joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e0b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r13, qword [0x140074b90]
mov r11d, dword [r13]
mov r12, rcx
test r11d, r11d
jne 0x14005e0f0
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14005e158
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x14005e170
mov r13d, dword [0x14007c5d8]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov r14d, eax
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r14d
mov r13, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r13, r13
je 0x14005e1e8
mov rbx, qword [r13]
cmp rbx, rsi
jb 0x14005e230
sub rsi, 1
mov rax, qword [r13 + rsi*8 + 8]
test rax, rax
jne 0x14005e0d9
mov rcx, r12
call fcn.14005dfb0
mov qword [r13 + rsi*8 + 8], rax
jmp 0x14005e0d9
call fcn.14005dfb0
mov qword [r12 + 0x10], rax
jmp 0x14005e0d9
mov r10d, dword [r13]
test r10d, r10d
je 0x14005e292
mov r9d, dword [0x140068900]
test r9d, r9d
je 0x14005e2c0
lock add dword [0x14007c5e0], 1
jne 0x14005e2f4
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x14005e2a0
mov eax, dword [r13]
test eax, eax
je 0x14005e0f9
mov eax, 0xffffffff
lock xadd dword [0x14007c5e0], eax
sub eax, 1
js 0x14005e0f9
mov rcx, qword [0x14007c5e8]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x14005e0f9
lea rcx, [rsi + 0x21]
mov edx, 8
lea rbx, [rsi + 0x20]
call sym.calloc
mov r13, rax
test rax, rax
je 0x14005e31b
mov qword [rax], rbx
mov ecx, dword [0x14007c5d8]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14005e137
call rdi
jmp 0x14005e137
lea r14, [rbx + rbx]
lea rax, [rsi + 0x20]
mov rcx, r13
cmp rsi, r14
cmova r14, rax
lea rdx, [r14*8 + 8]
call sym.realloc
mov r13, rax
test rax, rax
je 0x14005e31b
mov qword [rax], r14
sub r14, rbx
lea rcx, [rax + rbx*8 + 8]
xor edx, edx
lea r8, [r14*8]
call sym.memset
jmp 0x14005e209
call fcn.14005e050
mov dword [0x140068900], 1
mov edx, dword [r13]
test edx, edx
jne 0x14005e18d
mov rsi, qword [r12 + 0x10]
test rsi, rsi
jne 0x14005e0f9
mov rax, qword [0x14007c5d0]
lea rsi, [rax + 1]
mov qword [0x14007c5d0], rsi
mov qword [r12 + 0x10], rsi
jmp 0x14005e1a9
lock add dword [0x140068904], 1
je 0x14005e277
mov r8d, dword [0x140068900]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [0x140068900]
test r8d, r8d
jne 0x14005e286
nop dword [rax]
xor ecx, ecx
call rsi
mov ecx, dword [rbx]
test ecx, ecx
je 0x14005e2e8
jmp 0x14005e286
mov rcx, qword [0x14007c5e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14005e19b
lock sub dword [0x14007c5e0], 1
jmp 0x14005e19b
call sym.abort
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x2fc4c39d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4c4a90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4c43d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e8108]
test eax, eax
je 0x2fc4c446a
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e8110]
mov qword [rbp - 8], rax
jmp 0x2fc4c444e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c4442
cmp qword [rbp - 0x10], 0
je 0x2fc4c4442
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c4408
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c446b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c4570
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c4598
mov eax, 0
jmp 0x2fc4c45e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c45c1
mov eax, 0
jmp 0x2fc4c45e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c45e1
mov eax, 0
jmp 0x2fc4c45e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c45ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c466a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c4661
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c4661
mov rax, qword [rbp - 8]
jmp 0x2fc4c467f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c4634
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x18000b290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x18000b2d0
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x18000b2c5
cmp edi, 0x2d
jne 0x18000b2d0
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x18000b464
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x18000b46f
movzx r11d, r11b
cmp rbx, rsi
jae 0x18000b36d
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x18000b32c
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x18000b36d
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x18000b36d
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x18000b310
cmp r11d, 0xccccccc
jne 0x18000b358
cmp sil, 7
jbe 0x18000b310
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.180127540
jmp 0x18000b451
mov r10d, dword [rsp + 0x80]
test al, al
je 0x18000b38a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x18000b39a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x180130b30]
subpd xmm1, xmmword [0x180130b40]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x18000b40c
xorpd xmm1, xmm1
movsd xmm2, qword [0x180130b50]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x18000b3e8
jnp 0x18000b43a
test r10d, r10d
jns 0x18000b498
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x134
ja 0x18000b3e0
mov eax, eax
mov r9, qword [0x1801d15b0]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x18000b459
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x180130b60]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x180130b70]
jae 0x18000b498
test r8b, r8b
jne 0x18000b447
xorpd xmm0, xmmword [0x180130b80]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x18000b43f
jmp 0x18000b447
mov qword [rsp + 0x28], 5
jmp 0x18000b478
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1801275e0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x18000b451
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1801275e0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x18000b44e
Function at 0x18000d530
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.180052b90
test rax, rax
je 0x18000d59b
mov qword [rbp + 0x28], rax
mov rcx, rax
mov qword [rbp + 0x30], rdx
call qword [rdx]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18000d5e4
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.180023d50
jmp 0x18000d5e4
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x18013499c]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.1800529a0
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.1800504b0
Function at 0x1800377d0
Capabilities:
Log keystrokes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
and edx, 0xfffffffb
cmp edx, 0x100
sete bl
cmp r8w, 0x12
je 0x18003784a
movzx eax, r8w
cmp eax, 0x11
je 0x180037838
cmp eax, 0x10
jne 0x180037819
shr r9d, 0x10
movzx eax, r9b
mov rsi, rcx
mov ecx, eax
mov edx, 3
call qword [sym.imp.user32.dll_MapVirtualKeyA]
mov rcx, rsi
mov r8d, eax
test eax, eax
je 0x180037893
movzx eax, r8w
cmp eax, 0x28b
jbe 0x180037863
lea r8, str.C:UsersFrank.cargo_registry_srcindex.crates.io_6f17d22bba15001fhudhook_0.5.0_srchookscommonwnd_proc.rs
mov edx, 0x28c
mov rcx, rax
call fcn.18012dc60
and r9d, 0x1000000
cmp r9, 1
mov r8w, 0xa3
jmp 0x18003785a
and r9d, 0x1000000
cmp r9, 1
mov r8w, 0xa5
sbb r8w, 0
movzx eax, r8w
mov byte [rcx + rax + 0xb28], bl
movzx eax, r8w
cmp eax, 0x5a
jle 0x1800378ac
add eax, 0xffffffa5
cmp eax, 0x4a
ja case.0x180037889.93
lea rdx, [0x18013b040]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov byte [rcx + 0xe0f], bl
jmp case.0x180037889.93
mov r8w, 0x10
movzx eax, r8w
mov byte [rcx + rax + 0xb28], bl
movzx eax, r8w
cmp eax, 0x5a
jg 0x180037873
cmp eax, 0x10
je case.0x180037889.160
cmp eax, 0x11
je case.0x180037889.162
cmp eax, 0x12
jne case.0x180037889.93
mov byte [rcx + 0xe0e], bl
jmp case.0x180037889.93
mov byte [rcx + 0xe0c], bl
jmp case.0x180037889.93
mov byte [rcx + 0xe0d], bl
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x180052de0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x180052e52
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x180052e18
add rdi, rbx
sub rsi, rbx
je 0x180052e52
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x180052e10
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x180052e10
and ebp, 0x7fffffff
jmp 0x180052e54
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180053fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rsi, rcx
test byte [rdx + 0x44], 1
jne 0x18005406a
mov rbx, qword [rdi + 0x20]
mov r14, qword [rdi + 0x38]
mov dword [rsp + 0x2c], 0
lea r9, [rsp + 0x2c]
mov rcx, rbx
mov rdx, r14
mov r8d, 0x40
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1800540a2
mov ebp, dword [rsp + 0x2c]
mov r15, qword [rdi + 0x28]
test r15, r15
je 0x1800540cc
mov r13, qword [rdi + 0x30]
mov rcx, r15
call qword [r13 + 0x18]
mov r12d, 8
test al, al
je 0x1800540e2
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call qword [r13 + 0x20]
jmp 0x1800540dc
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x1800540b3
mov r14, qword [rdi + 0x30]
mov rcx, rbx
call qword [r14 + 0x18]
mov r12d, 8
test al, al
je 0x1800540fe
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [r14 + 0x20]
jmp 0x1800540c4
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsi], 1
mov dword [rsi + 4], eax
jmp 0x180054121
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov r12d, 0xb
jmp 0x1800540fe
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r12d, 0xb
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
mov rcx, rbx
mov rdx, r14
mov r8d, ebp
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov rcx, qword [rdi + 0x18]
mov r8d, dword [rdi + 0x40]
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov edx, 0x400
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [rsi], r12d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180055550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
test byte [rdx + 0x3c], 1
jne 0x1800555d8
mov rbx, qword [rdi + 0x20]
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov edx, 5
mov rcx, rbx
mov r8d, 0x40
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x180055610
mov ebp, dword [rsp + 0x24]
mov r14, qword [rdi + 0x28]
test r14, r14
je 0x18005563a
mov r12, qword [rdi + 0x30]
mov rcx, r14
call qword [r12 + 0x18]
mov r15d, 8
test al, al
je 0x180055650
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r14
call qword [r12 + 0x20]
jmp 0x18005564a
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x180055621
mov r14, qword [rdi + 0x30]
mov rcx, rbx
call qword [r14 + 0x18]
mov r15d, 8
test al, al
je 0x18005566e
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [r14 + 0x20]
jmp 0x180055632
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsi], 1
mov dword [rsi + 4], eax
jmp 0x180055691
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov r15d, 0xb
jmp 0x18005566e
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r15d, 0xb
mov dword [rsp + 0x2c], 0
lea r9, [rsp + 0x2c]
mov edx, 5
mov rcx, rbx
mov r8d, ebp
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov rcx, qword [rdi + 0x18]
mov r8d, dword [rdi + 0x38]
mov dword [rsp + 0x28], 0
lea r9, [rsp + 0x28]
mov edx, 0x64
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [rsi], r15d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18009f640
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x18009f682
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x18009f68a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x18009f69b
jmp 0x18009f6b2
xor r10d, r10d
jmp 0x18009f73d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x18009f6b2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x18009f6c9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x18009f6e9
add r11, r8
jmp 0x18009f81b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x18009f7b2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x18009f760
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x18009f7d0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x18009f7e2
jmp 0x18009f7fd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x18009f7fd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x18009f817
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800b0ce0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1800b0d80
jmp 0x1800b0d6f
jae 0x1800b0e3f
cmp r8, 0x201
jae 0x1800b0d80
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1800b0dd7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1800b0daf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.18012c600
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1800b0e00
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1800b0eab
mov r8d, r13d
cmp r12, r8
jne 0x1800b0d60
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800b0edf
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1800b0d6f
jmp 0x1800b0d80
cmp r14, r8
jb 0x1800b0ef9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1800b4820
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1800b0e94
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.180023d50
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1800b0e7f
jmp 0x1800b0e94
lea rcx, str.internal_error:_entered_unreachable_code_rustc_4d570eea025a19564429eb52b34ec34e14659f55library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.18012dbd0
jmp 0x1800b0f0e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.18012df60
ud2
Function at 0x1800b14a0
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x1800b14b5
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.1800b14d0
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.1800b9ee0

Function at 0x1800b47c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1800b47f2
movsxd rdx, eax
xor ecx, ecx
jmp 0x1800b4816
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x1800b4816
invalid
shl rax, 0x20

Function at 0x1800b9ee0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.1800bbc80
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1800b9f40
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1800bc790
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x1800b9f4c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x1800b9f78
test rdi, rdi
je 0x1800b9fa4
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.180023d50
xor eax, eax
jmp 0x1800b9f43
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x1800b9f43
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.180023d50
jmp 0x1800b9f40
xor eax, eax
jmp 0x1800b9f43

Function at 0x1800b9fb0
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.1800bbc80
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1800ba010
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1800bc790
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x1800ba01c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x1800ba046
test rdi, rdi
je 0x1800ba072
add rdi, rdi
mov r8d, 2
mov rcx, rsi
int1
mov rdx, rdi
call fcn.180023d50
xor eax, eax
jmp 0x1800ba013
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
enter 0x4802, 0xffffffffffffff85
invalid
je 0x1800ba013
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov edx, edi
mov rsi, rax
call fcn.180023d50
jmp 0x1800ba010
xor eax, eax
jmp 0x1800ba013