joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400b9e00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140077e35
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140077e96
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400526a0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008b8c0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140077f51
sub ecx, 1
je 0x140077fc4
sub ecx, 1
je 0x140077f00
cmp ecx, 1
je 0x140077ee3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14009cc00]
call fcn.1400526a0
jmp 0x140077fc4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140077ad0
test eax, eax
je 0x140077fc4
jmp 0x140077e6a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140077fc4
sub rax, rsi
cmp rax, rbp
jae 0x140077fc4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140052820
jmp 0x140077fc4
cmp r8d, 4
jle 0x140077fc4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140077fc4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400525c0
mov esi, eax
test eax, eax
je 0x140077fa3
mov edx, 5
mov rcx, rbx
call fcn.140078a90
mov eax, esi
jmp 0x140077e6a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140060ec0
mov rcx, r14
call fcn.1400611a0
test eax, eax
je 0x140077e68
mov edx, 5
mov rcx, rbx
call fcn.140078a90
mov eax, Ordinal_45
jmp 0x140077e6a
Function at 0x14008ad60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14008ada2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14008ade9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14008ae42
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14008ae00
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14008ae83
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400a238a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400a238b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14008ae50
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14008bdb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008be02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008be02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008be02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008be02
cmp dword [rcx + 0x84], 0xe
jbe 0x14008be02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008be04
xor al, al
add rsp, 0x28
ret
Function at 0x14008c044
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008c07e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008c083
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008c0cc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14008c0cc
dec r8
sub rdx, 1
jne 0x14008c0b2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1405bf599
Capabilities:
Encode data using xor

Disassembly:
adc rbx, 2
shl r8d, cl
push 0xd092a3b
push 0x4f0c4000
mov dword [rbx], r8d
lea rsp, [rsp + 0x10]
jmp fcn.1405ba5c2
test rcx, rcx
lea rsp, [rsp + 0x10]
je 0x1405bf601
push r11
mov r9d, 0xb57f90
movsx r11d, r9w
lea r9, [0x1405b93b0]
movzx r11d, byte [rdi]
xor r11d, ebx
push 0x21055f0e
and r11d, 0xff
mov r11d, dword [r9 + r11*4]
ror byte [rsp + 1], 0xc1
shr ebx, 8
xor ebx, r11d
inc rdi
xor ebx, 0x4b86a934
ror word [rsp + 3], 0x62
dec rcx
lea rsp, [rsp + 8]
jne 0x1405bf5ba
mov r11d, 0xf390ad1e
pop r11
call fcn.1405d34a5
mov esi, 0xe4926ca7
sub r10, 2
movzx esi, word [r10]
jmp 0x1405ca532
call fcn.1405bc792
jno 0x1405ae21b
mov r11d, dword [rsi]
mov eax, dword [rsi + 4]
call fcn.1405b32ff
push 0x411f4c2b
mov ebp, 0x499f63b7
not dword [rsp + rbp - 0x499f63b7]
mov rax, qword [rbp + rsi - 0x499f63b7]
neg byte [rsp + rbp - 0x499f63b3]
lea rbp, [rbp + rbp + 0x1f2f6730]
add bp, 0x7fb2
mov rbp, qword [rsi + 8]
adc rsi, 0x10
mov qword ss:[rax], rbp
lea rsp, [rsp + 8]
jmp fcn.1405c8475
Function at 0x1400017b0
Capabilities:
Allocate or change rwx memory
Create thread
Execute command
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.140001990
nop
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140001812
lea rdx, [rsp + 0x70]
add rdx, rax
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1400023f0
test al, al
je 0x1400018ee
mov eax, dword [0x14000a494]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14000a498]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x14000a49a]
mov byte [rsp + 0x6e], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 7]
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x40]
call fcn.140001f30
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000191b
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000191b
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140008a90
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140001c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140001c64
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140001c50
ret
Function at 0x1400065b0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14000667c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14000667c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140006695
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14000666c
cmp byte [rax], 0x5c
jne 0x140006666
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140006666
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140006652
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140006663
test r8b, 0x10
jne 0x140006666
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140006666
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140002b00
test edi, edi
jne 0x1400065d0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140002af0
int3

Function at 0x140009638
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009682
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009682
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009682
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009682
cmp dword [rcx + 0x84], 0xe
jbe 0x140009682
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009684
xor al, al
add rsp, 0x28
ret
Function at 0x180025b60
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
imul r14d, edx, 0x4d7
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov edi, edx
cmp edx, r14d
ja 0x180025cd6
xor r15d, r15d
nop word [rax + rax]
cmp edi, 0xcc
ja 0x180025c46
je 0x180025c1b
cmp edi, 0x21
je 0x180025c03
cmp edi, 0x3e
je 0x180025bcf
cmp edi, 0x68
jne 0x180025cc5
movzx eax, word [rbx]
neg ax
mov word [rbx], ax
jmp 0x180025cc5
cmp byte [rbx + 0x118], r15b
jne 0x180025cf3
mov r8, qword [rbx]
lea r9, [rbx + 0x78]
mov rcx, qword [rbx + 0x100]
mov edx, 0x71
call fcn.180072980
mov byte [rbx + 0x118], al
mov byte [rsp + 0x58], al
jmp 0x180025cc5
movzx eax, word [rsi + 2]
cmp word [rbx + 2], ax
jle 0x180025cc5
mov eax, 1
jmp 0x180025cda
test rbx, rbx
je 0x180025cc5
mov r9, rbx
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
mov r8d, 0x11e
call fcn.180057860
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180025c24
jmp 0x180025cc5
cmp edi, 0x16f2
je 0x180025cbb
cmp edi, 0x2b1c
je 0x180025cd6
cmp edi, 0x2dc3
jne 0x180025cc5
mov r10d, 0xc
cmp r10d, 0xc
je 0x180025c7c
cmp r10d, 0xa4
jne 0x180025ca9
mov eax, r15d
jmp 0x180025cda
mov r9, rsi
lea rax, [rbx + 0x16]
sub r9, rbx
mov ecx, 9
nop dword [rax + rax]
movzx edx, word [rax]
cmp dx, word [r9 + rax]
ja 0x180025c11
jb 0x180025cfa
sub rax, 2
sub ecx, 1
jns 0x180025c90
add r10d, 0x98
cmp r10d, 0x13c
jb 0x180025c68
jmp 0x180025cc5
movzx eax, word [rsi + 2]
cmp word [rbx + 2], ax
jl 0x180025cfa
imul eax, ebp, 0xb1
add edi, eax
cmp edi, r14d
jbe 0x180025ba0
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov byte [rsp + 0x58], r15b
jmp 0x180025cd6
mov eax, 0xffffffff
jmp 0x180025cda
Function at 0x18002bff0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea edi, [rcx - 0xa]
mov r14, r9
mov r13, r8
mov r15, rdx
cmp ecx, edi
jbe 0x18002c1be
mov rsi, qword [rsp + 0x30]
lea ebx, [rcx - 0xa4]
mov rbp, qword [rsp + 0x50]
lea rdx, [0x180000000]
mov r12, qword [rsp + 0x50]
nop dword [rax]
cmp ebx, 0x13
ja case.0x18002c053.1
mov ecx, dword [rdx + rbx*4 + 0x2c1f8]
add rcx, rdx
jmp rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], 2
mov r9d, 2
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rdx, rbp
mov ecx, 0x95
call fcn.18003d680
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], 3
mov r9d, 3
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov ecx, 0x95
call fcn.18003d680
mov rsi, qword [rsp + 0x30]
jmp 0x18002c1a7
cmp dword [r13], 0
movzx eax, word [r15]
je 0x18002c0c9
mov dword [r14 + 0x10], eax
jmp case.0x18002c053.1
mov dword [r14 + 0x14], eax
jmp case.0x18002c053.1
lea r8, [rsp + 0x90]
mov byte [rsp + 0x90], 1
mov edx, 9
mov rcx, rbp
call fcn.180029880
mov rbp, rax
jmp 0x18002c1a7
test rsi, rsi
je 0x18002c107
cmp qword [rsi + 8], 2
je case.0x18002c053.1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.INT_PTX_ATOM_LOAD_MIN_G_64p32imm
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, r12
mov ecx, 0x29
call fcn.18007c6e0
jmp 0x18002c1a7
mov qword [rsp + 0x48], 1
lea rax, [rsp + 0x48]
mov r9d, 1
jmp 0x18002c094
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8d, 0xbe
call fcn.180052fc0
xor esi, esi
mov rbp, rax
mov qword [rsp + 0x30], rsi
jmp 0x18002c1a7
mov r9, rsi
mov qword [rsp + 0x50], 1
mov r8d, 0x75
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.18006aa40
mov r12, rax
lea rdx, [0x180000000]
dec ebx
lea ecx, [rbx + 0xa4]
cmp ecx, edi
ja 0x18002c040
mov eax, dword [rsp + 0x90]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [r14]
mov r9d, 0x4e
xor r8d, r8d
xor edx, edx
call fcn.180058640
jmp 0x18002c1c5
Function at 0x180035b50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x18009a1f0]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movzx ebx, byte [rsp + 0x20]
lea esi, [rdx - 7]
mov r15, r8
mov r14, rcx
cmp edx, esi
jbe case.0x180035bb6.6
mov ebp, dword [rsp + 0x24]
lea edi, [rdx - 0x106]
lea r12, [0x180000000]
cmp edi, 9
ja case.0x180035bb6.3
mov ecx, dword [r12 + rdi*4 + 0x35ca8]
add rcx, r12
jmp rcx
mov dword [r14 + 4], ebp
jmp case.0x180035bb6.3
xor ebp, ebp
jmp case.0x180035bb6.3
mov ebp, dword [r14 + 4]
movzx eax, byte [r15]
and ebp, 0xffffffe0
or ebp, eax
jmp case.0x180035bb6.3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [r14 + 0x40], rax
jmp case.0x180035bb6.3
mov r9d, 0x32
lea r8, [rsp + 0xa0]
mov edx, 0x1009
lea ecx, [r9 + 0x4d]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x180035c26
lea r8, [rsp + 0xa0]
mov edx, 0x1009
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
cmp qword [r14 + 0x40], 0
setne bl
jmp case.0x180035bb6.3
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x90], rax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
dec edi
lea eax, [rdi + 0x106]
cmp eax, esi
ja 0x180035ba2
movzx eax, bl
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.180082e70
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800411c0
Capabilities:
Check for software breakpoints
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
movzx ebx, byte [rsp + 0x68]
mov rsi, r8
imul r14d, edx, 0x218
mov ebp, edx
mov r15, rcx
mov edi, edx
cmp edx, r14d
ja 0x1800412bc
mov rcx, qword [rsp + 0x78]
xor r12d, r12d
nop dword [rax]
cmp edi, 0x4407
ja 0x18004128c
je 0x180041286
mov eax, edi
sub eax, 0x81
je 0x18004127c
sub eax, 3
je 0x18004124b
sub eax, 0x21c0
je 0x180041245
cmp eax, 0xcc
jne 0x1800412ae
test rcx, rcx
je 0x1800412d6
mov rax, rcx
mov bl, 1
xchg qword [0x18009a2c0], rax
jmp 0x1800412ae
mov qword [rsi + 0x20], r12
jmp 0x1800412ae
mov qword [0x18009a2b8], rsi
lea r8, [0x180041680]
mov qword [rsp + 0x28], r12
mov r9, rsi
xor edx, edx
mov qword [rsi + 0x80], r15
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
jmp 0x1800412ae
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
jmp 0x1800412ae
mov dword [rsi + 0x28], r12d
jmp 0x1800412ae
cmp edi, 0x459c
je 0x1800412bc
cmp edi, 0x65ca
je 0x1800412aa
cmp edi, 0x878d
jne 0x1800412ae
mov qword [rsi + 0x38], r12
jmp 0x1800412ae
mov qword [rsi + 0x30], r12
imul eax, ebp, 0x43
add edi, eax
cmp edi, r14d
jbe 0x180041200
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
xor al, al
jmp 0x1800412bf
Function at 0x180052fc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r14d, [r8 + 9]
mov r13, r9
mov ebp, r8d
mov r15, rcx
cmp r8d, r14d
jae case.0x18005301a.3
mov r12, qword [rsp + 0x98]
lea esi, [r8 - 0xac]
mov rdi, qword [rsp + 0x20]
lea r8, [0x180000000]
cmp esi, 0x14
ja case.0x18005301a.4
mov ecx, dword [r8 + rsi*4 + 0x5318c]
add rcx, r8
jmp rcx
cmp dword [r12], 2
jge case.0x18005301a.4
mov dword [rsp + 0x20], 4
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
jne case.0x18005301a.4
lea ecx, [rdi + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Invalid_Header:_Invalid_content_length:__1
call fcn.1800824b0
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [r15], 3
jne 0x180053081
mov dword [r15], 4
mov eax, dword [r12]
lea rdx, [rsp + 0x80]
add eax, 0xfffffffe
mov r8d, 0xf2
lea ecx, [rax + rax*2]
mov dword [rsp + 0x80], ecx
xor ecx, ecx
call fcn.180027e80
mov edx, dword [r15]
inc eax
lea ecx, [rdx*4]
cmp eax, ecx
jg 0x180053145
mov eax, edx
mov ecx, 1
cdq
sub eax, edx
sar eax, 1
cmovne ecx, eax
mov dword [rsp + 0x20], ecx
jmp case.0x18005301a.3
movsxd r8, dword [r13]
mov rax, qword [r12 + 8]
movsxd rdx, dword [rdx]
mov rcx, qword [r12 + 0x10]
mov rax, qword [rax + r8*8]
mov qword [rcx + rdx*8], rax
jmp 0x180053145
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x73]
call fcn.18006a0c0
mov rdi, rax
jmp 0x180053145
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
jmp case.0x18005301a.4
mov ebx, 0x9a
mov eax, ebx
sub eax, 0x9a
je 0x180053125
cmp eax, 1
je case.0x18005301a.3
jmp 0x18005313b
mov rdx, rdi
mov ecx, 0x103
call fcn.180033fb0
test eax, eax
jne 0x180053163
mov qword [rsp + 0x20], rdi
inc ebx
cmp ebx, 0x9c
jb 0x180053111
mov rdx, qword [rsp + 0x78]
lea r8, [0x180000000]
inc ebp
inc esi
cmp ebp, r14d
jb 0x180053006
jmp case.0x18005301a.3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._Z18convert_float2_rtnDv2_f
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180064820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx ebx, byte [rsp + 0x80]
lea r12d, [rcx + 6]
movaps xmmword [rsp + 0x40], xmm6
mov r15, r9
mov r14, r8
mov rdi, rdx
mov ebp, ecx
cmp ecx, r12d
jae case.0x18006488a.8
movsd xmm6, qword [0x180092490]
lea esi, [rcx - 0x113]
lea r13, [0x180000000]
cmp esi, 0xd
ja case.0x18006488a.1
mov ecx, dword [r13 + rsi*4 + 0x649e0]
add rcx, r13
jmp rcx
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x80], 0x20000000
mov edx, 0x8f
xor ecx, ecx
call fcn.180037f50
jmp case.0x18006488a.1
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
test rdx, rdx
je 0x1800648f5
mov rax, qword [rdi]
mov r8, qword [rax + 0x20]
mov rax, qword [rdi + 8]
nop dword [rax + rax]
cmp qword [rax], r8
jb 0x1800649dc
inc rcx
add rax, 8
cmp rcx, rdx
jb 0x1800648e0
mov bl, 1
jmp case.0x18006488a.1
test rdi, rdi
jne case.0x18006488a.1
mov al, 1
jmp 0x1800649b9
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x80], 0x20000000
mov edx, 0x8f
xor ecx, ecx
call fcn.180037f50
jmp case.0x18006488a.1
movsxd rax, dword [r14]
mov r8d, 1
mov r9d, r8d
mov qword [rdi + rax*8], 0
mov edx, dword [r15]
cmp edx, 2
jle 0x180064992
lea r10d, [r8 + 1]
movsxd rcx, dword [r14]
sub edx, r8d
inc r8d
add r10d, 2
lea rax, [rcx + r9*2]
inc r9
movsd xmm0, qword [rdi + rax*8]
movsxd rax, edx
xorps xmm0, xmm6
lea rcx, [rcx + rax*2]
movsd qword [rdi + rcx*8], xmm0
mov edx, dword [r15]
cmp r10d, edx
jl 0x180064962
lea eax, [r8 + r8]
cmp eax, edx
jne case.0x18006488a.1
movsxd rax, dword [r14]
lea rcx, [rax + r9*2]
mov qword [rdi + rcx*8], 0
inc ebp
inc esi
cmp ebp, r12d
jb 0x180064876
movzx eax, bl
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor al, al
jmp 0x1800649b9