joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a49a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, reloc.OLEAUT32.dll_VariantTimeToSystemTime
call fcn.1800724d0
sub rsp, rax
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x110]
xor esi, esi
mov r13, r9
movsxd rdi, r8d
mov r12, rdx
mov rbp, rcx
mov eax, esi
test r9, r9
je 0x1800a49ee
lea eax, [rsi + 1]
mov qword [rcx], r9
jmp 0x1800a49f1
mov r13, qword [rcx]
mov qword [rsp + 0xb0], rbx
test rdx, rdx
je 0x1800a4ac1
mov rcx, r13
call fcn.1800a89a0
mov ebx, eax
cmp eax, 0x80
jle 0x1800a4a2b
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x54
call fcn.1800a84f0
cmp ebx, edi
jge 0x1800a4a63
lea rcx, [rbp + 8]
mov r8, r14
mov rdx, r13
call fcn.1800a7020
lea rcx, [rbp + 8]
mov r8, rdi
mov rdx, r12
call fcn.1800a7100
lea r12, [rbp + 0x68]
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 8]
mov r8, r12
call fcn.1800a7120
jmp 0x1800a4a9e
test edi, edi
js 0x1800a4a6f
cmp edi, 0x80
jle 0x1800a4a87
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x5e
call fcn.1800a84f0
lea rcx, [rbp + 0x6c]
mov r8, rdi
mov rdx, r12
call fcn.180070320
lea r12, [rbp + 0x68]
mov dword [r12], edi
mov ecx, dword [r12]
cmp ecx, 0x80
je 0x1800a4ac9
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rcx + rbp + 0x6c]
call fcn.18006f140
jmp 0x1800a4ac9
test eax, eax
je 0x1800a4b7d
lea rax, [rsp + 0x20]
mov rdi, rbp
mov rdx, rsi
sub rdi, rax
nop word [rax + rax]
lea rcx, [rsp + rdx + 0x20]
add rdx, 2
movzx eax, byte [rdi + rcx + 0x6c]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rdi + rcx + 0x6d]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x1800a4ae0
lea rcx, [rbp + 0x28]
mov r8, r14
mov rdx, r13
call fcn.1800a7020
mov rcx, r13
call fcn.1800a89a0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x28]
movsxd r8, eax
call fcn.1800a7100
nop dword [rax]
lea rdx, [rsp + rsi + 0x20]
add rsi, 2
movzx eax, byte [rdi + rdx + 0x6c]
xor al, 0x5c
mov byte [rdx], al
movzx eax, byte [rdi + rdx + 0x6d]
xor al, 0x5c
mov byte [rdx + 1], al
cmp rsi, 0x80
jl 0x1800a4b30
lea rcx, [rbp + 0x48]
mov r8, r14
mov rdx, r13
call fcn.1800a7020
mov rcx, r13
call fcn.1800a89a0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x48]
movsxd r8, eax
call fcn.1800a7100
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.1800a72c0
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18006f110
add rsp, 0xb8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a7770
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1800724d0
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x1800a787d
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
movzx ecx, byte [r10 - 1]
cmp r8d, 3
jl 0x1800a77ff
movzx eax, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
movzx eax, byte [rdx + rbx]
mov byte [r9 + 3], al
jmp 0x1800a7854
shl ecx, 0x10
cmp r8d, 2
jne 0x1800a7811
movzx eax, byte [r10]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
cmp r8d, 1
jne 0x1800a7840
lea eax, [r8 + 0x3c]
jmp 0x1800a784b
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
sub r8d, 3
add r9, 4
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x1800a77a0
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1800a84f0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x28
call fcn.1800724d0
sub rsp, rax
mov r9, r8
mov r8d, edx
mov rdx, rcx
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.1800a8220
add rsp, 0x28
jmp fcn.18008947c
Function at 0x1800af7c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800724d0
sub rsp, rax
mov rbx, r8
call fcn.1800af1d0
test eax, eax
js 0x1800af9fe
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1800af849
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x1800af800
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1800af9fc
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x180000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x101140]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x101140]
mov r9d, dword [rdi + rdx*4 + 0x101d40]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x102540]
movzx ecx, byte [rdi + rax*4 + 0x101140]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x102940]
movzx ecx, byte [rdi + rax*4 + 0x101140]
xor r9d, dword [rdi + rcx*4 + 0x102140]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x101140]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x101140]
mov r8d, dword [rdi + rdx*4 + 0x101d40]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x102540]
movzx ecx, byte [rdi + rax*4 + 0x101140]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x102140]
movzx ecx, byte [rdi + rax*4 + 0x101140]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x102940]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x101140]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x101140]
mov r8d, dword [rdi + rdx*4 + 0x101d40]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x102540]
movzx ecx, byte [rdi + rax*4 + 0x101140]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x102140]
movzx ecx, byte [rdi + rax*4 + 0x101140]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x102940]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x101140]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x101140]
mov r8d, dword [rdi + rdx*4 + 0x102540]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x102140]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x101140]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x101d40]
movzx ecx, byte [rdi + rax*4 + 0x101140]
xor r8d, dword [rdi + rcx*4 + 0x102940]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1800af870
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800b0660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800724d0
sub rsp, rax
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1800b081c
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1800b07b8
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1800abf70
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1800b0752
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1800b081c
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18006f110
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800c0c30
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x1800c0c88
movzx eax, byte [rcx]
test al, al
je 0x1800c0c88
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x1800c0c50
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x1800d3e10
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180155c14]
test ecx, ecx
jne 0x1800d3f74
mov eax, dword [0x180155c10]
cmp eax, 3
ja 0x1800d3f74
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180155c10], eax
call fcn.18009fed0
test eax, eax
je 0x1800d3e56
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800d3e63
lea rcx, [0x18010a830]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800d3e75
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rbx
mov qword [0x180155bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMemoryInfo
mov rcx, rbx
mov qword [0x180155bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov qword [0x180155bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
mov qword [0x180155bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleInformation
mov rcx, rbx
mov qword [0x180155be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180155be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180155bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameA
mov rcx, rbx
mov qword [0x180155bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameW
mov rcx, rbx
mov qword [0x180155c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180155c08], rax
mov dword [0x180155c14], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800d40d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180155cb4]
test ecx, ecx
jne 0x1800d4290
mov eax, dword [0x180155cb0]
cmp eax, 3
ja 0x1800d4290
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180155cb0], eax
call fcn.18009fed0
test eax, eax
je 0x1800d4116
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800d4123
lea rcx, [0x18010aa20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800d4135
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.WTSOpenServerA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSOpenServerW
mov rcx, rbx
mov qword [0x180155c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSCloseServer
mov rcx, rbx
mov qword [0x180155c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSFreeMemory
mov rcx, rbx
mov qword [0x180155c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateSessionsA
mov rcx, rbx
mov qword [0x180155c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateSessionsW
mov rcx, rbx
mov qword [0x180155c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSTerminateProcess
mov rcx, rbx
mov qword [0x180155c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateProcessesA
mov rcx, rbx
mov qword [0x180155c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateProcessesW
mov rcx, rbx
mov qword [0x180155c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSSendMessageA
mov rcx, rbx
mov qword [0x180155c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSSendMessageW
mov rcx, rbx
mov qword [0x180155c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQuerySessionInformationA
mov rcx, rbx
mov qword [0x180155c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQuerySessionInformationW
mov rcx, rbx
mov qword [0x180155c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSWaitSystemEvent
mov rcx, rbx
mov qword [0x180155ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180155ca8], rax
mov dword [0x180155cb4], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x14000206c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001ed4
Function at 0x140001bd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c22
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c24
xor al, al
add rsp, 0x28
ret

Function at 0x140866a1e
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov qword [rsp], 0x20870c19
test rcx, rcx
lea rsp, [rsp + 0x10]
je 0x140866a92
mov edx, 0x9191d029
lea rax, [0x140867658]
mov edx, 0x2d28a30d
shl dx, 0x87
movzx edx, byte [rbx + rdx*2 - 0x5a510d00]
push 0x7f1041b1
xor edx, r9d
dec byte [rsp + 4]
inc byte [rsp + 5]
and edx, 0xff
mov edx, dword [rax + rdx*4]
shl word [rsp + 6], 0xf
shr r9d, 8
xor r9d, edx
inc rbx
xor r9d, 0x76aead1c
dec rcx
lea rsp, [rsp + 8]
jne 0x140866a43
not r9d
call fcn.1408718a3

Function at 0x14089023a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140899287
jmp 0x14088a65a
add rsi, 0xa
shld rax, rdx, cl
push 0xffffffffd0031f0f
mov qword [rsi], rax
call fcn.14088a118
movzx r8w, byte [rbp + riz]
mov eax, 0x3e283b89
mov al, byte [rbp + rax*2 - 0x7c507710]
jmp 0x140880caf
lea rsp, [rsp + 8]
jmp 0x1408a2b12
ja 0x1408a2e33
inc ax
mov bx, word [rax + r10 - 0x3b1b3311]
setge al
lea r10, [r10 + rax*2 - 0x76366600]
call fcn.140885cf5
jmp 0x14088401c
add rbp, 2
push 0xffffffffbeaa9d03
add r8b, al
mov word [rbp + riz], r8w
jmp 0x14088daab
adc rbx, 0xc
xor ebp, ebp
test r9, r9
push 0xffffffffe5a30f94
lea rsp, [rsp + 0x10]
je 0x1408a2ed7
mov edx, 0xed9e0013
push rbx
shr dl, 0x63
push rdx
sbb qword [rsp], 0xfffffffff2912726
lea rbx, [0x1408938a8]
lea rsp, [rsp + 8]
mov edx, 0x7517588f
movzx edx, byte [rdx + r10 - 0x7517588f]
push 0xffffffff9a821110
xor edx, ebp
and edx, 0xff
mov edx, dword [rbx + rdx*4]
shr byte [rsp], 0x41
inc dword [rsp + 1]
push 0x4a2bc233
shr ebp, 8
xor ebp, edx
ror qword [rsp + 8], 0x8d
inc r10
xor ebp, 0x2ab6950d
add qword [rsp + 8], 0x6b86643d
dec r9
lea rsp, [rsp + 0x10]
jne 0x1408a2e6d
push 0xffffffffc6b6c614
push 0x3896562a
mov rbx, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
call fcn.140876d71
call fcn.140865d18
jmp 0x140879ba1
Function at 0x180c77268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180c773ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180c77299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c7727f
add dl, dl
jne 0x180c772a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c77306
xor eax, eax
add dl, dl
jne 0x180c772b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c773bd
add dl, dl
jne 0x180c772c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c772d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c772e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c772ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180c772fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180c7728e
mov eax, 1
add dl, dl
jne 0x180c77316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c77323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c7730b
sub eax, ebx
mov ebx, 1
jne 0x180c7735c
mov ecx, 1
add dl, dl
jne 0x180c7733e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c7734b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c77333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c7728e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180c77378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c77385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c7736d
cmp eax, 0x7d00
jae 0x180c773ab
cmp eax, 0x500
jb 0x180c773a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c7728e
cmp eax, 0x7f
ja 0x180c773ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c7728e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180c773e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180c7728e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
movabs rcx, 0x5d943b914035bf99
movabs rdx, 0x1000
movabs r8, 0x3d90
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
add rdx, rax
add r8, rax
mov r9, rdx
xor qword [rdx], rcx
add rdx, 8
cmp rdx, r8
jb 0x140004034
jmp r9
Function at 0x1400068d8
Capabilities:
Read file on windows

Disassembly:
fcos
mov eax, dword [rbp - 0x64]
mov ebx, dword [rax + 4]
mov eax, dword [rbx + 8]
cmp eax, dword [rbp - 0x68]
ja 0x140006895
in al, dx
mov eax, ebx
call 0x13ff48780
mov eax, dword [rbp - 0x14]
mov edx, dword [rax]
call qword [rdx + 0x44]
invalid
invalid
add byte [rax], al
add byte [rbx + 0x635ae8d3], cl
jb 0x14000694f
jae 0x140006880
jg 0x140006940
add byte [rdx], al
add byte [rax], al
add byte [rax], al
xor byte [rax + 0x2f005a], al
jo 0x1400068f4
jae 0x1400068f6
add byte [rax], al
mov al, 4
add al, byte [rax]
or eax, 0x4d541300
jne 0x1400069b3
je 0x1400069b2
push rdi
invalid
cmp al, 0x53
jns 0x1400069c7
je 0x1400069bb
insd dword [rdi], dx
insb byte [rdi], dx
invalid
and al, 0x60
invalid
cdq
jbe 0x1400069bf
add byte [rbp + 0x412575c0], al
mov eax, 0x8000
add byte [rax], al
Function at 0x1400083f4
Capabilities:
Get token membership
Packed with generic packer

Disassembly:
add byte [rdx], al
add byte [rdx], cl
outsd dx, dword [rsi]
insb byte [rdi], dx
insb byte [rdi], dx
invalid

Function at 0x140009cfc
Capabilities:
Terminate process

Disassembly:
js 0x140009d1f
push rcx
add byte [rdx + 0x61], ah
invalid
add byte [rbp - 5], dl
and dl, 0xfc
mov eax, dword [rbp - 4]
call 0x13fdd3f34
xor eax, eax
pop rdx
adc byte [rax], al
add al, byte [rax]
add eax, 0x65646e49
js 0x140009d3e
add byte [rdx], al
add byte [rsp + rsi*2 + 8], bl
add esp, 0xfffffff0
call 0x13ff034a0
mov byte [rbp - 1], dl
mov ebx, eax
xor esp, dword [rbp + 0x6d]
jae 0x140009d83
push rsp
push rbx
je 0x140009dd2
insb byte [rdi], dx
outsd dx, dword gs:[rsi]
outsd dx, dword [rsi]
imul eax, dword [rbx + 1], 8
mov byte [rcx + 0x65], al
add byte [rax], al
add byte [rbx + rdx*2], al
insb byte [rdi], dx
add al, byte [rax]
add al, byte [rbp + 8]
add dword [rax - 0x18], 2
mov eax, dword [rbp + 8]
add dword [rax - 0x14], 2
mov eax, dword [rbp + 8]
nop
nop
nop
nop
nop
nop
nop
dec dword [rax]
outsd dx, dword [rsi]
outsb dx, byte [rsi]
je 0x140009e4b
outsd dx, dword [rsi]
insb byte [rdi], dx
jae 0x140009ddf
add byte [rax + rdx - 0x6f3c3fcd], bl
adc byte [rbx], dh
rol bl, 0x90
push rbx
push rsi
push rdi
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.14000f3b0
add byte [rax - 0x80000000], al
invalid
or dword [rbx + 0x64], eax
mov edx, esi
add dword [rbx], esp
cld
mov dword [rdx + 0x10], ecx
mov dword [rax - 4], edx
je 0x140009e84
mov byte [rbx], 0
pop rbx
push rbp
mov ebp, esp
push 0
push rbx
push rsi
push rdi
mov ebx, edx
mov esi, eax
xor eax, eax
push rbp
push 0xffffffffc68bd055
call 0x13ffbe9c0
mov eax, dword [rbp - 0x30]
lea edx, [rbp - 0x2c]
call 0x140009e98
mov ah, 0x27
add byte [rax*4 - 0x7aebffc0], cl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add ah, cl

Function at 0x140009f6c
Capabilities:
Create process on windows
Terminate process

Disassembly:
add al, 2
add bh, bh
invalid
or eax, 0xc3746547
lea eax, [rax]
push rbx
cmp word [rax + 0x372], 0
je 0x140009f8f
mov eax, dword [rax + 0x3b0bb]
add byte [rax], al
je 0x140009fe8
test esi, 0x80000
jne 0x140009f21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rbp - 0x977b], cl
call qword [rax + 0x54]
jne 0x14000a067
je 0x14000a065
insd dword [rdi], dx
imul rbp, qword [rsi + 0x74], 0x776f6853
outsb dx, byte gs:[rsi]
jb 0x14000a070
invalid
hlt
and eax, 0x42004555
add ah, dh
jmp qword [rcx + 1]
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
je 0x14000a082
add byte gs:[rdi], ah
jb 0x14000a088
add byte gs:[rcx], bh
add byte [rax], al
add byte [rax], al
add al, byte [rax]
add al, byte [rax]
jb 0x14000a097
cmc
add byte [rsi], r9b
imul bp, word gs:[rax - 0x21], 0x62
add dword [rax], eax
add eax, 0x756c6156
add al, byte gs:[rax]
add al, byte [rax]
pop rbx
ret
Function at 0x14000c394
Capabilities:
Contain obfuscated stackstrings

Disassembly:
js 0x14000c406
invalid
jb 0x14000c3d2
outsd dx, dword [rsi]
add byte [rbp], dh
jo 0x14000c3d8
add byte [rax], dh
jge 0x14000c3da
pop rsp
add byte [rax], al
add byte [rax], al
add byte [rax + 0x75], bh
push rcx
add byte [rbx + rcx*4 + 0x72240053], cl
push rcx
add byte [rax - 0x6fffac74], bh
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and al, 0x61
je 0x14000c3d0
and al, 0x62
je 0x14000c3d5
and al, 0x63
jo 0x14000c3da
and al, 0x64
jae 0x14000c3df
and al, 0x65
cmp al, dh
and al, 0x66
invalid