joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x1400201a7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140020086
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001f960
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001ef70
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140020077
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140014540
mov dword [rbx + 0x80], 0
jmp 0x140020193
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001de60
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140034638
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140034682
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034682
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034682
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034682
cmp dword [rcx + 0x84], 0xe
jbe 0x140034682
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140034684
xor al, al
add rsp, 0x28
ret
Function at 0x180002940
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ebp, dword [rcx]
test ebp, ebp
je 0x18000298c
cmp qword [rdx + 0x18], 8
jb 0x180002985
mov rcx, qword [rdx]
call fcn.18001b768
xor edi, edi
jmp 0x180002a16
cmp qword [rdx + 0x18], 8
jb 0x180002998
mov r8, qword [rdx]
jmp 0x18000299b
mov r8, rdx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
test rax, rax
je 0x1800029e4
mov qword [rsi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800029ce
lea rdx, str.RZh5FAFphJOxKVeutKuNPe0paXbYCiwevQki6c4bcp26wkhR5Hn82R2NONAFOezqtU1YkoY6hKR4cDFlVwBX3E
xor ecx, ecx
call fcn.180012cf0
jmp 0x1800029fb
mov r8, rdi
lea rdx, str.8dKCvrIKfrlEq5cgpLBIZowDSXAW2W_4UCzns82peJOXOZ42kl1E4xFISIq7g12E1zxkyIgPT6RI2KB_r8ZGSbYvyw
mov ecx, 4
call fcn.180012cf0
jmp 0x1800029fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.6mu7rjigpkZg5VVxbSucL48fDulxKF2lIY9kmn1PnX0FV1Zsv_gTsHYLXbIgAhJrkLYvCqjr19nwnxMIacPHLSUfDFIZw
xor ecx, ecx
call fcn.180012cf0
xor edi, edi
mov ebp, edi
cmp qword [rsi + 0x20], rdi
setne bpl
cmp qword [rbx + 0x18], 8
jb 0x180002a16
mov rcx, qword [rbx]
call fcn.18001b768
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov eax, ebp
mov word [rbx], di
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18001a840
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180002a50
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
mov ebp, dword [rcx]
test ebp, ebp
je 0x180002a9f
cmp qword [rdx + 0x18], 8
jb 0x180002a98
mov rcx, qword [rdx]
call fcn.18001b768
xor edi, edi
jmp 0x180002b82
cmp qword [rdx + 0x18], 8
jb 0x180002aab
mov r8, qword [rdx]
jmp 0x180002aae
mov r8, rdx
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor edi, edi
test rax, rax
jne 0x180002b65
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180002b48
mov dword [rsp + 0x28], 0x2a
mov qword [rsp + 0x2c], 0x1f0001
cmp qword [rbx + 0x18], 8
jb 0x180002aee
mov rax, qword [rbx]
jmp 0x180002af1
mov rax, rbx
mov qword [rsp + 0x38], rax
mov rax, qword [rsi + 0x18]
test rax, rax
jne 0x180002b35
lea rcx, [rsi + 0x10]
call fcn.180002870
test eax, eax
jne 0x180002b1c
lea rdx, str.mn4b172ncESVoTF3wbnVIsdX_N65w9KLzDlryCfSEbsNNgSxsvaWkgQYyaEtRIT6BGemia7hloUm_w
xor ecx, ecx
call fcn.180012cf0
jmp 0x180002b48
mov rax, qword [rsi + 0x18]
test rax, rax
jne 0x180002b35
lea rdx, str.xGfn7C5jrb0OaK1fjLgiudkEQ8RYTh4FQT9nlVjiq7HMrWLZNF5Yz0AUHzrq_dlCIlz2eSD7T9RUfIE6Og
xor ecx, ecx
call fcn.180012cf0
jmp 0x180002b48
lea rdx, [rsp + 0x28]
lea rcx, [0x1800644c8]
call rax
test rax, rax
jne 0x180002b65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._dFe5FB4xGPjEFYuAsqthbFAAZZZlsh9nZZKcc4DJFYIjzPoBRfyrpmzdpSGPZJziRxu_RFNHKi613DFyi1WmrcVSZoVnKZPM6E
xor ecx, ecx
call fcn.180012cf0
mov qword [rsi + 0x20], rdi
jmp 0x180002b69
mov qword [rsi + 0x20], rax
mov ebp, edi
cmp qword [rsi + 0x20], rdi
setne bpl
cmp qword [rbx + 0x18], 8
jb 0x180002b82
mov rcx, qword [rbx]
call fcn.18001b768
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov eax, ebp
mov word [rbx], di
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18001a840
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180002c50
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rcx + 0x18], 7
xor ebx, ebx
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
xor r8d, r8d
lea rdx, [0x180062134]
call fcn.180008eb0
nop
mov qword [rsi + 0x38], 7
mov qword [rsi + 0x30], rbx
mov word [rsi + 0x20], bx
xor r8d, r8d
lea rdx, [0x180062134]
lea rcx, [rsi + 0x20]
call fcn.180008eb0
nop
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x180002cdf
mov rax, qword [rsi]
jmp 0x180002ce2
mov rax, rsi
mov word [rax], bx
mov qword [rsi + 0x30], rbx
cmp qword [rsi + 0x38], 8
jb 0x180002cf6
mov rax, qword [rsi + 0x20]
jmp 0x180002cfa
lea rax, [rsi + 0x20]
mov word [rax], bx
mov dword [rsp + 0x50], ebx
mov word [rsp + 0x60], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.18001d560
mov r8d, 0x104
lea rdx, [rsp + 0x60]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x180002e6d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x180002e6d
cmp word [rsp + 0x60], 0
jne 0x180002d60
mov r8, rbx
jmp 0x180002d7b
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180002d70
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x20]
call fcn.1800086b0
mov r8d, 1
lea rdx, [0x18006283c]
lea rcx, [rsi + 0x20]
call fcn.1800086b0
cmp word [rdi], 0
jne 0x180002daa
mov r8, rbx
jmp 0x180002dbb
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdi + r8*2], 0
jne 0x180002db0
mov rdx, rdi
lea rcx, [rsi + 0x20]
call fcn.1800086b0
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1800027b0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsi + 0x20]
call fcn.180008570
nop
cmp qword [rsp + 0x38], 8
jb 0x180002dfc
mov rcx, qword [rsp + 0x20]
call fcn.18001b768
mov r8d, 4
lea rdx, [0x180062840]
lea rcx, [rsi + 0x20]
call fcn.1800086b0
cmp word [rdi], 0
je 0x180002e2a
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x180002e20
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.1800086b0
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1800027b0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.180008570
nop
cmp qword [rsp + 0x38], 8
jb 0x180002e6d
mov rcx, qword [rsp + 0x20]
call fcn.18001b768
nop
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18001a840
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r14
pop rdi
pop rsi
ret
Function at 0x180002ea0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp qword [rcx + 0x10], 0
mov rsi, rdx
mov rbx, rcx
jbe 0x180002fdf
cmp qword [rcx + 0x30], 0
jbe 0x180002fdf
xor eax, eax
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x290], rdi
mov word [rsp + 0x50], ax
call fcn.18001d560
cmp qword [rbx + 0x38], 8
lea rdi, [rbx + 0x20]
jb 0x180002f0c
mov rax, qword [rdi]
jmp 0x180002f0f
mov rax, rdi
cmp qword [rbx + 0x18], 8
jb 0x180002f1b
mov rcx, qword [rbx]
jmp 0x180002f1e
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x180002fa7
lea rcx, [rsp + 0x50]
call fcn.18001b2b8
lea rcx, [rsp + 0x30]
lea edx, [rax + 1]
call fcn.180002710
cmp qword [rdi + 0x18], 8
jb 0x180002f61
mov rdi, qword [rdi]
cmp qword [rax + 0x18], 8
jb 0x180002f6b
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
jb 0x180002f75
mov rbx, qword [rbx]
mov r9, rdi
mov r8, rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp qword [rsp + 0x48], 8
mov ebx, eax
jb 0x180002fd3
mov rcx, qword [rsp + 0x30]
call fcn.18001b768
mov rdi, qword [rsp + 0x290]
mov eax, ebx
jmp 0x180002fe1
cmp qword [rdi + 0x18], 8
jb 0x180002fb1
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x180002fbb
mov rbx, qword [rbx]
lea r8, [0x18006284c]
mov r9, rdi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, eax
mov rdi, qword [rsp + 0x290]
mov eax, ebx
jmp 0x180002fe1
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18001a840
mov rbx, qword [rsp + 0x298]
add rsp, 0x270
pop rsi
ret
Function at 0x180003010
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x278
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp qword [rcx + 0x10], 0
mov rbp, rdx
mov rbx, rcx
jbe 0x180003151
cmp qword [rcx + 0x30], 0
jbe 0x180003151
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x52]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov qword [r11 - 0x18], rdi
mov word [rsp + 0x50], si
call fcn.18001d560
cmp qword [rbx + 0x38], 8
lea rdi, [rbx + 0x20]
jb 0x18000307b
mov rax, qword [rdi]
jmp 0x18000307e
mov rax, rdi
cmp qword [rbx + 0x18], 8
jb 0x18000308a
mov rcx, qword [rbx]
jmp 0x18000308d
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x18000313d
lea rcx, [rsp + 0x50]
call fcn.18001b2b8
cmp eax, 1
jle 0x180003115
lea edx, [rax - 1]
lea rcx, [rsp + 0x30]
call fcn.180002710
cmp qword [rdi + 0x18], 8
jb 0x1800030d9
mov rdi, qword [rdi]
cmp qword [rax + 0x18], 8
jb 0x1800030e3
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
jb 0x1800030ed
mov rbx, qword [rbx]
mov r9, rdi
mov r8, rax
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp qword [rsp + 0x48], 8
mov esi, eax
jb 0x18000313d
mov rcx, qword [rsp + 0x30]
call fcn.18001b768
jmp 0x18000313d
cmp qword [rdi + 0x18], 8
jb 0x18000311f
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x180003129
mov rbx, qword [rbx]
mov r9, rdi
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, eax
mov rdi, qword [rsp + 0x270]
mov eax, esi
mov rsi, qword [rsp + 0x2a0]
jmp 0x180003153
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x278
pop rbp
pop rbx
ret
Function at 0x18000b150
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 1
jne 0x18000b17e
call fcn.180012a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [0x1800808b0], rbx
mov eax, 1
add rsp, 0x20
pop rbx
ret
test edx, edx
jne 0x18000b192
call fcn.180012b50
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp edx, 0x72
jne 0x18000b173
test r8, r8
jne 0x18000b1b6
lea r8d, [rdx - 0x46]
lea rdx, str.UNHvKebg0E4WNirTj3YeJkuOqIApaJ6Hva8Qh0FxXPN9SwGNIGf4mldQg7bHHETYK9LEHZc4xgUUp7_QgZM
xor ecx, ecx
call fcn.180012cf0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0x5a4d
cmp ax, word [rcx]
je 0x18000b1dc
lea rdx, str.LBzVmE18jrbNBg79Ff_2KLES92AL0ZWXcGWogGlgB1ZH6O1eSF2sQVZzdg4888qT3ZQmnlfuVjdmQDiYcp
mov r8d, 0x34
xor ecx, ecx
call fcn.180012cf0
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
je 0x18000b205
lea rdx, str.FW51jZ4ei6o2J3C1vGheT408eTiD4zsAN5C4XVHwl7TFmgEK6mohbMbV6hU2JU78ItbddJcbDk0zyi1rQ0
mov r8d, 0x3d
xor ecx, ecx
call fcn.180012cf0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r8]
xor edx, edx
mov rax, rcx
shr rax, 0x10
cmp dx, ax
jae 0x18000b21b
mov qword [r8], rdx
jmp 0x18000b237
cmp rcx, 0x640
jne 0x18000b216
lea rax, [0x180004950]
mov qword [r8], rax
test rax, rax
jne 0x18000b173
mov r8d, 0x47
lea rdx, str.77CBFleMUZGVdeqncljpaUxWO68O5nofx5ow2musR2uBp04WrEaRhyJqs1f0NA2fciJX07BXSM
lea ecx, [r8 - 0x43]
call fcn.180012cf0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18000bb20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
lea r8, [0x18000bab0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x18000bb70
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x48
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x48
ret
Function at 0x18000e180
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r8, [0x18000d8f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], ecx
call fcn.18001bc48
test rax, rax
je 0x18000e1c6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x48
ret

Function at 0x18000e1e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r8, [0x18000df30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], ecx
call fcn.18001bc48
test rax, rax
je 0x18000e226
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x48
ret
Function at 0x180010a50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15d, r8d
mov r14, rdx
mov rbp, rcx
mov dword [rsp + 0x40], 0x7273722e
mov word [rsp + 0x44], 0x63
test rcx, rcx
jne 0x180010a8d
xor eax, eax
jmp 0x180010b01
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180010a89
mov qword [rsp + 0x70], rsi
mov esi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
je 0x180010aae
xor eax, eax
jmp 0x180010afc
movzx eax, word [rsi + 0x14]
mov qword [rsp + 0x78], rbx
lea rbx, [rsi + 0x18]
add rbx, rax
mov eax, dword [rsi + 8]
mov qword [rsp + 0x68], rdi
xor edi, edi
mov dword [r9], eax
cmp di, word [rsi + 6]
jae 0x180010af0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18001c510
test eax, eax
je 0x180010b1b
movzx eax, word [rsi + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jb 0x180010ad1
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
mov ecx, dword [rbx + 0xc]
add rcx, rbp
je 0x180010af0
mov eax, dword [rbx + 8]
add rax, 0xffffffffffffffcc
cmp dword [rcx], 0xfeef04bd
je 0x180010b45
add rax, rcx
inc rcx
cmp rcx, rax
ja 0x180010af0
cmp dword [rcx], 0xfeef04bd
jne 0x180010b35
movzx r8d, word [rcx + 0xe]
movzx eax, word [rcx + 0xc]
movzx r10d, word [rcx + 8]
movzx r9d, word [rcx + 0xa]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
lea r8, str._d._d._d._d
mov rdx, r15
mov rcx, r14
mov dword [rsp + 0x20], r10d
call fcn.18000fe60
mov eax, 1
jmp 0x180010af2
Function at 0x180012b50
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x1d0
mov rax, qword [0x1800760b0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor esi, esi
cmp dword [0x1800796bc], esi
je 0x180012b91
mov ecx, dword [section..data]
mov dword [0x1800796bc], esi
mov dword [section..data], 0xffffffff
call qword [0x180079598]
cmp dword [0x1800798e8], esi
je 0x180012bc7
mov r9, qword [0x180079580]
mov r8, qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [0x1800798e8], esi
mov qword [0x180079580], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800796b8], esi
je 0x180012cd1
xor edx, edx
lea rcx, [rsp + 0x31]
mov qword [rsp + 0x1e0], rbx
lea r8d, [rdx + 0x7f]
mov qword [rsp + 0x1e8], rdi
mov byte [rsp + 0x30], sil
call fcn.18001d560
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [0x180079a18]
mov rcx, rdi
mov edx, 0x20
mov ebx, eax
call fcn.180010950
lea rdx, str.YRQTNFXXIJgIda_m2r4WzO91p4Zop4CcClUhPbruF2xbNOzG6FcW7O3V1mL6PhMymxQzfuVQarzZDBzC8o4RGZR0noRVznCZCHWv5_0YHMzfU3b
mov ecx, 0xffffff9d
call fcn.180011fa0
lea rdx, [rsp + 0x30]
lea rcx, [0x180074328]
mov r8d, 0x80
call fcn.180013720
lea rcx, [rsp + 0xb1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xb0], sil
call fcn.18001d560
lea r9, [0x1800799f8]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0xb0]
mov edx, 0x104
mov qword [rsp + 0x20], rdi
call fcn.18000fe60
lea r8, [rsp + 0xb0]
lea rdx, str.Th6qiJwQTn8wysNojw
mov ecx, 0xffffff9d
call fcn.180011fa0
lea rdx, str.RAd8SyT81vhHBvz9xcZy6i4DIosEI271QHqsyRwM0uKeAQmEZI6URd5giRhlv_ftCAzcz27X_mUgd8zNGTwi4k4FnIxh7pZ4tyCMGjW8JqpOm8R
mov ecx, 0xffffff9d
call fcn.180011fa0
lea rcx, [0x180079688]
call qword [0x180079620]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1e0]
mov dword [0x1800796b8], esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18001a840
add rsp, 0x1d0
pop rsi
ret
Function at 0x180013440
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
xor r10d, r10d
mov r11, rdx
mov r9d, r10d
nop dword [rax]
movzx r8d, byte [r9 + rcx]
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x180013466
movsx eax, r8b
sub eax, 0x41
jmp 0x1800134af
lea eax, [r8 - 0x61]
cmp al, 0x19
ja 0x180013477
movsx eax, r8b
sub eax, 0x47
jmp 0x1800134af
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x180013488
movsx eax, r8b
add eax, 4
jmp 0x1800134af
cmp r8b, 0x2b
jne 0x180013495
mov eax, 0x3e
jmp 0x1800134af
cmp r8b, 0x2f
jne 0x1800134a2
mov eax, 0x3f
jmp 0x1800134af
cmp r8b, 0x3d
jne 0x180013530
or eax, 0xffffffff
mov dword [rsp + r9*4], eax
inc r9
cmp r9, 4
jl 0x180013450
mov edx, dword [rsp]
cmp edx, 0xffffffff
je 0x180013530
mov r8d, dword [rsp + 4]
cmp r8d, 0xffffffff
je 0x180013530
mov ecx, dword [rsp + 8]
mov eax, dword [rsp + 0xc]
cmp ecx, 0xffffffff
jne 0x1800134e6
cmp eax, ecx
jne 0x180013530
lea r10d, [rcx + 2]
jmp 0x1800134f1
cmp eax, 0xffffffff
setne r10b
add r10d, 2
shl edx, 6
and eax, 0x3f
and ecx, 0x3f
or edx, r8d
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [r11], al
cmp r10d, 1
jle 0x18001351e
mov ecx, edx
shr ecx, 8
mov byte [r11 + 1], cl
cmp r10d, 2
jle 0x180013528
mov byte [r11 + 2], dl
mov eax, r10d
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x180013720
Capabilities:
Encrypt data using rc4 prga
Terminate process

Disassembly:
push rsi
push r12
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x28], r14
lea rbx, [rcx + 1]
mov r14d, r8d
mov ebp, 0xff
mov qword [rsp + 0x20], r15
mov r15, rdx
sub bpl, byte [rcx]
mov rdx, rcx
mov r12d, 1
xor ecx, ecx
mov r8d, r12d
call fcn.180013c00
xor esi, esi
test r14d, r14d
je 0x1800137b5
mov qword [rsp + 0x30], r13
sub r15, rbx
lea r13, [0x180052c80]
nop dword [rax]
movzx ecx, bpl
mov r8d, r12d
mov rdx, rbx
movzx edi, byte [rcx + r13]
movzx ecx, ax
xor dil, byte [rbx]
mov byte [r15 + rbx], dil
call fcn.180013c00
inc rbx
test dil, dil
je 0x1800137b0
inc esi
inc bpl
cmp esi, r14d
jb 0x180013780
mov r13, qword [rsp + 0x30]
mov r8d, r12d
mov rdx, rbx
movzx ecx, ax
call fcn.180013c00
lea rdx, [rbx + 1]
movzx r8d, r12w
movzx ecx, ax
call fcn.180013c00
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test ax, ax
je 0x1800137fb
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, esi
add rsp, 0x38
pop r12
pop rsi
ret
Function at 0x180013810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r12
push r14
push r15
sub rsp, 0x28
mov r15d, edx
mov ebp, 0xff
mov r14d, r9d
sub bpl, byte [rcx]
mov r12, r8
mov rdx, rcx
cmp r15d, 1
jne 0x180013844
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
lea rsi, [rcx + 1]
xor ecx, ecx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r13
lea r8d, [rcx + 1]
call fcn.180013c00
movzx r9d, ax
xor eax, eax
mov ebx, eax
test r14d, r14d
je 0x1800138c9
sub r12, rsi
lea r13, [0x180052c80]
nop
movzx ecx, bpl
mov r8d, 1
mov rdx, rsi
movzx edi, byte [rcx + r13]
movzx ecx, r9w
xor dil, byte [rsi]
mov byte [r12 + rsi], dil
call fcn.180013c00
movzx r9d, ax
test dil, dil
je 0x1800138c6
lea eax, [rbx + 2]
cmp eax, r15d
jae 0x1800138c2
inc ebx
inc rsi
inc bpl
cmp ebx, r14d
jb 0x180013880
jmp 0x1800138c9
xor eax, eax
jmp 0x1800138f8
inc rsi
mov r8w, 1
mov rdx, rsi
movzx ecx, r9w
call fcn.180013c00
lea rdx, [rsi + 1]
mov r8w, 1
movzx ecx, ax
call fcn.180013c00
test ax, ax
mov eax, 0
cmovne ebx, eax
mov eax, ebx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rbp
ret