joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a6094
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1401e1e10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14025bb80]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1402733bf]
call fcn.1400a676f
nop
xor edx, edx
mov ecx, 2
call fcn.1400a5243
mov qword [rbp + 0x268], rax
mov dword [rbp + 0x10], 0x238
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400a573e
test eax, eax
je 0x1401e1ecd
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401e1eb9
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
mov dword [0x140263eec], eax
mov eax, dword [rbp + 0x18]
jmp 0x1401e1ee1
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400a61e8
test eax, eax
jne 0x1401e1e88
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [0x140263eec]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402415b0]
call fcn.1400a60df
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400a52ac
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x1400a6490
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400daf00
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x14027307c]
call fcn.1400a676f
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1401f7d40]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400daf80
mov dword [rbp + 0x120], 1
jmp 0x1400daf8a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400dafd3
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400daf4b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400a694f
Capabilities:
Hide graphical window

Disassembly:
jmp 0x1401e2a80
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x70]
lea rdi, [rsp + 0x70]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14025bb80]
xor rax, rbp
mov qword [rbp + 0x1b0], rax
lea rcx, [0x1402733d9]
call fcn.1400a676f
nop
mov dword [rbp + 0x10], 0x50
mov dword [rbp + 0x14], 0
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x28], 0
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x30], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
lea rax, [0x1402435a8]
mov qword [rbp + 0x50], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov word [rbp + 0x74], ax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x98]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
nop
mov rax, qword [0x140263dc0]
mov qword [rbp + 0x1a8], rax
mov dword [rsp + 0x60], 2
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rbp + 0xa4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x9c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x98]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, str.SofMainFNBase
movzx edx, word [rbp + 0x74]
xor ecx, ecx
call qword [rbp + 0x1a8]
mov qword [0x140263dd8], rax
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
nop
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
nop
mov dword [rbp + 0xc8], 0xffffffff
lea rax, [rbp + 0xcc]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc8]
mov rcx, qword [0x140263dd8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
nop
mov edx, 5
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
lea rcx, [rbp - 0x70]
lea rdx, [0x1402427a0]
call fcn.1400a60df
mov rcx, qword [rbp + 0x1b0]
xor rcx, rbp
call fcn.1400a52ac
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1401e71c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1402733c9]
call fcn.1400a676f
nop
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1401e7214
xor al, al
jmp 0x1401e7295
mov r8d, 0x1e
lea rdx, [0x140263e58]
mov rcx, qword [rbp + 8]
call fcn.1400a52bb
nop
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov r8d, dword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov ecx, dword [rbp + 0x120]
call qword [rbp + 0xf8]
mov dword [rbp + 0x24], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.1400a5dce
nop
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
cmp dword [rbp + 0x24], 0
jle 0x1401e7287
mov byte [rbp + 0xf4], 1
jmp 0x1401e728e
mov byte [rbp + 0xf4], 0
movzx eax, byte [rbp + 0xf4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1401eb750
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400a68dc
movzx eax, al
test eax, eax
jne 0x1401eb770
mov ecx, 7
call fcn.1400a611b
nop
mov byte [rsp + 0x20], 0
call fcn.1400a61b6
mov byte [rsp + 0x21], al
cmp dword [0x1402646a8], 1
jne 0x1401eb794
mov ecx, 7
call fcn.1400a611b
nop
jmp 0x1401eb7ec
cmp dword [0x1402646a8], 0
jne 0x1401eb7e7
mov dword [0x1402646a8], 1
lea rdx, [0x1401f77c8]
lea rcx, [0x1401f7498]
call fcn.1400a522f
test eax, eax
je 0x1401eb7c8
mov eax, 0xff
jmp 0x1401eb8f1
lea rdx, [0x1401f7388]
lea rcx, [section..rdata]
call fcn.1400a61a7
mov dword [0x1402646a8], 2
jmp 0x1401eb7ec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400a60a3
call fcn.1400a5c75
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1401eb849
mov rcx, qword [rsp + 0x30]
call fcn.1400a4ed8
movzx eax, al
test eax, eax
je 0x1401eb849
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140275020]
nop
call fcn.1400a5e2d
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1401eb87d
mov rcx, qword [rsp + 0x38]
call fcn.1400a4ed8
movzx eax, al
test eax, eax
je 0x1401eb87d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400a6652
nop
call fcn.1401eb960
mov dword [rsp + 0x28], eax
call fcn.1400a5b58
movzx eax, al
test eax, eax
jne 0x1401eb89c
mov ecx, dword [rsp + 0x28]
call fcn.1400a42da
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1401eb8ab
call fcn.1400a66d4
nop
xor edx, edx
mov cl, 1
call fcn.1400a4e0b
mov eax, dword [rsp + 0x28]
jmp 0x1401eb8f1
add rsp, 0x68
ret
Function at 0x14000caf8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140005a7c
xor ebx, ebx
cmp qword [0x1400163c0], rbx
mov rdi, rax
jne 0x14000cc0b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000cce2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000cce2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400163c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400163c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400163d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400163e0], rax
test rax, rax
je 0x14000cc02
lea rdx, [0x140011c40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400163d8], rax
jmp 0x14000cc12
mov rax, qword [0x1400163d8]
jmp 0x14000cc19
mov rax, qword [0x1400163d8]
mov r11, qword [0x1400163e0]
cmp rax, rdi
je 0x14000cc80
cmp r11, rdi
je 0x14000cc80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400163e0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000cc80
test rax, rax
je 0x14000cc80
call rsi
test rax, rax
je 0x14000cc7a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000cc7a
test byte [rsp + 0x40], 1
jne 0x14000cc80
bts ebp, 0x15
jmp 0x14000ccc0
mov rcx, qword [0x1400163c8]
cmp rcx, rdi
je 0x14000ccc0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000ccc0
call rax
mov rbx, rax
test rax, rax
je 0x14000ccc0
mov rcx, qword [0x1400163d0]
cmp rcx, rdi
je 0x14000ccc0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000ccc0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400163c0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000cce2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000cce4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001cf0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140001a44
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
and qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor r8d, r8d
and qword [rsp + 0x20], 0
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
setns al
add rsp, 0x48
ret
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400133c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014700
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014720
xor al, al
jmp 0x1400147a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014733
xor al, al
jmp 0x1400147a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001475d
xor al, al
jmp 0x1400147a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014771
xor al, al
jmp 0x1400147a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014783
xor al, al
jmp 0x1400147a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001479f
xor al, al
jmp 0x1400147a1
mov al, 1
add rsp, 0x38
ret
Function at 0x1808ee058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1808ee1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1808ee089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808ee06f
add dl, dl
jne 0x1808ee096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808ee0f6
xor eax, eax
add dl, dl
jne 0x1808ee0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808ee1ad
add dl, dl
jne 0x1808ee0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ee0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ee0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ee0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1808ee0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1808ee07e
mov eax, 1
add dl, dl
jne 0x1808ee106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808ee113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808ee0fb
sub eax, ebx
mov ebx, 1
jne 0x1808ee14c
mov ecx, 1
add dl, dl
jne 0x1808ee12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808ee13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808ee123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808ee07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1808ee168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808ee175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808ee15d
cmp eax, 0x7d00
jae 0x1808ee19b
cmp eax, 0x500
jb 0x1808ee196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808ee07e
cmp eax, 0x7f
ja 0x1808ee19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808ee07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1808ee1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1808ee07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400042b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400042fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400042fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400042fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400042fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400042fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400042fc
xor al, al
add rsp, 0x28
ret
Function at 0x18002a750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx ebx, byte [rsp + 0x98]
lea esi, [rdx - 0x12]
mov rbp, rcx
cmp edx, esi
jbe case.0x18002a7d2.1
mov r12, qword [rsp + 0xa8]
lea edi, [rdx - 0x1b]
mov r14, qword [rsp + 0xa8]
lea rdx, [0x180000000]
mov r13, qword [rsp + 0xa8]
lea r9, [0x180058e40]
mov r15, qword [rsp + 0xa8]
lea r10, [0x180058fa0]
cmp edi, 0x5a
ja case.0x18002a7d2.16
movzx eax, byte [rdx + rdi + 0x2aa5c]
mov ecx, dword [rdx + rax*4 + 0x2aa18]
add rcx, rdx
jmp rcx
xor edx, edx
mov r9, r12
xor ecx, ecx
lea r8d, [rdx + 9]
call fcn.18002b040
jmp 0x18002a9cd
mov rcx, qword [rbp + 0x10]
call fcn.1800591e0
jmp 0x18002a9cd
mov r9, r14
xor edx, edx
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea ecx, [rdx + 0x2e]
call fcn.1800276a0
mov r14, rax
jmp 0x18002a9cd
mov r9, qword [rsp + 0xa8]
xor edx, edx
xor ecx, ecx
mov r8d, 0x113
call fcn.180052110
jmp 0x18002a9cd
mov qword [rsp + 0x30], r9
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, 0x8b
xor ecx, ecx
call fcn.180015af0
mov r12, rax
jmp 0x18002a9cd
mov r9, r13
jmp 0x18002a820
mov qword [rsp + 0x28], 0
lea r8, [0x180013f70]
mov r9, rbp
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
jmp 0x18002a9cd
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0x11e
call fcn.180021dc0
mov r13, rax
mov r14, rax
jmp 0x18002a9cd
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0x11e
call fcn.180021dc0
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0x38]
lea rax, [0x180075308]
mov ecx, 0xef
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
call fcn.180028180
jmp 0x18002a9cd
mov qword [0x180079880], rbp
mov qword [rbp + 0x80], r8
jmp case.0x18002a7d2.16
mov bl, 1
jmp case.0x18002a7d2.16
lea r8, [rsp + 0x98]
mov dword [rsp + 0x98], 0
mov edx, 0x74
xor ecx, ecx
call fcn.180013ba0
lea rax, [0x180058e40]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, 0x8b
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.180015af0
mov r12, rax
jmp 0x18002a9cd
test r15, r15
je 0x18002aa12
mov rax, r15
xchg qword [0x180079888], rax
jmp case.0x18002a7d2.16
xor edx, edx
mov qword [rsp + 0x20], 0
mov r9, r14
xor r8d, r8d
lea ecx, [rdx + 0x2e]
call fcn.1800276a0
mov r9, rax
jmp 0x18002a7fa
xor r8d, r8d
mov qword [rsp + 0x48], r10
lea rdx, [rsp + 0x48]
lea ecx, [r8 + 0x3e]
call fcn.1800187a0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0x128
call fcn.18001d2d0
mov r8, qword [rsp + 0xa0]
lea rdx, [0x180000000]
lea r9, [0x180058e40]
lea r10, [0x180058fa0]
dec edi
lea eax, [rdi + 0x1b]
cmp eax, esi
ja 0x18002a7b7
movzx eax, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x18002a9fa
Function at 0x18003fa30
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov r14, r9
imul r15d, ebp, 0x9b
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov ebx, ebp
cmp ebp, r15d
ja 0x18003fb67
mov edi, dword [rsp + 0x90]
cmp ebx, 0x19
je 0x18003fae5
cmp ebx, 0x46
je 0x18003fab0
cmp ebx, 0x320
je 0x18003fb67
cmp ebx, 0x8c0
je 0x18003faa7
cmp ebx, 0x113a
je 0x18003fb67
jmp 0x18003fb52
mov dword [rsp + 0x30], edi
jmp 0x18003fb52
movzx eax, byte [rsi]
mov edi, 0x1505
mov rcx, rsi
test al, al
je 0x18003fb52
nop dword [rax]
nop word [rax + rax]
imul edi, edi, 0x21
lea rcx, [rcx + 1]
movzx eax, al
add edi, eax
movzx eax, byte [rcx]
test al, al
jne 0x18003fad0
jmp 0x18003fb52
movzx ecx, byte [r14]
mov eax, ecx
sub eax, 0xa
je 0x18003fb23
sub eax, 1
je 0x18003fb23
sub eax, 4
je 0x18003fb62
cmp eax, 6
jne 0x18003fb23
mov rcx, qword [r13 + 8]
mov r8b, 0x1c
mov r9, qword [rcx + 8]
movzx edx, byte [rcx + 4]
xor ecx, ecx
lea rax, [r9 + 0x1c]
mov qword [rsp + 0x20], rax
call qword [0x180079870]
movzx ecx, byte [r14]
mov byte [rsp + 0x90], cl
lea rax, [rsp + 0x90]
mov ebx, 0x19
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, r12
mov rcx, r13
lea r9d, [rbx + 0x6a]
call fcn.180040dd0
mov byte [rsp + 0x30], al
imul eax, ebp, 0x1f
add ebx, eax
cmp ebx, r15d
jbe 0x18003fa78
jmp 0x18003fb67
mov byte [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180056b60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
imul eax, r9d, 0x5a0
mov r12, r8
mov rsi, rdx
mov dword [rsp + 0x48], r9d
mov r15, rcx
mov edi, r9d
mov dword [rsp + 0x60], eax
cmp r9d, eax
ja 0x180056c7e
mov rbp, qword [rsp + 0x68]
xor ebx, ebx
mov r13, qword [rsp + 0x68]
mov r14, qword [rsp + 0x68]
cmp edi, 0x2155
ja 0x180056d04
je 0x180056c7e
mov eax, edi
sub eax, 0x2c
je 0x180056d7a
sub eax, 9
je 0x180056c9b
sub eax, 0xa4
je 0x180056bec
cmp eax, 0x41
jne 0x180056c61
mov rbp, qword [r15 + 8]
jmp 0x180056c61
mov rcx, qword [r12]
call qword [r15 + reloc.SHELL32.dll_ILFindLastID]
xor edx, edx
div dword [r15 + 8]
mov rax, qword [r15]
mov rsi, qword [rax + rdx*8]
test rsi, rsi
je 0x180056c59
nop word [rax + rax]
mov edi, 0xce
mov eax, edi
sub eax, 0xcc
je 0x180056c42
sub eax, 1
je 0x180056c2d
cmp eax, 1
jne 0x180056c46
mov r14, rsi
jmp 0x180056c46
mov rdx, qword [r14]
mov rcx, qword [r12]
call qword [r15 + 0x18]
test eax, eax
je 0x180056c46
mov rax, qword [r14 + 8]
jmp 0x180056c83
mov rsi, qword [rsi + 0x10]
dec edi
cmp edi, 0xcb
ja 0x180056c15
test rsi, rsi
jne 0x180056c10
mov edi, dword [rsp + 0x48]
mov rsi, qword [rsp + 0xb8]
mov eax, dword [rsp + 0xc8]
lea eax, [rax + rax*4]
shl eax, 5
add edi, eax
mov dword [rsp + 0x48], edi
cmp edi, dword [rsp + 0x60]
jbe 0x180056bb4
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9, r12
mov qword [rsp + 0x20], rbx
mov r8d, 0x102
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.180043440
test al, al
je 0x180056d71
movzx eax, word [rsi]
lea rcx, [rsp + 0x48]
mov word [rsp + 0x48], ax
mov r9, r15
mov eax, dword [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], 0xf6
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.18001ecb0
mov byte [rsp + 0x68], al
jmp 0x180056c61
cmp edi, 0x8879
je 0x180056da8
cmp edi, 0xb15a
je 0x180056d61
cmp edi, 0x1619a
je 0x180056d40
cmp edi, 0x211da
jne 0x180056c61
nop dword [rax]
mov byte [rbp], bl
inc rbp
cmp rbp, r13
jne 0x180056d30
jmp 0x180056c61
movzx eax, byte [r15 + 5]
movzx ecx, byte [rsp + 0x40]
add rax, rax
nop dword [rax]
add r13, rax
add cl, 0xff
jne 0x180056d50
mov byte [rsp + 0x40], cl
jmp 0x180056c61
movzx eax, byte [r15]
mov r13, rbp
mov byte [rsp + 0x40], al
jmp 0x180056c61
mov byte [rsp + 0x68], bl
jmp 0x180056c7e
xor r9d, r9d
mov byte [rsp + 0xc8], 0xa
lea r8, [rsp + 0xc8]
mov dword [rsp + 0x20], 0x5b
mov rdx, r15
xor ecx, ecx
call fcn.18003aa90
mov byte [rsp + 0x68], al
jmp 0x180056c7e
mov rax, rbx
jmp 0x180056c83
Function at 0x140011226
Capabilities:
Terminate process

Disassembly:
jmp 0x140014130
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112bc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015480
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400154a0
xor al, al
jmp 0x140015521
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400154b3
xor al, al
jmp 0x140015521
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400154dd
xor al, al
jmp 0x140015521
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400154f1
xor al, al
jmp 0x140015521
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015503
xor al, al
jmp 0x140015521
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001551f
xor al, al
jmp 0x140015521
mov al, 1
add rsp, 0x38
ret