joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003b00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140003b2d
xor eax, eax
jmp 0x140003c99
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003b67
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003b67
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003c99
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140003c8c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003baa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003bd5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003c91
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003c44
sub eax, 1
je 0x140003c44
cmp eax, 2
jne 0x140003c8c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003c91
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003c72
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003c8c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003c91
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140005610
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140004000
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400040d3
cmp byte [rcx + 0x71], 0
je 0x1400040d3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400040cf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004094
sub eax, 1
je 0x140004098
cmp eax, 2
jne 0x1400040cf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005610
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400040c6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400040cf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000407c
xor al, al
jmp 0x14000407c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005610
add rsp, 0x60
pop rbx
ret

Function at 0x1400050e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140005164
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140007510]
cmp byte [rcx + rax], 0
je 0x140005164
dec r8
sub rdx, 1
jne 0x14000514a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400061a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400061ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400061ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400061ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400061ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400061ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400061f0
xor al, al
add rsp, 0x28
ret
Function at 0x180009370
Capabilities:
Encode data using xor

Disassembly:
stosb byte [rdi], al
cmp ecx, dword [rdi - 0x4174c0cd]
adc eax, 0xd0f40ea1
add ax, 0x6a76
invalid
mov ch, 0x5c
cmpsb byte [rsi], byte [rdi]
mov dl, 0x82
test dword [rbp - 0x851e6d3], ecx
sbb byte [rax], 0x9b
jg 0x180009320
invalid

Function at 0x18000d910
Capabilities:
Encode data using xor

Disassembly:
adc ah, dl
cmp ebx, dword [rbx + rax]
jg 0x18000d8e1
std
invalid
call 0x178770923
wrmsr
jbe 0x18000d90c
test eax, 0x57af04dc
dec byte [rbp + 2]
invalid
or ecx, dword [rdi + 0x63]

Function at 0x180016340
Capabilities:
Encode data using xor

Disassembly:
jae 0x180016343
shl byte [rax], cl
int1
int1
xchg ebx, eax
mov bl, 0x38
jge 0x1800162e6
invalid

Function at 0x18004b6e0
Capabilities:
Encode data using xor

Disassembly:
shl byte [rax], cl
int1
xchg ebx, eax
jrcxz 0x18004b766
fbstp tbyte [rax]
scasb al, byte [rdi]
mov edi, 0xb7b2cd4c
movabs al, byte [0xee8f55ea74351b85]
invalid
hlt

Function at 0x180073830
Capabilities:
Encode data using xor

Disassembly:
vorpd ymm13, ymm2, ymmword [rbp + 0x40]
invalid
insb byte [rdi], dx
invalid
jb 0x18007377d
invalid
sbb dword [rdx], esi
jbe 0x1800737d5
mov bl, 0xf
sti
cwde
and eax, 0xfa5db18a
xor dword [rbx], 0xf7d802e7
add bl, al
test eax, 0x568c8b8f
push rbp
mov ds, esi
adc edx, edx
or dword [rbp - 0x1a], edi
jle 0x180073891
stc
cmp eax, 0xeb7f7fcb
jne 0x1800737fa
fadd st(1)
mov ebp, 0x9086183c
jp 0x1800738d0
invalid
fdivrp st(7)
loopne 0x18007389e
ret 0xee80
invalid
sbb dh, byte [rdi - 0x7a]
clc
invalid
Function at 0x1400012f0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x140005740], 0
movaps xmm0, xmmword [0x140003410]
movss xmm6, dword [0x1400033f8]
movups xmmword [0x1400056b0], xmm0
mov dword [0x1400056c0], 0x42f00000
mov dword [0x1400056c4], 0x43160000
je 0x14000151f
lea rcx, str.Connection_success
call fcn.140001150
movss xmm0, dword [0x1400056c4]
lea rbx, [0x1400056d0]
movss xmm1, dword [0x1400056c0]
xor edi, edi
movss xmm2, dword [0x1400056bc]
xorps xmm7, xmm7
movss xmm4, dword [0x1400056b8]
movss xmm5, dword [0x1400056b4]
movss xmm3, dword [0x1400056b0]
movaps xmm9, xmmword [0x140003400]
movss xmm8, dword [0x1400033fc]
mov qword [rsp + 0x50], 0x7d0
nop dword [rax]
cvtss2sd xmm0, xmm0
lea r8, str._.2f__.2f__.2f__.2f__.2f__.2f_n
mov edx, 0x64
mov rcx, rbx
cvtss2sd xmm1, xmm1
movsd qword [rsp + 0x40], xmm0
movsd qword [rsp + 0x38], xmm1
cvtss2sd xmm2, xmm2
cvtss2sd xmm4, xmm4
movsd qword [rsp + 0x30], xmm2
cvtss2sd xmm3, xmm3
cvtss2sd xmm5, xmm5
movsd qword [rsp + 0x28], xmm4
movq r9, xmm3
movsd qword [rsp + 0x20], xmm5
call fcn.1400011b0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], dil
jne 0x140001416
mov rcx, qword [0x140005738]
lea r9, [rsp + 0x58]
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140001458
mov rcx, qword [0x140005738]
lea r8, [0x140005744]
lea rdx, [0x140005750]
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rcx, [rsp + 0x50]
call fcn.140001570
movups xmm3, xmmword [0x1400056b0]
movss xmm1, dword [0x1400056c0]
movss xmm0, dword [0x1400056c4]
subps xmm3, xmm9
addss xmm1, xmm8
addss xmm0, xmm8
comiss xmm7, xmm3
movss dword [0x1400056c0], xmm1
movss dword [0x1400056c4], xmm0
movups xmmword [0x1400056b0], xmm3
jbe 0x1400014ae
movss dword [0x1400056b0], xmm6
movaps xmm3, xmm6
movss xmm5, dword [0x1400056b4]
comiss xmm7, xmm5
jbe 0x1400014c6
movss dword [0x1400056b4], xmm6
movaps xmm5, xmm6
movss xmm4, dword [0x1400056b8]
comiss xmm7, xmm4
jbe 0x1400014de
movss dword [0x1400056b8], xmm6
movaps xmm4, xmm6
movss xmm2, dword [0x1400056bc]
comiss xmm7, xmm2
jbe 0x1400014f6
movss dword [0x1400056bc], xmm6
movaps xmm2, xmm6
comiss xmm7, xmm1
jbe 0x140001506
movss dword [0x1400056c0], xmm6
movaps xmm1, xmm6
comiss xmm7, xmm0
jbe 0x1400013c0
movss dword [0x1400056c4], xmm6
movaps xmm0, xmm6
jmp 0x1400013c0
lea rdx, str.COM1
lea rcx, str.Connection_to__s_failed._n
call fcn.140001150
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001750
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rdi
ret
Function at 0x1400020bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002106
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002106
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002106
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002106
cmp dword [rcx + 0x84], 0xe
jbe 0x140002106
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002108
xor al, al
add rsp, 0x28
ret
Function at 0x18000c8a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13d, [rcx + 7]
mov r14, r9
mov r12, r8
mov rbx, rdx
cmp ecx, r13d
jae 0x18000c9fd
mov rdi, qword [rsp + 0x80]
lea r15d, [rcx - 0x77]
lea rdx, [0x180000000]
cmp r15d, 0x1c
ja case.0x18000c902.6
movzx eax, byte [rdx + r15 + 0xca9c]
mov ecx, dword [rdx + rax*4 + 0xca80]
add rcx, rdx
jmp rcx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x53]
call fcn.180063980
test eax, eax
jne 0x18000ca1e
xor esi, esi
cmp dword [r12], esi
jbe 0x18000c9e6
lea rbp, [rdi + 0xf]
nop dword [rax]
lea rax, [rbx + 0xf]
cmp rdi, rax
ja 0x18000c964
cmp rbp, rbx
jb 0x18000c964
mov rax, rdi
mov edx, 0x10
nop word [rax + rax]
movzx ecx, byte [rbx]
inc rbx
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18000c950
jmp 0x18000c978
movdqu xmm1, xmmword [rbx]
add rbx, 0x10
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rdi], xmm1
mov r9, r14
mov r8, rdi
mov rdx, rdi
mov ecx, 6
call fcn.18002f6b0
add esi, 0x10
cmp esi, dword [r12]
jb 0x18000c930
jmp 0x18000c9e6
cmp byte [0x18073dbf9], 0
je case.0x18000c902.6
call qword [0x18073dbf0]
mov byte [0x18073dbf9], 0
jmp 0x18000c9e6
mov eax, dword [rdi]
mov dword [r14 + 4], eax
jmp case.0x18000c902.6
mov r8d, 0x81
mov rdx, r14
xor ecx, ecx
mov esi, 1
call fcn.18005e9f0
cmp eax, esi
jbe 0x18000c9e6
nop
mov r8d, 0x81
mov rdx, r14
xor ecx, ecx
inc esi
call fcn.18005e9f0
cmp esi, eax
jb 0x18000c9d0
lea rdx, [0x180000000]
inc r15d
lea eax, [r15 + 0x77]
cmp eax, r13d
jb 0x18000c8e5
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, dword [r12]
lea r8, [rsp + 0x60]
mov r9d, 0x9c
mov dword [rsp + 0x60], eax
mov rdx, rbx
mov qword [rsp + 0x20], r14
mov rcx, rdi
call fcn.18003cc80
jmp 0x18000c9fd
mov rbx, qword [r14]
mov rsi, qword [r14 + 8]
cmp rbx, rsi
je 0x18000ca6e
nop
mov rcx, qword [rbx]
mov r8d, 0x1a
mov rdx, rdi
call fcn.180027230
test al, al
jne 0x18000ca75
add rbx, 8
cmp rbx, rsi
jne 0x18000ca50
mov byte [rsp + 0x60], 0
jmp 0x18000c9fd
mov byte [rsp + 0x60], 1
jmp 0x18000c9fd
xor eax, eax
jmp 0x18000ca01
Function at 0x18001d1c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, dword [rsp + 0x90]
mov r13, r9
imul eax, r12d, 0x5b8
mov rdi, r8
movaps xmmword [rsp + 0x30], xmm6
mov r15, rdx
mov r14, rcx
mov ebx, r12d
mov dword [rsp + 0x90], eax
cmp r12d, eax
ja 0x18001d3a7
movdqa xmm6, xmmword [rsp + 0x20]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x70]
nop
cmp ebx, 0x8b0f
ja 0x18001d31b
je 0x18001d30c
cmp ebx, 0x2e9b
ja 0x18001d2db
je 0x18001d2be
mov eax, ebx
sub eax, 0xc
je 0x18001d2a8
sub eax, 0x55
je 0x18001d263
cmp eax, 0x5f
jne 0x18001d387
movdqu xmm6, xmmword [r15]
pxor xmm6, xmmword [rdi]
jmp 0x18001d387
cmp qword [rdi], 0
je 0x18001d2cf
cmp qword [r13], 0
je 0x18001d2cf
mov eax, dword [r15]
test eax, eax
jne 0x18001d283
mov dword [r15], 0x10
mov eax, 0x10
mov ecx, eax
shl rcx, 3
call fcn.18006f754
mov rbp, rax
test rax, rax
je 0x18001d2cf
mov ecx, 0x20
call fcn.18006f754
mov rsi, rax
jmp 0x18001d387
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18001d3cd
jmp 0x18001d387
test rsi, rsi
jne 0x18001d387
mov rcx, rbp
call fcn.18006f74c
mov qword [r14], 0
jmp 0x18001d3a7
cmp ebx, 0x5c40
je 0x18001d2fe
cmp ebx, 0x5cd5
jne 0x18001d387
mov qword [rsi], rbp
mov dword [rsi + 8], 0
jmp 0x18001d387
aesdec xmm6, xmmword [rdi + 0x10]
aesdec xmm6, xmmword [rdi + 0x20]
jmp 0x18001d387
mov eax, dword [r15]
mov dword [rsi + 0xc], eax
mov rax, qword [rdi]
mov qword [rsi + 0x10], rax
jmp 0x18001d387
cmp ebx, 0xb7c0
je 0x18001d37b
cmp ebx, 0xb949
je 0x18001d39c
cmp ebx, 0x11340
je 0x18001d373
cmp ebx, 0x16ec0
je 0x18001d36b
cmp ebx, 0x1ca40
jne 0x18001d387
aesdec xmm6, xmmword [rdi + 0x70]
aesdec xmm6, xmmword [rdi + 0x80]
aesdec xmm6, xmmword [rdi + 0x90]
aesdeclast xmm6, xmmword [rdi + 0xa0]
movdqu xmmword [r14], xmm6
jmp 0x18001d3a7
aesdec xmm6, xmmword [rdi + 0x60]
jmp 0x18001d387
aesdec xmm6, xmmword [rdi + 0x50]
jmp 0x18001d387
aesdec xmm6, xmmword [rdi + 0x30]
aesdec xmm6, xmmword [rdi + 0x40]
imul eax, r12d, 0x7a
add ebx, eax
cmp ebx, dword [rsp + 0x90]
jbe 0x18001d220
jmp 0x18001d3a7
mov rax, qword [r13]
mov qword [rsi + 0x18], rax
mov qword [r14], rsi
movaps xmm6, xmmword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rax, r14
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.me_de_fichiers__attendez_...
call fcn.18002cc20
int3
Function at 0x18003f070
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x58
lea edi, [rcx + 0x51]
mov r14, rdx
mov ebx, ecx
cmp ecx, edi
jae 0x18003f0bc
xor ebp, ebp
mov eax, ebx
sub eax, 0x25
je 0x18003f0cd
sub eax, 0x56
je 0x18003f0ab
cmp eax, 0x1b
jne 0x18003f0b5
mov rcx, qword [r14]
test rcx, rcx
je 0x18003f0b5
call fcn.18006f74c
mov qword [r14], rbp
jmp 0x18003f0b5
test r14, r14
je 0x18003f0bc
cmp qword [r14], rbp
je 0x18003f0bc
add ebx, 0x1b
cmp ebx, edi
jb 0x18003f088
mov eax, dword [rsp + 0x80]
add rsp, 0x58
pop r14
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [r14]
lea r8, [rsp + 0x80]
mov r9d, 0xb8
mov dword [rsp + 0x80], eax
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x50], rsi
xor ecx, ecx
mov dword [rsp + 0x90], 2
call fcn.180017910
mov esi, eax
lea r8, [rsp + 0x98]
mov eax, dword [r14]
lea rdx, [rsp + 0x20]
mov r9d, 0xb8
mov dword [rsp + 0x98], eax
xor ecx, ecx
mov dword [rsp + 0x20], 1
call fcn.180017910
mov edi, eax
lea r8, [rsp + 0x28]
mov eax, dword [r14]
lea rdx, [rsp + 0x30]
mov r9d, 0xb8
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov dword [rsp + 0x30], ebp
call fcn.180017910
mov ebx, eax
lea r8, [rsp + 0x38]
mov eax, dword [r14]
lea rdx, [rsp + 0x40]
mov r9d, 0xb8
mov dword [rsp + 0x38], eax
xor ecx, ecx
mov dword [rsp + 0x40], 3
call fcn.180017910
lea r9, str.cw
movzx edx, dil
movzx ecx, sil
mov rsi, qword [rsp + 0x50]
movzx r8d, byte [rdx + r9]
movzx ecx, byte [rcx + r9]
shl ecx, 8
xor ecx, r8d
movzx edx, bl
shl ecx, 8
movzx r8d, byte [rdx + r9]
movzx edx, al
xor ecx, r8d
shl ecx, 8
movzx eax, byte [rdx + r9]
xor eax, ecx
add rsp, 0x58
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800418c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
imul r13d, r8d, 0x42f
mov ebp, r8d
mov rsi, rdx
mov r14, rcx
mov edi, r8d
cmp r8d, r13d
ja 0x180041a61
mov r12, qword [rsp + 0x2b8]
xor ebx, ebx
mov r15, qword [rsp + 0x2b8]
nop word [rax + rax]
cmp edi, 0xbf
ja 0x1800419bc
je 0x180041a84
cmp edi, 5
je 0x180041988
cmp edi, 0x13
je 0x180041972
cmp edi, 0x38
jne 0x180041a50
movzx eax, byte [r14]
lea r8, [rsp + 0x2b8]
mov dword [rsp + 0x2b0], eax
lea ecx, [rdi + 0x2b]
lea rax, [rsp + 0x2b0]
mov dword [rsp + 0x2b8], 8
mov r9, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.180058af0
jmp 0x180041a50
mov rcx, qword [rsi + 8]
call fcn.18006f74c
mov rcx, rsi
call fcn.18006f74c
jmp 0x180041a50
mov rax, qword [r14]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8d, 0xc9
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
call fcn.18005dad0
mov r15, rax
jmp 0x180041a50
cmp edi, 0x11f
je 0x1800419f3
cmp edi, 0x302
je 0x180041acd
cmp edi, 0xaca6
jne 0x180041a50
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180041aed
jmp 0x180041ac0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x180041add
imul ecx, ebp, 0x99
add edi, ecx
cmp edi, r13d
jbe 0x180041910
mov rax, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r14]
lea r9, [rsp + 0x2b0]
mov qword [rsp + 0x2b8], rax
lea rdx, [rsp + 0x2b8]
mov eax, dword [rsi + 8]
mov r8d, 0x81
mov rcx, rsi
mov dword [rsp + 0x2b0], eax
call fcn.1800692d0
mov dword [rsp + 0x2b8], eax
jmp 0x180041a61
mov rax, qword [rsp + 0x48]
mov qword [r14], rax
mov rax, r12
jmp 0x180041a69
test r15, r15
jne 0x180041ad7
mov rax, rbx
jmp 0x180041a69
mov rax, qword [r15 + 0x10]
jmp 0x180041a69
mov rdx, rsi
lea rcx, str.CWecRebexSftp.ReleaseForReuse
call fcn.18002cc20
int3
mov rdx, rsi
lea rcx, str.D__EFGHIJKLMNOPHHHHQ_RHSHTHUVWX7YZ_
call fcn.18002cc20
int3
Function at 0x1800461a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea r12d, [rcx - 0xc]
mov rdi, r8
mov rsi, rdx
mov r14d, ecx
cmp ecx, r12d
jbe case.0x18004620d.2
mov r13, qword [rsp + 0xa8]
lea r15d, [rcx - 0x34]
mov rbp, qword [rsp + 0xa8]
lea rdx, [0x180000000]
xor ebx, ebx
nop word [rax + rax]
cmp r15d, 0x30
ja case.0x18004620d.12
movzx eax, byte [rdx + r15 + 0x46440]
mov ecx, dword [rdx + rax*4 + 0x4640c]
add rcx, rdx
jmp rcx
test r13, r13
je 0x180046365
mov rax, qword [rdi]
mov qword [r13 + 0x18], rax
mov rax, qword [rsi]
mov qword [r13 + 0x20], rax
mov dword [r13 + 8], ebx
jmp case.0x18004620d.12
mov rcx, qword [rsi]
mov rbp, rbx
cmp rcx, qword [rdi + 0x10]
jae case.0x18004620d.12
nop
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x18004624d
mov rax, qword [rdi]
movsx ecx, byte [rcx + rax]
call fcn.18006ed94
test eax, eax
je case.0x18004620d.10
mov rcx, qword [rsi]
inc rbp
inc rcx
mov qword [rsi], rcx
cmp rcx, qword [rdi + 0x10]
jb 0x180046240
jmp 0x18004632a
xor r9d, r9d
mov dword [r13 + 0x10], ebx
mov rdx, r13
mov qword [r13 + 0x28], rbx
xor ecx, ecx
lea r8d, [r9 + 0x3c]
call fcn.18000ac10
test eax, eax
je 0x18004635d
mov qword [rsp + 0x30], r13
jmp 0x18004632a
mov rax, qword [0x1800b60d0]
mov dword [rsp + 0xa8], 0x80
mov dword [rsp + 0x90], ebx
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x40], rax
jmp case.0x18004620d.12
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xfc
xor edx, edx
mov qword [rsp + 0x38], rbx
xor ecx, ecx
call fcn.180043d70
jmp 0x18004632a
mov r9d, dword [rsp + 0x90]
xor r8d, r8d
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x38]
call sub.IMM32.dll_ImmGetCompositionStringW
mov qword [0x1800b60d0], rbx
jmp 0x18004632a
mov rcx, qword [rsp + 0x40]
mov edx, 8
call fcn.180069fec
jmp 0x18004632a
mov ecx, 0x30
call fcn.18006f754
mov r13, rax
lea rdx, [0x180000000]
dec r14d
dec r15d
cmp r14d, r12d
ja 0x1800461f0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r13
call fcn.18006f74c
mov rax, rbx
jmp 0x180046345
mov eax, dword [rdi]
cmp eax, dword [rsi]
jge 0x18004637a
mov dword [rsp + 0x30], 0xffffffff
jmp case.0x18004620d.2
jle 0x180046387
mov eax, 1
mov dword [rsp + 0x30], eax
jmp case.0x18004620d.2
mov dword [rsp + 0x30], ebx
jmp case.0x18004620d.2
mov rax, rbp
jmp 0x180046345
mov rdi, qword [rdi + 0x18]
mov ebx, 0xb0
mov ecx, dword [rsp + 0x90]
cmp ebx, 6
je 0x1800463fd
cmp ebx, 0xb0
je 0x1800463cf
cmp ebx, 0x7f30
jne 0x1800463e2
mov eax, 1
sub eax, ecx
movsxd rcx, eax
mov rax, qword [rdi + 0x18]
mov rax, qword [rax + rcx*8 + 0x20]
jmp 0x180046345
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
lea r8d, [r9 + 0x2d]
call fcn.18000ac10
mov ecx, eax
add ebx, 0x7e80
cmp ebx, 0x17b80
jbe 0x1800463a2
mov rax, qword [rsp + 0xa8]
jmp 0x180046345
lea rax, str.unknown
jmp 0x180046345
Function at 0x18004bd20
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r12d, [r8 + 0x4d0]
mov r13, r9
mov edi, r8d
mov r15, rdx
cmp r8d, r12d
jae 0x18004bded
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x30]
mov esi, dword [rsp + 0x90]
cmp edi, 0xbf
ja 0x18004be1b
je 0x18004be0c
mov eax, edi
sub eax, 0xf
je 0x18004bd95
sub eax, 0x5a
je 0x18004bd90
cmp eax, 0x1e
jne 0x18004bdde
mov esi, 0x1505
mov r14, r15
jmp 0x18004bdde
mov qword [r15], rcx
jmp 0x18004bdde
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x6c]
call fcn.18004f630
mov r8d, 0x81
mov rdx, rax
xor ecx, ecx
mov rbp, rax
xor ebx, ebx
call fcn.18005e9f0
test eax, eax
je 0x18004bdd6
nop
mov r8d, 0x81
mov rdx, rbp
xor ecx, ecx
inc ebx
call fcn.18005e9f0
cmp ebx, eax
jb 0x18004bdc0
mov rcx, qword [rsp + 0x80]
add edi, 0xb0
cmp edi, r12d
jb 0x18004bd63
mov eax, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbp
mov ecx, 0x114
call fcn.18001e480
jmp 0x18004bdd6
mov eax, edi
sub eax, 0x119
je 0x18004be5c
sub eax, 0x1e
je 0x18004be68
cmp eax, 0x92
jne 0x18004bdde
lea rax, [r15 + 0x108]
mov r9d, 0xd7
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call fcn.18000cb90
jmp 0x18004bdd6
mov qword [r15 + 0x100], r13
jmp 0x18004bdde
movzx ecx, byte [r14]
test cl, cl
je 0x18004be84
imul esi, esi, 0x21
lea r14, [r14 + 1]
movzx ecx, cl
add esi, ecx
movzx ecx, byte [r14]
test cl, cl
jne 0x18004be70
mov eax, esi
jmp 0x18004bdf4