joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400027f7
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140018580
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x140083908]
xor ecx, ecx
lea r8, [0x140083900]
lea rdx, str.FlsAlloc
call fcn.140018100
test rax, rax
je 0x1400185b9
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400a2020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140002874
Capabilities:
Get geographical location

Disassembly:
jmp 0x140063014
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x140087468]
mov rbp, rcx
lea r8, [0x140087460]
lea rdx, str.GetLocaleInfoEx
mov ecx, 8
call fcn.140062534
test rax, rax
je 0x140063074
movabs r10, 0xe375262d7cd44270
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call qword [0x1400a2030]
jmp 0x14006308e
xor edx, edx
mov rcx, rbp
call fcn.1400021b2
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140002883
Capabilities:
Terminate process

Disassembly:
jmp 0x14000a208
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400029b9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021804
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140021560

Function at 0x140002b44
Capabilities:
Parse pe header

Disassembly:
jmp 0x140079870
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140079898
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140079898
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140002e41
Capabilities:
Parse pe header

Disassembly:
jmp 0x14000afd4
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b01e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b01e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b01e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b01e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b01e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b020
xor al, al
add rsp, 0x28
ret

Function at 0x1400030b2
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400797b0
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x1400797f1
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x1400797e5
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x1400797f3
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x1400797d3
xor eax, eax
ret
Function at 0x14000329c
Capabilities:
Terminate process

Disassembly:
jmp 0x1400557c4
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400557de
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.14000392c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140003a0d
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140018688
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140083968]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140083960]
call fcn.140018100
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400186c8
call qword [0x1400a2020]
jmp 0x1400186ce
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003b8e
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400217f4
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400215cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400215cf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400215cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400215cf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400215cf
cmp dword [rcx + 0x84], 0xe
jbe 0x1400215cf
cmp dword [rcx + 0xf8], 0
je 0x1400215cf
mov ecx, ebx
call fcn.140021738
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400212b0
nop
cmp dword [rbp + 0x20], 0
je 0x14002161d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140021658
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140021560

Function at 0x14000afd4
Capabilities:
Parse pe header

Disassembly:
jmp 0x14000afd4
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b01e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b01e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b01e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b01e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b01e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b020
xor al, al
add rsp, 0x28
ret
Function at 0x140002dc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003e50
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003e50
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002e30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x140002f60
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002e7b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002f05
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002e60
mov rcx, rbx
call fcn.140003880
mov rdi, rax
test rax, rax
je 0x140002f82
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400039c0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002f67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002efe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002f10
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002efe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002dc0
nop dword [rax]
xor esi, esi
jmp 0x140002e88
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002dc0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002dc0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400034f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x14000354c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003543
test rsi, rsi
je 0x140003543
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003528
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003880
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006a60]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400038a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400038a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400038a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400038fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400038f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400038a0
add rax, 0x28
cmp rax, r9
jne 0x1400038e0
xor eax, eax
ret

Function at 0x140003900
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a60]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000391f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003928
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000391f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400039c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a60]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400039df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400039e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002b9f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140011040]
jne 0x1400020da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400020d6
repz ret
ror rcx, 0x10
jmp 0x140002af8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140012640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140012738]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002b7d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140012640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140002b9f
mov rax, qword [rsp + 0x88]
mov qword [0x140012738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400126d8], rax
mov rax, qword [0x140012738]
mov qword [0x1400125b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400126c0], rax
mov dword [0x1400125a0], 0xc0000409
mov dword [0x1400125a4], 1
mov rax, qword [0x140011040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140011048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140012638], eax
mov ecx, 1
call fcn.140003644
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000d398]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012638], 0
jne 0x140002c26
mov ecx, 1
call fcn.140003644
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003cf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140004e2c
nop
cmp dword [0x140012b78], 1
je 0x140003c9c
mov dword [0x140012b74], 1
mov byte [0x140012b70], r12b
test ebx, ebx
jne 0x140003c88
mov rcx, qword [0x140014650]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140003c75
mov rcx, qword [0x140014648]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140003c14
call fcn.140003654
cmp qword [rdi], rax
jne 0x140003c14
jmp 0x140003bfa
cmp rdi, rsi
jb 0x140003c75
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140003654
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140014650]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140014648]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140003c53
cmp r13, rax
je 0x140003c73
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140003bfa
lea rdx, [0x14000d308]
lea rcx, [0x14000d2f0]
call fcn.140003a44
lea rdx, [0x14000d318]
lea rcx, [0x14000d310]
call fcn.140003a44
nop
test r12d, r12d
je 0x140003cab
mov ecx, 8
call fcn.140004d2c
test r12d, r12d
jne 0x140003cd6
mov dword [0x140012b78], 1
lea ecx, [r12 + 8]
call fcn.140004d2c
mov ecx, r15d
call fcn.1400039d8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140003b64

Function at 0x140003cfc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140003b64
Function at 0x1400069e8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140003654
xor ebx, ebx
mov rdi, rax
cmp qword [0x140013308], rbx
jne 0x140006aee
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140006bc3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006bc3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140013308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140013310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140013318], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140013328], rax
test rax, rax
je 0x140006ae5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140013320], rax
jmp 0x140006af5
mov rax, qword [0x140013320]
jmp 0x140006afc
mov rax, qword [0x140013320]
mov r11, qword [0x140013328]
cmp rax, rdi
je 0x140006b64
cmp r11, rdi
je 0x140006b64
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140013328]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140006b64
test rax, rax
je 0x140006b64
call rsi
test rax, rax
je 0x140006b5e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140006b5e
test byte [rsp + 0x38], 1
jne 0x140006b64
bts ebp, 0x15
jmp 0x140006ba2
mov rcx, qword [0x140013310]
cmp rcx, rdi
je 0x140006ba2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140006ba2
call rax
mov rbx, rax
test rax, rax
je 0x140006ba2
mov rcx, qword [0x140013318]
cmp rcx, rdi
je 0x140006ba2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140006ba2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140013308]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140006bc3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140006bc5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800016e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rsp + 0x50]
lea eax, [rcx + 0x3b8]
mov r10d, dword [rsp + 0x58]
xor eax, 0x1c58
xor r10d, 0x3fd5
lea ebx, [rdx + 0xec8]
cmp r10d, eax
jg 0x180001906
xor edx, 0x20e
add edx, 0x73e
cmp r10d, edx
jg 0x1800018c1
mov edx, dword [0x1800590a0]
add edx, 0x15e6
add edx, dword [r9 + 0x10]
mov dword [r9 + 0x64], edx
mov eax, dword [r9 + 0x80]
sub eax, dword [0x1800590ec]
add eax, 0x10a
add eax, edx
mov dword [r9 + 0x64], eax
mov rax, qword [section..data]
add dword [rax + 0x64], 0x123
mov eax, 0xfcfcd8ff
sub eax, dword [r9 + 0x6c]
sub eax, dword [0x18005906c]
add dword [r9 + 0x64], eax
cmp dword [r9 + 0x6c], 0x4860
mov rcx, qword [section..data]
je 0x180001794
mov eax, 0xbab76
sub eax, dword [rcx + 0x130]
add dword [0x180059074], eax
cmp dword [r9 + 0x1c], 0x12675
jb 0x1800017ac
lea rax, [0x180059170]
mov qword [rcx + 0xa0], rax
xor r10d, r10d
nop
movsxd rcx, dword [0x180059078]
mov rax, qword [r9 + 0xa0]
mov r8d, dword [rax + r10]
add r10, 4
imul r8d, dword [r9 + 0x64]
mov rax, qword [r9 + 0xa8]
mov edx, r8d
shr edx, 0x10
mov byte [rcx + rax], dl
inc dword [0x180059078]
mov ecx, dword [r9 + 0xd0]
mov eax, dword [r9 + 0x50]
xor ecx, 2
imul eax, ecx
mov dword [r9 + 0x50], eax
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x104]
mov eax, dword [rdx + 0x34]
inc ecx
imul eax, ecx
mov dword [rdx + 0x34], eax
mov rdx, qword [section..data]
mov eax, dword [0x180059158]
inc eax
mov ecx, dword [rdx + 0x10]
imul ecx, eax
mov dword [rdx + 0x10], ecx
mov edx, r8d
mov rax, qword [0x1800590b8]
movsxd rcx, dword [r9 + 0x68]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [r9 + 0x68]
mov eax, dword [r9 + 0xec]
xor eax, 0x1bd89d
add dword [0x1800590a0], eax
mov rax, qword [section..data]
movsxd rdx, dword [r9 + 0x68]
mov rcx, qword [rax + 0xa8]
mov byte [rdx + rcx], r8b
inc dword [r9 + 0x68]
mov ecx, dword [r9 + 0xdc]
mov edx, dword [r9 + 0xc4]
add ecx, 0xff0c5a58
mov r8, qword [section..data]
add edx, ecx
or dword [r8 + 0x10], edx
mov rcx, qword [section..data]
mov edx, dword [r9 + 0x140]
sub edx, dword [rcx + 0x90]
xor edx, 0xffee0a9e
sub dword [r9 + 0x134], edx
cmp r10, 0x1670
jl 0x1800017b0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x10c]
xor eax, 0x3a20
cmp dword [0x180059094], eax
jb 0x180001906
mov r8d, dword [0x1800590f8]
mov edx, dword [r9 + 0x130]
imul r8d, r10d
and edx, ebx
or r10d, 0x2e3d
xor r8d, dword [rcx + 0x148]
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180001bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
lea r10d, [r8 - 0x51d]
mov r9, qword [rsp + 0x68]
mov edi, ecx
xor edi, 0x1c7e
mov esi, r8d
lea r11d, [rax - 0x33af]
lea ebx, [rax - 0x5b6]
lea eax, [r11 + 0x2986]
cmp r8d, eax
je 0x180001d71
lea eax, [r10 - 0x74]
cmp ebx, eax
jg 0x180001d38
mov qword [rsp + 0x40], r14
xor r14d, r14d
nop dword [rax + rax]
mov rdx, qword [section..data]
mov ecx, dword [0x180059060]
mov eax, dword [rdx + 0x130]
sub eax, 0xb9fca
imul ecx, eax
mov dword [0x180059060], ecx
mov eax, dword [r9 + 0xbc]
xor eax, 0x1b8e3e
add dword [rdx + 0x104], eax
mov rax, qword [r9 + 0xa0]
movsxd rcx, dword [0x180059078]
mov r8d, dword [r14 + rax]
add r14, 4
imul r8d, dword [0x180059074]
mov eax, dword [0x1800590ec]
sub dword [0x1800590d4], eax
mov rax, qword [r9 + 0xa8]
mov edx, r8d
shr edx, 0x10
mov byte [rcx + rax], dl
inc dword [0x180059078]
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x50]
mov eax, dword [rdx + 0x2c]
xor ecx, 0xfff3d0fa
imul eax, ecx
mov dword [rdx + 0x2c], eax
mov edx, r8d
mov eax, dword [r9 + 0xec]
mov ecx, dword [r9 + 0x18]
inc ecx
shr edx, 8
imul eax, ecx
movsxd rcx, dword [r9 + 0x68]
mov dword [r9 + 0xec], eax
mov rax, qword [r9 + 0xa8]
mov byte [rcx + rax], dl
inc dword [r9 + 0x68]
movsxd rcx, dword [r9 + 0x68]
mov rax, qword [0x1800590b8]
mov byte [rcx + rax], r8b
mov eax, 1
sub eax, dword [r9 + 0x10c]
inc dword [r9 + 0x68]
sub eax, dword [0x180059028]
mov rcx, qword [section..data]
add dword [rcx + 0x34], eax
mov eax, dword [r9 + 0xc4]
xor eax, 0xf3a5a8
sub dword [0x180059090], eax
cmp r14, 0x228b0
jl 0x180001c10
mov rdx, qword [section..data]
mov r14, qword [rsp + 0x40]
mov eax, dword [rdx + 0x148]
add eax, 0x35931
mov dword [0x180059074], eax
jmp 0x180001d78
mov eax, r11d
xor eax, 0x2df9
cmp dword [0x18005906c], eax
jb 0x180001d71
mov eax, dword [r9 + 0x60]
sub eax, dword [r9 + 0x124]
add eax, ebx
cmp edi, eax
jae 0x180001d71
mov ecx, dword [r9 + 0x5c]
or ecx, dword [0x180059030]
xor ecx, dword [r9 + 0x5c]
xor ecx, 0x3537
mov dword [r9 + 0x5c], ecx
mov rdx, qword [section..data]
lea eax, [r11 + 0x2df9]
cmp r10d, eax
je 0x180001dcb
cmp dword [rdx + 0x104], 0x15ead
jae 0x180001d9f
mov eax, 0xffffe7d3
sub eax, dword [0x180059158]
add dword [r9 + 0x64], eax
lea eax, [r11 + 0x35a4]
add ebx, 0xa69
lea r8d, [r10 + 0x102d]
mov dword [rsp + 0x20], eax
lea edx, [rsi + 0x671]
lea ecx, [r10 + 0x9d0]
call sym.iixfgec031pc.dll_NIBPcz441G
jmp 0x180001dd5
mov ecx, ebx
xor ecx, edi
sub dword [rdx + 0x148], ecx
mov rsi, qword [rsp + 0x50]
xor ebx, 0x159b
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180002730
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, dword [rsp + 0x80]
lea r12d, [rdx - 0x2ff7]
mov esi, dword [rsp + 0x88]
xor r15d, 0x11f2
mov ebp, r8d
mov r14d, edx
xor ebp, 0x2e7e
xor r14d, 0x2ff7
add esi, 0x591
lea eax, [r15 + 0x1041]
cmp r14d, eax
mov rax, qword [rsp + 0x90]
jg 0x1800027bd
cmp dword [rax + 0x80], 0x12283
je 0x180002874
mov rdx, qword [section..data]
mov eax, 0x1325cc
mov ecx, dword [rdx + 0xbc]
xor ecx, dword [rdx + 0x10]
sub eax, ecx
add dword [rdx + 0x2c], eax
jmp 0x180002874
mov edx, dword [0x180059108]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rax + 0x5c]
mov eax, edx
or eax, 0x3862
cmp ebx, eax
je 0x18000286f
mov rcx, qword [section..data]
and ebp, 0x3fc9
mov qword [rsp + 0x68], rdi
nop dword [rax]
cmp dword [rcx + 0x2c], ebp
jb 0x18000285c
mov r8d, dword [rcx + 0x28]
mov eax, r15d
mov edi, dword [0x18005911c]
or eax, 0x3bc2
mov r9d, dword [0x180059104]
sub eax, r14d
mov ecx, dword [rcx + 0x10]
mov r11d, esi
movsxd r10, eax
and edi, esi
imul r11d, r14d
lea eax, [r14 + 0x3fc9]
mov dword [rsp + 0x30], edi
add r9d, 0xffffca5c
mov qword [rsp + 0x28], r10
sub ecx, 0x3f8c
imul r8d, r12d
movsxd rdx, eax
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov rcx, qword [section..data]
mov edx, dword [0x180059108]
mov eax, edx
add ebx, 4
or eax, 0x3862
cmp ebx, eax
jne 0x1800027f0
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
lea eax, [rsi + 0x188]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret