joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046400
Capabilities:
Encrypt data using curve25519
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x970]
sub rsp, 0xa70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14012e190]
xor rax, rsp
mov qword [rbp + 0x960], rax
mov rbx, r9
mov r12d, r8d
mov r15, rdx
mov r14, rcx
mov esi, 0x130
mov rax, qword gs:[0x58]
add rsi, qword [rax]
mov r8d, 0x20
lea rdx, [rbp + 0x920]
mov rcx, rsi
call fcn.140055b40
and byte [rbp + 0x920], 0xf8
movzx eax, byte [rbp + 0x93f]
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x93f], al
lea rdx, [rbp + 0x920]
lea rcx, [r15 + 0x1c]
call fcn.14005dc40
mov r8, rbx
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x940]
call fcn.14005dbe0
movups xmm1, xmmword [0x14010d1e0]
movaps xmmword [rbp + 0x1a0], xmm1
movups xmm0, xmmword [0x14010d1f0]
movaps xmmword [rbp + 0x1b0], xmm0
movaps xmmword [rbp + 0x1c0], xmm1
movaps xmmword [rbp + 0x1d0], xmm0
xor eax, eax
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x220], rax
mov word [rbp + 0x228], ax
mov byte [rbp + 0x22a], al
mov byte [rbp + 0x230], al
lea rdx, [rbp + 0x940]
lea rcx, [rbp + 0x1a0]
call fcn.140006c50
mov rdx, rbx
lea rcx, [rbp + 0x1a0]
call fcn.140006c50
lea rdx, [r15 + 0x1c]
lea rcx, [rbp + 0x1a0]
call fcn.140006c50
lea r8, [rbp + 0x940]
lea rcx, [rbp + 0x1a0]
call fcn.140008310
lea rdi, [rbp + 0x920]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rdi, [r15 + 0x10]
lea r8d, [rax + 0xc]
mov rdx, rdi
mov rcx, rsi
call fcn.140055b40
xor edx, edx
mov r8d, 0x248
lea rcx, [rsp + 0x58]
call fcn.14009e3e0
lea rcx, [rsp + 0x58]
call fcn.1400466b0
nop
mov qword [rsp + 0x20], 0xc
mov r9, rdi
mov r8d, 0x20
lea rdx, [rbp + 0x940]
lea rcx, [rsp + 0x58]
call fcn.140056700
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r14
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 0x10]
mov r8, r15
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140062300
lea rdi, [rbp + 0x940]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, vtable.CryptoPP::ChaCha20Poly1305_Final_1_.0
mov qword [rsp + 0x58], rax
lea rax, vtable.CryptoPP::ChaCha20Poly1305_Final_1_.1.0
mov qword [rsp + 0x60], rax
lea rax, vtable.CryptoPP::ChaCha20Poly1305_Final_1_.2.0
mov qword [rsp + 0x68], rax
lea rcx, [rbp + 0xa8]
call fcn.140046110
lea rax, [0x14010e858]
mov qword [rbp - 0x30], rax
lea rax, [0x14010e748]
mov qword [rbp - 0x28], rax
lea rax, [0x14010e4c8]
mov qword [rbp - 0x20], rax
lea rax, [0x14010e5d0]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x30]
call fcn.140046c60
lea rcx, [rsp + 0x58]
call fcn.140046230
mov eax, r12d
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.140079ca0
add rsp, 0xa70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140058de0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x14012e190]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140058e83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140058e83
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140058ea7
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140079ca0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.140023d60
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140058f20
lea rdx, [0x14012b270]
lea rcx, [rsp + 0x60]
call fcn.14009de88
int3

Function at 0x140059530
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x14012e190]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14013e650]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14013cdd8], ecx
jg 0x14005961c
mov eax, ebx
cmp rbx, rax
jne 0x1400595de
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x1400595de
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x14013cdd0]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14005965f
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140079ca0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x28]
call fcn.140023d60
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140058f20
lea rdx, [0x14012b270]
lea rcx, [rsp + 0x50]
call fcn.14009de88
nop
lea rcx, [0x14013cdd8]
call fcn.140079edc
cmp dword [0x14013cdd8], 0xffffffff
jne 0x140059589
lea rcx, [0x14013cdd0]
call fcn.140058de0
lea rcx, [0x1400e8250]
call fcn.14007a2e4
nop
lea rcx, [0x14013cdd8]
call fcn.140079e7c
jmp 0x140059589
lea rdx, [0x1400eb150]
lea rcx, [rsp + 0x28]
call fcn.140023d60
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140058f20
lea rdx, [0x14012b270]
lea rcx, [rsp + 0x50]
call fcn.14009de88
int3
Function at 0x14006ad00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x14006ad47
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x14006ad30
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x14006ae57
cmp r8, 8
jb 0x14006ae24
mov rdx, r8
mov rcx, r9
and rdx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rcx, r11
xorps xmm3, xmm3
mov r10, r11
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
xorps xmm0, xmm0
movd xmm1, dword [r10]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 4]
punpcklbw xmm1, xmm0
por xmm2, xmm4
punpcklwd xmm1, xmm0
movdqa xmm4, xmm2
movd xmm2, dword [rcx + r10 - 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
pxor xmm2, xmm1
por xmm2, xmm3
movdqa xmm3, xmm2
cmp rbx, rdx
jb 0x14006ada0
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x14006ae57
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x14006ae40
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x14006ae70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14006afb4
cmp r9, 4
jb 0x14006aeba
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14006aea0
xor r11d, r11d
test r9, r9
je 0x14006afb4
cmp r9, 0x40
jb 0x14006af88
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14006aeec
cmp rdx, r8
jae 0x14006af88
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14006af01
cmp rdx, r10
jae 0x14006af88
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
mov rbx, rcx
sub rdx, r8
mov rax, r8
sub rbx, r8
movdqu xmm0, xmmword [rax]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax]
movdqu xmm2, xmmword [rdx + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmmword [rbx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jb 0x14006af20
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14006afb4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14006afa0
add rsp, 8
ret
Function at 0x1400ace1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400acb80
Function at 0x1400c9c94
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400c9ca7
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400d3b98
lea rdx, [0x14012b8a8]
lea rcx, [rsp + 0x20]
call fcn.14009de88
int3

Function at 0x1400d4530
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14013fed0]
xor edx, edx
jmp fcn.1400c9c94

Function at 0x1400d4ec8
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14013fed0]
jmp fcn.1400c9c94

Function at 0x1400e0a84
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400e0b40]
mov r9, qword [r9 + 8]
jmp fcn.1400d1cf4

Function at 0x1400e0b18
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400e0b50]
mov r9, qword [r9 + 8]
jmp fcn.1400d1cf4
Function at 0x180001010
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 via systemfunction033
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x30], 0
lea rcx, str.systemkernel32.dll
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800011d7
mov qword [rsp + 0xa0], rsi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800011c1
mov edx, esi
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1800011c1
lea r9, [rbp + 0x18]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800011b0
cmp dword [rbp + 0x18], esi
jne 0x1800011b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SystemFunction033
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000119d
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x38], 0x646c6f74
mov qword [0x180054388], rcx
lea rdx, [0x180054380]
lea rcx, [0x180054390]
mov dword [rbp - 0x34], 0x72767064
mov dword [rbp - 0x30], 0x6b616f6c
mov dword [rbp - 0x2c], 0x6e707478
mov dword [rbp - 0x28], 0x6f777861
mov dword [rbp - 0x24], 0x726e7869
mov dword [rbp - 0x20], 0x6b666169
mov dword [rbp - 0x1c], 0x7576706c
mov byte [rbp - 0x18], 0
mov dword [0x180054380], 0x20
mov dword [0x180054384], 0x20
mov qword [0x180054398], rdi
mov dword [0x180054390], esi
mov dword [0x180054394], esi
call rax
mov edx, esi
mov dword [rbp + 0x20], 0
lea r9, [rbp + 0x20]
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000119d
call qword [0x180054398]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800011ca
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
add rsp, 0x78
pop rbx
pop rbp
ret

Function at 0x180004b70
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180004650
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180004baf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x18003d2b0]
jmp 0x180004bb9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1800218b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180002f50
lea rcx, [rsp + 0x40]
call fcn.180021870
movzx eax, al
test eax, eax
jne 0x1800218f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1800217a0
mov rax, qword [rsp + 0x70]
jmp 0x180021ac9
lea rcx, [rsp + 0x40]
call fcn.180002fd0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.180021820
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.180002fd0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180021670
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x18002199e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1800217a0
mov rax, qword [rsp + 0x80]
jmp 0x180021ac9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.18000d170
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180002f50
lea rcx, [rsp + 0x48]
call fcn.180002f90
movzx eax, al
test eax, eax
jne 0x180021a05
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.180002f70
lea rcx, [rsp + 0x40]
call fcn.1800217a0
mov rax, qword [rsp + 0x88]
jmp 0x180021ac9
lea rcx, [rsp + 0x48]
call fcn.180002fd0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.180002fd0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.180021670
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x180021a9b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.180002f70
lea rcx, [rsp + 0x40]
call fcn.1800217a0
mov rax, qword [rsp + 0xa0]
jmp 0x180021ac9
lea rcx, [rsp + 0x48]
call fcn.1800036d0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.180002f70
lea rcx, [rsp + 0x40]
call fcn.1800217a0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x180028fc0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180035ce0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.18003b1a0
sub rsp, rax
mov rax, qword [0x180052040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x180053890]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x180035ed2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x180035e26
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x180035e26
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x180035e0b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x180035da8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180035e92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180035ef1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x180035ecd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180035ef1
jmp 0x180035d7e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180002750
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180035f10
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.18003b1a0
sub rsp, rax
mov rax, qword [0x180052040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x180053890]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x18003611d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x180036069
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x180036069
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x180036049
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x180035fd8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800360dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x18003613c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x180036118
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x18003613c
jmp 0x180035fae
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180002750
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140001070
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, str.VirtualAlloc
mov qword [rsp + 0x38], rax
lea rcx, str.kernel32.dll
lea rax, str.VirtualProtect
mov qword [rsp + 0x40], rax
lea rax, str.QueueUserAPC
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
jne 0x1400010e7
lea rdx, str.kernel32.dll
lea rcx, str.Failed_to_load_the_library:__s_n
call fcn.140001010
jmp 0x140001249
xor edi, edi
xor ebx, ebx
nop dword [rax + rax]
mov rsi, qword [rsp + rbx + 0x38]
mov rcx, rbp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + rbx + 0x58], rax
test rax, rax
je 0x140001231
inc edi
add rbx, 8
cmp edi, 3
jl 0x1400010f0
lea rcx, str.Function_addresses_obtained_successfully_n
call fcn.140001010
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [0x1400012b0]
mov dword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140001179
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_failed_with_error:__d_n
call fcn.140001010
mov eax, 1
jmp 0x140001257
mov edx, 4
mov dword [rsp + 0x50], 0
mov r9d, edx
xor ecx, ecx
mov r8d, 0x3000
call qword [rsp + 0x58]
mov rbx, rax
test rax, rax
jne 0x1400011a6
lea rbx, str._t____VirtualAlloc_failed_with_error:__d_n
jmp 0x1400011e8
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x50]
mov edx, 4
mov dword [rbx], eax
mov r8d, 0x40
mov rcx, rbx
call qword [rsp + 0x60]
test eax, eax
jne 0x1400011d0
lea rbx, str._t____VirtualProtect_failed_with_error:__d_n
jmp 0x1400011e8
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [rsp + 0x68]
test eax, eax
jne 0x140001214
lea rbx, str._t____QueueUserAPC_failed_with_error:__d_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140001010
lea rcx, str.____APC_injection_failed_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001257
lea rcx, str.___APC_injection_succeeded_n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001255
mov rdx, rsi
lea rcx, str.Failed_to_find_the_function:__s_n
call fcn.140001010
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.Failed_to_get_function_addresses_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret