joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180021d98
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov eax, 0x4ec399a0
mov r15d, 0xf370a25f
mov r12, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13d, 0x693b686e
mov rbx, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 0x86cbd485
cmp eax, 0xf370a25e
jle 0x180021e1d
cmp eax, 0x4ec3999f
jg 0x180021e40
cmp eax, 0xf370a25f
je 0x180021e8e
cmp eax, 0x1154c88a
jne 0x180021de8
mov rcx, qword [rsp + 0x38]
call rbx
mov rcx, qword [rsp + 0x38]
call rdi
mov eax, 0x693b686e
jmp 0x180021de8
cmp eax, 0x926361ff
jle 0x180021e62
cmp eax, 0x92636200
je 0x180021ec1
cmp eax, 0xed81effd
jne 0x180021de8
mov eax, 0x92636200
xor r14d, r14d
jmp 0x180021de8
cmp eax, 0x693b686e
je 0x180021edb
cmp eax, 0x4ec399a0
jne 0x180021de8
cmp qword [rsp + 0x40], 0
mov eax, 0xed81effd
cmove eax, ebp
jmp 0x180021de8
cmp eax, 0x8e0cb99b
jne 0x180021eed
mov rax, qword [rsp + 0x30]
mov r8, qword [rax]
mov rcx, qword [0x1800474c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x86cbd485
jmp 0x180021de8
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov ecx, dword [rsp + 0x2c]
mov r8d, dword [rax + rcx*4]
mov ecx, 0x5a
xor edx, edx
call r12
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
mov eax, 0x1154c88a
cmove eax, r13d
jmp 0x180021de8
mov dword [rsp + 0x2c], r14d
mov eax, dword [rsp + 0x2c]
cmp eax, dword [rsi + 0xc]
mov eax, 0x8e0cb99b
cmovb eax, r15d
jmp 0x180021de8
mov r14d, dword [rsp + 0x2c]
inc r14d
mov eax, 0x92636200
jmp 0x180021de8
cmp eax, 0x86cbd485
jne 0x180021de8
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800015e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp], 0
jmp 0x1800015ff
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 4
jge 0x1800016a7
mov dword [rsp + 8], 0
jmp 0x18000161d
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp dword [rsp + 8], eax
jge 0x1800016a2
movsxd rax, dword [rsp]
movsxd rcx, dword [rsp + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rdx + rax*8]
movzx eax, byte [rcx + rax]
mov byte [rsp + 4], al
movzx eax, byte [rsp + 4]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cdqe
imul rax, rax, 0x10
lea rcx, str.cw
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
movzx ecx, byte [rsp + 4]
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
sub eax, edx
cdqe
movsxd rcx, dword [rsp]
movsxd rdx, dword [rsp + 8]
mov r8, qword [rsp + 0x38]
mov rcx, qword [r8 + rcx*8]
mov r8, qword [rsp + 0x10]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
jmp 0x180001613
jmp 0x1800015f7
add rsp, 0x28
ret

Function at 0x180001850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov byte [rsp + 0x26], 0
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x20], 0
jmp 0x180001880
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x1800018fc
movzx eax, byte [rsp + 0x50]
movzx ecx, byte [rsp + 0x24]
and eax, ecx
mov byte [rsp + 0x27], al
movzx eax, byte [rsp + 0x27]
test eax, eax
je 0x1800018ec
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x25], al
mov dword [rsp + 0x28], 0
jmp 0x1800018bd
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x28], eax
jge 0x1800018dc
movzx edx, byte [rsp + 0x25]
mov rcx, qword [rsp + 0x40]
call fcn.1800017f0
mov byte [rsp + 0x25], al
jmp 0x1800018b3
movzx eax, byte [rsp + 0x26]
movzx ecx, byte [rsp + 0x25]
xor eax, ecx
mov byte [rsp + 0x26], al
movzx eax, byte [rsp + 0x50]
sar eax, 1
mov byte [rsp + 0x50], al
jmp 0x180001876
movzx eax, byte [rsp + 0x26]
add rsp, 0x38
ret

Function at 0x180001ba0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
jmp 0x180001bbf
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 4
jge 0x180001c27
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cdqe
imul rax, rax, 0x10
lea rcx, str.cw
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx + rcx]
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
sub eax, edx
cdqe
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 8]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
jmp 0x180001bb7
add rsp, 0x18
ret
Function at 0x180002260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, 0x6b
mov word [rsp + 0x10], ax
mov eax, 0x65
mov word [rsp + 0x12], ax
mov eax, 0x72
mov word [rsp + 0x14], ax
mov eax, 0x6e
mov word [rsp + 0x16], ax
mov eax, 0x65
mov word [rsp + 0x18], ax
mov eax, 0x6c
mov word [rsp + 0x1a], ax
mov eax, 0x33
mov word [rsp + 0x1c], ax
mov eax, 0x32
mov word [rsp + 0x1e], ax
xor eax, eax
mov word [rsp + 0x20], ax
mov byte [rsp], 0x49
mov byte [rsp + 1], 0x73
mov byte [rsp + 2], 0x57
mov byte [rsp + 3], 0x6f
mov byte [rsp + 4], 0x77
mov byte [rsp + 5], 0x36
mov byte [rsp + 6], 0x34
mov byte [rsp + 7], 0x50
mov byte [rsp + 8], 0x72
mov byte [rsp + 9], 0x6f
mov byte [rsp + 0xa], 0x63
mov byte [rsp + 0xb], 0x65
mov byte [rsp + 0xc], 0x73
mov byte [rsp + 0xd], 0x73
mov byte [rsp + 0xe], 0
mov rax, qword [rsp + 0x40]
mov byte [rax], 1
mov al, 1
add rsp, 0x38
ret
Function at 0x180006250
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov byte [rsp], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 4]
cmp eax, 0x14c
je 0x1800062b4
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 4]
cmp eax, 0x8664
je 0x1800062b4
jmp 0x1800063ff
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x16]
and eax, 2
test eax, eax
je 0x1800062ce
mov rax, qword [rsp + 0x60]
mov byte [rax], 1
jmp 0x1800062db
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
jmp 0x1800063ff
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x16]
and eax, 0x2000
test eax, eax
je 0x1800062f7
mov rax, qword [rsp + 0x68]
mov byte [rax], 1
jmp 0x1800062ff
mov rax, qword [rsp + 0x68]
mov byte [rax], 0
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x18000631c
mov rax, qword [rsp + 0x58]
mov dword [rax], 0x20
jmp 0x180006349
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x180006339
mov rax, qword [rsp + 0x58]
mov dword [rax], 0x40
jmp 0x180006349
mov rax, qword [rsp + 0x58]
mov dword [rax], 0
jmp 0x1800063ff
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x18000635e
jmp 0x1800063ff
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x18], rax
mov eax, dword [rsp + 0x28]
dec eax
cdqe
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x10]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x18]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x28]
dec ecx
movsxd rcx, ecx
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x10]
mov ecx, dword [rdx + rcx + 0x10]
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x50]
cmp qword [rsp + 8], rax
jle 0x1800063f1
jmp 0x1800063ff
mov byte [rsp], 1
xor eax, eax
test eax, eax
jne 0x18000626c
movzx eax, byte [rsp]
add rsp, 0x48
ret

Function at 0x180006480
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x1505
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov dword [rsp], eax
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
add rcx, 2
mov qword [rsp + 0x20], rcx
test eax, eax
je 0x1800064ce
mov rax, qword [rsp + 8]
shl rax, 5
add rax, qword [rsp + 8]
movsxd rcx, dword [rsp]
add rax, rcx
mov qword [rsp + 8], rax
jmp 0x180006492
mov rax, qword [rsp + 8]
add rsp, 0x18
ret
Function at 0x1800068c0
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x2a0
mov dword [rsp + 0x150], 0
lea rax, [rsp + 0x158]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rsp + 0x150], 0x68
mov dword [rsp + 0x18c], 1
xor eax, eax
mov word [rsp + 0x190], ax
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 0xc4
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.1800066d0
lea rcx, str.explorer.exe__n
call fcn.18000ae68
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1800069cb
xor eax, eax
jmp 0x180006a9e
mov rax, qword [rsp + 0x60]
lea rcx, str.cmd.exe
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x1800069f0
add rax, 2
test dx, dx
jne 0x1800069da
xor eax, eax
jmp 0x1800069f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x180006a02
mov eax, dword [rsp + 0x78]
jmp 0x180006a9e
mov dword [rsp + 0x54], 5
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x54]
dec ecx
mov dword [rsp + 0x54], ecx
test eax, eax
je 0x180006a9a
mov ecx, 0x1388
call qword [0x18001dea8]
mov dword [rsp + 0x1c0], 0
lea rax, [rsp + 0x1c4]
mov rdi, rax
xor eax, eax
mov ecx, 0xc4
rep stosb byte [rdi], al
mov dword [rsp + 0x290], 0
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x1c0]
call fcn.1800066d0
mov r9d, dword [rsp + 0x290]
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x80]
call fcn.1800067a0
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x180006a95
jmp 0x180006a9a
jmp 0x180006a0a
mov eax, dword [rsp + 0x58]
add rsp, 0x2a0
pop rdi
ret
Function at 0x180006ab0
Capabilities:
Contain obfuscated stackstrings
Delete registry value
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0x53
mov byte [rsp + 0x41], 0x6f
mov byte [rsp + 0x42], 0x66
mov byte [rsp + 0x43], 0x74
mov byte [rsp + 0x44], 0x77
mov byte [rsp + 0x45], 0x61
mov byte [rsp + 0x46], 0x72
mov byte [rsp + 0x47], 0x65
mov byte [rsp + 0x48], 0x5c
mov byte [rsp + 0x49], 0x44
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0x6d
mov byte [rsp + 0x4c], 0x69
mov byte [rsp + 0x4d], 0x6f
mov byte [rsp + 0x4e], 0x6e
mov byte [rsp + 0x4f], 0x20
mov byte [rsp + 0x50], 0x53
mov byte [rsp + 0x51], 0x70
mov byte [rsp + 0x52], 0x65
mov byte [rsp + 0x53], 0x6e
mov byte [rsp + 0x54], 0x63
mov byte [rsp + 0x55], 0x65
mov byte [rsp + 0x56], 0x72
mov byte [rsp + 0x57], 0x5c
mov byte [rsp + 0x58], 0x50
mov byte [rsp + 0x59], 0x64
mov byte [rsp + 0x5a], 0x66
mov byte [rsp + 0x5b], 0x20
mov byte [rsp + 0x5c], 0x56
mov byte [rsp + 0x5d], 0x69
mov byte [rsp + 0x5e], 0x65
mov byte [rsp + 0x5f], 0x77
mov byte [rsp + 0x60], 0x65
mov byte [rsp + 0x61], 0x72
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x31], 0x61
mov byte [rsp + 0x32], 0x72
mov byte [rsp + 0x33], 0x61
mov byte [rsp + 0x34], 0x6d
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x74
mov byte [rsp + 0x37], 0x65
mov byte [rsp + 0x38], 0x72
mov byte [rsp + 0x39], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x180006bbe
jmp 0x180006c29
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180006bfe
jmp 0x180006c29
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x90]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x88
ret

Function at 0x180007b30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xd8e1
je 0x180007b5e
jmp 0x180007b9a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
lea r8, [0x180006f40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
add rsp, 0x48
ret
Function at 0x180012948
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18001b560]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000f094
xor ebx, ebx
cmp qword [0x18001d0b0], rbx
mov rdi, rax
jne 0x180012a5b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180012b32
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012b32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18001d0b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18001d0b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18001d0c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18001d0d0], rax
test rax, rax
je 0x180012a52
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18001d0c8], rax
jmp 0x180012a62
mov rax, qword [0x18001d0c8]
jmp 0x180012a69
mov rax, qword [0x18001d0c8]
mov r11, qword [0x18001d0d0]
cmp rax, rdi
je 0x180012ad0
cmp r11, rdi
je 0x180012ad0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18001d0d0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180012ad0
test rax, rax
je 0x180012ad0
call rsi
test rax, rax
je 0x180012aca
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180012aca
test byte [rsp + 0x40], 1
jne 0x180012ad0
bts ebp, 0x15
jmp 0x180012b10
mov rcx, qword [0x18001d0b8]
cmp rcx, rdi
je 0x180012b10
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180012b10
call rax
mov rbx, rax
test rax, rax
je 0x180012b10
mov rcx, qword [0x18001d0c0]
cmp rcx, rdi
je 0x180012b10
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180012b10
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18001d0b0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180012b32
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180012b34
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180011700
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180013c7f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18001b560]
jne 0x18001171a
rol rcx, 0x10
test cx, 0xffff
jne 0x180011716
repz ret
ror rcx, 0x10
jmp 0x180013bd8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001d190]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18001d288]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180013c5d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001d190]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180013c7f
mov rax, qword [rsp + 0x88]
mov qword [0x18001d288], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001d228], rax
mov rax, qword [0x18001d288]
mov qword [0x18001d100], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001d210], rax
mov dword [0x18001d0f0], 0xc0000409
mov dword [0x18001d0f4], 1
mov rax, qword [0x18001b560]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18001b568]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001d188], eax
mov ecx, 1
call fcn.180011720
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800186d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001d188], 0
jne 0x180013d06
mov ecx, 1
call fcn.180011720
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1c47bb0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1c47bbd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1c47bcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1c47bb5
lea eax, [rcx + 1]
jmp 0x1c47bdb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1c47bee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1c47bd4
sub eax, 3
jb 0x1c47c0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1c47c5d
sar eax, 1
movsxd rbp, eax
jb 0x1c47c44
jmp 0x1c47c1c
add ebx, ebx
jne 0x1c47c1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1c47c44
inc ecx
add ebx, ebx
jne 0x1c47c2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1c47c44
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1c47c3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1c47c2c
add ecx, 2
jmp 0x1c47c49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01c47b72
jmp 0x1c47bbd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1832000]
mov eax, dword [rdi]
or eax, eax
je 0x1c47cb9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1847000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1c47c69
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1c47cb3
mov qword [rbx], rax
add rbx, 8
jmp 0x1c47c89
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1c47cfd
cmp al, 0xef
ja 0x1c47ce5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1c47cc5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1c47cd4
mov eax, dword [rdi]
add rdi, 4
jmp 0x1c47cd4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1c47d51
sub rsp, 0xffffffffffffff80
jmp 0x468640
Function at 0x1400078a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x141e27080]
xor rax, rsp
mov qword [rbp + 0x40], rax
xor ebx, ebx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], bx
lea rax, [0x14005b868]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xd
mov rdx, rcx
cmp qword [rcx + 0x18], 7
jbe 0x14000791f
mov rdx, qword [rcx]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x80], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x58]
call fcn.14000d5c0
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400079c9
xor bl, bl
jmp 0x1400079ee
mov edx, 0x2710
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x140007a2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007a4a
call fcn.140019270
movzx eax, bl
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140019250
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rbp
ret
call fcn.140020bb8
int3