joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011542c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x140115455
mov rdi, qword [rdx + 0x10]
jmp 0x1401154a6
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140115476
call fcn.140018e28
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x140115490
call fcn.140018e28
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x1401154a6
call fcn.140018e28
call fcn.140007224
cmp qword [rax + 0x68], 0
je 0x1401154c0
mov rdx, rdi
mov rcx, rbp
call fcn.140113bb4
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.14011526c
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x1401154e7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x1401154f6
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140142fe0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140142e50

Function at 0x140146bcb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401f0b90]
jne 0x14013f9ba
rol rcx, 0x10
test cx, 0xffff
jne 0x14013f9b6
repz ret
ror rcx, 0x10
jmp 0x140146b24
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1401fd330]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1401fd428]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140146ba9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1401fd330]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140146bcb
mov rax, qword [rsp + 0x88]
mov qword [0x1401fd428], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1401fd3c8], rax
mov rax, qword [0x1401fd428]
mov qword [0x1401fd2a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1401fd3b0], rax
mov dword [0x1401fd290], 0xc0000409
mov dword [0x1401fd294], 1
mov rax, qword [0x1401f0b90]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401f0b98]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1401fd328], eax
mov ecx, 1
call fcn.140151ad8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401b4920]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1401fd328], 0
jne 0x140146c52
mov ecx, 1
call fcn.140151ad8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001350
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov dword [rsp + 0x64], 0x727a3f6
mov byte [rsp + 0x43], 0xae
mov ax, word [rsp + 0x62]
mov word [rsp + 0x62], ax
cmp r9d, 0
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x24], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rcx
mov word [rsp + 0xe], ax

Function at 0x1400013b8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
jne 0x1400013a6
mov word [rsp + 0x62], 0x8331
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, 0x727a3f6
mov ecx, dword [rsp + 0x24]
mov edx, ecx
mov r8d, edx
mov qword [rsp + 0x50], r8
push rax
mov word [rsp + 0x62], 0xc491
mov qword [rsp + 0x58], 0
sub eax, dword [rsp + 0x64]
mov dword fs:[rsp + 0x44], 0
mov r9b, byte [rsp + 0x6b]
mov byte [rsp + 0x6b], r9b
mov dword [rsp + 0x3c], eax
jmp 0x1400014cd
mov eax, 0x100
mov cl, byte [rsp + 0x6b]
imul eax, dword [rdx], 0x4c
and al, 0x6b
mov edx, dword [rsp + 0x34]
mov dword [rsp + 8], eax
mov eax, edx
cdq
mov r8d, dword [rsp + 8]
idiv r8d
movsxd r9, edx
mov r10, qword [rsp + 0x10]
mov r11b, byte [r10 + r9]
movzx esi, r11b
mov byte [rsp + 0x6b], cl
mov edi, esi
add edi, dword [rsp + 0x38]
mov eax, edi
mov dword [rsp + 4], edx
cdq
idiv r8d
movsxd rbx, edx
mov cl, byte [r10 + rbx]
mov byte [r10 + r9], cl
mov byte [r10 + rbx], r11b
movzx edi, byte [r10 + r9]
add edi, esi
mov byte [rsp + 0x6b], 0xf1
mov r9, qword [rsp + 0x48]
and edi, 0xff
mov esi, edi
mov ebx, esi
mov cl, byte [rsp + 0x6b]
mov r14, qword [rsp + 0x18]
mov r11b, byte [r14 + r9]
mov byte [rsp + 0x6b], cl
xor r11b, byte [r10 + rbx]
mov r9, qword [rsp + 0x48]
mov qword [rsp + 0x70], 0x2dec620e
mov rbx, qword [rsp + 0x28]
mov byte [rbx + r9], r11b
mov bp, word [rsp + 0xe]
xor bp, 0xffff
mov word [rsp + 0x62], bp
mov r9, qword [rsp + 0x48]
add r9, 1
mov r15, qword [rsp + 0x50]
mov cl, byte [rsp + 0x6b]
mov r11b, 0x9e
mov al, cl
mul r11b
mov byte [rsp + 0x6b], al
mov qword [rsp + 0x58], r9
mov esi, dword [rsp + 4]
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x3c], edx
mov byte [rsp + 0x6b], 0x36
cmp r9, r15
je 0x140001392
invalid
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
and al, 0x70
or rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], rcx
mov edx, dword [rsp + 0x3c]
add eax, 0x27f103d8
mov dword [rsp + 0x38], edx
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x44]
and al, 0x44
mov qword [rsp + 0x48], rcx
add edx, 1
mov dword [rsp + 0x34], edx
and al, 0x34
mov r8w, word [rsp + 0xe]
mov word [rsp + 0x62], r8w
mov edx, dword [rsp + 0x6c]
and edx, dword [rsp + 0x6c]
mov r9b, byte [rsp + 0x43]
mov dword [rsp + 0x6c], edx
imul edx, dword [rsp + 0x6c], 0x10c412fe
mov dword [rsp + 0x6c], edx
push rsp
and al, 0x6c
mov qword [rsp + 0x58], 0x2663461c
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x3c], 0x80d72af
mov r10b, byte [rsp + 0x6b]
xor r10b, 0xff
mov byte [rsp + 0x6b], r10b
cmp r9b, 0x82
jb 0x1400014cd
jmp 0x1400013e8
Function at 0x1400014d4
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
jne 0x1400013a6
mov word [rsp + 0x62], 0x8331
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, 0x727a3f6
mov ecx, dword [rsp + 0x24]
mov edx, ecx
mov r8d, edx
mov qword [rsp + 0x50], r8
push rax
mov word [rsp + 0x62], 0xc491
mov qword [rsp + 0x58], 0
sub eax, dword [rsp + 0x64]
mov dword fs:[rsp + 0x44], 0
mov r9b, byte [rsp + 0x6b]
mov byte [rsp + 0x6b], r9b
mov dword [rsp + 0x3c], eax
jmp 0x1400014cd
mov eax, 0x100
mov cl, byte [rsp + 0x6b]
imul eax, dword [rdx], 0x4c
and al, 0x6b
mov edx, dword [rsp + 0x34]
mov dword [rsp + 8], eax
mov eax, edx
cdq
mov r8d, dword [rsp + 8]
idiv r8d
movsxd r9, edx
mov r10, qword [rsp + 0x10]
mov r11b, byte [r10 + r9]
movzx esi, r11b
mov byte [rsp + 0x6b], cl
mov edi, esi
add edi, dword [rsp + 0x38]
mov eax, edi
mov dword [rsp + 4], edx
cdq
idiv r8d
movsxd rbx, edx
mov cl, byte [r10 + rbx]
mov byte [r10 + r9], cl
mov byte [r10 + rbx], r11b
movzx edi, byte [r10 + r9]
add edi, esi
mov byte [rsp + 0x6b], 0xf1
mov r9, qword [rsp + 0x48]
and edi, 0xff
mov esi, edi
mov ebx, esi
mov cl, byte [rsp + 0x6b]
mov r14, qword [rsp + 0x18]
mov r11b, byte [r14 + r9]
mov byte [rsp + 0x6b], cl
xor r11b, byte [r10 + rbx]
mov r9, qword [rsp + 0x48]
mov qword [rsp + 0x70], 0x2dec620e
mov rbx, qword [rsp + 0x28]
mov byte [rbx + r9], r11b
mov bp, word [rsp + 0xe]
xor bp, 0xffff
mov word [rsp + 0x62], bp
mov r9, qword [rsp + 0x48]
add r9, 1
mov r15, qword [rsp + 0x50]
mov cl, byte [rsp + 0x6b]
mov r11b, 0x9e
mov al, cl
mul r11b
mov byte [rsp + 0x6b], al
mov qword [rsp + 0x58], r9
mov esi, dword [rsp + 4]
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x3c], edx
mov byte [rsp + 0x6b], 0x36
cmp r9, r15
je 0x140001392
invalid
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
and al, 0x70
or rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], rcx
mov edx, dword [rsp + 0x3c]
add eax, 0x27f103d8
mov dword [rsp + 0x38], edx
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x44]
and al, 0x44
mov qword [rsp + 0x48], rcx
add edx, 1
mov dword [rsp + 0x34], edx
and al, 0x34
mov r8w, word [rsp + 0xe]
mov word [rsp + 0x62], r8w
mov edx, dword [rsp + 0x6c]
and edx, dword [rsp + 0x6c]
mov r9b, byte [rsp + 0x43]
mov dword [rsp + 0x6c], edx
imul edx, dword [rsp + 0x6c], 0x10c412fe
mov dword [rsp + 0x6c], edx
push rsp
and al, 0x6c
mov qword [rsp + 0x58], 0x2663461c
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x3c], 0x80d72af
mov r10b, byte [rsp + 0x6b]
xor r10b, 0xff
mov byte [rsp + 0x6b], r10b
cmp r9b, 0x82
jb 0x1400014cd
jmp 0x1400013e8
Function at 0x2fc4d3a6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d3aea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d3ae1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d3ae1
mov rax, qword [rbp - 8]
jmp 0x2fc4d3aff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d3ab4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400018e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000192e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000192e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000192e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000192e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000192e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001930
xor al, al
add rsp, 0x28
ret
Function at 0x180001790
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea edi, [r8 - 0x4049]
mov eax, edi
lea r10d, [rcx - 0x3c5f]
xor eax, 0x3b75
lea esi, [r9 - 0x4a4]
add ecx, 0x636
lea r8d, [r9 - 0x3b7]
lea ebp, [rdx - 0x43f1]
cmp esi, eax
jne 0x1800018f0
lea eax, [r9 + 0x303]
xor eax, 0x270
cmp ecx, eax
jl 0x180001895
mov rdx, qword [rsp + 0x60]
mov ecx, dword [rdx + 0x120]
mov r8d, dword [rdx + 0x64]
lea eax, [rcx - 7]
mov dword [rdx + 0xf4], eax
cmp r8d, dword [rdx + 0x8c]
jbe 0x18000181f
mov eax, dword [rdx + 0xf8]
xor eax, dword [rdx + 0xa4]
add eax, r8d
xor dword [rdx + 0x28], eax
jmp 0x18000182e
lea eax, [rcx + 0x389e2]
mov ecx, dword [rdx + 0x28]
imul ecx, eax
mov dword [rdx + 0x28], ecx
mov r8d, dword [rdx + 0x28]
cmp r8d, dword [rdx + 0x128]
ja 0x180001850
mov eax, dword [rdx + 0x10c]
imul eax, dword [rdx + 0x8c]
mov dword [rdx + 0x10c], eax
jmp 0x18000186c
mov ecx, dword [rdx + 0x10c]
mov eax, dword [rdx + 0xa4]
xor eax, ecx
sub ecx, eax
sub ecx, 0x1371d5
mov dword [rdx + 0x10c], ecx
mov ecx, dword [rdx + 0x78]
cmp ecx, dword [rdx + 0x7c]
jb 0x180001880
mov eax, dword [rdx + 0x48]
add eax, 0x1da5b919
mov dword [rdx], eax
jmp 0x1800018f0
mov eax, dword [rdx + 0xf8]
add eax, 0xfffcf5a4
add eax, ecx
add eax, r8d
mov dword [rdx + 0x78], eax
jmp 0x1800018f0
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x60]
mov eax, dword [rbx + 0x7c]
add eax, dword [rbx + 0x58]
xor eax, dword [rbx + 0xa0]
cmp r10d, eax
jne 0x1800018eb
mov eax, dword [rbx + 0x70]
sub r8d, edi
mov r9d, dword [rbx + 0x10c]
movsxd rdx, r8d
or r9, rax
mov r8d, edi
mov qword [rsp + 0x20], rdx
lea eax, [rcx + 0x4019]
or r8d, 0x3f25
movsxd rcx, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebp, edi
add dword [rbx + 0xb0], ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
lea eax, [rsi + 0xed]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180002cb0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
sub rsp, 0x48
mov esi, dword [rsp + 0x80]
mov rbx, rdx
mov qword [rsp + 0x60], rbp
add esi, 0xffffbc0f
mov ebp, dword [rsp + 0x90]
mov qword [rsp + 0x70], r12
add ebp, 0xffffc3fb
mov qword [rsp + 0x40], r13
lea r12d, [rcx + 0x704]
mov qword [rsp + 0x38], r14
lea eax, [rsi + 0x3c6a]
mov qword [rsp + 0x30], r15
lea r15d, [rcx - 0x3c18]
lea r13d, [rcx + 0x4a]
lea r14d, [r8 - 0x610]
cmp ebp, eax
jg 0x180002e24
lea eax, [rsi + 0x3c05]
cmp ebp, eax
jge 0x180002d6d
cmp dword [rdx + 0x84], 0x1851d
jae 0x180002d38
mov eax, dword [rdx + 0x30]
add eax, 0x6ff4d
add dword [rdx + 0x80], eax
mov ecx, dword [rdx + 0x28]
cmp ecx, dword [rdx + 0x78]
jb 0x180002d57
mov ecx, dword [rdx + 0x5c]
add ecx, 0x8b17e
add ecx, dword [rdx + 0x30]
xor dword [rdx + 0x80], ecx
jmp 0x180002e24
mov eax, dword [rdx + 0x128]
xor eax, 0x14ebe
imul eax, ecx
mov dword [rdx + 0x28], eax
jmp 0x180002e24
mov eax, dword [rdx + 0x114]
sub eax, r14d
cmp esi, eax
jne 0x180002e24
mov eax, dword [rdx + 0x6c]
and eax, 0x3c05
mov qword [rsp + 0x68], rdi
imul eax, dword [rdx + 0x30]
mov edi, esi
cmp esi, eax
ja 0x180002e1f
nop dword [rax]
mov eax, dword [rbx + 0x58]
and eax, ebp
add eax, 0x3ea6
cmp dword [rbx + 0x20], eax
je 0x180002e0d
mov ecx, dword [rbx + 0x60]
mov eax, esi
or eax, 0x3ea6
add eax, r15d
movsxd rdx, eax
mov eax, r12d
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [rbx + 0x28]
and eax, dword [rbx + 0x114]
mov r9d, dword [rbx + 0x120]
mov ecx, dword [rbx + 0x78]
or r9d, 0x4295
sub r9d, dword [rbx + 0x10c]
imul r8d, eax, 0x3ea6
mov eax, dword [rbx + 0x20]
mov edx, ebp
xor rdx, rax
mov eax, dword [rbx + 0x60]
or rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [rbx + 0x6c]
inc edi
and eax, 0x3c05
imul eax, dword [rbx + 0x30]
cmp edi, eax
jbe 0x180002da0
mov rdi, qword [rsp + 0x68]
cmp dword [rbx + 0x128], 0x11a78
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
jne 0x180002e56
mov eax, dword [rbx + 0x8c]
sub eax, dword [rbx + 0x7c]
xor eax, dword [rbx + 0xa4]
xor eax, 0x247d
mov dword [rbx + 0xa4], eax
jmp 0x180002e64
mov eax, dword [rbx + 0x78]
add eax, 0x3c6922fc
xor dword [rbx + 0x80], eax
mov eax, dword [rbx + 0x84]
lea r9d, [r13 + 0x407]
mov dword [rbx + 0xf0], eax
lea r8d, [r15 + 0x4295]
mov eax, r14d
mov qword [rsp + 0x28], rbx
xor eax, 0x281
lea edx, [r14 + 0x589]
lea ecx, [r13 + 0x17f]
mov dword [rsp + 0x20], eax
call fcn.18000b510
cmp dword [rbx + 0x48], 0x8b03
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
jbe 0x180002ed3
mov eax, dword [rbx + 0x28]
add eax, dword [rbx + 0x20]
xor eax, dword [rbx + 0x58]
add dword [rbx + 0x6c], eax
lea eax, [rsi + 0x3b75]
add rsp, 0x48
pop rsi
pop rbx
ret
mov eax, dword [rbx + 0xf0]
mov edx, dword [rbx + 0x20]
add edx, 5
add edx, dword [rbx + 0x24]
imul eax, edx
mov dword [rbx + 0xf0], eax
lea eax, [rsi + 0x3b75]
add rsp, 0x48
pop rsi
pop rbx
ret
Function at 0x180003480
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
lea r15d, [r8 - 0x3ea6]
mov ebp, eax
lea r13d, [rcx - 0x3b75]
mov r14d, ecx
xor ebp, 0x2ee
xor r14d, 0x71f
mov rsi, r9
lea r12d, [rax - 0x463]
lea eax, [r12 + 0x4a]
cmp r14d, eax
jl 0x1800035bc
cmp dword [r9 + 0x28], 0x8fe0
jbe 0x1800034f4
mov ecx, dword [r9 + 0x48]
add ecx, 0x18121
add ecx, dword [r9 + 0x38]
mov dword [r9 + 0x20], ecx
jmp 0x18000350c
mov eax, dword [r9 + 0x20]
mov ecx, dword [r9 + 0x84]
add ecx, 0x665b2
imul eax, ecx
mov dword [r9 + 0x20], eax
lea eax, [r15 + 0x416c]
mov dword [rsp + 0x30], eax
lea edx, [rbp - 0x129]
mov dword [rsp + 0x28], edx
lea r10d, [rbp + 0x15c]
mov rdx, rsi
mov dword [rsp + 0x20], r10d
lea r9d, [r14 + 0x3af]
lea r8d, [r13 + 0x4295]
lea ecx, [r15 + 0x3b75]
call sym.bpapele498of.dll_Pah52
mov r8d, r12d
mov qword [rsp + 0x20], rsi
mov ecx, r15d
lea r9d, [r12 + 0x401]
xor r8d, 0x7c51
lea edx, [r12 + 0x7d9]
xor ecx, 0x3c5f
mov ebx, eax
call fcn.180001790
lea r8d, [r15 + 0x3c18]
xor ebx, 0x105
sub ebx, 0x144
lea r9d, [r13 + 0x43f1]
xor r15d, 0x3c05
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r8d
lea ecx, [r13 + 0x416c]
mov r8, rsi
mov edx, r15d
mov ebp, eax
call fcn.18000bf90
jmp 0x180003695
mov qword [rsp + 0x28], 0xe19
mov edx, 0x3320
mov ecx, 0x349a
mov qword [rsp + 0x20], 0x1819
mov r9d, 0x1859
mov qword [rsp + 0x70], rdi
mov r8d, 0x3dbb
call fcn.180002020
movsxd rcx, eax
mov qword [0x180065330], rcx
lea ecx, [r12 + r15]
mov edi, dword [rsi + 0x38]
mov r9d, dword [rsi + 0x30]
and edi, 1
mov ebx, dword [rsi + 0x5c]
or rdi, 0x436a
mov r11d, dword [rsi + 0x120]
mov edx, dword [rsi + 0x50]
sub ebx, dword [rsi + 0x84]
lea r10d, [r9 - 0x407b]
xor r11d, dword [rsi + 0xf8]
xor ebx, r15d
mov r8d, dword [rsi + 0xdc]
xor r11d, 0x4049
mov eax, dword [rsi + 0x64]
and r9d, 0x425f
mov qword [rsp + 0x38], rdi
and r8d, r14d
mov dword [rsp + 0x30], ebx
and rcx, rax
mov dword [rsp + 0x28], r11d
imul edx, r13d
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [rsi + 0x10c]
mov edx, dword [rsi + 0x60]
add ecx, 0x3de1
and edx, 0x3c62
mov eax, r12d
or edx, r13d
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
xor ebp, 0x7e3d
mov eax, ebp
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x18000b510
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10d, edx
lea eax, [r8 - 0x4b4]
mov ebx, r9d
lea edi, [r9 - 0x109]
xor r10d, 0x206
xor ebx, 0x7ecf
add edx, 0xfffffe02
mov r11d, ecx
cmp edx, eax
jle 0x18000b61a
mov rcx, qword [rsp + 0x68]
lea eax, [rdi - 0x2f6]
cmp r11d, eax
je 0x18000b5d3
mov r8d, dword [rcx + 0x74]
add ebx, 0x2c6
mov r11d, dword [rcx + 0x80]
cmp r8d, r11d
ja 0x18000b61a
mov edx, dword [rcx + 0x84]
mov r9d, dword [rcx + 0xf0]
mov r10d, dword [rcx + 0x7c]
nop word [rax + rax]
sub edx, dword [rcx + 0xa4]
mov eax, r8d
add edx, dword [rcx + 0xe4]
imul eax, r8d
sub r10d, edx
inc r8d
mov dword [rcx + 0x84], edx
mov dword [rcx + 0x7c], r10d
add r9d, eax
mov dword [rcx + 0xf0], r9d
cmp r8d, r11d
jbe 0x18000b590
lea eax, [rbx - 0xf1]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rcx + 0x64]
sub eax, r10d
imul eax, eax, 0x3f25
cmp edx, eax
je 0x18000b61a
mov edx, dword [rcx + 0x60]
sub r10d, edi
mov r9d, dword [rcx + 0xdc]
mov r8d, ebx
add r9d, dword [rcx + 0x78]
xor r8d, r11d
or edx, r11d
mov qword [rsp + 0x20], rcx
lea ecx, [r10 - 0x407b]
add r8d, r11d
sub edx, r11d
call fcn.18000bc00
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [rbx - 0xf1]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000bd50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x30
mov edx, dword [rsp + 0x80]
lea r15d, [rcx - 0x3f25]
mov rbx, qword [rsp + 0x88]
lea eax, [r15 + 0x3c5f]
mov ebp, r8d
lea r13d, [rcx - 0x2bb]
lea r8d, [rcx + 0x370]
lea esi, [rdx - 0x700]
mov dword [rsp + 0x60], r8d
xor edx, 0x9b
lea r14d, [rbp - 0x3f60]
mov dword [rsp + 0x80], edx
xor ebp, 0x3f60
cmp esi, eax
jl 0x18000be0b
add esi, 0x502
lea ecx, [rdx - 0x87]
xor esi, 0x7a19
xor r14d, 0x4019
mov r9d, esi
mov r8d, esi
add r14d, 0x27c
xor r9d, 0x792a
xor r8d, 0x71f
mov rdx, rbx
lea eax, [rsi + 0xf5]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
call fcn.180002f00
mov r8d, dword [rsp + 0x60]
mov r14d, eax
lea ecx, [r14 - 0x765]
cmp r13d, ecx
jl 0x18000bf70
lea ecx, [rsi + 0xf5]
cmp r13d, ecx
jne 0x18000bf70
mov ecx, r13d
xor ecx, 0x7e35
cmp r15d, ecx
je 0x18000be7b
mov r10d, ebp
lea eax, [r14 - 0x40a]
xor r10d, 0x4019
lea r9d, [rsi + 0x4d4]
mov ecx, ebp
mov dword [rsp + 0x28], r10d
lea r8d, [r13 + 0x787]
mov dword [rsp + 0x20], eax
xor ecx, 0x4295
mov rdx, rbx
call fcn.18000c2c0
add ebp, 0x3f25
jmp 0x18000bf70
mov qword [rsp + 0x68], rdi
mov edi, r15d
mov qword [rsp + 0x70], r12
lea r12d, [r15 - 0x425f]
add r12d, r8d
cmp r15d, r12d
jle 0x18000bec2
nop word [rax + rax]
mov eax, dword [rbx + 0x60]
sub eax, r14d
add eax, esi
cmp dword [rbx + 0xc0], eax
jbe 0x18000beb6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
inc edi
cmp edi, r12d
jg 0x18000bea0
mov r8d, dword [rsp + 0x60]
mov eax, dword [rbx + 0x84]
or eax, dword [rbx + 0x64]
mov r12, qword [rsp + 0x70]
sub eax, 0x425f
mov rdi, qword [rsp + 0x68]
cmp r15d, eax
jbe 0x18000bf70
mov eax, dword [rbx + 0xe4]
xor eax, r8d
cmp r15d, eax
je 0x18000bf70
mov ecx, dword [rsp + 0x80]
mov edx, dword [rbx + 0x60]
mov r10d, ecx
imul r10d, dword [rbx + 0x110]
movsxd rax, r13d
sub r13d, dword [rbx + 0x128]
movsxd r9, esi
mov r8d, r13d
or r9, rax
mov eax, r15d
or rdx, rax
mov qword [rsp + 0x20], r10
mov eax, r15d
xor rdx, rcx
imul eax, r15d
or r9, 0x4019
sub eax, 0x3c62
movsxd rcx, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
sub eax, r14d
movsxd rcx, eax
movsxd rax, r15d
or rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [rbx + 0x124]
or eax, 0x4049
sub eax, dword [rbx + 0x110]
mov dword [rbx + 0x124], eax
mov rbx, qword [rsp + 0x78]
xor ebp, 0x45
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x18000c2c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov r10d, dword [rsp + 0x68]
lea r14d, [r9 - 0x3ea]
mov esi, ecx
lea r15d, [r8 - 0x610]
mov ecx, dword [rsp + 0x60]
xor esi, 0x2ee
mov rbx, rdx
xor r10d, 0x7c1c
xor ecx, 0x7f1b
lea edx, [r8 - 0x43f1]
lea eax, [rsi + 0x21a]
mov dword [rbx + 0x88], 0xaa7
cmp ecx, eax
je 0x18000c3c4
lea eax, [rsi - 0x463]
cmp ecx, eax
je 0x18000c359
mov ecx, 0x1b6c13
sub ecx, dword [rbx + 0x60]
cmp dword [rbx + 0x78], 0xf76f
mov dword [rbx + 0x88], ecx
jbe 0x18000c3c4
mov eax, dword [rbx + 0xe4]
sub eax, dword [rbx + 0x5c]
add eax, 0x12ba
add eax, ecx
mov dword [rbx + 0x88], eax
jmp 0x18000c3c4
mov eax, dword [rbx + 0xa0]
add eax, r14d
and eax, edx
cmp dword [rbx + 0x10c], eax
je 0x18000c3c4
mov ecx, dword [rbx + 0x6c]
add ecx, edx
cmp r10d, ecx
je 0x18000c3c4
mov qword [rsp + 0x40], rbp
lea ebp, [rdx - 0x3f60]
mov qword [rsp + 0x48], rdi
mov edi, dword [rbx + 0x84]
cmp edi, ebp
jl 0x18000c3ba
mov ecx, dword [rbx + 0x60]
mov edx, dword [rbx + 0xc]
mov r8d, ecx
mov eax, esi
xor rcx, rax
imul r8d, r15d
mov eax, dword [rbx + 0x84]
imul edx, esi
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc edi
cmp edi, ebp
jge 0x18000c390
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea eax, [r14 - 0xea]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret