joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180046c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x440
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3b8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rdx]
mov rdi, qword [r9]
movzx ecx, byte [rax + 0x88]
cmp cl, 2
je 0x180046c8b
test cl, 1
je 0x180046dd1
movzx eax, byte [rax + 0x82]
cmp al, 2
je 0x180046c9e
test al, 1
je 0x180046dd1
mov rax, qword [r8 + 0x10]
mov qword [rbp + 0x178], rax
movups xmm0, xmmword [r8]
movups xmmword [rbp + 0x168], xmm0
movzx eax, byte [r8 + 0x18]
mov ecx, dword [r8 + 0x19]
mov dword [rbp + 0x3a9], ecx
mov ecx, dword [r8 + 0x1c]
mov dword [rbp + 0x3ac], ecx
mov qword [rbp + 0x380], 0
movups xmm0, xmmword [rbp + 0x160]
movups xmmword [rbp + 0x388], xmm0
mov rcx, qword [rbp + 0x170]
mov qword [rbp + 0x398], rcx
mov rcx, qword [rbp + 0x178]
mov qword [rbp + 0x3a0], rcx
mov byte [rbp + 0x3a8], al
mov byte [rbp + 0x378], 3
mov qword [rbp + 0x350], 0
lea rcx, [rbp - 0x60]
call fcn.180063fd0
movups xmm0, xmmword [rbp + 0x350]
movups xmm1, xmmword [rbp + 0x360]
movups xmm2, xmmword [rbp + 0x370]
movaps xmmword [rbp + 0x180], xmm2
movaps xmmword [rbp + 0x170], xmm1
movaps xmmword [rbp + 0x160], xmm0
lea rcx, [rbp + 0x190]
lea rdx, [rbp - 0x60]
mov r8d, 0x1c0
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0x380]
movups xmm1, xmmword [rbp + 0x390]
movups xmm2, xmmword [rbp + 0x3a0]
movaps xmmword [rbp - 0x40], xmm2
movaps xmmword [rbp - 0x50], xmm1
movaps xmmword [rbp - 0x60], xmm0
lea rcx, [rbp + 0x160]
lea rdx, [rbp - 0x60]
call fcn.1800290b0
lock inc qword [rdi]
jle 0x180046ea1
movzx eax, byte [rbp + 0x188]
cmp al, 2
jae 0x180046df0
mov rcx, qword [rbp + 0x170]
mov rdx, qword [rbp + 0x178]
lock inc qword [rcx]
jle 0x180046ea1
movzx eax, byte [rbp + 0x188]
mov r8, qword [rbp + 0x180]
jmp 0x180046df0
mov edi, 2
cmp byte [r8 + 0x18], 2
je 0x180046dee
mov rax, qword [r8]
lock dec qword [rax]
jne 0x180046dee
mov rcx, r8
call fcn.18000b0c0
jmp 0x180046e61
movaps xmm0, xmmword [rbp + 0x160]
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], r8
mov byte [rbp - 0x38], al
mov qword [rbp - 0x30], rdi
cmp al, 3
je 0x180046e2f
cmp al, 2
je 0x180046e2f
mov rax, qword [rbp + 0x170]
lock dec qword [rax]
jne 0x180046e2f
lea rcx, [rbp + 0x170]
call fcn.18000b0c0
lea rcx, [rbp + 0x190]
call fcn.18002f1f0
mov rdi, qword [rbp - 0x60]
movups xmm0, xmmword [rbp - 0x58]
movups xmm1, xmmword [rbp - 0x48]
mov rax, qword [rbp - 0x38]
movzx ecx, byte [rbp - 0x30]
mov edx, dword [rbp - 0x2f]
mov dword [rbp + 0x160], edx
mov edx, dword [rbp - 0x2c]
mov dword [rbp + 0x163], edx
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm1
mov qword [rsi + 0x30], rax
mov byte [rsi + 0x38], cl
mov eax, dword [rbp + 0x160]
mov ecx, dword [rbp + 0x163]
mov dword [rsi + 0x39], eax
mov dword [rsi + 0x3c], ecx
mov qword [rsi + 8], rdi
movabs rax, 0x8000000000000002
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x440
pop rdi
pop rsi
pop rbp
ret
ud2
Function at 0x180050c80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x180050cc2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x180050cca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x180050cdb
jmp 0x180050cf2
xor r10d, r10d
jmp 0x180050d7d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x180050cf2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x180050d09
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x180050d29
add r11, r8
jmp 0x180050e59
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x180050df2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x180050da0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x180050e0f
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x180050e20
jmp 0x180050e3b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x180050e3b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x180050e55
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800d85d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
sub rbx, rdx
movabs rax, 0x7ffffffffffffffc
cmp rbx, rax
ja 0x1800d8795
mov rdi, rdx
mov rsi, rcx
cmp r8, rdx
je 0x1800d86bd
movzx eax, byte [0x1801dc1b9]
mov r14d, 4
mov edx, 4
mov rcx, rbx
call fcn.18000a400
test rax, rax
je 0x1800d8798
mov rcx, rbx
shr rcx, 3
cmp rbx, 0x80
jae 0x1800d86dc
xor edx, edx
mov r8, rdx
or r8, 1
test bl, 8
je 0x1800d8669
mov r9d, dword [rdi + rdx*8]
mov r10d, dword [rdi + rdx*8 + 4]
cmp r9d, r10d
mov r11d, r10d
cmovb r11d, r9d
cmova r10d, r9d
mov dword [rax + rdx*8], r11d
mov dword [rax + rdx*8 + 4], r10d
mov rdx, r8
cmp rcx, r8
je 0x1800d86c4
nop
mov r8d, dword [rdi + rdx*8]
mov r9d, dword [rdi + rdx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rdx*8], r10d
mov dword [rax + rdx*8 + 4], r9d
mov r8d, dword [rdi + rdx*8 + 8]
mov r9d, dword [rdi + rdx*8 + 0xc]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rdx*8 + 8], r10d
mov dword [rax + rdx*8 + 0xc], r9d
add rdx, 2
cmp rcx, rdx
jne 0x1800d8670
jmp 0x1800d86c4
mov eax, 4
xor ecx, ecx
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, [rax + rcx*8]
add r8, 0xfffffffffffffff8
xor edx, edx
cmp r8, rax
jb 0x1800d863a
lea r8, [rax + rcx*8]
add r8, 0xfffffffffffffffc
mov r9, rax
add r9, 4
cmp r8, r9
jb 0x1800d863a
lea r8, [rcx - 1]
shr r8, 0x3d
jne 0x1800d863a
movabs rdx, 0xffffffffffffffe
and rdx, rcx
xor r8d, r8d
movdqa xmm0, xmmword [0x18013c380]
nop dword [rax]
movdqu xmm1, xmmword [rdi + r8*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + r8*8], xmm2
add r8, 2
cmp rdx, r8
jne 0x1800d8730
cmp rcx, rdx
jne 0x1800d863a
jmp 0x1800d86c4
xor r14d, r14d
mov rcx, r14
mov rdx, rbx
call fcn.180118d70
int3
Function at 0x1800dfd10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1801dc1b9]
mov ecx, 0x1818
mov edx, 4
call fcn.18000a400
test rax, rax
je 0x1800dfe2e
xor ecx, ecx
lea rdx, [0x180172870]
movdqa xmm0, xmmword [0x18013c380]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1800dfd60
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x303
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1800d5850
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1800ddbf0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.180118d70
int3

Function at 0x1800dffa0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1801dc1b9]
mov ecx, 0x200
mov edx, 4
call fcn.18000a400
test rax, rax
je 0x1800e00ad
xor ecx, ecx
lea rdx, [0x1801740d8]
movdqa xmm0, xmmword [0x18013c380]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1800dfff0
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1800d5850
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1800ddbf0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.180118d70
int3
Function at 0x1800e7530
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x1800e75a2
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x1800e7568
add rdi, rbx
sub rsi, rbx
je 0x1800e75a2
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x1800e7560
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x1800e7560
and ebp, 0x7fffffff
jmp 0x1800e75a4
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1800e7680
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x1800f1450
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1800f14f0
jmp 0x1800f14df
jae 0x1800f15be
cmp r8, 0x201
jae 0x1800f14f0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1800f1556
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1800f152e
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.180117e20
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1800f157f
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1800f162a
mov r8d, r13d
cmp r12, r8
jne 0x1800f14d0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800f165e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1800f14df
jmp 0x1800f14f0
cmp r14, r8
jb 0x1800f1678
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1800f3db0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1800f1613
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.18000a410
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1800f15fe
jmp 0x1800f1613
lea rcx, [0x1801b4438]
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.180119080
jmp 0x1800f168d
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.180119470
ud2
Function at 0x1800f70e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10c8
call fcn.180112bd0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1030], xmm6
mov qword [rbp + 0x1028], 0xfffffffffffffffe
mov rsi, rdx
mov qword [rbp + 0x1020], rcx
mov qword [rbp + 0xfd8], rcx
mov qword [rbp + 0xfe0], rdx
lea rcx, [rbp - 0x50]
mov r8d, 0x1000
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea rbx, [0x1800fc960]
lea r12, [rbp + 0xfb0]
mov rdi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov r15, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
mov r8d, 0x1000
lea rcx, [rbp + 0xfd8]
lea rdx, [rbp - 0x50]
call fcn.1800fc880
mov r14, rdx
test rax, rax
jne 0x1800f727c
test r14, r14
je 0x1800f724c
cmp r14, 0x1000
ja 0x1800f7320
xor r13d, r13d
nop dword [rax + rax]
cmp r13, r14
ja 0x1800f72f7
mov r8d, r14d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xff4], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea rax, [rbp + 0xff4]
mov qword [rbp + 0xfc8], rax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov r9, r12
call rdi
test eax, eax
je 0x1800f7246
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r15
cmp dword [rbp + 0xff4], 1
jne 0x1800f7210
cmp dword [rbp + 0xff8], 0
jne 0x1800f724c
mov eax, dword [rbp + 0xffc]
add r13, rax
cmp r13, r14
jne 0x1800f71b0
jmp 0x1800f715b
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1020]
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1030]
add rsp, 0x10c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x1800f724c
mov rax, r14
dec rax
mov qword [rbp + 0xfe8], rax
mov rax, qword [r14 - 1]
mov qword [rbp + 0x1000], rax
mov rax, qword [r14 + 7]
mov qword [rbp + 0x1008], rax
mov rax, qword [rax]
test rax, rax
je 0x1800f72bb
mov rcx, qword [rbp + 0x1000]
call rax
mov rcx, qword [rbp + 0x1000]
mov rax, qword [rbp + 0x1008]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1800f72db
mov r8, qword [rax + 0x10]
call fcn.18000a410
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0xfe8]
call fcn.18000a410
jmp 0x1800f724c
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
lea r8, str.std_src_syspalwindowspipe.rs
mov rcx, r13
mov rdx, r14
call fcn.1801194e0
jmp 0x1800f7349
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
lea r8, str.std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r14
call fcn.180119470
ud2
Function at 0x1800fb390
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x1801b60e8]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1800fb426
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x1800fb453
test eax, eax
js 0x1800fb432
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x1800fb449
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.1800f3940
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.1800ec5c0
mov ecx, 7
int 0x29
ud2
Function at 0x1800fba40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov qword [rbp - 8], rcx
movzx r15d, byte [rdx + 0x18]
mov byte [rdx + 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 2
mov qword [rbp - 0x10], 0
mov r12, qword [rdx + 8]
movzx esi, word [rdx + 0x10]
mov eax, 2
xor edi, edi
xor r13d, r13d
jmp 0x1800fbaac
mov word [rax + rdi*2], r14w
inc rdi
mov qword [rbp - 0x10], rdi
mov rdx, qword [rbx]
mov r14d, esi
test si, si
jne 0x1800fbb50
nop dword [rax + rax]
cmp rdx, r12
je 0x1800fbc0f
lea rcx, [rdx + 1]
mov qword [rbx], rcx
movzx r9d, byte [rdx]
movzx r14d, r9b
test r14b, r14b
jns 0x1800fbb7a
mov r8d, r14d
and r8d, 0x1f
lea rcx, [rdx + 2]
mov qword [rbx], rcx
movzx r10d, byte [rdx + 1]
and r10d, 0x3f
cmp r14b, 0xdf
jbe 0x1800fbb70
lea rcx, [rdx + 3]
mov qword [rbx], rcx
movzx r14d, byte [rdx + 2]
shl r10d, 6
and r14d, 0x3f
or r14d, r10d
cmp r9b, 0xf0
jb 0x1800fbb98
lea rcx, [rdx + 4]
mov qword [rbx], rcx
movzx edx, byte [rdx + 3]
and r8d, 7
shl r8d, 0x12
shl r14d, 6
and edx, 0x3f
or edx, r14d
or edx, r8d
mov r14d, edx
cmp r14d, 0xffff
jbe 0x1800fbb7a
jmp 0x1800fbba8
mov word [rbx + 0x10], 0
xor esi, esi
cmp r14w, 0x22
je 0x1800fbb86
jmp 0x1800fbbe0
shl r8d, 6
or r8d, r10d
mov r14d, r8d
xor esi, esi
mov rdx, rcx
cmp r14w, 0x22
jne 0x1800fbbe0
xor r13b, 1
mov r14d, esi
test si, si
je 0x1800fbac0
jmp 0x1800fbb50
shl r8d, 0xc
or r14d, r8d
cmp r14d, 0xffff
jbe 0x1800fbb7a
lea r8d, [r14 + 0xff0000]
shr r8d, 0xa
or r8d, 0xd800
and r14d, 0x3ff
or r14d, 0xdc00
mov word [rbx + 0x10], r14w
mov rdx, rcx
mov esi, r14d
mov r14d, r8d
cmp r14w, 0x22
je 0x1800fbb86
nop dword [rax]
movzx ecx, r14w
cmp ecx, 0x3b
jne 0x1800fbbef
test r13b, 1
je 0x1800fbc0b
cmp rdi, qword [rbp - 0x20]
jne 0x1800fbaa0
lea rcx, [rbp - 0x20]
call fcn.1800f0840
mov rax, qword [rbp - 0x18]
jmp 0x1800fbaa0
mov byte [rbx + 0x18], 1
test rdi, rdi
setne al
or r15b, al
je 0x1800fbc48
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x40]
mov r8, rdi
call fcn.1800f3db0
movups xmm0, xmmword [rbp - 0x40]
movups xmm1, xmmword [rbp - 0x30]
mov rax, qword [rbp - 8]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x1800fbc62
jmp 0x1800fbc74
movabs rax, 0x8000000000000000
mov rcx, qword [rbp - 8]
mov qword [rcx], rax
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x1800fbc74
mov rcx, qword [rbp - 0x18]
add rdx, rdx
mov r8d, 2
call fcn.18000a410
mov rax, qword [rbp - 8]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1800fc880
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rbp - 4], 0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
lea rax, [rbp - 4]
mov qword [rbp - 0x18], rax
mov rcx, qword [rcx]
lea rax, [0x1800fc960]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x1800fc90f
mov rsi, qword [sym.imp.kernel32.dll_SleepEx]
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call rsi
cmp dword [rbp - 4], 1
jne 0x1800fc8e0
mov eax, dword [rbp]
mov esi, dword [rbp + 4]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
test eax, eax
cmovne rsi, rcx
jne 0x1800fc922
xor eax, eax
jmp 0x1800fc952
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
mov eax, ecx
and eax, 3
shr rcx, 0x20
cmp eax, 2
jne 0x1800fc942
call case.0x1800f61e7.119
xor ecx, ecx
cmp al, 0xb
setne al
cmove rsi, rcx
jmp 0x1800fc952
cmp rcx, 0xb
setne al
xor edx, edx
cmp ecx, 0xb
cmove rsi, rdx
movzx eax, al
mov rdx, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
Function at 0x180102b90
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
clc
invalid
invalid
invalid
dec dword [rcx + rcx*4 - 0x39]
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1801dc1b9]
mov ecx, 0x10
adc byte [rax], al
add byte [rax], al
mov edx, 8
call fcn.18000a400
cmp bh, byte [rax - 0x10]
dec dword [rax - 0x7b]
ror byte [rdi], 0x84
lodsb al, byte [rsi]
add byte [rax], al
invalid
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
and al, 0x28
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x20], 0x10000
and al, 0x20
add byte [rax], al
add dword [rax], eax
lea r8, case.0x1800f5ede.372
xor edi, edi
xor ecx, ecx
leave
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
adc eax, 0x176af
mov rdx, rax
test rax, rax
jne 0x180102c6d
invalid
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je case.0x1800f5051.231
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je case.0x1800f48e1.221
mov r8, qword [rax + 0x10]
call fcn.18000a410
invalid
invalid
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x20]
call fcn.18000a410
call qword [sym.imp.kernel32.dll_GetLastError]
sub dh, byte [rbp + 1]
invalid
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
invalid
push rax
pop rbx
pop rdi
pop rsi
pop r14
pop rsi
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x18], edi
mov ecx, 8
mov edx, 0x10
call fcn.180118d90
add dword [rax], eax
ud2