*4]
mov rcx, rbp
add rdx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov edx, eax
lea rax, [rsi + 1]
test edx, edx
jne 0x140002e6a
mov eax, dword [rdi + 0x24]
add rsi, rsi
add rsi, rbx
movzx edx, word [rsi + rax]
mov eax, dword [rdi + 0x1c]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
jmp 0x140002e71
mov rsi, rax
jmp 0x140002e30
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14004102c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400410a1
cmp byte [rcx + 0x71], 0
je 0x1400410a1
or edx, 0xffffffff
call fcn.140040110
cmp eax, 0xffffffff
je 0x1400410f6
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140062ace.0]
test eax, eax
je 0x1400410bc
sub eax, 1
je 0x1400410c0
cmp eax, 2
jne 0x1400410f6
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004d060
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400410ed
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14005672c
cmp rdi, rax
jne 0x1400410f6
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400410a3
xor al, al
jmp 0x1400410a3

Function at 0x140042e0c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140042c67
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042c67
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042c67
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042c67
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042c67
cmp dword [rcx + 0x84], 0xe
jbe 0x140042c67
cmp dword [rcx + 0xf8], 0
je 0x140042c67
mov ecx, ebx
call fcn.140042d14
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140042ae4
cmp dword [rbp + 0x20], 0
je 0x140042cb4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140042cc4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140042c00
Function at 0x14004d6e8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14008d110], eax
call fcn.14004d3dc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14008d110], 0
jne case.default.0x14004d73e
mov ecx, 1
call fcn.14004d3dc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
invalid
cdq
and ch, byte [rbp + 0x21]
loop 0x1400f7915
invalid
movabs dword [0xf6fe4e2e7a7dfe98], eax
lahf
sbb edx, eax
sbb dword [rcx], edi
sbb al, 0x77
jo 0x1400f7961
jno 0x1400f7997
je 0x1400f7945
test al, 0x2f
mov ch, 0xb0
stosb byte [rdi], al
sbb al, 0x51
sub dword [rbp + 0x3e], edx
xchg ebp, eax
outsb dx, byte [rsi]
and eax, 0xe85622e8
jo 0x1400f79ba
fiadd word [rdi + 0x12d6418e]
mov esi, 0x5e719f8
pop rbx
pop rdx
mov esi, 0x6bd16daf
xor al, 0x2b
mov dword [rcx + 0x14], edx
sub eax, 0x5b3e99f7
pop rbx
invalid
cld
sal byte [rbx + 0x6bdb7b74], cl
invalid
Function at 0x100002b08
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100002ba5
lea rax, [rsp + 0x30]
lea rdx, [0x100001850]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100002ba5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, [0x1000018c8]
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100002b9a
cmp dword [rsp + 0x60], 4
jne 0x100002b9a
cmp dword [rsp + 0x68], eax
je 0x100002b9a
mov byte [rbx + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x10000e41c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov rdi, r8
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x20]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10000e46c
cmp dword [rsp + 0x40], 4
jne 0x10000e46c
mov eax, dword [rsp + 0x58]
mov bl, 1
mov dword [rdi], eax
mov al, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x10000e480
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
lea rax, [r11 + 0x18]
mov dword [r11 + 0x18], r8d
xor ebx, ebx
xor r8d, r8d
lea r9d, [rbx + 4]
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
lea edx, [rbx + 1]
movzx ecx, bl
cmove ecx, edx
mov al, cl
add rsp, 0x30
pop rbx
ret
Function at 0x10000f518
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r13, rcx
mov qword [rax - 0x38], r14
mov dword [rax + 8], r14d
cmp rcx, r14
je 0x10000f75f
cmp rdx, r14
je 0x10000f75f
cmp r8, r14
je 0x10000f75f
cmp rbx, r14
je 0x10000f75f
mov edx, 0x7fffffff
lea rcx, [0x100001ed0]
lea r10d, [r14 + 2]
mov rax, rdx
cmp word [rcx], r14w
je 0x10000f591
add rcx, r10
sub rax, 1
jne 0x10000f582
cmp rax, r14
je 0x10000f75f
mov r9, rdx
mov rcx, rdx
sub r9, rax
mov rax, rbx
cmp word [rax], r14w
je 0x10000f5b5
add rax, r10
sub rcx, 1
jne 0x10000f5a6
cmp rcx, r14
je 0x10000f75f
mov rax, rdx
sub rax, rcx
mov rcx, rdx
add r9, rax
cmp word [r8], r14w
je 0x10000f5d9
add r8, r10
sub rcx, 1
jne 0x10000f5ca
cmp rcx, r14
je 0x10000f75f
sub rdx, rcx
mov rax, r10
mov r15, 0xffffffffffffffff
lea rbp, [r9 + rdx + 1]
mul rbp
cmovo rax, r15
mov rcx, rax
call fcn.100010830
mov r12, rax
cmp rax, r14
jne 0x10000f625
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x10000f61b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 0x8007000e
jmp 0x10000f764
lea r8, [0x100001f20]
mov r9, rsi
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10000ed50
cmp eax, r14d
mov ebx, eax
jge 0x10000f65d
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x10000f656
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x10000f764
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
cmp rax, r14
jne 0x10000f678
mov ebx, 0x8007000e
jmp 0x10000f72d
lea rcx, [0x100001f78]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
cmp rax, r14
je 0x10000f66e
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x10000f69d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [r13]
lea rcx, [rsp + 0x30]
mov r9d, 0x30
mov qword [rsp + 0x28], rcx
mov r8, rsi
mov rdx, rbp
mov rcx, r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r14
call qword [rax + 0xa0]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebx, r14d
jl 0x10000f72d
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
jne 0x10000f6fa
xor edx, edx
mov ecx, 0x80004003
call fcn.100010690
int3
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
mov r8d, 1
mov qword [rsp + 0x20], r9
mov r9, rdi
mov edx, r15d
call qword [rax + 0x20]
cmp eax, r14d
mov ebx, eax
jl 0x10000f72d
cmp qword [rdi], r14
mov eax, 0x80004005
cmove ebx, eax
cmp ebx, r14d
jge 0x10000f73e
mov rcx, qword [rdi]
cmp rcx, r14
je 0x10000f73e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], r14
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x10000f656
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000f656
mov eax, 0x80070057
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10000f854
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rdi, rcx
xor r9d, r9d
mov qword [rax - 0x18], rsi
mov dword [rax - 0x20], esi
mov qword [rax - 0x28], rsi
mov dword [rax - 0x30], 3
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rax - 0x38], esi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, esi
jge 0x10000f89a
xor al, al
jmp 0x10000f945
xor edx, edx
lea rbx, [rdi + 8]
lea r9, [0x100001a90]
lea r8d, [rdx + 1]
lea rcx, [0x100001aa0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x10000f893
mov rcx, qword [rbx]
add rdi, 0x10
lea rdx, [0x100001f80]
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [rax + 0x18]
cmp eax, esi
jge 0x10000f905
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx], rsi
jmp 0x10000f893
mov rcx, qword [rdi]
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
or r9, 0xffffffffffffffff
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, esi
jge 0x10000f943
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], rsi
jmp 0x10000f8f7
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x100010920
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x100014818], rdi
je 0x100010979
cmp rax, rdi
jne 0x10001096c
mov esi, 1
jmp 0x100010979
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100010953
mov eax, dword [0x100014810]
cmp eax, 1
jne 0x10001098e
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x1000109f3
mov eax, dword [0x100014810]
test eax, eax
jne 0x1000109e9
mov dword [0x100014810], 1
lea r12, [0x100001678]
lea rdi, [0x100001660]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x1000109db
test eax, eax
jne 0x1000109db
mov rcx, qword [rdi]
test rcx, rcx
je 0x1000109d0
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x1000109b9
test eax, eax
je 0x1000109f3
mov eax, 0xff
jmp 0x100010b3d
mov dword [0x100014214], 1
mov eax, dword [0x100014810]
cmp eax, 1
jne 0x100010a1b
lea rdx, [0x100001658]
lea rcx, [0x100001640]
call sub.msvcrt.dll__initterm
mov dword [0x100014810], 2
test esi, esi
jne 0x100010a28
xor eax, eax
xchg qword [0x100014818], rax
cmp qword [0x100014830], 0
je 0x100010a51
lea rcx, [0x100014830]
call fcn.100010ecc
test eax, eax
je 0x100010a51
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100014830]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x100010adc
cmp byte [rdi], 0
je 0x100010a72
test esi, esi
jne 0x100010adc
cmp byte [rdi], 0
je 0x100010a86
cmp byte [rdi], 0x20
ja 0x100010a86
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x100010a72
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100006f68
mov dword [0x100014210], eax
cmp dword [0x1000141f4], 0
jne 0x100010ac5
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100014214], 0
jne 0x100010ada
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100014210]
jmp 0x100010b3d
cmp byte [rdi], 0x22
jne 0x100010aee
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x100010b03
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x100010a64
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.100010fe0
add rsp, 0x28
jmp 0x100010920
Function at 0x1400052e0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14009a140]
test rax, rax
jne 0x1400054cc
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0xb51bcdaa
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14000538d
psrldq xmm0, 8
mov edx, 0x8527d3fc
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140005384
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140005370
cmp edx, r11d
jne 0x14000548f
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x14000548f
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000548f
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x8527d3fc
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005407
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400053f0
cmp edx, r9d
je 0x140005413
test r8d, r8d
jne 0x1400053d0
jmp 0x14000548f
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x1400054a7
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x1400054a7
movzx ecx, byte [rax]
mov r11d, 0x8527d3fc
mov r9d, r11d
cmp cl, 0x2e
je 0x140005468
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140005450
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14000548b
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140005473
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1400054a5
cmp qword [rax + 0x30], 0
jne 0x140005340
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x14009a140], rax
add rsp, 0x38
jmp rax
Function at 0x140005a90
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x14009a110]
test rcx, rcx
jne 0x140005c7b
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x50], rbp
mov r9d, 0x65255170
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x140005b3d
psrldq xmm0, 8
mov edx, 0x7080790d
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140005b34
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140005b20
cmp edx, r11d
jne 0x140005c3e
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x140005c3e
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140005c3e
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x7080790d
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005bb7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005ba0
cmp edx, r9d
je 0x140005bc3
test r8d, r8d
jne 0x140005b80
jmp 0x140005c3e
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ecx, dword [rcx + rdx*4]
add rcx, r10
cmp rcx, rbx
jbe 0x140005c56
lea rax, [r15 + rbx]
cmp rcx, rax
jae 0x140005c56
movzx eax, byte [rcx]
mov r11d, 0x7080790d
mov r9d, r11d
cmp al, 0x2e
je 0x140005c17
nop dword [rax + rax]
movsx eax, al
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x140005c00
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x140005c3a
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x140005c22
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005c54
cmp qword [rax + 0x30], 0
jne 0x140005af0
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x14009a110], rcx
call fcn.140004330
call fcn.140004ac0
test eax, eax
je 0x140005c95
mov qword [0], 1
call fcn.140004f20
test eax, eax
je 0x140005caa
mov qword [0], 1
call fcn.1400052e0
test eax, eax
je 0x140005cbf
mov qword [0], 1
call fcn.1400054e0
test al, al
je 0x140005cd4
mov qword [0], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], reloc.WS2_32.dll_sendto
call fcn.140012150
add rsp, 0x38
ret
Function at 0x1400063e0
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x68
movups xmm1, xmmword [0x14008c418]
movups xmm0, xmmword [0x14008c408]
movups xmmword [rsp + 0x40], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x30], xmm0
test al, al
je 0x1400065af
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140006574
movdqa xmm0, xmmword [str.2222222222222222]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14008c850]
movdqa xmm4, xmmword [0x14008c910]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14008c870]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14008c880]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008c880]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x140006460
movaps xmm6, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
lea r8, [rsp + 0x30]
nop dword [rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x32
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0x20
jl 0x140006580
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret