joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400473b0
Capabilities:
Get disk information

Disassembly:
jmp 0x1400473b0
mov byte [rsp + 0x10], dl
push rsi
sub rsp, 0x240
mov rsi, rcx
call fcn.1400479c0
test al, al
je 0x1400474b6
mov qword [rsp + 0x250], rbx
mov qword [rsp + 0x238], rbp
mov qword [rsp + 0x230], rdi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x262], 0x3a
mov ebx, edi
mov ebp, eax
nop dword [rax + rax]
lea ecx, [rbx + 0x41]
mov dword [rsp + 0x258], 0x20a
mov word [rsp + 0x260], cx
lea r8, [rsp + 0x258]
lea rcx, [rsp + 0x260]
lea rdx, [rsp + 0x20]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x140047452
lea rdx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140047446
jmp 0x140047464
bt ebp, ebx
jae 0x14004747c
lea rdx, [rsp + 0x260]
mov eax, 2
mov r8d, eax
mov rcx, rsi
mov dword [rsp + 0x258], eax
call fcn.140047d30
test al, al
je 0x14004747c
inc edi
inc ebx
cmp ebx, 0x1a
jb 0x140047400
mov rbp, qword [rsp + 0x238]
test edi, edi
mov rdi, qword [rsp + 0x230]
mov rbx, qword [rsp + 0x250]
je 0x1400474b6
mov rcx, rsi
call fcn.140047ae0
mov al, 1
add rsp, 0x240
pop rsi
ret
xor al, al
add rsp, 0x240
pop rsi
ret
Function at 0x140047560
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov r14, rdx
mov rsi, rcx
lea rdx, [rsp + 0x40]
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
xor ebp, ebp
cmp rax, 0xffffffffffffffff
je 0x14004775c
mov eax, dword [rsp + 0x40]
test al, 0x10
je 0x140047683
bt eax, 0xa
jae 0x1400475c3
test dword [rsp + 0x64], 0xa000000c
jne 0x14004772d
cmp word [rsp + 0x6c], 0x2e
jne 0x1400475e9
movzx eax, word [rsp + 0x6e]
test eax, eax
je 0x14004772d
cmp eax, 0x2e
jne 0x1400475e9
cmp word [rsp + 0x70], 0
je 0x14004772d
lea rax, [rsp + 0x6c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400475f5
mov rdx, qword [r14 + 0x20]
add rdx, rbx
lea rdx, [rdx*2 + 0x34]
mov rcx, qword [rsi]
call fcn.140048010
mov rdi, rax
mov r8, qword [r14 + 0x20]
add r8, r8
lea rcx, [rax + 0x28]
lea rdx, [r14 + 0x28]
call fcn.140073d70
lea r8, [rbx + rbx]
mov rcx, qword [r14 + 0x20]
add rcx, 0x14
lea rcx, [rdi + rcx*2]
lea rdx, [rsp + 0x6c]
call fcn.140073d70
add rbx, qword [r14 + 0x20]
mov dword [rdi + rbx*2 + 0x28], 0x2a005c
mov word [rdi + rbx*2 + 0x2c], bp
inc rbx
mov qword [rdi + 0x20], rbx
mov r9, rdi
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x140047743
lock inc dword [rsi + 0x30]
jmp 0x14004772d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
mov r8, qword [r14 + 0x20]
lea rdx, [r14 + 0x28]
lea rcx, [rsp + 0x20]
call fcn.140037b30
nop
mov rbx, qword [rsi + 0x20]
mov rax, qword [rbx]
mov rdi, qword [rax]
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400476c0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140038d10
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call rdi
mov rax, qword [rsi + 0x28]
lock inc qword [rax]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14004772d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047728
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004777f
call fcn.140071ab4
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400475a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0x12
cmove ebx, ebp
mov ebp, ebx
mov eax, ebp
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140077e4c
int3
Function at 0x140047870
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
nop
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
test eax, eax
jne 0x140047880
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x102
jne 0x1400478c9
lea rcx, [rbx + 8]
call fcn.140047f80
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0x2c], edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx + 0x2c], ebx
jbe 0x14004790f
mov rcx, qword [rdi + 0x30]
inc ebx
xor edx, edx
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x140047921
cmp ebx, dword [rdi + 0x2c]
jb 0x1400478f4
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140047870
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400478e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
nop
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
test eax, eax
jne 0x140047880
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x102
jne 0x1400478c9
lea rcx, [rbx + 8]
call fcn.140047f80
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0x2c], edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx + 0x2c], ebx
jbe 0x14004790f
mov rcx, qword [rdi + 0x30]
inc ebx
xor edx, edx
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x140047921
cmp ebx, dword [rdi + 0x2c]
jb 0x1400478f4
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140047870
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140047930
Capabilities:
Resume thread
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov ecx, dword [rcx + 0x2c]
test ecx, ecx
je 0x14004797d
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x14004799c
mov rcx, qword [rbx + 0x30]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [rbx + 0x2c]
inc edi
cmp edi, ecx
jb 0x140047950
mov rdx, qword [rbx + 0x30]
mov r8d, 1
imul r9d, ecx, 0x3e8
add rdx, 8
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1400479ae
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400478e0
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140047870
Function at 0x1400479c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x140047ab6
cmp qword [rcx + 0x30], 0
jne 0x140047ad0
xor r13d, r13d
mov dword [rcx + 0x2c], r13d
mov r15d, dword [rcx + 0x28]
inc r15
lea rdx, [r15*8]
add rcx, 8
call fcn.140048010
mov qword [rbx + 0x30], rax
mov edi, 1
mov esi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x38]
cmp esi, r15d
jge 0x140047a9f
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rax
lea r8, [0x140047840]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd r14, esi
mov rcx, qword [rbx + 0x30]
mov qword [rcx + r14*8], rax
mov rdx, qword [rbx + 0x30]
cmp qword [rdx + r14*8], 0
jne 0x140047a9b
cmp r14, rdi
jle 0x140047a8a
nop word [rax + rax]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + rdi*8]
inc rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, r14
jl 0x140047a70
mov rdx, qword [rbx + 0x30]
lea rcx, [rbx + 8]
call fcn.1400480f0
mov qword [rbx + 0x30], r13
xor al, al
jmp 0x140047ab8
inc esi
jmp 0x140047a20
mov dword [rax + 0x30], r13d
mov eax, dword [rbx + 0x28]
mov dword [rbx + 0x2c], eax
mov rcx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x18]
mov qword [rcx], rax
jmp 0x140047ad0
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov al, 1
jmp 0x140047ab8

Function at 0x140047ae0
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x2c]
lea eax, [rcx + 1]
cmp eax, 1
jbe 0x140047b33
mov qword [rsp + 0x30], rbx
mov ebx, 8
mov qword [rsp + 0x38], rdi
mov edi, ecx
nop word [rax + rax]
mov rax, qword [rsi + 0x30]
lea rbx, [rbx + 8]
mov rcx, qword [rbx + rax - 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rdi, 1
jne 0x140047b10
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140047b40
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov esi, dword [rcx + 0x2c]
xor eax, eax
inc esi
mov qword [r11 - 0x48], rax
mov r12d, dword [r11 - 0x44]
xor r15d, r15d
mov rbp, rcx
mov qword [r11 + 0x18], rdi
mov r13d, eax
nop
mov rdx, qword [rbp + 0x30]
mov r9d, 0xffffffff
xor r8d, r8d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x140047c94
cmp ebx, 0xffffffff
je 0x140047c82
cmp ebx, esi
jae 0x140047c82
mov rax, qword [rbp + 0x30]
lea r14, [rbx*8]
lea rdx, [rsp + 0x80]
mov rdi, qword [r14 + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x80], 1
jne 0x140047c32
test r15d, r15d
je 0x140047bdf
cmp r12d, 1
je 0x140047c32
mov r9, qword [rbp + 0x38]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8, [0x140047840]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140047c32
mov rcx, qword [rbp + 0x30]
mov qword [r14 + rcx], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r12d, dword [rsp + 0x80]
inc r13d
mov r15d, r13d
jmp 0x140047b70
cmp esi, 2
je 0x140047c6c
nop word [rax + rax]
mov rdx, qword [rbp + 0x30]
lea r14, [r14 + 8]
inc ebx
mov rcx, qword [rdx + rbx*8]
mov qword [r14 + rdx - 8], rcx
cmp ebx, esi
jb 0x140047c40
mov r12d, dword [rsp + 0x80]
dec esi
inc r13d
mov r15d, r13d
jmp 0x140047b70
mov rcx, rbp
mov dword [rbp + 0x2c], 1
call fcn.140047930
xor al, al
jmp 0x140047d0a
lea eax, [rsi - 1]
mov rcx, rbp
mov dword [rbp + 0x2c], eax
call fcn.1400478e0
xor al, al
jmp 0x140047d0a
cmp esi, 1
jbe 0x140047cba
mov ebx, 8
lea edi, [rsi - 1]
mov rax, qword [rbp + 0x30]
lea rbx, [rbx + 8]
mov rcx, qword [rbx + rax - 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rdi, 1
jne 0x140047ca1
cmp esi, dword [rbp + 0x28]
ja 0x140047d08
nop
mov r9, qword [rbp + 0x38]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8, [0x140047840]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140047d00
mov rcx, qword [rbp + 0x30]
mov qword [rcx + rsi*8], rax
inc esi
cmp esi, dword [rbp + 0x28]
jbe 0x140047cc0
jmp 0x140047d08
mov rcx, rbp
call fcn.140047930
mov al, 1
mov rdi, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x140050564
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400ea188]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x1400505a8
movzx eax, r14w
jmp 0x1400506de
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400505e4
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400505e4
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400506de
cmp qword [rcx + 0x80], r14
je 0x1400506db
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140050622
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14005064b
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140083790
cmp ax, di
je 0x1400506db
movzx edi, si
jmp 0x1400506db
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x1400bd5e8]
test eax, eax
js 0x1400506db
cmp eax, 1
jle 0x1400506a0
cmp eax, 3
jne 0x1400506db
movzx ecx, word [rbp + 7]
jmp 0x14005062e
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x1400506ca
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140078ab8
cmp r14, rax
jne 0x1400506db
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x1400506de
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140072180
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140067af0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140052186
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140052169
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140052154

Function at 0x140071078
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140123fc0]
mov ebx, r9d
mov rdi, r8
mov esi, edx
test rax, rax
je 0x1400710a3
call qword [0x1400bd5e8]
jmp 0x1400710b8
call fcn.140071044
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007a9c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14007a853
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007a853
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007a853
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007a853
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007a853
cmp dword [rcx + 0x84], 0xe
jbe 0x14007a853
cmp dword [rcx + 0xf8], 0
je 0x14007a853
mov ecx, ebx
call fcn.14007a8f4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14007a6e4
cmp dword [rbp + 0x20], 0
je 0x14007a8a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14007a8a8
int3
xor r8d, r8d
xor edx, edx
jmp 0x14007a7ec
Function at 0x14008b7e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14008b506
call fcn.14007be5c
mov dword [rax], 0x16
call fcn.140077e2c
jmp 0x14008b651
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14008b651
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14008b651
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14008b535
lock or dword [rcx + 0x14], 0x10
jmp 0x14008b651
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008b549
call fcn.14008cc00
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14008b559
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14008b55c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140089d10
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14008d240
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008b63f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008b5ed
mov rcx, rbx
call fcn.140089d10
cmp eax, 0xffffffff
je 0x14008b5d8
mov rcx, rbx
call fcn.140089d10
cmp eax, 0xfffffffe
je 0x14008b5d8
mov rcx, rbx
call fcn.140089d10
movsxd rdi, eax
lea r14, [0x140124b30]
mov rcx, rbx
sar rdi, 6
call fcn.140089d10
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14008b5df
lea rdx, [0x1400ea3e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008b5ed
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14008b611
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14008b611
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14008b611
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14008b62f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14008b63a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14008b656
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14008b4d0
Function at 0x180001020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
movzx edi, word [r8 + 0xe]
movzx eax, word [r8 + 0xc]
mov rsi, r9
add edi, eax
mov r10, rcx
lea rbx, [r8 + 0x10]
je 0x1800010e8
mov qword [rsp + 0x60], rbp
mov ebp, dword [rsp + 0x70]
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x180001088
test ebp, ebp
jne 0x180001067
cmp word [rbx], 0x18
je 0x1800010d7
btr ecx, 0x1f
lea eax, [rbp + 1]
mov r9, rsi
lea r8, [rdx + rcx]
mov rcx, r10
mov dword [rsp + 0x20], eax
call fcn.180001020
mov r10, qword [rsp + 0x50]
jmp 0x1800010d2
btr ecx, 0x1f
mov r9d, dword [rcx + rdx + 4]
mov r8d, dword [rcx + rdx]
shr r9d, 2
add r8, r10
test r9d, r9d
je 0x1800010d7
mov eax, dword [rsi]
add r8, 4
xor dword [r8 - 4], eax
mov ecx, dword [rsi]
mov eax, 0x8fd66c05
mul ecx
shr edx, 0x11
imul edx, edx, 0x38f40
sub ecx, edx
imul ecx, ecx, 0x2455
add ecx, 0xc091
dec r9d
mov dword [rsi], ecx
jne 0x1800010a1
mov rdx, qword [rsp + 0x58]
add rbx, 8
dec edi
jne 0x180001056
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800010f0
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
movsxd rdi, dword [rcx + 0x3c]
xor r13d, r13d
mov rbp, rcx
add rdi, rcx
mov ebx, r13d
movzx eax, word [rdi + 0x14]
lea rsi, [rax + rdi + 0x18]
cmp r13w, word [rdi + 6]
jae 0x180001161
nop word [rax + rax]
lea rdx, str..rsrc
mov rcx, rsi
call fcn.180001ae8
test eax, eax
je 0x180001161
movzx eax, word [rdi + 6]
inc ebx
add rsi, 0x28
cmp ebx, eax
jl 0x180001140
movzx eax, word [rdi + 6]
cmp ebx, eax
jge 0x1800012fd
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x188], r12
mov byte [rsp + 0x40], r13b
call fcn.180001ca0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.QA1Q0ZWQIE__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.180001bb4
lea r8, [rsp + 0x40]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, rax
test rax, rax
je 0x1800012f5
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1800012ec
mov ebx, dword [rsi + 0xc]
add rbx, rbp
mov ecx, dword [rbx]
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x1800012e3
mov eax, ecx
shr eax, 0x10
xor al, 0x76
cmp cl, al
jne 0x1800012e3
mov eax, ecx
shr ecx, 8
shr eax, 0x18
xor al, 0x5a
cmp cl, al
jne 0x1800012e3
mov edx, dword [rsi + 0x10]
lea r9, [rsp + 0x34]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edi, word [rbx + 0xe]
movzx eax, word [rbx + 0xc]
add edi, eax
mov dword [rbx], r13d
lea r11, [rbx + 0x10]
je 0x1800012cd
mov eax, dword [rsp + 0x30]
mov ecx, dword [r11 + 4]
test ecx, ecx
jns 0x180001276
cmp word [r11], 0x18
je 0x1800012c1
btr ecx, 0x1f
lea r9, [rsp + 0x30]
mov rdx, rbx
lea r8, [rbx + rcx]
mov rcx, rbp
mov dword [rsp + 0x20], 1
call fcn.180001020
mov eax, dword [rsp + 0x30]
jmp 0x1800012c1
btr ecx, 0x1f
mov r9d, dword [rcx + rbx + 4]
mov r8d, dword [rcx + rbx]
shr r9d, 2
add r8, rbp
test r9d, r9d
je 0x1800012c1
nop
xor dword [r8], eax
mov ecx, dword [rsp + 0x30]
mov eax, 0x8fd66c05
add r8, 4
mul ecx
shr edx, 0x11
imul ecx, ecx, 0x2455
imul edx, edx, 0x7eac6fc0
dec r9d
lea eax, [rdx + rcx + 0xc091]
mov dword [rsp + 0x30], eax
jne 0x180001290
add r11, 8
dec edi
jne 0x180001241
mov edx, dword [rsi + 0x10]
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180001c70
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret
Function at 0x1800052db
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x180001c8a
rol rcx, 0x10
test cx, 0xffff
jne 0x180001c86
repz ret
ror rcx, 0x10
jmp 0x180005234
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180020150]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180020248]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800052b9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180020150]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800052db
mov rax, qword [rsp + 0x88]
mov qword [0x180020248], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800201e8], rax
mov rax, qword [0x180020248]
mov qword [0x1800200c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800201d0], rax
mov dword [0x1800200b0], 0xc0000409
mov dword [0x1800200b4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000e008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180020148], eax
mov ecx, 1
call fcn.180006e24
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000a910]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180020148], 0
jne 0x180005362
mov ecx, 1
call fcn.180006e24
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret