joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800fc800
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx + 0x28], 0xffffffffffffffff
cmp qword [rcx + 0x18], 0
je 0x1800fc96b
call fcn.1800f3960
test al, al
je 0x1800fc96b
lea rdx, [rbp + 0x17]
mov rcx, rbx
call fcn.1800f3170
nop
cmp qword [rdi + 0x18], 0
jne 0x1800fc863
xor eax, eax
jmp 0x1800fc871
lea rax, [rdi + 8]
cmp qword [rax + 0x18], 0x10
jb 0x1800fc871
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov dword [rbp - 0x59], WSACleanup
mov qword [rbp - 0x51], 0
mov dword [rbp - 0x55], 0x440
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 0x10
jb 0x1800fc8b4
mov rcx, qword [rcx]
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x39], rax
cmp qword [rsi + 0x18], 0
jne 0x1800fc8d3
lea rax, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rax, qword [rbp + 0x1f]
jmp 0x1800fc8e1
lea rax, [rsi + 8]
cmp qword [rax + 0x18], 0x10
jb 0x1800fc8e1
mov rax, qword [rax]
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x29], 1
lea rcx, [rbp - 0x59]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1800fc8fe
xor bl, bl
jmp 0x1800fc923
mov rax, qword [rbx + 0x30]
mov rdx, qword [rax + 0x50]
test rdx, rdx
je 0x1800fc917
mov rcx, qword [rbp + 0xf]
call rdx
mov eax, eax
mov qword [rbx + 0x28], rax
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rax, [0x1800567d8]
mov qword [rbp + 0x17], rax
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x1800fc966
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800fc960
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800fc98c
call fcn.1801e60f0
nop
movzx eax, bl
jmp 0x1800fc96d
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
call fcn.18010f960
nop
int3
Function at 0x1800fd8d0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
add rcx, 0x10
cmp qword [rcx + 0x18], 0x10
jb 0x1800fd8e2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x180102a90
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, dword [0x1802b2ac4]
mov rax, qword gs:[0x58]
mov edx, 0x26820
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1802b07b0], eax
jg 0x180102aeb
lea rax, [0x1802973d0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x1d8
ret
lea rcx, [0x1802b07b0]
call fcn.1801e65c0
cmp dword [0x1802b07b0], 0xffffffff
jne 0x180102acc
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x20]
call fcn.18020be10
mov ecx, 2
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x1802973d0], eax
lea rcx, [0x180230400]
call fcn.1801e6410
nop
lea rcx, [0x1802b07b0]
call fcn.1801e6560
jmp 0x180102acc

Function at 0x180102e30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r9
mov rbp, r8
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x180102f8d
test rdx, rdx
je 0x180102f8d
cmp r8, 0x10
jbe 0x180102f8d
test r9, r9
je 0x180102f8d
mov qword [rsp + 0x58], rdi
mov rdi, r8
and edi, 0xf
mov qword [rsp + 0x50], r12
mov r12d, reloc.WS2_32.dll_recv
cmove edi, r12d
cmp r8, 0x20
jbe 0x180102ecd
mov qword [rsp + 0x60], rbx
mov eax, r12d
mov rbx, r8
cmp rdi, rax
mov ecx, 0x20
cmove eax, ecx
and rbx, 0xfffffffffffffff0
sub rbx, rax
mov rcx, r14
mov r8, rbx
call qword [r14 + gethostname]
add r15, rbx
add rsi, rbx
mov rbx, qword [rsp + 0x60]
lea rdx, [r15 + 0x10]
mov r8, rdi
lea rcx, [rsp + 0x20]
call fcn.18020b760
lea r8, [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call qword [r14 + 0x28]
xor eax, eax
test rdi, rdi
je 0x180102f11
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0x20]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, rdi
jb 0x180102f00
lea rcx, [rsi + 0x10]
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18020b760
test rdi, rdi
je 0x180102f7e
sub r12, rdi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
add rdx, rdi
add rcx, rdi
mov r8, r12
call fcn.18020b760
lea r8, [rsp + 0x20]
mov rcx, r14
lea rdx, [rsp + 0x20]
call qword [r14 + 0x28]
mov ecx, dword [rsp + 0x20]
xor ecx, dword [r14 + 0x50]
mov dword [rsi], ecx
mov ecx, dword [rsp + 0x24]
xor ecx, dword [r14 + 0x54]
mov dword [rsi + 4], ecx
mov ecx, dword [rsp + 0x28]
xor ecx, dword [r14 + 0x58]
mov dword [rsi + 8], ecx
mov ecx, dword [rsp + 0x2c]
xor ecx, dword [r14 + 0x5c]
mov dword [rsi + 0xc], ecx
mov r12, qword [rsp + 0x50]
mov rax, rbp
mov rdi, qword [rsp + 0x58]
jmp 0x180102f8f
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x68
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x1801032c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov rsi, r9
and edi, 0xf
mov rbp, r8
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x1801033ed
cmp r8, 0x10
jbe 0x1801033ed
mov rax, r8
mov qword [rsp + 0x58], rbx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jbe 0x180103329
mov rbx, r8
and rbx, 0xfffffffffffffff0
sub rbx, 0x10
mov r8, rbx
call qword [rcx + 0x30]
add r15, rbx
add rsi, rbx
mov eax, dword [r14 + 0x50]
lea r8, [rsp + 0x20]
xor eax, dword [r15]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
mov rcx, r14
mov eax, dword [r15 + 4]
xor eax, dword [r14 + 0x54]
mov dword [rsp + 0x24], eax
mov eax, dword [r15 + 8]
xor eax, dword [r14 + 0x58]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0xc]
xor eax, dword [r14 + 0x5c]
mov dword [rsp + 0x2c], eax
call qword [r14 + 0x20]
test rdi, rdi
je 0x1801033d3
lea rdx, [r15 + 0x10]
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.18020b760
lea rcx, [rsi + 0x10]
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18020b760
xor eax, eax
test rdi, rdi
je 0x1801033b1
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x30]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, rdi
jb 0x1801033a0
lea r8, [r14 + 0x50]
mov rcx, r14
lea rdx, [rsp + 0x20]
call qword [r14 + 0x20]
movups xmm0, xmmword [r14 + 0x50]
mov rbx, qword [rsp + 0x58]
mov rax, rbp
movups xmmword [rsi], xmm0
jmp 0x1801033ef
movups xmm0, xmmword [rsi - 0x10]
mov rbx, qword [rsp + 0x58]
mov rax, rbp
movups xmm1, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
movups xmmword [rsi - 0x10], xmm1
jmp 0x1801033ef
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180103410
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x180103569
test rdx, rdx
je 0x180103569
test r9, r9
je 0x180103569
mov qword [rsp + 0x78], rsi
mov rsi, r8
shr rsi, 4
mov qword [rsp + 0x40], r15
test rsi, rsi
je 0x1801034ba
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rbp + 0x50]
call qword [rbp + 0x20]
mov eax, dword [rsp + 0x20]
xor eax, dword [rbx]
mov dword [rdi], eax
mov eax, dword [rsp + 0x24]
xor eax, dword [rbx + 4]
mov dword [rdi + 4], eax
mov eax, dword [rsp + 0x28]
xor eax, dword [rbx + 8]
mov dword [rdi + 8], eax
mov eax, dword [rsp + 0x2c]
xor eax, dword [rbx + 0xc]
add rbx, 0x10
mov dword [rdi + 0xc], eax
movups xmm0, xmmword [rdi]
add rdi, 0x10
movups xmmword [rbp + 0x50], xmm0
sub rsi, 1
jne 0x180103470
mov rsi, r14
and esi, 0xf
je 0x18010355a
lea r8, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rbp + 0x50]
call qword [rbp + 0x20]
xor edx, edx
test rsi, rsi
je 0x18010350a
lea rax, [rsp + 0x20]
mov r8, rdi
sub rbx, rax
lea rax, [rsp + 0x20]
sub r8, rax
nop
lea rcx, [rsp + 0x20]
add rcx, rdx
inc rdx
movzx eax, byte [rbx + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp rdx, rsi
jb 0x1801034f0
add rdi, rsi
cmp r14, 0x10
jae 0x180103552
mov ebx, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x50]
sub rbx, r14
lea rcx, [rbp + 0x50]
mov r8, rbx
add rdx, r14
call fcn.18020b760
sub rdi, r14
lea rcx, [rbp + 0x50]
add rcx, rbx
mov r8, r14
mov rdx, rdi
call fcn.18020b760
mov r15, qword [rsp + 0x40]
mov rax, r14
mov rsi, qword [rsp + 0x78]
jmp 0x18010356b
movups xmm0, xmmword [rdi - 0x10]
movups xmmword [rbp + 0x50], xmm0
mov r15, qword [rsp + 0x40]
mov rax, r14
mov rsi, qword [rsp + 0x78]
jmp 0x18010356b
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x48
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801038d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp], rax
xor eax, eax
xor edi, edi
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
mov qword [rsp + 0x48], rdi
mov rbx, rcx
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x6c], eax
mov byte [rsp + 0x70], al
mov qword [rbp - 0x5f], rax
mov dword [rbp - 0x57], eax
mov word [rbp - 0x53], ax
mov byte [rbp - 0x51], al
mov qword [rbp - 0x50], rdi
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x71], xmm0
movups xmmword [rbp - 0x7f], xmm0
movups xmmword [rbp - 0x6f], xmm0
test rcx, rcx
je 0x180103a58
lea rcx, [rsp + 0x40]
call fcn.180106860
lea r9d, [rdi + 1]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x18010398f
lea ecx, [rdi + 2]
call fcn.1801164f0
mov rdx, rax
lea rcx, [0x180059178]
call fcn.180117c90
jmp 0x1801039cb
mov rcx, qword [rsp + 0x30]
lea r8, [rbp - 0x40]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1801039be
lea ecx, [rax + 2]
call fcn.1801164f0
mov rdx, rax
lea rcx, [0x180059198]
call fcn.180117c90
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8d, 0x20
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.1801068b0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x180103a1d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x30]
mov qword [rbp - 0x40], rcx
lea rcx, [rsp + 0x38]
mov dword [rbp - 0x38], eax
call fcn.180115590
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x34], rax
mov r8d, 0x20
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.1801068b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.180106760
mov r8d, 0x20
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.180103a80
mov dword [rbx + 0x24], 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1801e67e0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1801053a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm2, xmmword [rcx]
movdqa xmm1, xmm2
movdqu xmmword [rdx], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x10], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x20], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x30], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x40], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x50], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0x60], xmm2
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x80], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x180106860
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 8
mov rdx, rcx
test rcx, rcx
je 0x1801068a2
movups xmm0, xmmword [0x1800592f0]
xor eax, eax
mov qword [rsp], rdi
lea rdi, [rcx + 0x30]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [0x180059300]
movups xmmword [rcx + 0x20], xmm1
mov ecx, 0x40
rep stosb byte [rdi], al
mov rdi, qword [rsp]
mov qword [rdx + 8], rax
mov qword [rdx], rax
mov qword [rdx + 0x70], rax
add rsp, 8
ret
Function at 0x18012af20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movzx eax, byte [rcx]
mov byte [rsp + 0x38], al
movdqu xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
mov rbp, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
cmp rbp, r15
je 0x18012afac
mov rbx, r15
sub rbx, rbp
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800afd60
mov rsi, qword [rsp + 0x40]
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.18020b760
sub rsi, rbp
add rsi, r15
mov qword [rsp + 0x48], rsi
jmp 0x18012afb1
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], 1
mov rdx, qword [rsp + 0x40]
mov eax, dword [r14 + 0x20]
not eax
add eax, eax
xor eax, dword [r14 + 0x20]
mov dword [rsp + 0x30], eax
sub rsi, rdx
je 0x18012aff6
nop word [rax + rax]
mov rax, rdi
and eax, 3
movzx eax, byte [rsp + rax + 0x30]
xor byte [rdx + rdi], al
inc rdi
cmp rdi, rsi
jb 0x18012afe0
mov rcx, qword [r13 + 0x38]
test rcx, rcx
je 0x18012b04c
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
sub rcx, rdi
xor eax, eax
rep stosb byte [rdi], al
lea rcx, [rsp + 0x38]
call fcn.1800aff90
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e67e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.1801e7500
nop
int3

Function at 0x18012b5e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rbx, [rcx + 0xee4]
cmp byte [rbx], 0
jne 0x18012b6da
xor esi, esi
mov qword [rsp + 0x30], rsi
call fcn.18012c7e0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800fd190
nop
cmp byte [rbx], sil
jne 0x18012b6d0
cmp qword [rdi + 0xee8], rsi
jne 0x18012b66b
lea ecx, [rsi + 8]
call fcn.1801e60b0
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18012b664
xor ecx, ecx
mov qword [rax], rcx
mov rcx, rax
call fcn.1800fd150
mov rsi, rax
mov qword [rdi + 0xee8], rsi
mov qword [rsp + 0x20], rbx
mov byte [0x18029b160], 0xf0
mov rcx, rdi
call fcn.18013c8f0
test al, al
jne 0x18012b694
mov byte [rbx], 1
lea rcx, [rsp + 0x30]
call fcn.1800fd1e0
xor al, al
jmp 0x18012b6dc
jmp 0x18012b6a0
mov rcx, rdi
call fcn.18012b850
call fcn.18014bdd0
test al, al
jne 0x18012b6bd
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.18014a930
mov rcx, rax
xor edx, edx
call fcn.18014bcd0
nop
mov byte [rbx], 1
lea rcx, [rsp + 0x30]
call fcn.1800fd1e0
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180135d10
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.180135d60
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x180135d52
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x180135d4c
add rsp, 0x30
pop rbx
ret
mov qword [rbx + 0x18], rax
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180141bb0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.1800b0960
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x101
lea rcx, [rsp + 0x70]
call fcn.18020be10
mov dword [rsp + 0x24], 0x101
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x180141cc3
mov r8d, dword [rsp + 0x24]
dec r8d
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rdi, [0x1800567d8]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.1800f15a0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1800f2960
nop
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180141cc3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180141cbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180141d88
call fcn.1801e60f0
nop
lea rcx, [rsp + 0x50]
call fcn.1800f87d0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], sendto
mov byte [rsp + 0x28], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180141cf0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180099770
nop
lea rcx, [rbx + 0x1d0]
lea rdx, [rsp + 0x28]
call fcn.180186570
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180141d54
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180141d4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180141d82
call fcn.1801e60f0
nop
lea rcx, [rsp + 0x50]
call fcn.180092860
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1801e67e0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18010f960
nop
call fcn.18010f960
int3
Function at 0x180142a60
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x140
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx eax, byte [rcx + 0x2d0]
mov rsi, rcx
test al, al
jne 0x180142b1e
mov qword [r11 + 0x10], rbx
lea rcx, [rsp + 0x30]
mov qword [r11 + 0x18], rbp
xor edx, edx
xor ebp, ebp
mov qword [r11 + 0x20], rdi
mov r8d, pe_nt_image_headers64
movzx ebx, bp
call fcn.18020be10
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea rcx, [0x18006c6c0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x180142b04
lea ecx, [rdi - 1]
cmp ecx, 0x1e
ja 0x180142b04
mov ecx, ebp
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6d0]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180142b37
cmp rcx, 8
jne 0x180142af0
xor al, al
mov rbp, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x140
pop rsi
ret
mov rcx, rbp
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6d8]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180142b66
cmp rcx, 8
jne 0x180142b50
jmp 0x180142b04
mov rcx, rbp
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6e0]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180142b99
cmp rcx, 8
jne 0x180142b80
jmp 0x180142b04
mov r8d, 8
lea rdx, [0x18006c6e8]
lea rcx, [rsp + 0x30]
call fcn.180113e60
test eax, eax
jne 0x180142c2b
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
lea rdx, [0x18006c6f8]
lea rcx, [rsp + 0x30]
call fcn.180155860
cmp eax, 1
jne 0x180142bf9
mov eax, dword [rsp + 0x20]
inc eax
and eax, 0x800000ff
jge 0x180142be9
dec eax
or eax, 0xffffff00
inc eax
cdqe
lea r8, [0x18006c210]
movzx ebx, byte [rax + r8]
jmp 0x180142c59
test edi, edi
je 0x180142c5e
lea rdx, [rsp + 0x30]
mov r9, rdi
lea r8, [0x18006c210]
nop dword [rax]
movsx rax, byte [rdx]
lea rdx, [rdx + 1]
movzx ecx, bx
xor rcx, rax
movzx ebx, byte [rcx + r8]
sub r9, 1
jne 0x180142c10
jmp 0x180142c59
test edi, edi
je 0x180142c5e
lea rdx, [rsp + 0x30]
mov r9, rdi
lea r8, [0x18006c210]
nop
movsx rcx, byte [rdx]
lea rdx, [rdx + 1]
movzx eax, bx
xor rcx, rax
movzx ebx, byte [rcx + r8]
sub r9, 1
jne 0x180142c40
cmp bp, bx
jne 0x180142c63
mov ebx, 0xff
mov byte [rsi + 0x2d0], bl
movzx eax, bl
jmp 0x180142b06