joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002af60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140077048]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor esi, esi
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbx + 0xf0]
test rcx, rcx
je 0x14002afac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbx + 0xb0]
xor edx, edx
mov ecx, 0xc3a
call qword [0x14007a250]
mov qword [rbx + 0xf0], rax
lea rcx, [rbx + 0x70]
call fcn.140030cd0
mov dword [rbp - 0x29], esi
mov dword [rbp - 0x39], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14002b04b
lea rdx, [rbp - 0x39]
mov rcx, qword [rbx + 0xf0]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14002b04b
mov eax, dword [rbp - 0x39]
cmp dword [rbp - 0x29], eax
je 0x14002b04b
lea r8, [0x14007a480]
cmp qword [0x14007a498], 8
cmovae r8, qword [0x14007a480]
lea rdx, [0x14007a6c0]
cmp qword [0x14007a6d8], 8
cmovae rdx, qword [0x14007a6c0]
xor ecx, ecx
lea r9d, [rcx + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x14002b10a
cmp qword [rbx + 0xf0], rsi
jne 0x14002b108
lea rdx, [0x14007a660]
lea rcx, [rbp - 9]
call fcn.140013530
lea rdx, [0x14007a480]
lea rcx, [rbp + 0x17]
call fcn.140013530
mov dword [rbp + 0x37], 0x10
mov ecx, 0x48
call fcn.140033e04
mov rbx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.140013530
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x17]
call fcn.140013530
mov ecx, dword [rbp + 0x37]
mov dword [rbx + 0x40], ecx
mov qword [rbp - 0x29], rbx
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x14001b7a0]
xor edx, edx
xor ecx, ecx
call fcn.14003ed48
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14002b12f
lea rcx, [rbp - 9]
call fcn.1400169f0
cmp dword [rbp - 0x11], 0
je 0x14002b13d
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call fcn.1400333ac
test eax, eax
jne 0x14002b13d
jmp 0x14002b10a
mov al, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140033db0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov dword [rbp - 0x11], esi
mov ecx, 6
call fcn.140033310
nop
mov ecx, 1
call fcn.140033310
int3
Function at 0x140031190
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140077048]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x14007a268]
mov rbx, rax
test rax, rax
jne 0x14003131d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14002b800
nop
lea r8, [0x14007a6a0]
cmp qword [0x14007a6b8], 8
cmovae r8, qword [0x14007a6a0]
mov r9, qword [0x14007a6b0]
mov rcx, rax
call fcn.140007d50
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x14007a480]
cmp qword [0x14007a498], 8
cmovae r8, qword [0x14007a480]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400312c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400312c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031366
call fcn.140033dd0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140031319
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031360
call fcn.140033dd0
xor al, al
jmp 0x14003133f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140033db0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.14003a754
nop
call fcn.14003a754
nop
int3
Function at 0x140034af0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140034b3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034b3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034b3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034b3a
cmp dword [rcx + 0x84], 0xe
jbe 0x140034b3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140034b3c
xor al, al
add rsp, 0x28
ret

Function at 0x14003e8bc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14003e74f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e74f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003e74f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003e74f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003e74f
cmp dword [rcx + 0x84], 0xe
jbe 0x14003e74f
cmp dword [rcx + 0xf8], 0
je 0x14003e74f
mov ecx, ebx
call fcn.14003e7f0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14003e5e0
cmp dword [rbp + 0x20], 0
je 0x14003e79c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003e7a4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14003e6e8
Function at 0x180001570
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add rsp, 0x28
ret

Function at 0x18000ba70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x1c0], 0xfffffffffffffffe
mov qword [rsp + 0x90], 0
lea rdi, [rsp + 0x98]
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1f0]
movzx eax, word [rax]
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], 0
mov dword [rsp + 0x88], 0
mov rax, qword [rsp + 0x1f0]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0xb0], eax
lea rcx, [rsp + 0x40]
call fcn.18000c1b0
nop
mov eax, dword [rsp + 0x84]
mov r8d, dword [rsp + 0xb0]
sub r8d, eax
movsxd rax, dword [rsp + 0x84]
mov rdx, qword [rsp + 0x30]
add rdx, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000bc45
cmp dword [rsp + 0x88], 0
jbe 0x18000bc45
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1f0]
mov r8, qword [rsp + 0x1e8]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
call fcn.18000bc70
cmp eax, 1
jne 0x18000bbb2
mov dword [rsp + 0xb4], 1
lea rcx, [rsp + 0x40]
call fcn.18000c490
mov eax, dword [rsp + 0xb4]
jmp 0x18000bc61
mov ecx, dword [rsp + 0x88]
mov eax, dword [rsp + 0xa0]
add eax, ecx
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0x84], 0
jle 0x18000bbf6
movsxd r8, dword [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.180019ce0
jmp 0x18000bc40
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x88], eax
jbe 0x18000bc40
movsxd r8, dword [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
add rdx, rax
movsxd rax, dword [rsp + 0x80]
sub rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.180019ce0
jmp 0x18000bb06
mov dword [rsp + 0xb8], 0
lea rcx, [rsp + 0x40]
call fcn.18000c490
mov eax, dword [rsp + 0xb8]
add rsp, 0x1d0
pop rdi
ret
Function at 0x180011070
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
mov rax, qword [0x18003c1b0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r9, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
xor r11d, r11d
mov rdi, r9
mov r8, rdx
repne scasb al, byte [rdi]
mov byte [rsp], 7
mov byte [rsp + 1], 3
not rcx
mov byte [rsp + 2], 4
mov byte [rsp + 3], 1
dec rcx
mov byte [rsp + 4], 5
mov byte [rsp + 5], 1
mov byte [rsp + 6], 2
mov rdx, r11
movsxd r10, ecx
test ecx, ecx
jle 0x180011116
mov rcx, r8
sub r9, r8
mov rdi, r10
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
cmp rdx, 5
cmove rdx, r11
inc rcx
xor al, byte [rsp + rdx]
inc rdx
sub rdi, 1
mov byte [rcx - 1], al
jne 0x1800110e0
mov byte [r10 + r8], r11b
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180019b50
add rsp, 0x10
pop rdi
ret
mov byte [r10 + r8], al
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180019b50
add rsp, 0x10
pop rdi
ret
Function at 0x180019490
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x10058
call fcn.1800306d0
sub rsp, rax
mov rax, qword [0x18003c1b0]
xor rax, rsp
mov qword [rsp + 0x10040], rax
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x10060]
call fcn.18001b46c
mov rcx, qword [rsp + 0x10060]
call fcn.18001b6e0
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x10060]
call fcn.18001b46c
mov r11d, dword [rsp + 0x20]
mov dword [rsp + 0x28], r11d
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x28], 0x10000
jl 0x18001954c
mov r9, qword [rsp + 0x10060]
mov r8d, 1
mov edx, 0x10000
lea rcx, [rsp + 0x40]
call fcn.18001bd74
mov r8d, dword [rsp + 0x24]
mov edx, 0x10000
lea rcx, [rsp + 0x40]
call fcn.1800195b0
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x28]
sub eax, 0x10000
mov dword [rsp + 0x28], eax
jmp 0x1800194fe
cmp dword [rsp + 0x28], 0
jle 0x180019587
movsxd rdx, dword [rsp + 0x28]
mov r9, qword [rsp + 0x10060]
mov r8d, 1
lea rcx, [rsp + 0x40]
call fcn.18001bd74
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1800195b0
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.180019b50
add rsp, 0x10058
ret

Function at 0x18001cd3b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18003c1b0]
jne 0x180019b6a
rol rcx, 0x10
test cx, 0xffff
jne 0x180019b66
repz ret
ror rcx, 0x10
jmp 0x18001cc94
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18003f010]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18003f108]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18001cd19
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18003f010]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18001cd3b
mov rax, qword [rsp + 0x88]
mov qword [0x18003f108], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18003f0a8], rax
mov rax, qword [0x18003f108]
mov qword [0x18003ef80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18003f090], rax
mov dword [0x18003ef70], 0xc0000409
mov dword [0x18003ef74], 1
mov rax, qword [0x18003c1b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18003c1b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18003f008], eax
mov ecx, 1
call fcn.18001efb0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800326f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18003f008], 0
jne 0x18001cdc2
mov ecx, 1
call fcn.18001efb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18001e810
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.180023edc
nop
cmp dword [0x18003f538], 1
je 0x18001e7bc
mov dword [0x18003f534], 1
mov byte [0x18003f530], r12b
test ebx, ebx
jne 0x18001e7a8
mov rcx, qword [0x180041d98]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18001e795
mov rcx, qword [0x180041d90]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x18001e734
call fcn.18001dcb8
cmp qword [rdi], rax
jne 0x18001e734
jmp 0x18001e71a
cmp rdi, rsi
jb 0x18001e795
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.18001dcb8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x180041d98]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x180041d90]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x18001e773
cmp r13, rax
je 0x18001e793
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x18001e71a
lea rdx, [0x180032650]
lea rcx, [0x180032638]
call fcn.18001e564
lea rdx, [0x180032660]
lea rcx, [0x180032658]
call fcn.18001e564
nop
test r12d, r12d
je 0x18001e7cb
mov ecx, 8
call fcn.180023ddc
test r12d, r12d
jne 0x18001e7f6
mov dword [0x18003f538], 1
lea ecx, [r12 + 8]
call fcn.180023ddc
mov ecx, r15d
call fcn.18001e4f8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18001e684
Function at 0x1800289b4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18001dcb8
xor ebx, ebx
mov rdi, rax
cmp qword [0x18003fcd0], rbx
jne 0x180028aba
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180028b8f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180028b8f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18003fcd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18003fcd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18003fce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18003fcf0], rax
test rax, rax
je 0x180028ab1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18003fce8], rax
jmp 0x180028ac1
mov rax, qword [0x18003fce8]
jmp 0x180028ac8
mov rax, qword [0x18003fce8]
mov r11, qword [0x18003fcf0]
cmp rax, rdi
je 0x180028b30
cmp r11, rdi
je 0x180028b30
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18003fcf0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180028b30
test rax, rax
je 0x180028b30
call rsi
test rax, rax
je 0x180028b2a
lea rcx, [rsp + 0x88]
mov r9d, recv
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180028b2a
test byte [rsp + 0x38], 1
jne 0x180028b30
bts ebp, 0x15
jmp 0x180028b6e
mov rcx, qword [0x18003fcd8]
cmp rcx, rdi
je 0x180028b6e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180028b6e
call rax
mov rbx, rax
test rax, rax
je 0x180028b6e
mov rcx, qword [0x18003fce0]
cmp rcx, rdi
je 0x180028b6e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180028b6e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18003fcd0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180028b8f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180028b91
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18004d550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18004d57d
xor al, al
jmp 0x18004d6df
mov rax, qword [0x18006d6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x18006d6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x18006d6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x18006d6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x18006d6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x18006d6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x18006d6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x18006d6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x18006d700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x18004d6d1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18004d629
mov r11d, 2
jmp 0x18004d64d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18004d643
mov r11d, 1
jmp 0x18004d64d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x18004d6f5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18004d692
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18004d6aa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18004d6ba
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x18004d6c8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x18004d610
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18004d6da

Function at 0x1802c49e4
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffff96a0d422
call fcn.18090e733
fscale
stosb byte [rdi], al
jbe 0x1802c4a61
pop rsi
xchg dword [rsi], edi
mov dl, byte [r10 + rcx - 0x31]
mov esi, 0xfd2cce9e
mov esi, 0xc19b426c
mov esi, 0x3664cc96
push r12
invalid
insb byte [rdi], dx
wait
sar dword [rsi + 0x3664cc96], 0x41
push rsp
push r12
ja fcn.1802c49e4
cmp al, byte [rcx - 0x23]
outsd dx, dword [rsi]
jbe 0x1802c4a08
mov esi, 0xc8ed34cb
mov esi, 0x2aa96f8e
ret
invalid
cmpsd dword [rsi], dword [rdi]
jg 0x1802c4a7c
out dx, eax
cmp eax, 0xe39e29e1
jno 0x1802c4adb
out 0x36, al
loopne 0x1802c49fd
iretd
jl 0x1802c4a01
js 0x1802c4a24
loopne 0x1802c4a92
scasd eax, dword [rdi]
cmp dword [rcx - 0x19913363], eax
mov ch, 0xa4
xor dl, al
in al, 0x49
invalid
pop rbp
mov ch, 0xab
cmp dword [rbx + 0x2d], edx
mov ecx, dword [rcx + 0x43815b6e]
fild dword [rbx + rcx*4 + 0x826f896]
sti
sub byte [rdi + rdi*8], cl
push rdx
mov edi, es
sub eax, 0x34dab1db
movsd dword [rdi], dword [rsi]
invalid
invalid
Function at 0x18000d480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp eax, 0xc
jne 0x18000d4da
mov rax, qword [rcx]
movsxd r10, dword [rdx + 8]
mov r9, qword [rax + 0x38]
mov edx, dword [r9 + r10*4]
mov eax, edx
and eax, 0x3f
cmp al, 0x1b
jne 0x18000d4df
dec dword [rcx + 0x20]
and edx, 0xffc5ffff
or edx, 0x440000
xor eax, eax
shr edx, 0x11
mov ecx, 0x4000
test r8d, r8d
cmove eax, ecx
or edx, eax
jmp 0x18000d544
cmp eax, 7
je 0x18000d51f
movzx ecx, byte [rcx + 0x3c]
mov r8, qword [rbx]
lea edx, [rcx + 1]
movzx eax, byte [r8 + 0xc]
cmp edx, eax
jbe 0x18000d502
cmp edx, 0xfa
jae 0x18000d563
mov byte [r8 + 0xc], dl
movzx ecx, byte [rbx + 0x3c]
inc cl
mov rdx, rdi
movzx r8d, cl
mov rcx, rbx
mov byte [rbx + 0x3c], r8b
dec r8d
call fcn.18000cc80
cmp dword [rdi], 7
jne 0x18000d533
mov ecx, dword [rdi + 8]
bt ecx, 8
jb 0x18000d533
movzx eax, byte [rbx + 0x3a]
cmp ecx, eax
jl 0x18000d533
dec byte [rbx + 0x3c]
mov edx, dword [rdi + 8]
shl edx, 9
or edx, esi
shl edx, 0xe
or edx, 0x3fe3
mov rcx, rbx
call fcn.18000c6d0
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18000c2f0
mov rcx, qword [rbx + 0x10]
lea rdx, str.function_or_expression_too_complex
call fcn.180018a80
int3
Function at 0x180012830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
je 0x18001284e
mov edx, dword [rdx]
call fcn.180012740
mov rdi, qword [rbx + 0x20]
lea rbp, [rbx + 0x60]
cmp rdi, rbp
je 0x1800129d7
mov qword [rsp + 0x38], r14
lea r14, sym.lua53_64.dll_cv_DKh_vSaS_MG0.Y_2yq2l_p8diOW4_Wp
mov qword [rsp + 0x30], rsi
test byte [rdi + 0x42], 2
jne 0x180012888
mov edx, 1
mov rcx, rbx
call fcn.180012740
jmp 0x1800129c0
mov rax, qword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
mov esi, dword [rax - 4]
mov edx, esi
and edx, 0x3f
lea eax, [rdx - 6]
cmp eax, 0x23
ja case.0x1800128ba.11
cdqe
movzx eax, byte [r14 + rax + 0x12a00]
mov ecx, dword [r14 + rax*4 + 0x129e8]
add rcx, r14
jmp rcx
add qword [rbx + 0x10], 0xfffffffffffffff0
mov eax, esi
mov rdx, qword [rbx + 0x10]
shr rax, 6
movzx ecx, al
add rcx, rcx
movups xmm0, xmmword [rdx]
movups xmmword [r8 + rcx*8], xmm0
jmp case.0x1800128ba.11
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax - 8]
test ecx, ecx
je 0x1800128fc
cmp ecx, 1
jne 0x1800128f4
cmp dword [rax - 0x10], 0
je 0x1800128fc
mov r9d, 1
jmp 0x1800128ff
xor r9d, r9d
add rax, 0xfffffffffffffff0
mov qword [rbx + 0x10], rax
cmp edx, 0x21
jne 0x180012932
mov rdx, rsi
mov rcx, rbx
shr rdx, 0x17
shl rdx, 4
add rdx, r8
mov r8d, 0x15
call fcn.18002dbc0
cmp dword [rax + 8], 0
jne 0x180012932
xor r9d, 1
shr esi, 6
movzx eax, sil
cmp r9d, eax
je case.0x1800128ba.11
add qword [rdi + 0x28], 4
jmp case.0x1800128ba.11
mov rdx, qword [rbx + 0x10]
mov rax, rsi
shr rax, 0x17
inc rax
shl rax, 4
movups xmm0, xmmword [rdx - 0x10]
lea rcx, [rdx - 0x10]
sub rcx, rax
sub rcx, r8
sar rcx, 4
movups xmmword [rdx - 0x30], xmm0
cmp ecx, 1
jle 0x180012984
lea rax, [rdx - 0x20]
mov edx, ecx
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.180031230
mov rdx, qword [rbx + 0x10]
mov eax, esi
shr rax, 6
movzx ecx, al
mov rax, qword [rdi + 0x20]
add rcx, rcx
movups xmm0, xmmword [rdx - 0x10]
movups xmmword [rax + rcx*8], xmm0
jmp case.0x1800128ba.10
and esi, 0x7fc000
cmp esi, 0x4000
jb case.0x1800128ba.11
mov rax, qword [rdi + 8]
mov qword [rbx + 0x10], rax
mov rcx, rbx
call fcn.180031810
mov rdi, qword [rbx + 0x20]
cmp rdi, rbp
jne 0x180012870
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret