joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180045980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, r8d
test rdx, rdx
je 0x180045a02
not eax
test dl, 1
jne 0x18004599a
mov r8, rdx
cmp rdx, 1
jne 0x1800459c0
jmp 0x180045a00
lea r8, [rdx - 1]
movzx r9d, al
shr eax, 8
movzx r10d, byte [rcx]
inc rcx
xor r10d, r9d
lea r9, [0x1800eee10]
xor eax, dword [r9 + r10*4]
cmp rdx, 1
je 0x180045a00
xor edx, edx
lea r9, [0x1800eee10]
nop dword [rax]
movzx r10d, al
shr eax, 8
movzx r11d, byte [rcx + rdx]
xor r11d, r10d
xor eax, dword [r9 + r11*4]
movzx r10d, al
shr eax, 8
movzx r11d, byte [rcx + rdx + 1]
xor r11d, r10d
xor eax, dword [r9 + r11*4]
add rdx, 2
cmp r8, rdx
jne 0x1800459d0
not eax
ret

Function at 0x180045a10
Capabilities:
Hash data with crc32

Disassembly:
not r8d
test rdx, rdx
je 0x180045a6e
dec rdx
add rcx, 2
lea r9, [0x1800eee10]
mov r10d, r8d
jmp 0x180045a51
movzx r11d, al
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc rcx
mov r10d, eax
add rdx, 0xffffffffffffffff
jae 0x180045ac7
movzx eax, byte [rcx - 2]
cmp rdx, 2
jb 0x180045a30
cmp al, 0x23
jne 0x180045a30
cmp byte [rcx - 1], 0x23
jne 0x180045a30
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x180045a30
movzx edx, byte [rcx]
test dl, dl
je 0x180045aca
add rcx, 2
lea r9, [0x1800eee10]
mov r10d, r8d
jmp 0x180045aaf
movzx r11d, al
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc rcx
mov r10d, eax
test dl, dl
je 0x180045ac7
mov eax, edx
movzx edx, byte [rcx - 1]
cmp al, 0x23
jne 0x180045a90
cmp dl, 0x23
jne 0x180045a90
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x180045a90
not eax
ret
mov eax, r8d
not eax
ret

Function at 0x180045cb0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, r9d
mov rsi, r8
test r8, r8
je 0x180045cce
mov qword [rsi], 0
call fcn.180045ad0
test rax, rax
je 0x180045d5c
mov rbx, rax
mov rcx, rax
call fcn.180045c20
cmp rax, 0xffffffffffffffff
je 0x180045d42
mov r14, rax
movsxd r15, ebp
lea rcx, [rax + r15]
call fcn.180045410
test rax, rax
je 0x180045d42
mov rdi, rax
mov edx, 1
mov rcx, rax
mov r8, r14
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, r14
jne 0x180045d4c
test ebp, ebp
jle 0x180045d30
mov rcx, rdi
add rcx, r14
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.180045c00
test rsi, rsi
je 0x180045d5e
mov qword [rsi], r14
jmp 0x180045d5e
mov rcx, rbx
call fcn.180045c00
jmp 0x180045d5c
mov rcx, rbx
call fcn.180045c00
mov rcx, rdi
call fcn.1800454e0
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18004c0a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x180128540]
mov dword [rax + 0x5f0c], 0
test rcx, rcx
je 0x18004c118
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.18005fda0
mov rdi, rax
lea rdx, [0x1800f0ff4]
mov rcx, rsi
call fcn.180045ad0
test rax, rax
je 0x18004c118
mov rsi, rax
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, rdi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
call fcn.180045c00
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800cf260
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x18005f3f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r15, qword [0x180128540]
cmp byte [r15 + 0x5fa8], 0
je 0x18005f4fe
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rsp + 0x20], rdi
lea rbx, [r15 + 0x5fb8]
cmp qword [r15 + 0x5fb0], 0
je 0x18005f4f0
cmp dword [r15 + 0x5fbc], 0
jns 0x18005f49d
xor ecx, ecx
call fcn.180045410
mov r14, rax
mov rdx, qword [r15 + 0x5fc0]
test rdx, rdx
je 0x18005f48b
movsxd r8, dword [r15 + 0x5fb8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r15 + 0x5fc0]
call fcn.1800454e0
mov qword [r15 + 0x5fc0], r14
mov dword [r15 + 0x5fbc], 0
mov dword [r15 + 0x5fb8], 0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1800472e0
mov r9, qword [r15 + 0x5fb0]
mov eax, dword [r15 + 0x5fb8]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [r15 + 0x5fc0]
test rax, rax
lea rcx, [0x180128548]
cmovne rcx, rax
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x18005f4fe
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1800472e0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800cf260
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800940f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm15
movdqa xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
shufps xmm1, xmm1, 0
movdqa xmm5, xmmword [0x180108f00]
movdqa xmm6, xmmword [str._b_t_n_v]
movdqa xmm3, xmmword [0x180108f20]
movdqa xmm4, xmmword [0x180108f30]
xor eax, eax
movdqa xmm11, xmmword [0x180108f90]
movdqa xmm13, xmmword [0x180108fa0]
movaps xmm12, xmmword [0x180108f70]
nop dword [rax]
movdqa xmm0, xmm3
movdqa xmm8, xmmword [0x180108f40]
pand xmm0, xmm8
movdqa xmm9, xmmword [0x180108f50]
por xmm0, xmm9
movdqa xmm14, xmm3
psrld xmm14, 0x10
movdqa xmm10, xmmword [0x180108f60]
por xmm14, xmm10
subps xmm14, xmm12
addps xmm14, xmm0
movdqa xmm0, xmm4
pand xmm0, xmm8
por xmm0, xmm9
movdqa xmm15, xmm4
psrld xmm15, 0x10
por xmm15, xmm10
subps xmm15, xmm12
addps xmm15, xmm0
movdqa xmm2, xmm5
pand xmm2, xmm8
por xmm2, xmm9
movdqa xmm0, xmm5
psrld xmm0, 0x10
por xmm0, xmm10
subps xmm0, xmm12
addps xmm0, xmm2
movdqa xmm7, xmm6
pand xmm7, xmm8
por xmm7, xmm9
movdqa xmm2, xmm6
psrld xmm2, 0x10
por xmm2, xmm10
subps xmm2, xmm12
addps xmm2, xmm7
mulps xmm2, xmm1
mulps xmm0, xmm1
mulps xmm15, xmm1
mulps xmm14, xmm1
cvttps2dq xmm8, xmm14
movdqa xmm7, xmm8
psrad xmm7, 0x1f
movaps xmm10, xmmword [0x180108f80]
subps xmm14, xmm10
cvttps2dq xmm14, xmm14
pand xmm14, xmm7
por xmm14, xmm8
cvttps2dq xmm7, xmm15
movdqa xmm8, xmm7
psrad xmm8, 0x1f
subps xmm15, xmm10
cvttps2dq xmm15, xmm15
pand xmm15, xmm8
por xmm15, xmm7
cvttps2dq xmm9, xmm0
movdqa xmm8, xmm9
psrad xmm8, 0x1f
subps xmm0, xmm10
cvttps2dq xmm7, xmm0
pand xmm7, xmm8
por xmm7, xmm9
cvttps2dq xmm0, xmm2
movdqa xmm8, xmm0
psrad xmm8, 0x1f
subps xmm2, xmm10
cvttps2dq xmm2, xmm2
pand xmm2, xmm8
por xmm2, xmm0
movdqa xmm8, xmm2
movdqa xmm9, xmmword [0x1800d5c50]
pxor xmm8, xmm9
movdqa xmm0, xmm11
pcmpgtd xmm0, xmm8
pand xmm2, xmm0
movdqa xmm10, xmmword [0x1800d5300]
pandn xmm0, xmm10
por xmm0, xmm2
movdqa xmm2, xmm7
pxor xmm2, xmm9
movdqa xmm8, xmm11
pcmpgtd xmm8, xmm2
pand xmm7, xmm8
pandn xmm8, xmm10
por xmm8, xmm7
packuswb xmm0, xmm8
movdqa xmm2, xmm15
pxor xmm2, xmm9
movdqa xmm7, xmm11
pcmpgtd xmm7, xmm2
pand xmm15, xmm7
pandn xmm7, xmm10
por xmm7, xmm15
movdqa xmm2, xmm14
pxor xmm2, xmm9
movdqa xmm8, xmm11
pcmpgtd xmm8, xmm2
pand xmm14, xmm8
pandn xmm8, xmm10
por xmm8, xmm14
packuswb xmm7, xmm8
packuswb xmm7, xmm0
movdqu xmmword [rcx + rax], xmm7
add rax, 0x10
paddd xmm4, xmm13
paddd xmm3, xmm13
paddd xmm6, xmm13
paddd xmm5, xmm13
cmp rax, 0x100
jne 0x180094180
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
movaps xmm15, xmmword [rsp + 0x90]
add rsp, 0xa8
ret
Function at 0x1800a26e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
add rsp, 0x28
ret

Function at 0x1800a2700
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rsi
sub rsp, 0x20
call fcn.1800a1780
mov rsi, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr eax, 0x10
add rsi, 0x2c
mov ecx, eax
mov edx, 0x20001004
mov r8, rsi
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1800a273c
mov dword [rsi], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1800d10d8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800d1112
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800d1117
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800d1160
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18010b1d0]
cmp byte [rcx + rax], 0
je 0x1800d1160
dec r8
sub rdx, 1
jne 0x1800d1146
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140678058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406781df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140678089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14067806f
add dl, dl
jne 0x140678096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406780f6
xor eax, eax
add dl, dl
jne 0x1406780a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406781ad
add dl, dl
jne 0x1406780b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406780c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406780d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406780dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406780ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14067807e
mov eax, 1
add dl, dl
jne 0x140678106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140678113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406780fb
sub eax, ebx
mov ebx, 1
jne 0x14067814c
mov ecx, 1
add dl, dl
jne 0x14067812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14067813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140678123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140678168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140678175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14067815d
cmp eax, 0x7d00
jae 0x14067819b
cmp eax, 0x500
jb 0x140678196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067807e
cmp eax, 0x7f
ja 0x14067819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406781d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14067807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000a464
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14000a441
call fcn.1400091a8
mov dword [rax], 0x16
call fcn.140008fb8
or eax, 0xffffffff
jmp 0x14000a45e
sub dword [rcx + 0x10], 1
jns 0x14000a450
add rsp, 0x28
jmp 0x14000d278
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14000a420
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000d118
call fcn.1400091a8
mov dword [rax], 0x16
call fcn.140008fb8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000d100
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14000d100
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14000d14a
lock or dword [rax + 0x14], 0x10
jmp 0x14000d100
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000d167
mov rcx, qword [rbp + 0x10]
call fcn.14000d280
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140009ae0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14000e620
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14000d1be
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14000d100
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000d22a
mov rcx, qword [rbp + 0x10]
call fcn.140009ae0
cmp eax, 0xffffffff
je 0x14000d211
mov rcx, qword [rbp + 0x10]
call fcn.140009ae0
cmp eax, 0xfffffffe
je 0x14000d211
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140009ae0
movsxd rdi, eax
lea rsi, [0x14016ab00]
mov rcx, rbx
sar rdi, 6
call fcn.140009ae0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000d218
lea rax, [0x14016a290]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000d22a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14000d260
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14000d25c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14000d25c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000d103
jmp 0x14000d0d0
Function at 0x140010834
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [rsp + 0x28]
add r9d, 0xffffe79c
mov eax, ecx
mov r10, rdx
xor eax, 0x322
xor ecx, 0x2ea
add eax, 0x169
cmp ecx, eax
je 0x140010981
lea rax, [0x1400d05e0]
xor r11d, r11d
mov qword [rdx + 0xc8], rax
mov ecx, dword [r10 + 0xe4]
mov rax, qword [r10 + 0xc8]
mov r8d, dword [rax + r11]
add r11, 4
imul r8d, dword [0x1400cd074]
mov rax, qword [section..data]
sub ecx, dword [rax + 0x68]
mov edx, r8d
mov eax, dword [0x1400cd158]
add eax, ecx
shr edx, 0x10
mov dword [0x1400cd158], eax
mov ecx, dword [r10 + 0x18]
xor ecx, eax
xor ecx, 0xfffe73a2
mov dword [r10 + 0x18], ecx
mov eax, dword [r10 + 0xe4]
sub dword [0x1400cd0f4], eax
movsxd rcx, dword [r10 + 0x88]
mov rax, qword [r10 + 0xd8]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [r10 + 0x88]
mov rax, qword [section..data]
shr edx, 8
movsxd rcx, dword [rax + 0x88]
mov rax, qword [rax + 0xd8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x88]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x138]
mov edx, dword [rax + 0x74]
add ecx, 0xfffffffe
mov eax, dword [r10 + 8]
add edx, ecx
imul eax, edx
mov dword [r10 + 8], eax
movsxd rcx, dword [0x1400cd098]
mov rax, qword [0x1400cd0e8]
mov byte [rcx + rax], r8b
inc dword [0x1400cd098]
mov rdx, qword [section..data]
mov ecx, dword [r10 + 0x60]
xor ecx, dword [0x1400cd04c]
sub ecx, 0x10add7
add dword [rdx + 0x50], ecx
mov ecx, dword [0x1400cd078]
mov edx, dword [r10 + 0x130]
inc ecx
imul edx, ecx
mov dword [r10 + 0x130], edx
cmp r11, 0x981c0
jl 0x14001086d
xor r9d, 0x197b
mov eax, r9d
ret
Function at 0x140012478
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r10d, dword [rsp + 0x70]
lea esi, [r8 + 0x58f]
mov ebx, ecx
mov r11d, ecx
mov rdi, r9
xor ecx, 0x3935
mov r9d, r10d
add ecx, 0x76
xor r9d, 0x2213
xor ebx, 0x3a73
xor r11d, 0x3a10
add edx, 0xfffffc3b
xor r10d, 0x39d3
cmp r9d, ecx
jg 0x140012652
xor r9d, r9d
movsxd rcx, dword [rdi + 0x88]
mov rax, qword [rdi + 0xc8]
mov r8d, dword [r9 + rax]
add r9, 4
mov eax, dword [rdi + 0x108]
xor eax, 0xb028
sub dword [rdi + 0x74], eax
mov rax, qword [section..data]
imul r8d, dword [rax + 0x64]
mov rax, qword [rdi + 0xd8]
mov edx, r8d
shr edx, 0x10
mov byte [rcx + rax], dl
mov eax, 5
inc dword [rdi + 0x88]
mov edx, r8d
sub eax, dword [rdi + 0xf8]
add dword [rdi + 0x24], eax
mov ecx, dword [rdi + 0x108]
mov eax, dword [rdi + 0xd0]
add eax, 0x17f5f7
shr edx, 8
add ecx, eax
mov rax, qword [section..data]
or dword [0x1400cd060], ecx
movsxd rcx, dword [rax + 0x88]
mov rax, qword [0x1400cd0e8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x88]
mov rax, qword [section..data]
movsxd rdx, dword [rdi + 0x88]
mov rcx, qword [rax + 0xd8]
mov byte [rdx + rcx], r8b
inc dword [rdi + 0x88]
mov eax, dword [rdi + 0x1c]
xor eax, 0xfff16cc1
add dword [rdi + 0x50], eax
mov eax, dword [rdi + 0x16c]
sub eax, dword [rdi + 8]
mov rcx, qword [section..data]
add eax, 0x1a09ec
add dword [rcx + 0x3c], eax
mov eax, 0x2d10bc
sub eax, dword [rdi + 0x28]
mov rcx, qword [section..data]
add dword [rcx + 0x118], eax
mov eax, dword [rdi + 0xb0]
sub eax, 0xb9f07
or dword [rdi + 0x148], eax
cmp r9, 0x9e950
jl 0x1400124d4
mov rax, qword [section..data]
lea edx, [r11 + 0x10e]
xor r10d, 0x3a4
lea r9d, [rsi - 0x8eb]
mov dword [rsp + 0x30], r10d
mov r8d, ebx
xor r8d, 0x3a71
mov ecx, dword [rax + 0xfc]
lea eax, [rsi - 0x321]
sub ecx, 0x483fec7c
mov dword [rsp + 0x28], eax
mov dword [rdi + 0x64], ecx
lea ecx, [rbx + 0x146]
mov dword [rsp + 0x20], edx
mov rdx, rdi
call fcn.140010834
mov rax, qword [section..data]
mov ecx, dword [rax + 8]
add ecx, dword [rdi + 0xe4]
xor ecx, 0x1a02bd
mov dword [rdi + 0x64], ecx
jmp 0x1400126b2
mov rax, qword [section..data]
or r10d, 0x235b
cmp dword [rax + 8], r10d
jbe 0x1400126b2
or edx, ebx
mov ecx, ebx
cmp ebx, edx
jl 0x1400126b2
mov r10d, dword [0x1400cd028]
mov r8d, ebx
sub r8d, r9d
mov esi, 0x1e1f
mov r9d, dword [0x1400cd088]
mov eax, r8d
add ecx, 3
or eax, esi
or r10d, eax
mov dword [0x1400cd028], r10d
mov eax, dword [rdi + 0xa8]
and eax, r11d
xor eax, esi
or r9d, eax
mov dword [0x1400cd088], r9d
cmp ecx, edx
jge 0x140012687
mov rsi, qword [rsp + 0x58]
lea eax, [rbx + 0x506]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18007653c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rax, rax
je 0x18007657a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
add eax, 0xffffff80
test eax, 0xffffff7f
je 0x18007657a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800765f0
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1800765f0
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0xd2655366
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x1800765ec
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x1800765cc
cmp r11d, 0xb4f6c83c
je 0x1800765f5
test edx, edx
jne 0x1800765af
mov rax, qword [rax]
jmp 0x18007658b
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbx
add rax, r8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x180076aa8
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180076afb
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, rbx
call fcn.180074fcc
call fcn.18007653c
call fcn.180076624
and qword [rsp + 0x28], 0
lea r8, [0x180075e44]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180076afb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180076ea8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180076ecd
xor eax, eax
jmp 0x180076fca
cmp qword [rcx + 0x68], 0
je 0x180076ede
call fcn.180079000
jmp 0x180076fca
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x180076ef5
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180076ef7
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180076f2c
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180119a60
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180076fc4
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x180076f67
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x180076f9f
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.18012357c
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x180076fdb
cmp rbp, r15
ja 0x180076f75
mov r8, rbx
test rbx, rbx
je 0x180076fc4
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.18012357c
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x180076fc7
Function at 0x1800773a8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18021e070]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1800773e1
xor eax, eax
jmp 0x180077503
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18007741b
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x18007741b
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x180077503
cmp qword [rbx + 0x80], 0
je 0x180077501
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180077456
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180077479
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.180123910
cmp eax, edi
cmovne edi, esi
jmp 0x180077501
lea r8, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
je 0x1800774c7
sub eax, 1
je 0x1800774c7
cmp eax, 2
jne 0x180077501
movsx ecx, byte [rbp - 0x30]
jmp 0x180077463
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1800774f1
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.180123298
cmp r14, rax
jne 0x180077501
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x180077503
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801170d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret