joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011940
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180061460]
mov r15, rcx
mov rcx, rdx
mov rbp, r8
call qword [rax + 0xe0]
mov r14, rax
test rax, rax
je 0x180011b01
mov qword [rsp + 0xa0], rbx
mov ebx, 0x57
test rbp, rbp
je 0x180011ae4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x180011adf
mov ebx, dword [rsp + 0xb8]
mov qword [rsp + 0xa8], rsi
lea edx, [rax + 2]
inc ebx
mov qword [rsp + 0x78], rdi
mov esi, r12d
mov ecx, ebx
mov dword [rsp + 0xb8], ebx
call fcn.18002cde4
mov rdi, rax
test rax, rax
jne 0x180011a12
lea ebx, [rax + 8]
jmp 0x180011ad2
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x60]
mov r8, rax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test eax, eax
jne 0x180011ac0
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x180061460]
mov rcx, rdi
call qword [rax + 0x2e0]
mov rbx, rax
test rax, rax
je 0x180011a86
mov r9, qword [0x180061460]
mov r8, rax
mov edx, 0x103f2
mov rcx, r14
call qword [r9 + 0x50]
mov rcx, rbx
call fcn.18002ce28
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
inc esi
lea r9, [rsp + 0x60]
mov r8, rdi
mov rcx, rbp
mov edx, esi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test eax, eax
je 0x180011a50
cmp ebx, 0x103
mov rcx, rdi
cmove ebx, r12d
call fcn.18002ce28
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x70]
mov rax, qword [0x180061460]
mov r8, r14
mov rdx, r15
mov ecx, ebx
call qword [rax + 0xc0]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
Function at 0x180011fa0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x48
mov rax, qword [0x180061460]
mov r15, rcx
mov rcx, rdx
mov r12, r8
mov rsi, rdx
call qword [rax + 0xe0]
mov rbp, rax
test rax, rax
je 0x18001210a
mov qword [rsp + 0x70], rbx
mov rbx, qword [0x180061460]
mov edx, 0x103f2
mov rcx, rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], r14
call qword [rbx + 0xc8]
mov rcx, rax
call qword [rbx + 0x2d8]
mov r8, qword [0x180061460]
mov edx, 0x203f3
mov rcx, rsi
mov r14, rax
call qword [r8 + 0x100]
mov r9, qword [0x180061460]
lea r8, [rsp + 0x30]
mov edx, 0x403f4
mov rcx, rsi
mov edi, eax
call qword [r9 + 0x88]
test eax, eax
je 0x180012041
mov edi, 0x57
jmp 0x1800120de
test edi, edi
je 0x1800120a9
cmp edi, 2
jbe 0x18001207a
cmp edi, 7
jne 0x1800120a9
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x88], rax
call fcn.180011d50
mov rbx, rax
mov rax, qword [rsp + 0x88]
jmp 0x1800120b2
mov rax, qword [0x180061460]
mov rcx, qword [rsp + 0x38]
call qword [rax + 0x2d8]
mov rbx, rax
or rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x180012093
lea rax, [rax*2 + 2]
jmp 0x1800120b2
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov r9d, edi
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp rbx, qword [rsp + 0x38]
je 0x1800120de
mov rcx, rbx
call fcn.18002ce28
mov rcx, r14
call fcn.18002ce28
mov rax, qword [0x180061460]
mov r8, rbp
mov rdx, r15
mov ecx, edi
call qword [rax + 0xc0]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x48
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x180012120
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
push r14
sub rsp, 0x48
mov rax, qword [0x180061460]
mov r12, rcx
mov rcx, rdx
mov r14, r8
mov rsi, rdx
call qword [rax + 0xe0]
mov rdi, rax
test rax, rax
je 0x180012325
mov qword [rsp + 0x70], rbx
mov rbx, qword [0x180061460]
mov qword [rsp + 0x78], rbp
xor ebp, ebp
mov edx, 0x103f2
mov rcx, rsi
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x88], ebp
mov dword [rsp + 0x30], ebp
call qword [rbx + 0xc8]
mov rcx, rax
call qword [rbx + 0x2d8]
xor r9d, r9d
xor r8d, r8d
mov r15, rax
lea rax, [rsp + 0x88]
mov rcx, r14
mov qword [rsp + 0x28], rax
mov rdx, r15
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test eax, eax
jne 0x1800122f9
mov ecx, dword [rsp + 0x88]
inc ecx
mov dword [rsp + 0x88], ecx
mov edx, ecx
lea ecx, [rax + 1]
call fcn.18002cde4
mov rbx, rax
test rax, rax
je 0x1800122f9
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test eax, eax
jne 0x1800122f9
mov rax, qword [0x180061460]
mov r8d, dword [rsp + 0x30]
mov edx, 0x203f3
mov rcx, rdi
call qword [rax + 0x58]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800122dc
cmp eax, 2
jbe 0x1800122a4
cmp eax, 4
je 0x18001228d
cmp eax, 7
jne 0x1800122dc
mov eax, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.180011b20
mov edx, 0x403f4
mov rsi, rax
mov rcx, rdi
test rax, rax
je 0x1800122e4
mov r10, qword [0x180061460]
mov r9d, dword [rsp + 0x38]
mov r8, rax
call qword [r10 + 0x48]
mov rcx, rsi
call fcn.18002ce28
jmp 0x1800122f9
mov rax, qword [0x180061460]
mov r8d, dword [rbx]
mov edx, 0x403f4
mov rcx, rdi
call qword [rax + 0x58]
jmp 0x1800122f9
mov rax, qword [0x180061460]
mov rcx, rbx
call qword [rax + 0x2e0]
mov edx, 0x403f4
mov rcx, rdi
mov rsi, rax
test rax, rax
je 0x1800122e4
mov r9, qword [0x180061460]
mov r8, rax
call qword [r9 + 0x50]
mov rcx, rsi
call fcn.18002ce28
jmp 0x1800122f9
mov edx, 0x403f4
mov rcx, rdi
mov rax, qword [0x180061460]
mov r9d, dword [rsp + 0x88]
mov r8, rbx
call qword [rax + 0x48]
mov rcx, r15
call fcn.18002ce28
mov rax, qword [0x180061460]
mov r8, rdi
mov rdx, r12
mov ecx, ebp
call qword [rax + 0xc0]
mov r15, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800129f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180012a40
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x180014380
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800143d0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret
Function at 0x1800161b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x180049270]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.psapi.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rbx, rbx
je 0x1800162a9
test rax, rax
je 0x1800162a9
test rdi, rdi
je 0x1800162a9
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180062a50], rax
test rax, rax
jne 0x18001624c
lea rcx, str.Psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1800162a9
lea rdx, str.GetProcessImageFileNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180062a58], rax
test rax, rax
je 0x1800162a9
lea rdx, str.GetProcessImageFileNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180062a58], rax
test rax, rax
je 0x1800162a9
lea rdx, str.GetRawInputData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x180062a68], rax
test rax, rax
je 0x1800162a3
lea rdx, str.RegisterRawInputDevices
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180062a60], rax
test rax, rax
jne 0x1800162b6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180016470
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor eax, eax
movzx ebx, cx
mov edi, edx
mov qword [rsp + 0x30], rax
xor edx, edx
mov ecx, ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 0x28
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], 0
lea ecx, [r8 - 0x27]
mov word [rsp + 0x2a], ax
mov word [rsp + 0x28], bx
mov dword [rsp + 0x2c], edi
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800167f0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get file attributes
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x420
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x400
xor ebx, ebx
call fcn.18002d6f0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800492e8]
mov r8d, 0x3ff
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, qword [0x180061458]
lea r8, [0x1800492f8]
lea edx, [rbx + 0x65]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x18001685f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x440]
add rsp, 0x420
pop rdi
ret
mov rcx, qword [0x180061458]
mov rdx, rax
mov qword [rsp + 0x430], rbp
mov qword [rsp + 0x438], rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [0x180061458]
mov rdx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [rsp + 0x20]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1800168f6
lea rdx, [0x1800492fc]
lea rcx, [rsp + 0x20]
call fcn.18002fcd4
mov rdi, rax
test rax, rax
je 0x1800168ee
mov r8d, ebp
mov r9, rax
mov edx, 1
mov rcx, rsi
call fcn.18002e96c
mov rcx, rdi
call fcn.18002dfd8
jmp 0x1800168f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, qword [rsp + 0x438]
mov rbp, qword [rsp + 0x430]
mov qword [0x1800616c8], rax
test rax, rax
jne 0x180016925
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x440]
add rsp, 0x420
pop rdi
ret

Function at 0x180016940
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180016990
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret
Function at 0x1800186d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180018720
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x1800196b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180019700
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x18001aa90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x180061740], 0
mov rbx, rcx
je 0x18001aaf0
mov rcx, qword [0x180061738]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
or r8, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
nop dword [rax]
inc r8
cmp byte [rbx + r8], al
jne 0x18001aac0
mov rcx, qword [0x180061740]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180061738]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
add rsp, 0x30
pop rbx
ret
Function at 0x18001ab00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18001ab50
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x18001d850
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
call fcn.18001db50
mov edx, 0x98
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.18001db30
mov rbx, rax
test rax, rax
jne 0x18001d8a6
mov rcx, rdi
call fcn.180021560
mov rcx, qword [rdi]
mov dword [rcx + 0x28], reloc.WS2_32.dll_getservbyport
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.18001d060]
lea rcx, str.JPEGMEM
mov qword [rbx], rax
lea rax, [fcn.18001ceb0]
mov qword [rbx + 8], rax
lea rax, [fcn.18001cf80]
mov qword [rbx + 0x10], rax
lea rax, [fcn.18001cdc0]
mov qword [rbx + 0x18], rax
lea rax, [0x18001d750]
mov qword [rbx + 0x20], rax
lea rax, [0x18001d6a0]
mov qword [rbx + 0x28], rax
lea rax, [0x18001d4c0]
mov qword [rbx + 0x30], rax
lea rax, [0x18001cc60]
mov qword [rbx + 0x38], rax
lea rax, [0x18001caf0]
mov qword [rbx + 0x40], rax
lea rax, [fcn.18001d350]
mov qword [rbx + 0x48], rax
lea rax, [0x18001d800]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov dword [rbx + 0x90], 0x98
mov qword [rdi + 8], rbx
call fcn.1800314f0
test rax, rax
je 0x18001d9ad
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.18003155c
test eax, eax
jle 0x18001d9ad
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x18001d9a0
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x18001d9a4
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180030cf8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.180030b60
Function at 0x14004c430
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx eax, byte [rcx + 6]
mov rdx, rcx
movzx r8d, byte [rcx + 7]
movzx esi, byte [rcx + 0xb]
movzx ebp, byte [rcx + 0xf]
movzx r11d, byte [rcx + 0x13]
movzx ebx, byte [rcx + 0x17]
movzx edi, byte [rcx + 0x1b]
movzx r14d, byte [rcx + 0x1f]
shl r8, 8
or r8, rax
shl rsi, 8
movzx eax, byte [rcx + 5]
shl rbp, 8
shl r11, 8
shl rbx, 8
shl rdi, 8
shl r14, 8
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 4]
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 0xa]
or rsi, rax
movzx eax, byte [rcx + 9]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 8]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 0xe]
or rbp, rax
movzx eax, byte [rcx + 0xd]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0xc]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0x12]
or r11, rax
movzx eax, byte [rcx + 0x11]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x10]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x16]
or rbx, rax
movzx eax, byte [rcx + 0x15]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x14]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x1a]
or rdi, rax
movzx eax, byte [rcx + 0x19]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x18]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x1e]
or r14, rax
movzx eax, byte [rcx + 0x1d]
shl r14, 8
or r14, rax
movzx eax, byte [rcx + 0x1c]
movzx ecx, byte [rcx + 3]
shl rcx, 8
shl r14, 8
or r14, rax
movzx eax, byte [rdx + 2]
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
mov edx, 0x5cf5d3ec
mov eax, 1
sub rdx, rcx
test rdx, rdx
jle 0x14004c58a
mov r10d, eax
jmp 0x14004c597
xor r10d, r10d
test rdx, rdx
setns r10b
dec r10d
mov ecx, 0x5812631a
sub rcx, r8
test rcx, rcx
jle 0x14004c5a9
mov r9d, eax
jmp 0x14004c5b6
xor r9d, r9d
test rcx, rcx
setns r9b
dec r9d
mov ecx, 0xa2f79cd6
sub rcx, rsi
test rcx, rcx
jle 0x14004c5c8
mov r8d, eax
jmp 0x14004c5d5
xor r8d, r8d
test rcx, rcx
setns r8b
dec r8d
mov ecx, 0x14def9de
sub rcx, rbp
test rcx, rcx
jle 0x14004c5e6
mov edx, eax
jmp 0x14004c5f0
xor edx, edx
test rcx, rcx
setns dl
dec edx
mov ecx, 0x10000000
neg r11
sub rcx, r14
neg rbx
neg rdi
test rcx, rcx
jg 0x14004c610
xor eax, eax
test rcx, rcx
setns al
dec eax
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
cdqe
sar rdi, 0x3f
sar rbx, 0x3f
sar r11, 0x3f
lea rcx, [rdi + rax*2]
mov rdi, qword [rsp + 0x28]
lea rax, [rbx + rcx*2]
mov rbx, qword [rsp + 0x10]
lea rcx, [r11 + rax*2]
movsxd rax, edx
lea rdx, [rax + rcx*2]
movsxd rax, r8d
lea rcx, [rax + rdx*2]
movsxd rax, r9d
lea rdx, [rax + rcx*2]
movsxd rax, r10d
lea rax, [rax + rdx*2]
sar rax, 8
pop r14
ret
Function at 0x14004da30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14004dc3a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14004daf4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14004dab0
mov ecx, dword [r10]
jmp 0x14004dbd7
cmp ecx, 0x4e0
jb 0x14004dbd7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004db10
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004db60
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14004da90
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14004da80
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14004dc5a
cmp r8d, r14d
jne 0x14004da60
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret