joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800389a0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x18016d968], ebp
je 0x1800389f7
cmp rbx, 0x20
jae 0x1800389e0
xor ecx, ecx
jmp 0x1800389e2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18016d968], ebp
jne 0x1800389d6
cmp qword [0x18016d970], r15
je 0x180038af1
test rdi, rdi
jne 0x180038a17
mov ecx, esi
call fcn.180038510
mov ebp, eax
jmp 0x180038af6
mov ecx, dword [0x18016ee6c]
mov ebx, r15d
test ecx, ecx
je 0x180038a3f
mov r8, qword [0x18016ee60]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180038a49
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180038a30
mov ebp, 4
jmp 0x180038af6
cmp ebx, 0xffffffff
je 0x180038a3f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x180038ae8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180038230
mov edx, esi
mov ecx, ebx
call fcn.1800383e0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180038af6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180038ad2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180038ac8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180038aa0
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18016d970]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180038af6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180038af6
mov ebp, 2
xchg dword [0x18016d968], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18003f300
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x18003f336
cmp edx, 1
jne 0x18003f364
xor eax, eax
lea r8, [0x18003f290]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
cmp dword [0x18016da78], 0
je 0x18003f364
xor edx, edx
xor ecx, ecx
call fcn.1800389a0
mov rcx, qword [0x18016da70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x18016da70], rax
mov dword [0x18016da78], eax
mov eax, 1
add rsp, 0x38
ret

Function at 0x18003fe90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, dword [0x18016da90]
lea r11, [0x18016da90]
mov r9d, 0x270
cmp r8d, r9d
jne 0x18003fef5
lea r8, [0x18016da98]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18003feb0
mov r8d, dword [0x18016da90]
jmp 0x18003ffcf
cmp r8d, 0x4e0
jb 0x18003ffcf
xor r8d, r8d
mov r9d, 0x38c
mov r10d, r8d
nop
mov eax, dword [r10 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r10 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + r11 + 0xff8]
xor ecx, edx
mov dword [r10 + r11 + 4], ecx
add r10, 4
cmp r10, r9
jb 0x18003ff10
mov eax, dword [r9 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r9 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + r11 - 0x388]
xor ecx, edx
mov dword [r9 + r11 + 4], ecx
add r9, 4
cmp r9, 0x9bc
jb 0x18003ff50
mov edx, dword [0x18016da94]
xor edx, dword [0x18016ee10]
btr edx, 0x1f
mov dword [0x18016da90], r8d
xor edx, dword [0x18016ee10]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [0x18016e0c4]
mov dword [0x18016e450], ecx
mov eax, r8d
inc r8d
mov ecx, dword [r11 + rax*4 + 4]
mov eax, ecx
shr eax, 0xb
and eax, dword [0x18016ee14]
xor ecx, eax
mov dword [0x18016da90], r8d
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x18000d150
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
imul r15d, r8d, 0x1d4
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov ebx, r8d
cmp r8d, r15d
ja 0x18000d234
mov r12, qword [rsp + 0x98]
lea r13, [0x180000000]
mov rbp, qword [rsp + 0x98]
movabs rdx, 0x4000000017ffbff9
nop dword [rax]
mov eax, ebx
sub eax, 0xb8
je 0x18000d399
sub eax, 0x4e
je 0x18000d20c
sub eax, 0x53ca
je 0x18000d1d9
cmp eax, 0x5418
jne 0x18000d3d3
mov rax, r12
jmp 0x18000d23c
movsxd rcx, dword [rsp + 0x34]
call fcn.18003b520
movsxd rdx, dword [rsp + 0x34]
mov r9, rbp
mov r8d, 1
mov rcx, rax
mov r12, rax
call fcn.18003adc8
mov rcx, rbp
mov qword [rdi], rax
call fcn.1800368d0
jmp 0x18000d3c9
mov ecx, 1
mov eax, ecx
sub eax, 1
je 0x18000d274
sub eax, 5
je case.default.0x18000d28f
sub eax, 5
je 0x18000d26a
sub eax, 5
je 0x18000d25a
cmp eax, 5
jne 0x18000d38b
mov rax, qword [rsp + 0x98]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rsp + 0x98], 1
jmp 0x18000d38b
mov ebx, 0x106
jmp 0x18000d38b
mov eax, dword [rsi]
add eax, 0xfffffffe
cmp eax, 8
ja case.default.0x18000d28f
cdqe
mov ecx, dword [r13 + rax*4 + 0xd430]
add rcx, r13
jmp rcx
movzx ecx, byte [rdi]
cmp cl, 0x40
je 0x18000d3e7
movzx eax, cl
or al, 0x20
sub al, 0x61
cmp al, 0x19
jbe 0x18000d2c2
lea eax, [rcx - 0x21]
cmp al, 0x3e
ja 0x18000d2b9
movsx rax, al
bt rdx, rax
jb 0x18000d2c2
cmp cl, 0x7e
jne case.default.0x18000d28f
mov dword [rsp + 0x98], 3
jmp 0x18000d234
movzx ecx, byte [rdi]
cmp cl, 0x5b
je 0x18000d3f7
movzx eax, cl
or al, 0x20
sub al, 0x61
cmp al, 0x19
jbe 0x18000d304
cmp cl, 0x2f
je case.default.0x18000d28f
cmp cl, 0x2c
jle case.default.0x18000d28f
cmp cl, 0x3a
jge case.default.0x18000d28f
mov dword [rsp + 0x98], 6
jmp 0x18000d234
movzx ecx, byte [rdi]
movzx eax, cl
or al, 0x20
sub al, 0x61
cmp al, 0x19
jbe 0x18000d304
cmp cl, 0x2f
je case.0x18000d28f.8
cmp cl, 0x2c
jle case.0x18000d28f.8
cmp cl, 0x3a
jl 0x18000d304
cmp byte [rdi], 0x3a
jne case.default.0x18000d28f
mov dword [rsp + 0x98], 9
jmp 0x18000d234
cmp byte [rdi], 0x5d
je 0x18000d407
movzx ecx, byte [rdi]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x18000d369
movzx eax, cl
or al, 0x20
sub al, 0x61
cmp al, 5
jbe 0x18000d369
cmp cl, 0x3a
jne case.default.0x18000d28f
mov dword [rsp + 0x98], 7
jmp 0x18000d234
movzx eax, byte [rdi]
sub al, 0x30
cmp al, 9
jbe 0x18000d417
mov ecx, 6
add ecx, 5
cmp ecx, 0x19
jbe 0x18000d211
jmp 0x18000d3d3
lea rdx, [0x180064798]
mov rcx, rsi
call fcn.1800363f4
mov rbp, rax
test rax, rax
je 0x18000d427
mov rcx, rax
call fcn.180040090
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.18003b42c
cmp eax, 0xffffffff
je 0x18000d427
movabs rdx, 0x4000000017ffbff9
imul eax, r14d, 0x75
add ebx, eax
cmp ebx, r15d
jbe 0x18000d1b0
jmp 0x18000d234
mov dword [rsp + 0x98], 4
jmp 0x18000d234
mov dword [rsp + 0x98], 5
jmp 0x18000d234
mov dword [rsp + 0x98], 8
jmp 0x18000d234
mov dword [rsp + 0x98], 0xa
jmp 0x18000d234
xor eax, eax
jmp 0x18000d23c
Function at 0x18000f4f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx ebx, byte [rsp + 0x70]
lea r15d, [rcx + 0x2be]
mov rsi, r8
mov r12, rdx
mov edi, ecx
cmp ecx, r15d
jae 0x18000f591
mov r14, qword [rsp + 0x88]
xor r13d, r13d
mov rbp, qword [rsp + 0x88]
cmp edi, 0x1a9
ja 0x18000f5f2
je 0x18000f5e9
mov eax, edi
sub eax, 0x10d
je 0x18000f5c2
sub eax, 0x17
je 0x18000f5a9
sub eax, 0x37
je 0x18000f584
cmp eax, 0x17
jne 0x18000f663
mov qword [rsp + 0x28], r13
lea r8, [0x180019590]
mov r9, r14
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
jmp 0x18000f663
cmp qword [0x1800707a0], r13
jne 0x18000f663
movzx eax, bl
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x10
call fcn.180031f30
mov r14, rax
mov qword [rax + 8], r12
mov qword [rax], rsi
jmp 0x18000f663
mov rcx, qword [0x1800707b0]
xor edx, edx
mov r8d, 0xe1
call fcn.18001b7b0
mov rcx, qword [0x1800707b0]
mov edx, 0x6e
call fcn.180004d20
jmp 0x18000f663
mov rbp, qword [0x1800707a0]
jmp 0x18000f663
mov eax, edi
sub eax, 0x1c0
je 0x18000f62c
sub eax, 0x37
je 0x18000f615
sub eax, 0x17
je 0x18000f591
cmp eax, 0x37
jne 0x18000f663
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000f663
mov edx, 0xffffffff
mov qword [0x1800707a0], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x18000f663
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000f674
mov eax, dword [rsi + 8]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x88], rcx
xor r8d, r8d
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
mov edx, 0x125
call fcn.18001cb00
mov byte [rsi + 0xc], 1
mov bl, 1
add edi, 0x4e
cmp edi, r15d
jb 0x18000f530
jmp 0x18000f591
mov edx, 0x10
mov rcx, r14
call fcn.180031f28
xor al, al
jmp 0x18000f594
Function at 0x180012fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
imul eax, ecx, 0x163
mov r15, r8
mov r14, rdx
mov r13d, ecx
mov r12d, ecx
mov dword [rsp + 0x188], eax
cmp ecx, eax
ja 0x180013127
mov rbp, qword [rsp + 0x188]
movzx edi, byte [rsp + 0x170]
mov rbx, qword [rsp + 0x188]
movzx r8d, byte [rsp + 0x170]
movzx esi, byte [rsp + 0x170]
mov eax, r12d
sub eax, 0xc5
je 0x18001314a
sub eax, 0x55
je 0x180013110
sub eax, 0x4e36
je 0x1800130d6
sub eax, 0x4e36
je 0x1800130c7
cmp eax, 0x4e36
jne 0x180013112
cmp qword [r14 + 0x18], 0x10
mov r9, r14
jb 0x180013046
mov r9, qword [r14]
cmp rbp, qword [r14 + 0x10]
jae 0x1800130b5
nop dword [rax]
mov edx, 0x69
mov eax, edx
sub eax, 0x67
je 0x180013087
sub eax, 1
je 0x180013076
cmp eax, 1
jne 0x1800130a8
inc r8b
movzx eax, r8b
movzx esi, byte [rax + rbx]
add dil, sil
jmp 0x1800130a8
movzx eax, dil
movzx ecx, r8b
movzx eax, byte [rax + rbx]
mov byte [rcx + rbx], al
jmp 0x1800130a8
movzx eax, dil
mov byte [rax + rbx], sil
movzx eax, r8b
movzx ecx, byte [rax + rbx]
add cl, sil
movzx eax, cl
movzx ecx, byte [rax + rbx]
xor byte [r9 + rbp], cl
inc rbp
dec edx
cmp edx, 0x66
ja 0x180013055
cmp rbp, qword [r14 + 0x10]
jb 0x180013050
mov byte [rsp + 0x120], r8b
mov byte [rsp + 0x121], dil
jmp 0x180013112
movzx edi, byte [rsp + 0x121]
lea rbx, [rsp + 0x20]
jmp 0x180013112
cmp qword [r15 + 0x18], 0x10
mov r9, r15
jb 0x1800130e3
mov r9, qword [r15]
mov eax, dword [r15 + 0x10]
lea r8, [rsp + 0x170]
mov edx, 0xb2
mov dword [rsp + 0x170], eax
lea rcx, [rsp + 0x20]
call fcn.18001c710
movzx r8d, byte [rsp + 0x120]
jmp 0x180013112
xor ebp, ebp
imul eax, r13d, 0x47
add r12d, eax
cmp r12d, dword [rsp + 0x188]
jbe 0x180013001
movzx eax, byte [rsp + 0x170]
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [r14 + 0x16]
add al, 0x80
test al, 0xdf
sete al
jmp 0x18001312f
Function at 0x180013310
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 8], ecx
push rsi
sub rsp, 0x20
movzx eax, byte [rsp + 0x30]
mov rsi, rdx
mov edx, 0xcf
nop word [rax + rax]
mov ecx, edx
sub ecx, 0xcb
je 0x18001340f
sub ecx, 1
je 0x180013374
cmp ecx, 3
jne 0x18001337b
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov ebx, 0xb8
cmp ebx, 0xb8
je 0x18001338b
cmp ebx, 0x6108
jne 0x1800133da
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800133da
cmp byte [rsi + 0x16], 0xfb
sete al
dec edx
cmp edx, 0xcc
ja 0x180013330
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi + 0x18]
lea rdx, [rsi + 0x60]
call qword [rsi + 0x10]
test al, al
je 0x180013403
cmp qword [rsi + 0x78], 0x10
lea rdx, [rsi + 0x60]
jb 0x1800133a9
mov rdx, qword [rsi + 0x60]
movzx eax, word [rsi + 0x80]
lea r9, [rsp + 0x30]
mov r8, qword [0x1800707b0]
mov ecx, 0x5b
mov word [rsp + 0x30], ax
call fcn.1800199b0
test al, al
jne 0x1800133f1
mov rcx, qword [rsi + 0x38]
lea rdx, [rsi + 0x60]
call qword [rsi + 0x30]
add ebx, 0x6050
cmp ebx, 0xc0a0
jbe 0x180013357
jmp 0x180013352
mov rbx, qword [rsp + 0x38]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor al, al
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret

Function at 0x180014280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x10c
xor ebp, ebp
mov r8d, ebx
sub r8d, 0x108
je 0x180014304
sub r8d, 1
je 0x180014333
sub r8d, 3
je 0x1800142c3
cmp r8d, 1
je 0x180014333
jmp 0x180014325
mov qword [rsp + 0x28], rbp
lea r8, [0x180014340]
mov r9, rdi
mov dword [rsp + 0x20], ebp
xor edx, edx
mov qword [0x1800707b0], rdi
xor ecx, ecx
mov qword [rdi + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x1800707a0], rax
setne byte [rsp + 0x68]
mov rax, qword [rsp + 0x68]
jmp 0x180014325
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], 6
xor r8d, r8d
mov edx, 0xe0
xor ecx, ecx
call fcn.18000b230
mov qword [rsp + 0x68], rax
inc ebx
cmp ebx, 0x110
jb 0x1800142a3
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180019fc0
Capabilities:
Read file on windows

Disassembly:
mov rax, rdx
mov r8d, 0xb8
mov rdx, rcx
mov rcx, rax
jmp fcn.18000d150

Function at 0x18001c710
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push r12
push r15
sub rsp, 0x58
lea eax, [rdx + 9]
mov r12, r8
mov dword [rsp + 0x78], eax
mov r15, r9
mov r8, rcx
cmp edx, eax
jae 0x18001c8f4
mov r9d, dword [rsp + 0x78]
mov r10d, 0x100
mov qword [r11 + 0x18], rbx
mov ecx, eax
movzx ebx, word [rsp + 0x78]
mov qword [r11 - 0x18], rbp
movzx ebp, byte [rsp + 0x78]
mov qword [r11 - 0x20], rsi
mov rsi, qword [rsp + 0x20]
mov qword [r11 - 0x28], rdi
movzx edi, byte [rsp + 0x78]
mov qword [r11 - 0x30], r13
lea r13d, [rdx - 0xa9]
mov qword [r11 - 0x38], r14
lea rdx, [0x180000000]
movzx r14d, byte [rsp + 0x78]
xor r11d, r11d
nop word [rax + rax]
cmp r13d, 0xf
ja case.default.0x18001c7a5
mov ecx, dword [rdx + r13*4 + 0x1c900]
add rcx, rdx
jmp rcx
mov ebx, r11d
mov rax, rsi
nop dword [rax]
mov byte [rax], bl
lea rax, [rax + 1]
inc bx
cmp bx, r10w
jb 0x18001c7b0
jmp case.0x18001c7a5.2
mov byte [r8 + 0x100], 0
jmp case.0x18001c7a5.2
mov r8, qword [r15 + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsp + 0x70]
lea rdx, [0x180000000]
mov r9d, eax
mov r10d, 0x100
xor r11d, r11d
jmp case.0x18001c7a5.2
cmp bx, r10w
jae case.0x18001c7a5.2
nop
mov ecx, 0x10e
cmp ecx, 0x10e
je 0x18001c84a
cmp ecx, 0x7c74
je 0x18001c840
cmp ecx, 0xf7da
jne 0x18001c86e
movzx eax, r14b
inc eax
cdq
idiv dword [r12]
inc bx
mov r14d, edx
jmp 0x18001c86e
movzx eax, dil
mov byte [rax + rsi], bpl
jmp 0x18001c86e
movzx r8d, bx
movzx eax, r14b
movzx ebp, byte [r8 + rsi]
movzx edx, byte [rax + r15]
add dl, bpl
add dil, dl
movzx eax, dil
movzx edx, byte [rax + rsi]
mov byte [r8 + rsi], dl
add ecx, 0x7b66
cmp ecx, 0x17232
jbe 0x18001c815
cmp bx, r10w
jb 0x18001c810
mov r8, qword [rsp + 0x70]
lea rdx, [0x180000000]
jmp case.0x18001c7a5.2
xor r14b, r14b
jmp case.0x18001c7a5.2
xor dil, dil
movzx ebx, r11w
jmp case.0x18001c7a5.2
cmp r9d, 0xb7
jne case.0x18001c7a5.2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [r8 + 0x101], 0
jmp case.0x18001c7a5.2
mov rsi, r8
mov ecx, dword [rsp + 0x78]
inc r13d
lea eax, [r13 + 0xa9]
cmp eax, ecx
jb 0x18001c790
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x30]
add rsp, 0x58
pop r15
pop r12
ret
Function at 0x180029b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180029b44
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180029b30
ret
Function at 0x1800360a4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x180035ec4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180035ec4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180035ec4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180035ec4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180035ec4
cmp dword [rcx + 0x84], 0xe
jbe 0x180035ec4
cmp dword [rcx + 0xf8], esi
je 0x180035ec4
mov ecx, r14d
call fcn.18003600c
mov ecx, 2
call fcn.18003bbd8
nop
cmp byte [0x18006fc88], 0
jne 0x180035f8e
mov r15d, 1
mov eax, r15d
xchg dword [0x18006fc78], eax
test ebx, ebx
jne 0x180035f37
mov rdi, qword [0x18006e028]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x18006fc80]
cmp rcx, rax
je 0x180035f2e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x180053508]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x18006fff8]
jmp 0x180035f43
cmp ebx, r15d
jne 0x180035f49
lea rcx, [0x180070010]
call fcn.18003fd4c
nop
test ebx, ebx
jne 0x180035f60
lea rdx, [0x1800535c8]
lea rcx, [0x1800535a8]
call fcn.18003ffa4
lea rdx, [0x1800535d8]
lea rcx, [0x1800535d0]
call fcn.18003ffa4
movzx eax, byte [0x18006fc88]
test esi, esi
cmove eax, r15d
mov byte [0x18006fc88], al
jmp 0x180035f8e
mov ecx, 2
call fcn.18003bc2c
test esi, esi
jne 0x180035fa5
mov ecx, r14d
call fcn.180035fc0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x180035e54
Function at 0x1800467e8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180046688
call fcn.18003a36c
mov dword [rax], 0x16
call fcn.1800367b4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180046670
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180046670
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1800466ba
lock or dword [rax + 0x14], 0x10
jmp 0x180046670
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1800466d7
mov rcx, qword [rbp + 0x10]
call fcn.18004ae54
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180040090
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800460c0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x18004672e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180046670
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x18004679a
mov rcx, qword [rbp + 0x10]
call fcn.180040090
cmp eax, 0xffffffff
je 0x180046781
mov rcx, qword [rbp + 0x10]
call fcn.180040090
cmp eax, 0xfffffffe
je 0x180046781
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180040090
movsxd rdi, eax
lea rsi, [0x180070200]
mov rcx, rbx
sar rdi, 6
call fcn.180040090
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180046788
lea rax, [0x18006e250]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18004679a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1800467d0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1800467cc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1800467cc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180046673
jmp 0x180046640
Function at 0x408e72
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.00408eb9
mov ecx, eax
add rsp, 0x28
jmp sub.KERNEL32.dll_TlsGetValue

Function at 0x408e86
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.00408eb9
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue

Function at 0x408eb9
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, dword [rcx + 0x18]
test edi, edi
je 0x408ed3
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, rcx
cmp qword [rcx], 0
je 0x408f43
lea r8, [rsp + 0x2c]
and dword [r8], 0
lea rbx, [rsi + 0x10]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x408f8a
cmp dword [rsp + 0x2c], 0
je 0x408f72
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x408f7a
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x004100b0]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x004100b0], rsi
jne 0x408f1e
mov byte [0x004100a8], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x408ec9
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x408f8a
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x408ec9
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x408ec9
mov edi, dword [rsi + 0x18]
jmp 0x408ec7
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2