joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f8d0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
mov rdx, rcx
xor ebx, ebx
mov rcx, rdi
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x18000f92b
lea rax, [rsp + 0x58]
mov r8, rbp
lea r9d, [rbx + 0x24]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18000f9c8
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.ServicesActive
xor ebx, ebx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18000fa2e
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x18000fa25
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000fc8c
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r15, r8
mov r12, rdx
mov rbx, rcx
lea rdx, str.ServicesActive
xor esi, esi
xor ecx, ecx
mov r14d, r9d
lea r8d, [rsi + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x18000fe35
lea r8d, [rsi + 0x10]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x18000fd02
lea rcx, str.____s_service_already_registered_n
mov rdx, rbx
call fcn.180009ba4
jmp 0x18000fdcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x18000fdb9
mov rdx, rbx
lea rcx, str.____s_service_not_present_n
call fcn.180009ba4
and qword [rsp + 0x60], rsi
mov r9d, 0x60010
and qword [rsp + 0x58], rsi
mov r8, r12
and qword [rsp + 0x50], rsi
mov rdx, rbx
and qword [rsp + 0x48], rsi
mov rcx, rbp
and qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x18000fdaa
mov rdx, rbx
lea rcx, str.____s_service_successfully_registered_n
call fcn.180009ba4
mov rcx, rdi
call fcn.18000fb28
mov esi, eax
test eax, eax
je 0x18000fd9b
lea rcx, str.____s_service_ACL_to_everyone_n
jmp 0x18000fcf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x18000fdc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x18000fdc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenService__0x_08x__n
mov edx, eax
call fcn.180009ba4
test rdi, rdi
je 0x18000fe2a
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, eax
test eax, eax
je 0x18000fdef
lea rcx, str.____s_service_started_n
jmp 0x18000fe03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x18000fe0d
lea rcx, str.____s_service_already_started_n
mov rdx, rbx
call fcn.180009ba4
jmp 0x18000fe21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_service_install___StartService__0x_08x__n
call fcn.180009ba4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000fe49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
call fcn.180009ba4
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180010978
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
and qword [rax - 0x18], rdi
mov rbx, rdx
and qword [rdx], rdi
xor r9d, r9d
and qword [rax - 0x20], rdi
xor edx, edx
and dword [r8], edi
mov rbp, rcx
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x180010a02
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180010a02
and qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
and qword [rsp + 0x28], rdi
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, eax
test eax, eax
jne 0x180010a02
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180010e24
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
lea rax, [r11 - 0x28]
mov rbp, r8
mov qword [r11 - 0x38], rax
mov r14, rdx
lea r8, [r11 + 0x20]
mov rsi, rcx
xor edi, edi
lea r9d, [rbx + 4]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180010ef9
mov eax, dword [rsp + 0x78]
cmp eax, 1
jne 0x180010eb3
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 1]
lea edx, [rbx + 8]
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test eax, eax
jne 0x180010ebd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
call fcn.180009ba4
mov eax, dword [rsp + 0x78]
jmp 0x180010eb8
mov qword [rsp + 0x38], rsi
cmp eax, 1
je 0x180010f0d
mov rcx, qword [rsp + 0x38]
mov r8, rbp
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test eax, eax
jne 0x180010ee8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
call fcn.180009ba4
test edi, edi
je 0x180010f0d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180010f0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
call fcn.180009ba4
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18001102c
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
lea rbp, [r11 - 0x24]
test r9, r9
lea rax, [r11 + 0x20]
mov rbx, rdx
mov rdi, r8
cmovne rbp, r9
mov r14, rcx
and dword [rsp + 0x40], esi
lea r9, [r11 - 0x28]
and dword [r11 + 0x20], esi
mov rdx, rcx
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x18001111d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18001111d
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x18001111d
mov edx, dword [rsp + 0x88]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x180011111
mov r8, qword [rbx]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rdx, r14
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x18001111d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x70]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180014478
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
xor edi, edi
movsxd rsi, r8d
xor r15d, r15d
xor r12d, r12d
mov r13, rdx
mov r10, rcx
mov r14, rcx
mov rbx, rsi
lea r11d, [rdi + 1]
lea ebp, [rdi + 3]
cmp r9b, r11b
jne 0x1800144bb
mov r8d, r11d
jmp 0x1800144f8
movzx eax, r9b
mov edx, ebp
sub edx, eax
mov rcx, rbp
sub rcx, rax
mov r8d, 2
jmp 0x1800144dd
cmp byte [rcx + r10], dil
jne 0x1800144e2
add edx, r8d
add rcx, r8
cmp rcx, rbx
jl 0x1800144d1
cmp edx, esi
movzx eax, r9b
movsxd rbx, edx
setl r12b
and rax, r11
add r10, rax
xor rbx, r11
lea rdx, [r14 + rbx]
lea r9, [0x1800ba530]
cmp r10, rdx
jae 0x180014539
mov ecx, r8d
movzx eax, byte [r10]
test byte [rax + r9], r11b
je 0x180014520
mov ecx, r8d
add r10, rcx
cmp r10, rdx
jb 0x18001450b
cmp r10, rdx
jae 0x180014539
cmp byte [r10], 0x2d
jne 0x180014530
mov r15d, r11d
jmp 0x180014536
cmp byte [r10], 0x2b
jne 0x180014539
add r10, rcx
mov rsi, r10
jmp 0x18001454a
cmp byte [r10], 0x30
jne 0x18001454f
mov eax, r8d
add r10, rax
cmp r10, rdx
jb 0x18001453e
xor ebx, ebx
mov r14d, r8d
cmp r10, rdx
jae 0x18001459d
mov r9, r10
mov al, byte [r9]
sub al, 0x30
cmp al, 9
ja 0x180014586
movsx rax, byte [r9]
lea rcx, [rdi - 6]
lea rcx, [rdi + rcx*4]
add ebx, r8d
add r9, r14
lea rdi, [rax + rcx*2]
movsxd rcx, ebx
add rcx, r10
cmp rcx, rdx
jb 0x18001455c
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x18001459d
mov edi, r15d
add rdi, rax
jmp 0x1800145a5
test r15d, r15d
je 0x1800145a5
neg rdi
xor r9d, r9d
mov qword [r13], rdi
test ebx, ebx
jne 0x1800145b5
cmp rsi, r10
je 0x1800145ea
test r12d, r12d
jne 0x1800145ea
movsxd rcx, ebx
add rcx, r10
cmp rcx, rdx
jae 0x1800145ed
mov edi, ebx
lea rsi, [0x1800ba530]
movzx eax, byte [rcx]
test byte [rax + rsi], r11b
je 0x1800145ea
add edi, r8d
add rcx, r14
movsxd rax, edi
add rax, r10
cmp rax, rdx
jae 0x1800145ed
jmp 0x1800145ce
mov r9d, r11d
imul eax, r8d, 0x13
cmp ebx, eax
jl 0x18001466a
jg 0x18001463f
xor eax, eax
lea rbx, str.922337203685477580
xor edx, edx
xor edi, edi
cmp edx, 0x12
jge 0x180014626
movsxd rax, edi
add edx, r11d
add edi, r8d
movsx ecx, byte [rax + r10]
movsx eax, byte [rbx]
add rbx, r11
sub ecx, eax
lea eax, [rcx + rcx*4]
add eax, eax
je 0x180014604
test eax, eax
jne 0x180014638
lea eax, [r8 + r8*8]
add eax, eax
movsx eax, byte [rax + r10]
sub eax, 0x38
mov r11d, eax
test eax, eax
js 0x18001466a
mov ecx, r15d
movabs rdx, 0x7fffffffffffffff
add rcx, rdx
mov qword [r13], rcx
test r11d, r11d
jle 0x18001465f
mov eax, 2
jmp 0x18001466d
test r15d, r15d
cmovne ebp, r9d
mov eax, ebp
jmp 0x18001466d
mov eax, r9d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x18001764c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd r10, dword [rcx + 0xc]
mov r9, rcx
movsxd r11, r8d
test r8d, r8d
jle 0x1800176a3
mov rsi, qword [rcx]
mov rbx, r10
movsxd rbp, dword [rcx + 8]
xor edi, edi
mov al, byte [rdi + rdx]
lea rcx, [rbx + 1]
xor byte [rbx + rsi], al
lea eax, [r10 + 1]
xor r10d, r10d
cmp rcx, rbp
cmovl r10d, eax
xor ebx, ebx
inc rdi
cmp rcx, rbp
cmovl rbx, rcx
cmp rdi, r11
jl 0x18001767a
add dword [r9 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r9 + 0xc], r10d
ret
Function at 0x1800358d0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov dword [rax - 0x10], ebx
mov rdi, rdx
mov qword [rax - 0x18], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.180037ccc
test ebx, ebx
jne 0x180035923
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.180037ccc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180058e0c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov edi, 0xc0000001
test rcx, rcx
je 0x180058eb3
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x180058eb3
mov edx, ebp
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180058eb3
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebp, eax
je 0x180058e79
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
test rbx, rbx
je 0x180058eb3
cmp word [rbx], 0x21
je 0x180058e9f
cmp word [rbx], 0x2a
je 0x180058e94
mov rcx, rbx
call fcn.180058ecc
jmp 0x180058ea8
lea rcx, [rbx + 2]
call fcn.180077340
jmp 0x180058ea8
lea rcx, [rbx + 2]
call fcn.18006b09c
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18005920c
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x18005926e
and qword [0x18010a570], 0
mov edx, 0x1fe
mov ecx, 0x40
mov qword [0x18010a578], 0xff
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x18010a568], rax
test rax, rax
je 0x180059265
mov ecx, dword [rsp + 0x38]
mov rdx, rbx
call fcn.180058c7c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x18010a568]
add rsp, 0x20
pop rbx
ret

Function at 0x180060fa0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rdx
lea rax, [rax + 8]
mov edx, dword [rdx]
mov rbp, r8
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov dword [rax], ebx
xor r9d, r9d
mov rcx, qword [rsi + 8]
mov r8d, 0x80000001
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x180061048
mov edx, dword [rsp + 0x40]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180061048
mov edx, dword [rsi]
lea rax, [rsp + 0x40]
mov rcx, qword [rsi + 8]
mov r9, rdi
mov r8d, 0x80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x18006103f
lea r8, str.RSA_PRIVATE_KEY
mov r9, rdi
lea rdx, str._____BEGIN__s______n_s_____END__s______n
mov qword [rsp + 0x20], r8
mov rcx, rbp
call fcn.180010a1c
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18006b09c
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea rdx, [rax + 0x10]
mov ebp, r12d
mov rsi, rcx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
mov edi, r12d
test rax, rax
je 0x18006b16e
cmp dword [rsp + 0x58], r12d
jle 0x18006b16e
movzx ebx, r12w
lea r13, [0x1800bcfc0]
cmp bx, 0x13
jae 0x18006b147
mov rcx, qword [r15]
movzx r14d, bx
shl r14, 5
mov rdx, qword [r14 + r13 + 0x10]
call fcn.180090484
test eax, eax
mov edi, r12d
sete dil
test eax, eax
jne 0x18006b140
mov rax, qword [r14 + r13]
test rax, rax
je 0x18006b131
mov ecx, dword [rsp + 0x58]
lea rdx, [r15 + 8]
dec ecx
call rax
mov ebp, eax
jmp 0x18006b140
mov ecx, dword [r14 + r13 + 8]
xor r8d, r8d
xor edx, edx
call fcn.1800082b0
inc bx
test edi, edi
je 0x18006b0f0
test edi, edi
jne 0x18006b16e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x18006b14f
lea r8d, [rax*2 + 2]
mov rdx, rsi
mov ecx, 0x22c003
call fcn.1800082b0
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180077090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8w
mov r11, r9
movzx r10d, dl
xor r9b, r9b
shl r10d, 0x10
mov rsi, rcx
or r10d, eax
movabs rax, 0x2004000000
add r10d, r10d
mov edi, r10d
xor r10b, r10b
or rdi, rax
xor r8b, r8b
movzx edx, r8b
mov rax, rdi
mov bl, r10b
inc r8b
lea ecx, [rdx + 0xd]
shr rax, cl
lea ecx, [rdx + 1]
and al, 1
xor r9b, al
mov rax, rdi
shr rax, cl
and al, 1
xor r10b, al
cmp r8b, 0xc
jb 0x1800770d0
xor ecx, ecx
cmp al, bl
movzx eax, r9b
sete cl
and eax, 1
shl rax, 0x19
or rcx, rax
or rdi, rcx
test r11, r11
je 0x18007711c
mov qword [r11], rdi
mov rcx, rdi
mov dword [rsi], 0x90625062
shr rcx, 0x28
call fcn.180077058
movzx ebx, al
mov rcx, rdi
or ebx, 0x1d00
shr rcx, 0x24
shl ebx, 8
call fcn.180077058
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x20
shl ebx, 8
call fcn.180077058
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x1c
mov dword [rsi + 4], ebx
call fcn.180077058
movzx ebx, al
mov rcx, rdi
shr rcx, 0x18
shl ebx, 8
call fcn.180077058
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x14
shl ebx, 8
call fcn.180077058
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x10
shl ebx, 8
call fcn.180077058
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0xc
mov dword [rsi + 8], ebx
call fcn.180077058
movzx ebx, al
mov rcx, rdi
shr rcx, 8
shl ebx, 8
call fcn.180077058
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 4
shl ebx, 8
call fcn.180077058
movzx eax, al
mov cl, dil
or ebx, eax
shl ebx, 8
call fcn.180077058
movzx eax, al
or ebx, eax
mov dword [rsi + 0xc], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18007720c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
and dword [rax + 8], 0
mov rdi, rdx
xor r10b, r10b
mov r11, rcx
movabs r8, 0xff80000000000000
movzx esi, r10b
lea rdx, [rsp + 8]
mov ecx, 9
mov r9, rdi
sub ecx, esi
shl ecx, 2
shr r9, cl
xor cl, cl
and r9b, 0xf
xor bl, bl
mov al, r9b
shr al, cl
inc cl
and al, 1
xor byte [rdx], al
xor bl, al
inc rdx
cmp cl, 4
jb 0x180077253
imul eax, esi, 0xfffffffb
inc r10b
movzx edx, bl
lea ecx, [rax + 0x32]
shl rdx, cl
lea ecx, [rax + 0x33]
movzx eax, r9b
shl rax, cl
or rdx, rax
or r8, rdx
cmp r10b, 0xa
jb 0x180077232
movzx eax, byte [rsp + 0xa]
movzx ecx, byte [rsp + 0xb]
mov rbx, qword [rsp + 0x10]
add ecx, ecx
mov rsi, qword [rsp + 0x18]
or ecx, eax
movzx eax, byte [rsp + 9]
add ecx, ecx
mov rdi, qword [rsp + 0x20]
or ecx, eax
movzx eax, byte [rsp + 8]
add ecx, ecx
or ecx, eax
mov dword [r11], 0x148040
lea eax, [rcx + rcx]
or r8, rax
mov rax, r8
mov dword [r11 + 8], r8d
shr rax, 0x20
mov dword [r11 + 4], eax
ret
Function at 0x140001903
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000e008]
jne 0x14000109a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001096
repz ret
ror rcx, 0x10
jmp 0x14000185c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000f4e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000f5d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400018e1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000f4e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001903
mov rax, qword [rsp + 0x88]
mov qword [0x14000f5d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000f578], rax
mov rax, qword [0x14000f5d8]
mov qword [0x14000f450], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000f560], rax
mov dword [0x14000f440], 0xc0000409
mov dword [0x14000f444], 1
mov rax, qword [0x14000e008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000e010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000f4d8], eax
mov ecx, 1
call fcn.140004dc4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000b320]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000f4d8], 0
jne 0x14000198a
mov ecx, 1
call fcn.140004dc4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001cf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140004fdc
nop
cmp dword [0x14000fa00], 1
je 0x140001c9c
mov dword [0x14000f9fc], 1
mov byte [0x14000f9f8], r12b
test ebx, ebx
jne 0x140001c88
mov rcx, qword [0x140011598]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001c75
mov rcx, qword [0x140011590]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140001c14
call fcn.140002d44
cmp qword [rdi], rax
jne 0x140001c14
jmp 0x140001bfa
cmp rdi, rsi
jb 0x140001c75
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140002d44
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140011598]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140011590]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140001c53
cmp r13, rax
je 0x140001c73
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140001bfa
lea rdx, [0x14000b2e0]
lea rcx, [0x14000b2c8]
call fcn.140001a44
lea rdx, [0x14000b2f0]
lea rcx, [0x14000b2e8]
call fcn.140001a44
nop
test r12d, r12d
je 0x140001cab
mov ecx, 8
call fcn.140004edc
test r12d, r12d
jne 0x140001cd6
mov dword [0x14000fa00], 1
lea ecx, [r12 + 8]
call fcn.140004edc
mov ecx, r15d
call fcn.1400019d8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140001b64

Function at 0x140001cfc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140001b64