joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180018874
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x180106ec8]
mov dword [rsp + 0x20], ecx
mov rbx, qword [rax + 0x1c10]
cmp dword [rbx + 0xc8], 0
jg 0x1800188be
mov r8d, 0x6c1
lea rdx, str.C:Users_fnafoDesktopNowy_folderimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0xc8]
mov r9d, 4
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1800c23f0]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x1800188df
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0xc8]
mov dword [rsp + 0x20], r8d
call fcn.180020ab4
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004c690
add rsp, 0x30
pop rbx
ret

Function at 0x18001ecc8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30f8], 0
lea rbx, [rcx + 0x3100]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001ed61
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x18001ed19
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180020e28
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.18000d130
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x30f8]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x180106eb9]
movsxd r8, eax
mov rax, qword [rdi + 0x3108]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001ed69
mov rcx, rbx
call fcn.18000d130
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001f5ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180106ec8]
mov rbx, rcx
and dword [rax + 0x3094], 0
test rcx, rcx
je 0x18001f655
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18001f660
lea rdx, [0x1800fc01c]
mov rcx, rbx
mov rdi, rax
call fcn.18000c568
mov rbx, rax
test rax, rax
je 0x18001f655
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18004bd54
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x18004bdb8
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18004bda6
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004bd9f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18004bd73
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180106ee0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18004bdc8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
imul rdi, rax, 0x38
add rdi, qword [0x180107550]
mov rdx, qword [rdi]
mov cl, byte [rdi + 0x20]
mov rsi, rdx
lea rbx, [rdx - 5]
and cl, 1
je 0x18004be0d
mov rsi, rbx
movzx eax, cl
lea r9, [rsp + 0x20]
test cl, cl
mov r8d, 0x40
cmove rbx, rdx
lea rbp, [rax*2 + 5]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004be40
mov eax, 0xa
jmp 0x18004be8d
mov byte [rbx], 0xe9
mov eax, dword [rdi + 8]
sub eax, esi
sub eax, 5
mov dword [rbx + 1], eax
test byte [rdi + 0x20], 1
je 0x18004be5c
mov rax, qword [rdi]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rdi + 0x20], 6
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004c690
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18004c2a0
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18004c2b7
cmp r8b, 0x90
je 0x18004c2b7
cmp r8b, 0xcc
jne 0x18004c2d9
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18004c2d5
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18004c2d9
add edx, r10d
cmp edx, r9d
jb 0x18004c2c5
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x422bf10
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x422bf1d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x422bf2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x422bf15
lea eax, [rcx + 1]
jmp 0x422bf3b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x422bf4e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x422bf34
sub eax, 3
jb 0x422bf6e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x422bfbd
sar eax, 1
movsxd rbp, eax
jb 0x422bfa4
jmp 0x422bf7c
add ebx, ebx
jne 0x422bf7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x422bfa4
inc ecx
add ebx, ebx
jne 0x422bf8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x422bfa4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x422bf9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x422bf8c
add ecx, 2
jmp 0x422bfa9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0422bed2
jmp 0x422bf1d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3dfc000]
mov eax, dword [rdi]
or eax, eax
je 0x422c019
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3e3e5c0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x422bfc9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x422c013
mov qword [rbx], rax
add rbx, 8
jmp 0x422bfe9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x422c05d
cmp al, 0xef
ja 0x422c045
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x422c025
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x422c034
mov eax, dword [rdi]
add rdi, 4
jmp 0x422c034
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x422c0b1
sub rsp, 0xffffffffffffff80
jmp 0x473c00
Function at 0x47e8c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e98a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x0061e4f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47e96f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d6a40]
xor ebx, ebx
mov rcx, rdx
call fcn.00447ce0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047f420
inc rbx
cmp rcx, rbx
jae 0x47e95e
mov edi, 1
lea rsi, [0x004d6a40]
call fcn.00447dc0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00522c00]
lea rsi, [0x005223c0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047e8c0
Function at 0x4acc20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4accf5
movdqa xmm0, xmmword [0x00522540]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4acc61
movdqa xmm0, xmmword [0x00522550]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4acd77
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4acd4b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005223b8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00522560]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x4c9240
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4c94d9
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x004ea260]
call fcn.0040c880
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x004f7945]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004ea260]
call fcn.0040c880
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x004f76c5]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004ea1a0]
call fcn.0040c880
cmp dword [0x0061e570], 0
jne 0x4c92d7
mov rcx, qword [rsp + 0x70]
jmp 0x4c92e4
call fcn.00461560
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x60], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xd
lea rcx, [0x004f87a5]
mov qword [rax], rcx
nop
lea rax, [0x004ea1a0]
call fcn.0040c880
cmp dword [0x0061e570], 0
jne 0x4c9320
mov rcx, qword [rsp + 0x68]
jmp 0x4c932d
call fcn.00461560
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rsp + 0x58], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xc
lea rcx, [0x004f830d]
mov qword [rax], rcx
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rcx
lea rax, [0x004d7880]
call fcn.0040c880
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.004c2320
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x4c94ce
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x004d7820]
call fcn.0040c880
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.004c2320
movzx ecx, word [0x0061e2c4]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x78], rdx
lea rax, [0x004d78e0]
nop dword [rax]
call fcn.0040c880
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.004bccc0
xorps xmm15, xmm15
mov r14, qword [0x0061e4f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
nop dword [rax]
call fcn.0045dfa0
add rsp, 0x98
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.004618e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004c9240
Function at 0x180002110
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x180074060]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800021ca
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, [0x180060b40]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x180002179
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800248c0
add rsp, 0x58
ret
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x180002161
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80000000
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800248c0
add rsp, 0x58
ret
Function at 0x180007a00
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180074060]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x48], 0x101
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor esi, esi
test eax, eax
je 0x180007b94
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x180007a80
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.18001b790
nop
lea rcx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rsp + 0x38]
lea rbp, [rcx + rax*2]
lea rdi, [rsp + 0x28]
cmovae rdi, r8
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rbp
sub rax, rdi
sar rax, 1
cmp rax, 0xf
jbe 0x180007afd
mov rdx, rax
mov rcx, rbx
call fcn.18001d9f0
mov qword [rbx + 0x10], rsi
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x20], rbx
cmp rdi, rbp
je 0x180007b5b
nop word [rax + rax]
movzx r9d, byte [rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180007b40
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180007b35
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180007b48
mov rcx, rbx
call fcn.18001dc80
add rdi, 2
cmp rdi, rbp
jne 0x180007b10
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
cmp rdx, 8
jb 0x180007bb8
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x180007b8a
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007be4
mov rcx, r8
call fcn.18002491c
jmp 0x180007bb8
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
xor r8d, r8d
lea rdx, [0x180060b38]
mov rcx, rbx
call fcn.1800061c0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800248c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18002b30c
int3
Function at 0x180007bf0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180074060]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x48], 0x10
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor esi, esi
test eax, eax
je 0x180007d84
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x180007c70
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.18001b790
nop
lea rcx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rsp + 0x38]
lea rbp, [rcx + rax*2]
lea rdi, [rsp + 0x28]
cmovae rdi, r8
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rbp
sub rax, rdi
sar rax, 1
cmp rax, 0xf
jbe 0x180007ced
mov rdx, rax
mov rcx, rbx
call fcn.18001d9f0
mov qword [rbx + 0x10], rsi
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x20], rbx
cmp rdi, rbp
je 0x180007d4b
nop word [rax + rax]
movzx r9d, byte [rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180007d30
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180007d25
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180007d38
mov rcx, rbx
call fcn.18001dc80
add rdi, 2
cmp rdi, rbp
jne 0x180007d00
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
cmp rdx, 8
jb 0x180007da8
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x180007d7a
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007dd1
mov rcx, r8
call fcn.18002491c
jmp 0x180007da8
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
xor r8d, r8d
lea rdx, [0x180060b38]
mov rcx, rbx
call fcn.1800061c0
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800248c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18002b30c
int3
Function at 0x180008fc0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
lea rcx, [rsp + 0x40]
call fcn.180007bf0
nop
cmp qword [rax + 0x18], 0x10
jb 0x180008fdf
mov rax, qword [rax]
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x180009000
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800061c0
nop
lea rcx, [rsp + 0x20]
call fcn.1800076e0
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18000906e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009069
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009108
call fcn.18002491c
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800090ba
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800090b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009102
call fcn.18002491c
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800090f5
test rbx, rbx
je 0x1800090e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.18002b30c
nop
call fcn.18002b30c
nop
int3

Function at 0x180009240
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
mov dword [rsp + 0x20], eax
cmp qword [rcx + 0x18], 0x10
jb 0x180009256
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], al
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], al
jne 0x180009274
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800061c0
nop
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.1800076e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800092bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800092bd
xor bl, bl
jmp 0x1800092bf
mov bl, 1
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800092f8
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800092f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009303
call fcn.18002491c
test bl, bl
setne al
add rsp, 0x50
pop rbx
ret
call fcn.18002b30c
int3

Function at 0x180009310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0x10
jb 0x18000931e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180009334
test al, 0x10
je 0x180009334
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret