joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Timeslip_tcrafty_tthursday_tdir_trez_tabonnes_treginternal_thttpmodules_tindexprint_twaves_teca_ttemplatesconf_teditprofile_tadmincustom_ttheblog_tinitrd_tlanguage_tserverstats_tmd_tflickrdk_tautopromo_tlogfiles_tmodulefiles_tproduce_topus_tguess_tkurgan_tmason_tband_tpreviews_tnetherlands_tsweden_torigpages_ttasks_tagreement_twebtools_tappthemes_tthemebackup_ttiendas_taspnet_tphpmybackuppro
mov r10, rax
sub rbx, rax
movabs rdi, 0xb89bc36ce3e0453b
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x163
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009090
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400090f2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000bdd0
test al, al
jne 0x140009104
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400090c0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x72
mov dword [rbp - 0x20], 0x2c001f
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b003f
mov dword [rbp - 0x18], 0x200036
mov dword [rbp - 0x14], 0x31002b
mov dword [rbp - 0x10], 0x26005a
call fcn.140004fd0
mov rcx, rax
call 0x140009090
mov ebx, 9
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], bx
mov dword [rbp - 0x20], 0x2c001f
mov dword [rbp - 0x1c], 0x2b003f
mov dword [rbp - 0x18], 0x200036
mov dword [rbp - 0x14], 0x42005a
call fcn.1400022a0
mov rcx, rax
call 0x140009090
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x1d003a
mov dword [rbp - 0x1c], 0x90009
mov dword [rbp - 0x18], 0x6c001f
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x140009090
Function at 0x14000c8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400090f2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000bdd0
test al, al
jne 0x140009104
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400090c0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x72
mov dword [rbp - 0x20], 0x2c001f
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b003f
mov dword [rbp - 0x18], 0x200036
mov dword [rbp - 0x14], 0x31002b
mov dword [rbp - 0x10], 0x26005a
call fcn.140004fd0
mov rcx, rax
call 0x140009090
mov ebx, 9
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], bx
mov dword [rbp - 0x20], 0x2c001f
mov dword [rbp - 0x1c], 0x2b003f
mov dword [rbp - 0x18], 0x200036
mov dword [rbp - 0x14], 0x42005a
call fcn.1400022a0
mov rcx, rax
call 0x140009090
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x1d003a
mov dword [rbp - 0x1c], 0x90009
mov dword [rbp - 0x18], 0x6c001f
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x140009090
Function at 0x14000cc10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000ce3e
mov word [rbp + 0x50], 0x6954
mov word [rbp + 0x58], 0x6954
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000ccc4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000ccb0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000ccf5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000cce0
cmp rdi, rbx
jne 0x14000ce12
mov r13, rsi
mov word [rbp - 0x50], 0x6954
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000cd36
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000cd22
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000ce38
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x690035
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000cda8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x69002e
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000cda8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x690035
mov dword [rbp - 0x42], 0x690015
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x690035
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000ce05
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x69002e
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000ce05
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x690035
mov dword [rbp - 0x32], 0x690015
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000ce12
inc r14
jmp 0x14000cd10
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000ce3e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000cc80
mov rax, qword [rbp - 8]
jmp 0x14000ce40
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x10007
mov dword [rbp - 0x1c], 0x90008
mov dword [rbp - 0x18], 0x5f001f
mov dword [rbp - 0x14], 0x5e005b
mov dword [rbp - 0x10], 0xf006d
mov dword [rbp - 0xc], 0x61001e
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400171a0], rax
mov dword [rbp - 0x20], 3
mov dword [rbp - 0x1c], 0xc0003
mov dword [rbp - 0x18], 0x9001d
mov dword [rbp - 0x14], 0x5e001d
mov dword [rbp - 0x10], 0xf006d
mov dword [rbp - 0xc], 0x61001e
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140016460]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400171b0], rax
mov word [rbp - 0x10], 0x3f02
mov byte [rbp - 0xe], 0x75
call fcn.140004620
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x9080107
mov dword [rbp - 0x1c], 0x1511291f
mov dword [rbp - 0x18], 0x406166a
mov word [rbp - 0x14], 0x7431
call fcn.140001180
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x19071d
mov dword [rbp - 0x1c], 0x40c0201
mov dword [rbp - 0x18], 0xf171346
mov word [rbp - 0x14], 0x7427
call fcn.140001180
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016360]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e8], rax
mov byte [rbp - 0x10], 0x74
call fcn.140004330
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016400]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170f0], rax
mov dword [rbp - 0x10], 0x72100410
call fcn.140002660
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016440]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e0], rax
mov byte [rbp - 0x10], 0x74
call fcn.140004330
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016470]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170d8], rax
mov dword [rbp - 0x10], 0x331b071d
mov byte [rbp - 0xc], 0x73
call fcn.140003130
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400163e0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x291a
mov byte [rbp - 0xe], 0x75
call fcn.140004620
mov rcx, qword [0x1400171b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x18000dae0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
imul esi, edx, 0xc8
mov r14, r8
mov edi, edx
mov rbp, rcx
mov ebx, edx
cmp edx, esi
ja 0x18000db45
mov edx, dword [rsp + 0x48]
nop word [rax + rax]
mov eax, ebx
sub eax, 0xac
je 0x18000db82
sub eax, 0x14
je 0x18000dbab
sub eax, 0x5e
je 0x18000db6e
sub eax, 0x1a6e
je 0x18000db5d
cmp eax, 0x1242
jne 0x18000db9b
movzx eax, word [0x1800dcc8e]
and eax, 0x7fff
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
cmp edx, 0xb7
jne 0x18000db9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
imul eax, dword [0x1800dcc8c], 0x15a4e35
inc eax
mov dword [0x1800dcc8c], eax
jmp 0x18000db9b
mov r8, qword [rbp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [rdi + rdi*4]
lea ebx, [rbx + rcx*8]
cmp ebx, esi
jbe 0x18000db10
jmp 0x18000db45
movzx eax, byte [r14]
lea r8, [rsp + 0x48]
mov r9, qword [rbp + 8]
lea rdx, [rsp + 0x58]
mov ecx, 0x6e
mov byte [rsp + 0x48], al
mov byte [rsp + 0x58], 0
call fcn.1800225a0
mov r8, rbp
mov edx, 0xf
mov rcx, rax
call fcn.180048220
jmp 0x18000db4a
Function at 0x180015e20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx ebx, byte [rsp + 0x90]
lea r13d, [rcx - 6]
mov r14, rdx
mov r15d, ecx
cmp ecx, r13d
jbe case.0x180015e87.6
movzx esi, byte [rsp + 0x90]
lea r12d, [rcx - 0x7d]
mov rbp, qword [rsp + 0xa0]
xor edi, edi
mov edx, dword [0x1800de204]
lea r8, [0x180000000]
cmp r12d, 8
ja case.0x180015e87.3
mov ecx, dword [r8 + r12*4 + 0x160ac]
add rcx, r8
jmp rcx
mov ecx, dword [r14]
cmp ecx, 0xffff
jb 0x180015f0b
lea eax, [rcx - 0xffff]
cmp eax, 6
jb 0x180015eef
mov eax, ecx
not eax
cmp eax, 6
jbe 0x180015eef
mov eax, dword [0x1800de208]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0xa0], ecx
mov r8d, 0xb7
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x90], eax
call fcn.18005ab30
mov ecx, dword [0x1800db0f8]
cmp eax, 1
mov edx, dword [0x1800de204]
cmovne ecx, edi
mov dword [0x1800db0f8], ecx
add dword [0x1800de208], 1
jne case.0x180015e87.3
mov dword [0x1800de208], 0xffff
jmp case.0x180015e87.3
mov edi, 0x114
cmp edi, 0x114
je 0x180015f3c
cmp edi, 0xc324
jne 0x180015f90
inc edx
mov dword [0x1800de204], edx
cmp edx, 0xffff
jb 0x180015f90
xor eax, eax
mov edx, eax
mov dword [0x1800de204], eax
jmp 0x180015f90
mov ecx, dword [r14]
cmp ecx, 6
jb 0x180015f90
mov eax, 0xfffe
sub eax, ecx
cmp eax, 6
jbe 0x180015f90
mov dword [rsp + 0xa8], edx
mov r8d, 0xb7
mov dword [rsp + 0x30], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.18005ab30
mov ecx, dword [0x1800db0f8]
cmp eax, 1
mov edx, dword [0x1800de204]
mov eax, 0
cmovne ecx, eax
mov dword [0x1800db0f8], ecx
add edi, 0xc210
cmp edi, 0x18420
jbe 0x180015f10
xor edi, edi
jmp case.0x180015e87.3
mov qword [rsp + 0x28], rdi
lea r8, [0x180015e10]
mov r9, r14
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x1800de204]
mov qword [r14], rax
jmp case.0x180015e87.3
mov edx, edi
mov dword [0x1800de204], edx
jmp case.0x180015e87.3
cmp qword [r14], 0
jne 0x180016065
mov ebx, 0x29
nop dword [rax]
mov eax, ebx
sub eax, 0x25
je 0x18001609a
sub eax, 1
je 0x180016040
sub eax, 1
je 0x18001602e
sub eax, 1
je 0x18001601c
cmp eax, 1
jne 0x180016058
xorps xmm0, xmm0
movzx esi, al
movups xmmword [rsp + 0x38], xmm0
jmp 0x180016058
mov dword [rsp + 0x38], 0xa
mov dword [rsp + 0x3c], 0x14
jmp 0x180016058
mov dword [rsp + 0x40], 0x64
mov dword [rsp + 0x44], 0x78
jmp 0x180016058
lea rcx, [rsp + 0x38]
call qword [sym.imp.GDI32.dll_CreateEllipticRgnIndirect]
test rax, rax
movzx esi, sil
mov rbp, rax
cmove esi, edi
dec ebx
cmp ebx, 0x24
ja 0x180015ff0
mov edx, dword [0x1800de204]
mov byte [r14 + 0xc], 1
mov bl, 1
nop dword [rax]
dec r15d
dec r12d
cmp r15d, r13d
ja 0x180015e6b
movzx eax, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test sil, sil
je 0x1800160a8
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteObject]
xor al, al
jmp 0x180016082
Function at 0x18001a4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push r12
sub rsp, 0x190
lea eax, [r8 - 8]
mov r12, rdx
mov rdx, rcx
cmp r8d, eax
jbe 0x18001a739
mov qword [r11 + 0x10], rbx
lea r9, [0x180000000]
movzx ebx, byte [rsp + 0x1b0]
mov qword [r11 - 0x10], rbp
movzx ebp, byte [rsp + 0x1b0]
mov qword [r11 - 0x18], rsi
movzx esi, byte [rsp + 0x1b0]
mov qword [r11 - 0x20], rdi
mov rdi, qword [rsp + 0x1b8]
mov qword [r11 - 0x28], r13
lea r13d, [r8 - 0x8d]
mov qword [r11 - 0x30], r14
mov r8d, 8
mov r14, qword [rsp + 0x1b8]
mov qword [r11 - 0x38], r15
mov r15, qword [rsp + 0x1b8]
mov qword [rsp + 0x40], r8
nop dword [rax + rax]
cmp r13d, 8
ja case.0x18001a565.1
mov ecx, dword [r9 + r13*4 + 0x1a744]
add rcx, r9
jmp rcx
cmp qword [r12 + 0x18], 0x10
lea rdi, [rsp + 0x50]
mov r15, r12
jb case.0x18001a565.1
mov r15, qword [r12]
jmp case.0x18001a565.1
movzx eax, byte [r12 + 0xc]
cmp al, 1
jne case.0x18001a565.1
mov byte [r12 + 0xc], 2
jmp case.0x18001a565.1
mov r9d, dword [rsp + 0x1b8]
mov r8d, dword [rsp + 0x1b0]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov byte [rsp + 0x150], bl
call sub.IMM32.dll_ImmNotifyIME
mov r8, qword [rsp + 0x40]
lea r9, [0x180000000]
mov rdx, qword [rsp + 0x1a0]
jmp case.0x18001a565.1
movzx esi, byte [rsp + 0x151]
mov dword [rsp + 0x1b0], 4
jmp case.0x18001a565.1
mov dword [rsp + 0x1b8], 0
cmp r14, qword [r12 + 0x10]
jae case.0x18001a565.1
nop dword [rax]
mov eax, 0x32
cmp eax, 0x32
je 0x18001a65a
cmp eax, 0xf6
je 0x18001a64a
cmp eax, 0x1ba
jne 0x18001a666
movzx ecx, sil
mov byte [rcx + rdi], bpl
movzx ecx, bl
movzx edx, byte [rcx + rdi]
add dl, bpl
movzx ecx, dl
movzx edx, byte [rcx + rdi]
xor byte [r14 + r15], dl
inc r14
jmp 0x18001a666
movzx ecx, sil
movzx edx, bl
movzx ecx, byte [rcx + rdi]
mov byte [rdx + rdi], cl
jmp 0x18001a666
inc bl
movzx ecx, bl
movzx ebp, byte [rcx + rdi]
add sil, bpl
add eax, 0xc4
cmp eax, 0x27e
jb 0x18001a615
cmp r14, qword [r12 + 0x10]
jb 0x18001a610
mov rdx, qword [rsp + 0x1a0]
jmp case.0x18001a565.1
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
mov dword [rsp + 0x30], 0x13
jb 0x18001a698
mov r8, qword [rdx]
mov eax, dword [rdx + 0x10]
mov r9d, 0x21
mov dword [rsp + 0x38], eax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180034f50
mov r8, qword [rsp + 0x40]
lea r9, [0x180000000]
mov rdx, qword [rsp + 0x1a0]
movzx ebx, byte [rsp + 0x150]
jmp case.0x18001a565.1
mov qword [rsp + 0x48], 0
xor r14d, r14d
jmp case.0x18001a565.1
mov byte [rsp + 0x151], sil
dec r13d
sub r8, 1
mov qword [rsp + 0x40], r8
jne 0x18001a550
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov r13, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop r12
ret
Function at 0x18001dab0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
lea r12d, [rdx + 0x6f6]
mov rsi, r8
mov edi, edx
mov r14, rcx
cmp edx, r12d
jae 0x18001dbee
mov r15, qword [rsp + 0x78]
xor ebx, ebx
nop word [rax + rax]
cmp edi, 0x176
ja 0x18001dbc6
je 0x18001dbbd
mov eax, edi
sub eax, 0x11
je 0x18001db99
sub eax, 0x9f
je 0x18001db8d
sub eax, 0x27
je 0x18001db7c
cmp eax, 0xe
jne 0x18001dc39
mov rbp, qword [rsi]
lea rdx, str.RealTimeMode
mov rcx, rbp
call fcn.18009a090
test eax, eax
jne 0x18001db40
mov qword [r14], rsi
jmp 0x18001dc39
lea rdx, str.indent_size
mov rcx, rbp
call fcn.18009a090
test eax, eax
jne 0x18001db5c
mov qword [r14 + 8], rsi
jmp 0x18001dc39
lea rdx, str.tab_width
mov rcx, rbp
call fcn.18009a090
test eax, eax
jne 0x18001dc39
mov qword [r14 + 0x10], rsi
jmp 0x18001dc39
cmp word [r15 + 8], 5
je 0x18001dc39
mov rax, rbx
jmp 0x18001dbf3
mov qword [0x1800dc588], rsi
jmp 0x18001dc39
mov eax, dword [r14]
lea rcx, [rsp + 0x68]
mov r8d, 0x78
mov dword [rsp + 0x68], eax
mov rdx, rsi
call fcn.18004a4b0
mov r15, rax
test rax, rax
je 0x18001db88
jmp 0x18001dc39
mov qword [rsi + 0x80], r14
jmp 0x18001dc39
mov eax, edi
sub eax, 0x19d
je 0x18001dc30
sub eax, 0x9f
je 0x18001dc0a
sub eax, 0x27
je 0x18001dbee
cmp eax, 0x9f
jne 0x18001dc39
cmp qword [0x1800dc590], rbx
setne byte [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], rbx
lea r8, [0x18001de80]
mov r9, rsi
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800dc590], rax
jmp 0x18001dc39
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x78], rax
add edi, 0xc6
cmp edi, r12d
jb 0x18001daf0
jmp 0x18001dbee
Function at 0x1800487f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180048824
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180048810
ret
Function at 0x180069ac0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x68]
lea r12d, [rdx + rdx*2]
shl r12d, 6
mov r14d, edx
mov r15, rcx
mov ebp, edx
cmp edx, r12d
ja 0x180069b50
mov rsi, qword [rsp + 0x70]
xor r13d, r13d
mov r9d, dword [0x1800dce6c]
mov ecx, dword [0x1800de1f0]
mov r8d, dword [0x1800db108]
nop dword [rax]
cmp ebp, 0x14e2
ja 0x180069b7f
je 0x180069b6c
mov eax, ebp
sub eax, 0x2f
je 0x180069b67
sub eax, 0x73
je 0x180069b33
cmp eax, 0x56d
je 0x180069bc7
jmp 0x180069b43
mov dword [0x1800de1ec], r13d
mov ecx, r13d
mov dword [0x1800de1f0], ecx
mov eax, r14d
shl eax, 5
add ebp, eax
cmp ebp, r12d
jbe 0x180069b10
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [r15]
jmp 0x180069b43
mov eax, dword [r15]
cmp dword [0x1800de1f4], eax
je 0x180069b43
mov dword [0x1800de1f4], eax
jmp 0x180069b3a
cmp ebp, 0x2922
je 0x180069c48
cmp ebp, 0x3d62
jne 0x180069b43
mov eax, 0xea
cmp eax, 0xea
je 0x180069bb4
cmp eax, 0x38ac
je 0x180069baf
cmp eax, 0x706e
je 0x180069b50
jmp 0x180069bbb
mov ebx, r8d
jmp 0x180069bbb
mov dword [0x1800de1ec], r9d
add eax, 0x37c2
cmp eax, 0xa746
jbe 0x180069b98
cmp qword [rsi], r13
je 0x180069b43
mov edi, 0x44
mov eax, edi
sub eax, 0x44
je 0x180069c12
sub eax, 0x1f
je 0x180069c05
sub eax, 0x1f
je 0x180069bfa
cmp eax, 0x1f
jne 0x180069c24
mov rcx, qword [0x1800dcaa8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x180069c24
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180069c24
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x180069c24
mov rcx, qword [0x1800dcaa8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add edi, 0x1f
cmp edi, 0xc0
jb 0x180069bd5
mov r9d, dword [0x1800dce6c]
mov ecx, dword [0x1800de1f0]
mov r8d, dword [0x1800db108]
jmp 0x180069b43
cmp dword [0x1800de1ec], r9d
jne 0x180069b3a
mov eax, dword [0x1800dce84]
xor edx, edx
div dword [r15]
inc ecx
inc eax
mov dword [0x1800de1f0], ecx
cmp ecx, eax
jbe 0x180069b43
mov r8d, r13d
mov dword [0x1800db108], r13d
jmp 0x180069b43