joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d3a80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d4482
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d451a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d44fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d44f2
cmp qword [rbp - 0x10], 0
je 0x2fc4d44f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d44b8
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d451b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4620
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4648
mov eax, 0
jmp 0x2fc4d4696
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4671
mov eax, 0
jmp 0x2fc4d4696
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4691
mov eax, 0
jmp 0x2fc4d4696
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d469c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d471a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4711
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4711
mov rax, qword [rbp - 8]
jmp 0x2fc4d472f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d46e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000bf20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x129
syscall
ret

Function at 0x14000bf3e
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x41
syscall
ret

Function at 0x1400138c0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400139f0
Function at 0x1404fd22e
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs rsi, 0x65660ea1039b491d
mov rsi, qword [rsp + 0x10]
add qword [rsp + 0x18], 0xffffffffbfb0aab7
push qword [rsp]
popfq
lea rsp, [rsp + 0x20]
call fcn.140ab013c
lea ebp, [rcx - 0x35bb726]
xor al, 0xdd
jae 0x1404fd239
sub eax, 0x28c570c0
invalid
Function at 0x2fc4cb2f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cbcf2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f0108]
test eax, eax
je 0x2fc4cbd8a
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f0110]
mov qword [rbp - 8], rax
jmp 0x2fc4cbd6e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cbd62
cmp qword [rbp - 0x10], 0
je 0x2fc4cbd62
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cbd28
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cbd8b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cbe90
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cbeb8
mov eax, 0
jmp 0x2fc4cbf06
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cbee1
mov eax, 0
jmp 0x2fc4cbf06
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cbf01
mov eax, 0
jmp 0x2fc4cbf06
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cbf0c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cbf8a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cbf81
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cbf81
mov rax, qword [rbp - 8]
jmp 0x2fc4cbf9f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cbf54
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400010a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
movsxd r9, r9d
mov rbx, rcx
mov r10d, r11d
test r9, r9
je 0x140001124
sub rdx, r8
lea eax, [r11 + 1]
and eax, 0x800000ff
jge 0x1400010d7
dec eax
or eax, 0xffffff00
inc eax
movsxd r11, eax
movzx esi, byte [r11 + rbx]
add r10d, esi
and r10d, 0x800000ff
jge 0x1400010f8
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rcx, r10d
mov al, byte [rcx + rbx]
mov byte [r11 + rbx], al
mov byte [rcx + rbx], sil
movzx eax, byte [r11 + rbx]
add rax, rsi
movzx eax, al
mov cl, byte [rax + rbx]
xor cl, byte [rdx + r8]
mov byte [r8], cl
inc r8
sub r9, 1
jne 0x1400010c3
mov rbx, qword [rsp + 8]
xor eax, eax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140001188
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [section..data]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, dword [section..data]
mov rbx, rax
mov r8d, r9d
test r9d, r9d
je 0x1400011c9
xor edx, edx
mov rcx, rax
call fcn.1400011ec
mov r9d, dword [section..data]
mov r8, rbx
lea rdx, [0x140003004]
lea rcx, str.TVnmtodKnpjfLslUasRzjaZUeQbJIOLwH
call fcn.140001138
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18000e6f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18000e724
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18000e710
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x18001aa60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x18013e378]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x6c34
mov dword [rsp + 0x20], 0x6c5d6c52
mov dword [rsp + 0x24], 0x6c516c46
mov dword [rsp + 0x28], 0x6c5b6c52
mov qword [rsp + 0x2c], 0x6c346c4c
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret
Function at 0x18001b4b0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.18001ad70
test al, al
je 0x18001b6e4
call fcn.180002590
test al, al
jne 0x18001b53d
call fcn.180002790
test al, al
je 0x18001b507
call fcn.180048a50
test al, al
sete al
jmp 0x18001b531
call fcn.180002390
test al, al
je 0x18001b6e4
lea rcx, [rsp + 0x90]
call fcn.180002990
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x18001b53d
call fcn.180048a50
mov byte [rsp + 0x20], al
test al, al
je 0x18001b6e4
call fcn.180002790
test al, al
je 0x18001b551
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.18001b720
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x18001b59d
mov r8d, ebx
jmp 0x18001b5aa
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x18001b5a0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800041a0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180061920
nop
cmp qword [rsp + 0x48], 8
jb 0x18001b5dd
mov rcx, qword [rsp + 0x30]
call fcn.180071ef0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180002e30
nop
call fcn.180038280
mov dl, 1
mov ecx, 0x2718
call fcn.18001d220
call fcn.180002790
test al, al
je 0x18001b636
xor edx, edx
lea rcx, [0x1800490b0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x1800490b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18001b64d
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18001b655
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180039350
nop
cmp qword [rsp + 0xc8], 8
jb 0x18001b67c
mov rcx, qword [rsp + 0xb0]
call fcn.180071ef0
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18001b6e4
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18001b6e4
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001b6e4
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.1800519d0
mov rcx, qword [0x18013cfd8]
test rcx, rcx
je 0x18001b6fe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180093670
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x18001c140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5203
lea r8, [0x18013e4b8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 9]
mov dword [rsp + 0x20], 0x52625274
mov dword [rsp + 0x24], 0x52625269
mov dword [rsp + 0x28], 0x525c526e
mov dword [rsp + 0x2c], 0x52375235
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret
Function at 0x180036560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x224e
lea r8, [0x18013ea90]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x2226222d
mov dword [rsp + 0x24], 0x2221223c
mov dword [rsp + 0x28], 0x222b2223
mov dword [rsp + 0x2c], 0x222a2260
mov dword [rsp + 0x30], 0x22222222
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret

Function at 0x1800366f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5203
lea r8, [0x18013eab8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x526b5260
mov dword [rsp + 0x24], 0x526c5271
mov dword [rsp + 0x28], 0x5266526e
mov dword [rsp + 0x2c], 0x5267522d
mov dword [rsp + 0x30], 0x526f526f
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret
Function at 0x180036fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x18013eb50]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xc]
mov r9d, 0x4948
mov dword [rsp + 0x20], 0x492d493b
mov dword [rsp + 0x24], 0x493d492b
mov dword [rsp + 0x28], 0x497b493a
mov dword [rsp + 0x2c], 0x4966497a
mov dword [rsp + 0x30], 0x4924492c
mov qword [rsp + 0x34], 0x49484924
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret

Function at 0x180038f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x265c
lea r8, [0x18013ed40]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x262f260b
mov dword [rsp + 0x24], 0x2603266e
mov dword [rsp + 0x28], 0x266e266f
mov dword [rsp + 0x2c], 0x26382672
mov dword [rsp + 0x30], 0x26302630
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret
Function at 0x180039150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5611
lea r8, [0x18013ed70]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x56625646
mov dword [rsp + 0x24], 0x564e5623
mov dword [rsp + 0x28], 0x56235622
mov dword [rsp + 0x2c], 0x5675563f
mov dword [rsp + 0x30], 0x567d567d
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048f00
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180093670
add rsp, 0x130
pop rbp
ret
Function at 0x180048950
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x1800489b1
xor al, al
jmp 0x180048a2c
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
call fcn.180047c10
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800635f0
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800489e4
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180048a28
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180048a28
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x180048a28
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180093670
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18004a240
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18012db10]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call fcn.18009a500
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x18004a2a6
cmp dword [rsp + 0x28], 2
jb 0x18004a2a6
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180093670
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180093670
add rsp, 0x158
ret