joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407c8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407c81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407c8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c806f
add dl, dl
jne 0x1407c8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c80f6
xor eax, eax
add dl, dl
jne 0x1407c80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c81ad
add dl, dl
jne 0x1407c80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407c80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407c807e
mov eax, 1
add dl, dl
jne 0x1407c8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c80fb
sub eax, ebx
mov ebx, 1
jne 0x1407c814c
mov ecx, 1
add dl, dl
jne 0x1407c812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407c8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c815d
cmp eax, 0x7d00
jae 0x1407c819b
cmp eax, 0x500
jb 0x1407c8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c807e
cmp eax, 0x7f
ja 0x1407c819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407c81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407c807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180044ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
movsxd rax, dword [rsp + 0x88]
imul rax, rax, 0x40
mov rcx, qword [rsp + 0x98]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
jmp 0x180044b9e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180044c1c
mov eax, dword [rsp + 0x20]
imul eax, dword [rsp + 0x80]
mov eax, eax
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call fcn.180015570
test eax, eax
jne 0x180044c17
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
imul eax, dword [rsp + 0x78]
cdqe
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
jmp 0x180044c1e
jmp 0x180044b94
xor eax, eax
add rsp, 0x68
ret
Function at 0x18004a020
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
jne 0x18004a047
xor al, al
jmp 0x18004a10c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x18004a086
xor al, al
jmp 0x18004a10c
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
inc eax
mov eax, eax
mov ecx, eax
call fcn.180015a34
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x18004a0af
xor al, al
jmp 0x18004a10c
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
inc eax
mov eax, eax
mov edx, eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call fcn.180001060
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov r9, qword [rax]
mov r8d, 1
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x18004a10a
xor al, al
jmp 0x18004a10c
mov al, 1
add rsp, 0x48
ret
Function at 0x14000bb30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edi, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x14000bc73
movzx eax, word [rbx]
cmp eax, 0x5c
je 0x14000bb90
cmp eax, 0x2f
je 0x14000bb90
mov ecx, eax
call fcn.140022750
test eax, eax
je 0x14000bc73
cmp word [rbx + 2], 0x3a
jne 0x14000bc73
movzx eax, word [rbx + 4]
cmp ax, 0x5c
je 0x14000bb90
cmp ax, 0x2f
jne 0x14000bc73
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000bc5a
test al, 0x50
jne 0x14000bc5a
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000bbfa
lea ecx, [rax + 0x21]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], edi
mov rcx, rbx
call fcn.14000d1a0
test eax, eax
je 0x14000bc33
cmp dword [rsp + 0x60], edi
jne 0x14000bc22
mov ecx, 0x80092009
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000bc33
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rsi, rsi
je 0x14000bc51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14000bbe7
xor ecx, ecx
jmp 0x14000bbe1
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14000bc90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x14000bd6f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x14000bcc7
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000bd72
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x14000bd16
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x14000bd20
test rax, rax
je 0x14000bd6f
lfence
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000bd60
cmp rdx, rax
jb 0x14000bd40
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f380
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000f3e2
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000f3d7
cmp edi, eax
jb 0x14000f3d7
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400230e4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400230c1
call fcn.14002154c
mov dword [rax], 0x16
call fcn.140020e60
or eax, 0xffffffff
jmp 0x1400230de
sub dword [rcx + 0x10], 1
jns 0x1400230d0
add rsp, 0x28
jmp 0x14002da68
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1400230a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x14002da9a
call fcn.14002154c
mov dword [rax], 0x16
call fcn.140020e60
jmp 0x14002dbb7
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002dbb7
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002dbb7
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14002dac9
lock or dword [rcx + 0x14], 0x10
jmp 0x14002dbb7
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002dadd
call fcn.14002f0b4
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.14002bc8c
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.14002c6c8
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14002dba5
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x14002db70
mov rcx, rdi
call fcn.14002bc8c
cmp eax, esi
je 0x14002db5b
mov rcx, rdi
call fcn.14002bc8c
cmp eax, 0xfffffffe
je 0x14002db5b
mov rcx, rdi
call fcn.14002bc8c
movsxd rbx, eax
lea r14, [0x1400535a0]
mov rcx, rdi
sar rbx, 6
call fcn.14002bc8c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14002db62
lea rdx, [0x140051240]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002db70
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x14002db94
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x14002db94
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x14002db94
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x14002dbba
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14002dbd4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14002d8fa
call fcn.14002154c
mov dword [rax], 0x16
call fcn.140020e60
jmp 0x14002da45
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002da45
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002da45
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14002d929
lock or dword [rcx + 0x14], 0x10
jmp 0x14002da45
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002d93d
call fcn.14002f0b4
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14002d94d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14002d950
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14002bc8c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14002c6c8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14002da33
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14002d9e1
mov rcx, rbx
call fcn.14002bc8c
cmp eax, 0xffffffff
je 0x14002d9cc
mov rcx, rbx
call fcn.14002bc8c
cmp eax, 0xfffffffe
je 0x14002d9cc
mov rcx, rbx
call fcn.14002bc8c
movsxd rdi, eax
lea r14, [0x1400535a0]
mov rcx, rbx
sar rdi, 6
call fcn.14002bc8c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14002d9d3
lea rdx, [0x140051240]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002d9e1
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14002da05
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14002da05
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14002da05
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14002da23
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14002da2e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14002da4a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14002d8c4
Function at 0x1800111bd
Capabilities:
Terminate process

Disassembly:
jmp 0x180012ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x180011271
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1800116d0
push rbp
push rsi
push rdi
sub rsp, 0x470
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xac
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x428], rax
lea rcx, [0x180022005]
call fcn.180011302
nop
lea rax, [rbp + 0x10]
lea rcx, [0x18001a900]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x22e
rep movsb byte [rdi], byte [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x258], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x22e
xor edx, edx
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x278], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x22e
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x278]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x278]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x298], rax
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x18001a8d0]
call fcn.1800112ad
mov rcx, qword [rbp + 0x428]
xor rcx, rbp
call fcn.180011177
lea rsp, [rbp + 0x430]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800409f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 4
jb 0x180040a05
mov rax, rdx
ret

Function at 0x180040a28
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 8
jb 0x180040a35
mov rax, rdx
ret
Function at 0x180085ec4
Capabilities:
Hash data with crc32

Disassembly:
movsxd r9, dword [rcx + 0xe8]
mov r10, r8
mov r8, qword [rcx + 0xf0]
mov r11, rdx
mov rax, r10
mov rcx, r11
sub rax, rdx
neg r10
mov r8d, dword [r8 + r9*4 - 4]
sbb rdx, rdx
and rdx, rax
jmp fcn.180086d1c

Function at 0x180085f6c
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rdx
sub rax, rcx
neg rdx
sbb rdx, rdx
and rdx, rax
jmp fcn.180086d1c

Function at 0x180086ce4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x180086d12
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1800de700]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x180086cef
not r8d
mov eax, r8d
ret

Function at 0x180086d1c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180086d76
mov r11b, 0x23
lea rbx, [0x1800de700]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x180086d60
cmp rdx, 2
jb 0x180086d60
cmp byte [r10], r11b
jne 0x180086d60
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x180086d3e
jmp 0x180086db7
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180086db7
mov r11b, 0x23
lea rbx, [0x1800de700]
cmp dl, r11b
jne 0x180086d9b
cmp byte [r10], r11b
jne 0x180086d9b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x180086d89
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1800ab54c
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul r8d
mov r11d, r8d
shr edx, 0xb
imul eax, edx, 0x15b0
sub r11d, eax
test r8d, r8d
je 0x1800ab640
xor edx, edx
cmp r11d, 7
jbe 0x1800ab5ec
lea ebx, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add r9d, eax
add ebx, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
cmp ebx, r11d
jb 0x1800ab586
cmp edx, r11d
jae 0x1800ab60b
mov eax, r11d
sub eax, edx
mov edx, eax
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub rdx, 1
jne 0x1800ab5f8
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub r8d, r11d
mov r11d, 0x15b0
jne 0x1800ab57b
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret
Function at 0x1800c6844
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov r9, rdx
je 0x1800c6874
xor r8d, r8d
xor edx, edx
mov rcx, r9
call fcn.180086d1c
mov ecx, eax
mov ebx, eax
call fcn.180088390
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x180143838]
xor r8d, r8d
mov rcx, qword [rax + 0x3eb0]
add rsp, 0x20
pop rbx
jmp fcn.180085ec4

Function at 0x1800cec88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14b, r9b
mov r15, r8
mov ebp, edx
mov rbx, rcx
call fcn.1800d4388
xor r12d, r12d
test rax, rax
je 0x1800ced42
movzx r11d, word [rax + 0x14]
movzx r9d, r12w
movzx edi, word [rax + 6]
add r11, rax
cmp r12w, di
jae 0x1800ced42
lea r13d, [r12 + 1]
movzx eax, r9w
lea rax, [rax + rax*4]
mov edx, dword [r11 + rax*8 + 0x20]
cmp dword [r11 + rax*8 + 0x28], edx
mov esi, dword [r11 + rax*8 + 0x24]
cmovb edx, dword [r11 + rax*8 + 0x28]
test esi, esi
je 0x1800ced38
test edx, edx
je 0x1800ced38
mov rax, qword [r11 + rax*8 + 0x18]
lea r10, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x84222325
mov qword [rsp + 0x28], r12
jmp 0x1800ced2f
movsx ecx, al
xor ecx, r8d
imul r8d, ecx, 0x1b3
add r10, r13
mov al, byte [r10]
test al, al
jne 0x1800ced1c
cmp ebp, r8d
je 0x1800ced61
add r9w, r13w
cmp r9w, di
jb 0x1800cecdb
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add rdx, rsi
lea rcx, [rsi + rbx]
add rdx, rbx
mov r9b, r14b
mov r8, r15
call fcn.1800ceb3c
jmp 0x1800ced44
Function at 0x1800d3c18
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword gs:[0x30]
mov bpl, dl
mov esi, ecx
mov r8, qword [rax + 0x60]
mov rdi, qword [r8 + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x1800d3cd1
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
call fcn.1800d3978
movzx r11d, word [rbx + 0x48]
xor r10d, r10d
shr r11, 1
add r11, 0xfffffffffffffffc
je 0x1800d3ca2
mov r9, qword [rbx + 0x50]
movzx edx, word [r9]
lea r9, [r9 + 2]
movzx r8d, dl
sub dx, 0x41
cmp dx, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
cmova ecx, r8d
mov byte [rsp + r10 + 0x20], cl
inc r10
cmp r10, r11
jne 0x1800d3c76
test esi, esi
je 0x1800d3cf5
mov al, byte [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov ecx, 0x84222325
jmp 0x1800d3cc6
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1b3
inc rdx
mov al, byte [rdx]
test al, al
jne 0x1800d3cb6
cmp esi, ecx
je 0x1800d3cf5
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1800d3c51
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test bpl, bpl
je 0x1800d3d26
mov rcx, qword [rbx - 0x10]
mov rax, qword [rbx - 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx - 8]
mov rax, qword [rbx - 0x10]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx + 0x20]
jmp 0x1800d3cdc

Function at 0x1800d3d2c
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov bpl, r8b
mov rsi, rdx
mov r14d, ecx
mov r9, qword [rax + 0x60]
mov rdi, qword [r9 + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x1800d3d84
mov rcx, qword [rbx + 0x20]
cmp rsi, rcx
je 0x1800d3d81
mov r8b, bpl
mov edx, r14d
call fcn.1800d3da8
test rax, rax
jne 0x1800d3d8b
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1800d3d68
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret