joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003afe0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140016202
movzx eax, al
test eax, eax
jne 0x14003b000
mov ecx, 7
call fcn.140015e42
nop
mov byte [rsp + 0x20], 0
call fcn.140015ea1
mov byte [rsp + 0x21], al
cmp dword [0x140107420], 1
jne 0x14003b024
mov ecx, 7
call fcn.140015e42
nop
jmp 0x14003b07c
cmp dword [0x140107420], 0
jne 0x14003b077
mov dword [0x140107420], 1
lea rdx, [0x140044888]
lea rcx, [0x140044558]
call fcn.1400157f8
test eax, eax
je 0x14003b058
mov eax, 0xff
jmp 0x14003b181
lea rdx, [0x140044448]
lea rcx, [section..rdata]
call fcn.140015e7e
mov dword [0x140107420], 2
jmp 0x14003b07c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140015df7
call fcn.140015c30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14003b0d9
mov rcx, qword [rsp + 0x30]
call fcn.14001568b
movzx eax, al
test eax, eax
je 0x14003b0d9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140112020]
nop
call fcn.140015cfd
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14003b10d
mov rcx, qword [rsp + 0x38]
call fcn.14001568b
movzx eax, al
test eax, eax
je 0x14003b10d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400160d1
nop
call fcn.14003b1f0
mov dword [rsp + 0x28], eax
call fcn.140015bbd
movzx eax, al
test eax, eax
jne 0x14003b12c
mov ecx, dword [rsp + 0x28]
call fcn.14001515e
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14003b13b
call fcn.1400160f4
nop
xor edx, edx
mov cl, 1
call fcn.140015618
mov eax, dword [rsp + 0x28]
jmp 0x14003b181
add rsp, 0x68
ret
Function at 0x180002530
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002562
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002562
nop word cs:[rax + rax]
jmp 0x180002560
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002638
mov rsi, r10
test r8b, r8b
je 0x180002650
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800025d0
test r9b, r9b
je 0x180002660
sub rsi, rcx
je 0x180002634
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002630
test ebp, ebp
jne 0x180002630
add rbx, 1
cmp rsi, rbx
jne 0x1800025f0
jmp 0x180002634
test ebp, ebp
jne 0x1800025bc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002650
jmp 0x180002660
Function at 0x14000f4f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
movabs rdx, 0x27d4eb2f165667c5
mov r10, rcx
lea rcx, [rcx + 0x28]
mov r9d, dword [r10 + 0x48]
mov r8, qword [r10 + 0x18]
mov r11, qword [r10]
add r9, rcx
add rdx, r8
cmp r11, 0x1f
jbe 0x14000f5cd
mov rbx, qword [r10 + 0x10]
mov rdx, qword [r10 + 8]
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, qword [r10 + 0x20]
mov rsi, rbx
imul rbx, rdi
mov rbp, rdx
rol rdx, 1
rol rsi, 7
imul rbp, rdi
add rdx, rsi
mov rsi, r8
rol rsi, 0xc
imul r8, rdi
add rdx, rsi
mov rsi, rax
rol rbp, 0x1f
rol rsi, 0x12
imul rax, rdi
add rdx, rsi
rol r8, 0x1f
movabs rsi, 0x9e3779b185ebca87
imul rbp, rsi
imul r8, rsi
xor rdx, rbp
mov rbp, rbx
movabs rbx, 0x85ebca77c2b2ae63
imul rdx, rsi
rol rbp, 0x1f
imul rbp, rsi
add rdx, rbx
xor rdx, rbp
imul rdx, rsi
add rdx, rbx
xor r8, rdx
mov rdx, rax
imul r8, rsi
rol rdx, 0x1f
imul rdx, rsi
lea rax, [r8 + rbx]
xor rdx, rax
imul rdx, rsi
add rdx, rbx
lea rsi, [r10 + 0x30]
add rdx, r11
cmp r9, rsi
jb 0x14000f639
movabs rbx, 0xc2b2ae3d27d4eb4f
mov rcx, rsi
movabs r8, 0x9e3779b185ebca87
movabs r11, 0x85ebca77c2b2ae63
nop word [rax + rax]
mov rax, qword [rcx - 8]
add rcx, 8
imul rax, rbx
rol rax, 0x1f
imul rax, r8
xor rax, rdx
rol rax, 0x1b
imul rax, r8
lea rdx, [rax + r11]
cmp r9, rcx
jae 0x14000f600
mov rax, r9
sub rax, r10
lea rcx, [rax - 0x30]
and rcx, 0xfffffffffffffff8
add rcx, rsi
lea r8, [rcx + 4]
cmp r9, r8
jb 0x14000f677
mov eax, dword [rcx]
movabs rcx, 0x9e3779b185ebca87
imul rax, rcx
mov rcx, r8
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
rol rax, 0x17
imul rax, rdx
movabs rdx, 0x165667b19e3779f9
add rdx, rax
cmp rcx, r9
jae 0x14000f6ae
movabs r10, 0x27d4eb2f165667c5
movabs r8, 0x9e3779b185ebca87
movzx eax, byte [rcx]
add rcx, 1
imul rax, r10
xor rax, rdx
rol rax, 0xb
imul rax, r8
mov rdx, rax
cmp r9, rcx
jne 0x14000f690
mov rax, rdx
shr rax, 0x21
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
imul rax, rdx
mov rdx, rax
shr rdx, 0x1d
xor rax, rdx
movabs rdx, 0x165667b19e3779f9
imul rax, rdx
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14001b950
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.14001e190
sub rsp, rax
mov eax, dword [0x1400310a0]
mov rsi, rcx
test eax, eax
je 0x14001b9f0
xor ebx, ebx
lea rdi, [0x1400400e0]
test eax, eax
jg 0x14001b98c
jmp 0x14001b9a0
add rbx, 1
cmp dword [0x1400310a0], ebx
jle 0x14001b9a0
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14001b980
jmp 0x14001b9d7
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14001b9b5
cmp word [rsi + 2], 0x3a
je 0x14001b9d7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001ba40
movsxd rbx, dword [0x1400310a0]
cmp ebx, 0x3ff
jle 0x14001ba58
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.14001b170
test al, al
je 0x14001ba7a
movsxd rbx, dword [0x1400310a0]
mov rcx, rdi
lea rdi, [0x1400400e0]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x1400310a0]
add eax, 1
mov dword [0x1400310a0], eax
jmp 0x14001b971
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001b9c4
xor eax, eax
jmp 0x14001b9dc
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x1400310a0], 1
mov rdx, rax
lea rax, [0x1400400e0]
mov qword [rax + rbx*8], rdx
jmp 0x14001b9d7
mov rcx, rbx
call fcn.1400020b0
nop
nop word cs:[rax + rax]
nop
Function at 0x14001ce70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140023dd0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140023dd0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14001db42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140044228]
test eax, eax
je 0x14001dbda
lea rax, [0x140044200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140044230]
mov qword [rbp - 8], rax
jmp 0x14001dbbe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14001dbb2
cmp qword [rbp - 0x10], 0
je 0x14001dbb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14001db78
lea rax, [0x140044200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14001dbdb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14001dce0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14001dd08
mov eax, 0
jmp 0x14001dd56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14001dd31
mov eax, 0
jmp 0x14001dd56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14001dd51
mov eax, 0
jmp 0x14001dd56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14001dd5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001ddda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14001ddd1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14001ddd1
mov rax, qword [rbp - 8]
jmp 0x14001ddef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14001dda4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180002fc0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180021a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180021a98], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180021a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180021a7c], 0xa
setl r9b
or r9b, al
mov eax, dword [0x180021a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180021aa0], 0xa
setl r14b
or r14b, al
lea rax, [rcx - 1]
mov r15, r10
test r8b, r8b
je 0x1800030f0
mov r15, qword [r15]
cmp r15, r10
je 0x180003112
mov rdi, rax
test r9b, r9b
je 0x180003100
nop word cs:[rax + rax]
nop
cmp byte [rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x180003070
test r14b, r14b
je 0x180003110
sub rdi, rcx
je 0x1800030d8
mov r12, qword [r15 + 0x60]
xor edx, edx
nop
movzx esi, word [r12 + rdx*2]
lea ebx, [rsi - 0x41]
lea ebp, [rsi + 0x20]
cmp bx, 0x1a
cmovae ebp, esi
movsx ebx, byte [rcx + rdx]
lea r13d, [rbx - 0x41]
lea r11d, [rbx + 0x20]
cmp r13b, 0x1a
cmovae r11d, ebx
sub ebp, r11d
test esi, esi
je 0x1800030d0
test ebp, ebp
jne 0x1800030d0
add rdx, 1
cmp rdi, rdx
jne 0x180003090
jmp 0x1800030d8
test ebp, ebp
jne 0x180003044
mov rax, qword [r15 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800030f0
jmp 0x180003100
jmp 0x180003110
xor eax, eax
jmp 0x1800030dc
Function at 0x1800027e0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a8c], 0xa
jl 0x180002812
mov eax, dword [0x180020a90]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002812
nop word cs:[rax + rax]
jmp 0x180002810
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800028e8
mov rsi, r10
test r8b, r8b
je 0x180002900
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002880
test r9b, r9b
je 0x180002910
sub rsi, rcx
je 0x1800028e4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800028e0
test ebp, ebp
jne 0x1800028e0
add rbx, 1
cmp rsi, rbx
jne 0x1800028a0
jmp 0x1800028e4
test ebp, ebp
jne 0x18000286c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002900
jmp 0x180002910

Function at 0x1407c2f99
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
sub rbx, 8
mov qword [rsp], 0x9b13a3f
mov dword [rbx + 4], eax
call fcn.1407bd942
mov eax, 0x8abe7b31
mov esi, eax
bts si, 0x84
mov esi, dword [r11 + riz]
jb 0x1407c6a24

Function at 0x1407c94c7
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffdd9eed2c
not r11d
push 0x69a3c43c
jmp 0x1407af802
movsx ebx, r8b
lea r8, [0x1407ac540]
lea rsp, [rsp + 0x10]
push 0xffffffffe7aab102
movzx ebx, byte [rdx]
xor ebx, r11d
and ebx, 0xff
push 0x36b70390
mov ebx, dword [r8 + rbx*4]
shr r11d, 8
shl dword [rsp + 8], 0x8c
xor r11d, ebx
add word [rsp + 0xd], 0xba12
inc rdx
push 0xfffffffff421581c
xor r11d, 0x2f8d1207
dec rcx
not qword [rsp + 0xa]
push 0xffffffffa1befb34
push 0xffffffffc63ac8a3
lea rsp, [rsp + 0x28]
jne 0x1407c94d7
push 0xffffffffc5a50e8f
mov rbx, qword [rsp + 8]
jmp 0x1407cf2e7
pop r8
mov r8, qword [rsp + r8*2 + 0x74b5e2ea]
lea rsp, [rsp + 0x10]
push 0x79b3ff35
jmp 0x1407b7a59
Function at 0x180002a40
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r9b
or r9b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r14b
or r14b, al
lea rax, [rcx - 1]
mov r15, r10
test r8b, r8b
je 0x180002b70
mov r15, qword [r15]
cmp r15, r10
je 0x180002b92
mov rdi, rax
test r9b, r9b
je 0x180002b80
nop word cs:[rax + rax]
nop
cmp byte [rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x180002af0
test r14b, r14b
je 0x180002b90
sub rdi, rcx
je 0x180002b58
mov r12, qword [r15 + 0x60]
xor edx, edx
nop
movzx esi, word [r12 + rdx*2]
lea ebx, [rsi - 0x41]
lea ebp, [rsi + 0x20]
cmp bx, 0x1a
cmovae ebp, esi
movsx ebx, byte [rcx + rdx]
lea r13d, [rbx - 0x41]
lea r11d, [rbx + 0x20]
cmp r13b, 0x1a
cmovae r11d, ebx
sub ebp, r11d
test esi, esi
je 0x180002b50
test ebp, ebp
jne 0x180002b50
add rdx, 1
cmp rdi, rdx
jne 0x180002b10
jmp 0x180002b58
test ebp, ebp
jne 0x180002ac4
mov rax, qword [r15 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002b70
jmp 0x180002b80
jmp 0x180002b90
xor eax, eax
jmp 0x180002b5c
Function at 0x100d49e60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100d49e6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100d49e7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100d49e65
lea eax, [rcx + 1]
jmp 0x100d49e8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100d49e9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100d49e84
sub eax, 3
jb 0x100d49ebe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100d49f0d
sar eax, 1
movsxd rbp, eax
jb 0x100d49ef4
jmp 0x100d49ecc
add ebx, ebx
jne 0x100d49eca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100d49ef4
inc ecx
add ebx, ebx
jne 0x100d49eda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100d49ef4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100d49eed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100d49edc
add ecx, 2
jmp 0x100d49ef9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100d49e22
jmp 0x100d49e6d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xd45000]
mov eax, dword [rdi]
or eax, eax
je 0x100d49f69
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd63148]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100d49f19
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100d49f63
mov qword [rbx], rax
add rbx, 8
jmp 0x100d49f39
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100d49fec], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100d49fec
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100d49fdc
sub rsp, 0xffffffffffffff80
jmp 0x1000032a0
Function at 0x140027e40
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b8c4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b8c4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f90
cmp rax, 0xffffffffffffffff
je 0x140027f90
xor edi, edi
test rbp, rbp
jle 0x140027f3b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dec8
mov rbx, rax
test rax, rax
jne 0x140027ec8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027f31
mov edx, 0x8000
mov ecx, r14d
call fcn.140015978
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c5a0
cmp eax, 0xffffffff
je 0x140027f11
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027ed8
mov edx, r15d
mov ecx, r14d
call fcn.140015978
jmp 0x140027f31
cmp byte [rsi + 0x38], dil
je 0x140027f28
cmp dword [rsi + 0x34], 5
jne 0x140027f28
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027f31
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019f88
jmp 0x140027fa4
jns 0x140027fa4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b8c4
cmp rax, 0xffffffffffffffff
jne 0x140027f5c
cmp byte [rsi + 0x30], dil
je 0x140027fa4
mov edi, dword [rsi + 0x2c]
jmp 0x140027fa4
mov ecx, r14d
call fcn.14001706c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027fa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027fa4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f9d
mov eax, dword [rsi + 0x2c]
jmp 0x140027fa2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b8c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800014b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp edx, 1
jne 0x1800014ee
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, section..text
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001520
add rsp, 0x48
ret
Function at 0x275030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
je 0x275040
jne 0x275040
sub rsp, 0x28
mov rax, qword [rdx]
cmp dword [rax + 0x8c], 0
je 0x2750eb
mov rsi, qword [rdx + 8]
mov edi, dword [rax + 0x88]
cmp dword [rdi + rsi + 0x18], 0
je 0x275088
jne 0x275088
je 0x491b51b6
add r12, rsi
add rbx, rsi
je 0x2750eb
cmp dword [rsi + rdi + 0x14], 0
je 0x2750eb
mov r15, r8
mov r13, rcx
mov ebx, dword [rsi + rdi + 0x20]
mov r12d, dword [rsi + rdi + 0x24]
je 0x275069
jne 0x275069
je 0x74eaafeb
and eax, 0x44e92375
mov esi, dword [rcx + rax]
Function at 0x282790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x2827c0
mov eax, dword [rax + 0x20]
mov dword [rdi + 0x38], eax
mov rcx, rbx
mov rdx, rsi
call r15
mov rcx, rdi
jmp 0x282870
xor r14d, r14d
xor edx, edx
jmp 0x2828ff
mov rax, qword [rcx]
jmp 0x28280b
push r15
je 0x2828f6
jne 0x2828f6
add byte [rax], al
add byte [rax], al
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
jmp 0x2828de
mov rcx, rbp
jmp 0x2828b1
mov r15, qword [sym.imp.itmkl_beo_UteNpt2HgazewrUmZvtjloS]
je 0x2827d2
jne 0x2827d2
jmp 0xffffffffff29b34d
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x282796
call qword [rax + 8]
je 0x282914
jne 0x282914
jmp 0x28d508
jmp 0x2828cc
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
je 0x28287d
jne 0x28287d
por mm3, qword [rdx - 0x17]
je 0x2827ed
jne 0x2827ed
je 0xffffffff8437d62d
jmp 0x282821
sub rsp, 0x28
mov rdi, rcx
je 0x28290b
jmp 0x282932
push rdi
push rbp
push rbx
jmp 0x282845
je 0x282920
mov rax, qword [rcx]
jmp 0x2827ad
call fcn.00283060
jmp 0x28295e
jmp 0xe0ac90
je 0x28293b
je 0x28294f
jne 0x28294f
je 0xffffffff8dac3819
je 0x282925
add byte [rax], al
add byte [rax - 0x75], cl
outsd dx, dword [rsi]
adc byte [rdi], cl
test ch, cl
add byte [rax], al
add byte [rdi], cl
test edi, eax
add byte [rax], al
add byte [rax - 0x7b], cl
leave
mov rbp, qword [rdi + 0x10]
je 0x28296f
jne 0x28296f
test rcx, rcx
jmp 0x28285e
call qword [rax + 0x18]
lea edx, [rax + 1]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
jmp 0x2827bb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [rax + 0x30]
test rax, rax
je 0x28293b
mov rcx, qword [rdi + 0x10]
je 0x282801
jne 0x282801
push r14
push rsi
jmp 0x282857
je 0x282842
jne 0x282842
mov rcx, qword [rcx + 0x10]
je 0x2828a8
jne 0x2828a8
jmp 0x113e99d
test eax, eax
jmp 0x282918
jne 0x2827e0
jmp 0x28293b
xor r14d, r14d
jmp 0x28293b
je 0x282935
jne 0x282935
jmp 0x28287c
jne 0x28290b
jmp 0x29e77a
mov r14d, 1
mov eax, r14d
jmp 0x282942
je 0x28281b
jne 0x28281b
jmp 0x3887b69b
lea rbx, [rdi + 0x38]
lea rsi, [rdi + 0x3c]
jmp 0x2827f5
cmp eax, 1
je 0x282892
jne 0x282892
je 0x6db4bb
mov rax, qword [rbp]
jmp 0x282838
invalid
add al, ah
dec dword [rbp + 0x29]
imul r9, rbx, 0xa2c13
Function at 0x298de0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x002afbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret