joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013650
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
sub rsp, 0x88
test cl, cl
je 0x180013883
mov qword [rax + 8], rbx
mov ecx, 0x20
mov qword [rax - 8], rdi
movaps xmmword [rax - 0x18], xmm6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movabs rdi, 0xd80958fc74e988a6
xorps xmm6, xmm6
test ax, ax
je 0x1800136fa
mov rcx, rdi
call fcn.180021510
call fcn.1800214a0
movss xmm0, dword [0x1800554e4]
xorps xmm3, xmm3
mov dword [rsp + 0x68], 1
xorps xmm2, xmm2
mov dword [rsp + 0x60], 1
mov edx, 1
mov ecx, dword [rax]
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], 1
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm6
movss dword [rsp + 0x20], xmm0
call fcn.180005800
movabs rcx, 0xd24d37cc275948cc
call fcn.180021510
lea rcx, str.GADGET_PARACHUTE
call fcn.180021530
call fcn.1800214a0
mov rcx, rdi
mov ebx, dword [rax]
call fcn.180021510
call fcn.1800214a0
mov r9d, 1
mov edx, ebx
mov r8d, r9d
mov ecx, dword [rax]
call fcn.1800095b0
mov rcx, rdi
call fcn.180021510
call fcn.1800214a0
movabs rcx, 0x886e37ec497200b6
mov ebx, dword [rax]
call fcn.180021510
mov qword [rsp + 0x98], 0
mov dword [rsp + 0x98], ebx
mov rcx, qword [rsp + 0x98]
call fcn.180021530
call fcn.1800214a0
cmp dword [rax], 0
je 0x18001386e
mov rcx, rdi
call fcn.180021510
call fcn.1800214a0
movabs rcx, 0x47e4e977581c5b55
mov ebx, dword [rax]
call fcn.180021510
mov qword [rsp + 0x98], 0
mov dword [rsp + 0x98], ebx
mov rcx, qword [rsp + 0x98]
call fcn.180021530
call fcn.1800214a0
cmp dword [rax], 0
jne 0x18001386e
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180013805
mov rcx, rdi
call fcn.180021510
call fcn.1800214a0
movss xmm1, dword [0x1800554a8]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov ecx, dword [rax]
call fcn.1800059e0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001383c
mov rcx, rdi
call fcn.180021510
call fcn.1800214a0
movss xmm2, dword [0x1800554d4]
xorps xmm3, xmm3
movss xmm1, dword [0x1800554a8]
mov ecx, dword [rax]
call fcn.1800059e0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001386e
mov rcx, rdi
call fcn.180021510
call fcn.1800214a0
movss xmm1, dword [0x1800554d4]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov ecx, dword [rax]
call fcn.1800059e0
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x180017210
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
lea rdx, [0x1800561e4]
lea rcx, [rsp + 0xa0]
call fcn.180015ea0
mov rbx, rax
lea rcx, [rsp + 0x80]
call fcn.180005f80
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180014d70
nop
lea r8, [0x180096d68]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180014da0
nop
lea rcx, [rsp + 0x60]
call fcn.1800053e0
nop
lea rcx, [rsp + 0x80]
call fcn.1800053e0
nop
lea rcx, [rsp + 0xa0]
call fcn.1800053e0
lea rcx, [rsp + 0x40]
call fcn.180019e70
mov qword [rsp + 0xd0], rax
xor r8d, r8d
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.180014d10
nop
lea rcx, [rsp + 0x20]
call fcn.18001a0c0
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.180016fd0
test bl, bl
je 0x1800172e9
lea rcx, [rsp + 0x40]
call fcn.180019e70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x1800a7590]
call fcn.18001aac0
lea rcx, str.Cleaning_up_hooks
call fcn.18001d5d0
lea rcx, [0x1800a7480]
call fcn.180019dd0
mov rsi, rax
lea rcx, [0x1800a7480]
call fcn.180019dc0
mov rbx, rax
cmp rax, rsi
je 0x180017363
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.18000211c
test eax, eax
jne 0x180017341
lea rcx, str.Successfully_disabled_hooks
call fcn.18001d5d0
jmp 0x18001735a
mov ecx, eax
call fcn.180002124
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_disable_hookS__p___s_
call fcn.18001d5d0
add rbx, 8
cmp rbx, rsi
jne 0x180017324
mov dword [rsp + 0xd0], 0x32
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.1800042d0
mov rcx, rax
call fcn.1800042e0
lea rcx, [0x1800a7480]
call fcn.180019dd0
mov rsi, rax
lea rcx, [0x1800a7480]
call fcn.180019dc0
mov rbx, rax
cmp rax, rsi
je 0x1800173fb
nop
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.180001f68
test eax, eax
jne 0x1800173d9
lea rcx, str.Successfully_Cleaning_up_hooks
call fcn.18001d5d0
lea rcx, str.WOLF_Successfully_____unloaded.
call fcn.18001d5d0
jmp 0x1800173f2
mov ecx, eax
call fcn.180002124
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_unhook__p___s_
call fcn.18001d5d0
add rbx, 8
cmp rbx, rsi
jne 0x1800173b0
mov dword [rsp + 0xd0], 0x190
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.1800042d0
mov rcx, rax
call fcn.1800042e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov rcx, qword [0x1800a7450]
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
Function at 0x18001b070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180096e80]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x18001b09d
xor eax, eax
jmp 0x18001b206
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x18001b0dd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x18001b0dd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x18001b1fe
cmp qword [rdi + 0x80], 0
je 0x18001b1f9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x18001b117
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x18001b142
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x18001b1fe
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001b1b1
sub eax, 1
je 0x18001b1b1
cmp eax, 2
jne 0x18001b1f9
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x18001b1fe
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x18001b1df
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18001b1f9
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x18001b1fe
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18004e300
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18001b6b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x18001b6e1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x18001b6ff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x18001b749
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x18001b7c1
mov rcx, rbp
call fcn.18001d810
cmp rbx, 0xfff
jbe 0x18001b7a1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x18001b7e2
cmp rbx, rax
ja 0x18001b770
test rdi, rdi
je 0x18001b7c1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x18001b7c4
Function at 0x18001b7f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x18001b818
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x18001b88c
test rax, rax
jle 0x18001b86c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x18001b88c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18001b88c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x18001d610
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180096e80]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18001d6e3
cmp byte [rcx + 0x71], 0
je 0x18001d6e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18001d6df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001d6a4
sub eax, 1
je 0x18001d6a8
cmp eax, 2
jne 0x18001d6df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004e300
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18001d6d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18001d6df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001d68c
xor al, al
jmp 0x18001d68c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004e300
add rsp, 0x60
pop rbx
ret
Function at 0x18001e040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180096e80]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x20]
call fcn.180004e80
nop
movabs r9, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmova rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rdx
cmp rax, rcx
je 0x18001e0d3
movabs r8, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
imul r9, r8
movsx rdx, byte [rax]
xor r9, rdx
inc rax
cmp rax, rcx
jne 0x18001e0c0
mov qword [rsi + 0x40], r9
mov byte [rsi + 0x68], 0
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.18001e240
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x1800a87f0]
mov rcx, qword [rbx + 8]
mov rax, rcx
mov rdi, rbx
cmp byte [rcx + 0x19], 0
jne 0x18001e138
mov r8, qword [rsi + 0x40]
nop
mov rdx, qword [rax + 0x20]
cmp rdx, r8
jae 0x18001e11f
mov rax, qword [rax + 0x10]
jmp 0x18001e132
cmp byte [rdi + 0x19], 0
je 0x18001e12c
cmp r8, rdx
cmovb rdi, rax
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18001e110
cmp byte [rdi + 0x19], 0
jne 0x18001e141
mov rcx, qword [rdi]
cmp byte [rcx + 0x19], 0
jne 0x18001e168
mov rax, qword [rsi + 0x40]
nop dword [rax + rax]
cmp rax, qword [rcx + 0x20]
jae 0x18001e15e
mov rdi, rcx
mov rcx, qword [rcx]
jmp 0x18001e162
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x18001e150
cmp rbx, rdi
je 0x18001e1e9
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.18001de90
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18001e1a8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18001e1a3
cmp rbx, qword [rax + 0x10]
jne 0x18001e1a3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18001e190
mov rbx, rax
jmp 0x18001e1cf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18001e1cf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18001e1c0
cmp rbx, rdi
jne 0x18001e170
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x18001e1e9
mov byte [rsi + 0x68], 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18001e229
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e224
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e224
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004decc
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004e300
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004d2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rdx
mov r15, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
movsxd r8, dword [rax + 0x3c]
mov r14d, dword [r8 + rax + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov r11d, ebp
mov qword [rsp + 0x40], rbp
lea r12, [0x18005fe70]
mov r9, qword [rsp + 0x38]
nop word [rax + rax]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov rdi, rbp
movzx edx, byte [rsi]
inc rsi
test dl, dl
je 0x18004d3e7
nop dword [rax + rax]
movzx eax, dil
shl al, 2
not al
and al, 4
movzx ecx, dl
movzx r8d, byte [rcx + r12]
cmp r8b, 0xff
je 0x18004d387
mov rdx, rdi
shr rdx, 1
movzx ecx, al
mov eax, 0xf
shl al, cl
or byte [rsp + rdx + 0x28], al
shl r8b, cl
or byte [rsp + rdx + 0x20], r8b
jmp 0x18004d390
cmp dl, 0x3f
je 0x18004d390
test al, al
jne 0x18004d399
inc rdi
cmp rdi, 0x10
je 0x18004d3a3
movzx edx, byte [rsi]
inc rsi
test dl, dl
jne 0x18004d350
test rdi, rdi
je 0x18004d3dd
cmp r9, r11
je 0x18004d3c1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r9], xmm0
add r9, 0x10
mov qword [rsp + 0x38], r9
jmp 0x18004d3dd
lea r8, [rsp + 0x20]
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.18004ceb0
mov r11, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp rdi, 0x10
jae 0x18004d330
lea r10, [r14 + rbx]
mov r8, qword [rsp + 0x30]
cmp rbx, r10
jae 0x18004d438
sub r9, r8
sar r9, 4
mov rcx, rbp
test r9, r9
je 0x18004d43b
mov rdx, r8
nop word [rax + rax]
mov rax, qword [rbx + rcx*8]
xor rax, qword [rdx]
test qword [rdx + 8], rax
jne 0x18004d42b
inc rcx
add rdx, 0x10
cmp rcx, r9
jb 0x18004d410
jmp 0x18004d43b
inc rbx
cmp rbx, r10
jae 0x18004d438
mov rcx, rbp
jmp 0x18004d404
mov rbx, rbp
test r8, r8
je 0x18004d47a
sub r11, r8
and r11, 0xfffffffffffffff0
mov rax, r8
cmp r11, 0x1000
jb 0x18004d46f
add r11, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004d46f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r11
mov rcx, r8
call fcn.18004decc
mov rax, r15
test rbx, rbx
je 0x18004d487
mov qword [r15], rbx
jmp 0x18004d48a
mov qword [r15], rbp
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18004d814
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18004d84e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18004d853
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18004d89c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18005ffc0]
cmp byte [rcx + rax], 0
je 0x18004d89c
dec r8
sub rdx, 1
jne 0x18004d882
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1eabc1380
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push rbx
xor eax, eax
mov r10d, edx
mov byte [rcx + rax], al
inc rax
cmp rax, 0x100
jne 0x1eabc1387
xor r9d, r9d
xor r11d, r11d
mov esi, 0x100
mov eax, r9d
mov bl, byte [rcx + r9]
cdq
idiv r10d
movsxd rdx, edx
movzx eax, byte [r8 + rdx]
movzx edx, bl
add edx, r11d
add eax, edx
cdq
idiv esi
movsxd rax, edx
mov dl, byte [rcx + rax]
mov r11, rax
mov byte [rcx + r9], dl
inc r9
mov byte [rcx + rax], bl
cmp r9, 0x100
jne 0x1eabc13a0
xor eax, eax
mov qword [rcx + 0x100], rax
pop rbx
pop rsi
ret

Function at 0x1eabc1456
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r9d, 1
xor r8d, r8d
lea rax, [rsp + 0x48]
mov rdi, rdx
xor edx, edx
mov rbp, rcx
mov dword [rsp + 0x40], edx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x44], edx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x1eabc1596
lea r9, [rsp + 0x44]
xor eax, eax
lea r15, [rsp + 0x40]
xor r8d, r8d
lea r14, str.ProductName
mov qword [rsp + 0x38], r9
mov rcx, qword [rsp + 0x48]
mov rdx, r14
mov qword [rsp + 0x28], r15
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov qword [rsp + 0x20], rax
call r13
mov r12, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rsp + 0x38]
test eax, eax
mov edx, eax
je 0x1eabc14fb
cmp eax, 0xea
jne 0x1eabc1580
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x38], r9
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, r14
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
mov rsi, rax
mov rcx, qword [rsp + 0x48]
call r13
mov edx, eax
test eax, eax
jne 0x1eabc156a
cmp dword [rsp + 0x44], 1
jne 0x1eabc154c
lea r8, [rdi - 1]
mov rdx, rsi
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
mov byte [rbp + rdi - 1], 0
jmp 0x1eabc1576
lea rcx, str.Unsupported_registry_value_type.
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsp + 0x48]
call r12
jmp 0x1eabc15a4
lea rcx, str.Failed_to_query_registry_value._Error_code:__ld_n
call fcn.1eabc24b0
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x1eabc158c
lea rcx, str.Failed_to_get_registry_value_size._Error_code:__ld_n
call fcn.1eabc24b0
mov rcx, qword [rsp + 0x48]
call r12
jmp 0x1eabc15a7
mov edx, eax
lea rcx, str.Failed_to_open_registry_key._Error_code:__ld_n
call fcn.1eabc24b0
or ebx, 0xffffffff
mov eax, ebx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1eabc15ba
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r9d, 0x40
mov r8d, 0x1000
mov rsi, rcx
mov rbx, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1eabc15f3
lea rcx, str.Failed_to_allocate_memory_for_errorcode.
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov rdi, rax
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax

Function at 0x1eabc1691
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x1eabc16c3
xor eax, eax
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x20], edx
lea r8, [sym.test.dll_ThreadFunction]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x1eabc1870
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.1eabc2490
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]