joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001aaf0
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, rdx
xor r9d, r9d
mov rdi, rcx
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001ab44
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x50], rbx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x18001ab7a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rdx, str.SFXJPG
mov r9d, 0x409
mov r8d, 0xce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x18001abb6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x58], rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov rbp, rax
test rax, rax
je 0x18001ac9d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov edi, eax
call fcn.180058214
mov dword [rsp + 0x60], 0
mov rbx, rax
test rax, rax
je 0x18001ac31
lea r9, [rsp + 0x60]
mov r8d, edi
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18001ac87
cmp edi, dword [rsp + 0x60]
jne 0x18001ac87
lea rdx, str.SFXJPG
mov r9d, 0x409
mov r8d, 0xce
mov rcx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
je 0x18001ac95
mov rcx, rbx
call fcn.180058a20
mov eax, 1
jmp 0x18001ac9f
mov edx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov rcx, rbx
call fcn.180058a20
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18001acc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x18008b590]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov rbp, rcx
mov edx, 0x18
mov r9d, 0x409
lea r8d, [rdx - 0x17]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x18001ad1e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x18001ae99
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rdi, eax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180001c00
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str._asInvoker_
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
xor r8d, r8d
lea rdx, str._asInvoker_
lea rcx, [rsp + 0x38]
call fcn.18001b7e0
mov rdx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001adbf
cmp qword [rsp + 0x58], 0x10
jb 0x18001adb8
mov rcx, qword [rsp + 0x40]
call fcn.18005822c
xor eax, eax
jmp 0x18001ae99
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str._asInvoker_
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
or rcx, 0xffffffffffffffff
lea rdi, str._requireAdministrator_
repne scasb al, byte [rdi]
not rcx
dec rcx
mov qword [rsp + 0x20], rcx
lea r9, str._requireAdministrator_
lea rcx, [rsp + 0x38]
call fcn.18001b5d0
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov rdi, rax
test rax, rax
jne 0x18001ae27
cmp qword [rsp + 0x58], 0x10
jb 0x18001ae23
mov rcx, qword [rsp + 0x40]
call fcn.18005822c
xor eax, eax
jmp 0x18001ae99
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov r9d, 0x409
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov edx, 0x18
lea r8d, [rdx - 0x17]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
jne 0x18001ae82
cmp qword [rsp + 0x58], 0x10
jb 0x18001ae7e
mov rcx, qword [rsp + 0x40]
call fcn.18005822c
xor eax, eax
jmp 0x18001ae99
cmp qword [rsp + 0x58], 0x10
jb 0x18001ae94
mov rcx, qword [rsp + 0x40]
call fcn.18005822c
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180058250
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001dc10
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x18008b590]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor eax, eax
mov r14, rdx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0x6a09e667
mov dword [rsp + 0x34], 0xbb67ae85
mov dword [rsp + 0x38], 0x3c6ef372
mov dword [r11 - 0x37], eax
mov word [r11 - 0x33], ax
mov byte [r11 - 0x31], al
mov dword [rsp + 0x3c], 0xa54ff53a
mov dword [rsp + 0x40], 0x510e527f
mov dword [rsp + 0x44], 0x9b05688c
mov dword [rsp + 0x48], 0x1f83d9ab
mov dword [rsp + 0x4c], 0x5be0cd19
mov qword [rsp + 0x50], 0
mov byte [r11 - 0x38], 0
mov r15d, r8d
mov r13d, 0x80000
nop
mov ebx, dword [rsp + 0x50]
mov rbp, r15
mov r12, r14
mov edi, ebx
and edi, 0x3f
movsxd rsi, edi
test r15, r15
je 0x18001dd05
nop word [rax + rax]
movzx eax, byte [r12]
inc edi
inc rsi
mov byte [rsp + rsi + 0x57], al
inc qword [rsp + 0x50]
inc r12
dec rbp
cmp edi, 0x40
jne 0x18001dcfc
lea rcx, [rsp + 0x30]
xor edi, edi
xor esi, esi
call fcn.18001f000
test rbp, rbp
jne 0x18001dcd0
mov ebx, dword [rsp + 0x50]
and ebx, 0x3f
mov esi, 8
lea rbp, [rsp + 0xa0]
movsxd rdi, ebx
nop dword [rax + rax]
movzx eax, byte [rbp]
inc ebx
inc rdi
mov byte [rsp + rdi + 0x57], al
inc qword [rsp + 0x50]
inc rbp
dec rsi
cmp ebx, 0x40
jne 0x18001dd4b
lea rcx, [rsp + 0x30]
xor ebx, ebx
xor edi, edi
call fcn.18001f000
test rsi, rsi
jne 0x18001dd20
xor eax, eax
add byte [rsp + rax + 0xa0], 1
jne 0x18001dd65
inc rax
cmp rax, 8
jl 0x18001dd52
sub r13, 1
jne 0x18001dcb0
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18001f0e0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180058250
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001f570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov dword [rcx + 0x3c], 0x20
mov dword [rcx + 0x68], 1
mov dword [rcx + 0x60], 4
lea r8, [rcx + 0x84]
mov qword [rcx + 0x40], rdx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x64], edx
mov dword [rcx + 0x6c], edx
nop dword [rax]
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
add r8, 4
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x18001f5a0
repz ret

Function at 0x180020b70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x180020c90
add rcx, 0x48
call fcn.180028770
test eax, eax
je 0x180020bb0
mov eax, 0xc
jmp 0x180020c92
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rbx + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x180020be4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x180020ba6
lea rcx, [rbx + 0x20]
call fcn.1800286e0
test eax, eax
jne 0x180020ba6
lea rcx, [rbx + 0x28]
call fcn.1800286e0
test eax, eax
jne 0x180020ba6
lea rcx, [rbx + 0x30]
mov r8d, edi
mov edx, edi
call fcn.180028730
test eax, eax
jne 0x180020ba6
xor r9d, r9d
mov r8d, edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x180020c41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x180020ba6
lea rax, [rsp + 0x40]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rbx + 4], 1
call fcn.180059514
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x180020c8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x180020ba6
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800242e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
add edx, edx
shr ecx, 7
shr rax, 8
movzx r10d, word [rbx + rax*2]
and ecx, 1
neg ecx
shr r10, 4
sar rcx, 4
and ecx, 0x7f
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1800242f0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret
Function at 0x180033420
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rcx
mov ecx, dword [rcx]
cmp ecx, 8
jle 0x180033479
and ecx, 1
je 0x18003343f
mov eax, dword [r9 + 0x10]
add eax, eax
sub eax, dword [r9 + 0x14]
jmp 0x18003344c
mov eax, dword [r9 + 0x10]
lea eax, [rax + rax*2]
sub eax, dword [r9 + 0x14]
sar eax, 1
mov edx, dword [r9 + 0x10]
mov dword [r9 + 0x10], eax
mov dword [r9 + 0x14], edx
test ecx, ecx
je 0x180033469
add eax, eax
sub eax, edx
mov dword [r9 + 0x14], eax
add rsp, 8
ret
lea eax, [rax + rax*2]
sub eax, edx
sar eax, 1
mov dword [r9 + 0x14], eax
add rsp, 8
ret
cmp ecx, 1
jle 0x1800334db
mov eax, ecx
xor r10d, r10d
mov qword [rsp], rbx
cdq
lea r11d, [rcx - 1]
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x1800334d7
nop word [rax + rax]
and r11d, 7
and r10d, 7
movsxd r8, r11d
movsxd rdx, r10d
dec r11d
mov ecx, dword [r9 + r8*4 + 0x10]
inc r10d
xor dword [r9 + rdx*4 + 0x10], ecx
mov ecx, dword [r9 + rdx*4 + 0x10]
xor dword [r9 + r8*4 + 0x10], ecx
mov eax, dword [r9 + r8*4 + 0x10]
xor dword [r9 + rdx*4 + 0x10], eax
sub ebx, 1
jne 0x1800334a0
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x180036090
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rcx
mov ecx, dword [rcx]
cmp ecx, 8
jle 0x180036127
and ecx, 1
je 0x1800360bd
mov edx, dword [r9 + 0x10]
mov eax, dword [r9 + 0x30]
add edx, edx
add eax, eax
sub edx, dword [r9 + 0x14]
sub eax, dword [r9 + 0x34]
jmp 0x1800360d7
mov eax, dword [r9 + 0x10]
lea edx, [rax + rax*2]
mov eax, dword [r9 + 0x30]
sub edx, dword [r9 + 0x14]
lea eax, [rax + rax*2]
sub eax, dword [r9 + 0x34]
sar edx, 1
sar eax, 1
mov r8d, dword [r9 + 0x10]
mov r10d, dword [r9 + 0x30]
mov dword [r9 + 0x10], edx
mov dword [r9 + 0x14], r8d
mov dword [r9 + 0x34], r10d
mov dword [r9 + 0x30], eax
test ecx, ecx
je 0x18003610a
add edx, edx
add eax, eax
sub edx, r8d
sub eax, r10d
mov dword [r9 + 0x34], eax
mov dword [r9 + 0x14], edx
add rsp, 8
ret
lea edx, [rdx + rdx*2]
lea eax, [rax + rax*2]
sub edx, r8d
sub eax, r10d
sar edx, 1
sar eax, 1
mov dword [r9 + 0x34], eax
mov dword [r9 + 0x14], edx
add rsp, 8
ret
cmp ecx, 1
jle 0x18003619b
mov eax, ecx
xor r10d, r10d
mov qword [rsp], rbx
cdq
lea r11d, [rcx - 1]
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x180036197
and r11d, 7
and r10d, 7
movsxd r8, r11d
movsxd rdx, r10d
dec r11d
mov ecx, dword [r9 + r8*4 + 0x10]
inc r10d
xor dword [r9 + rdx*4 + 0x10], ecx
mov ecx, dword [r9 + rdx*4 + 0x10]
xor dword [r9 + r8*4 + 0x10], ecx
mov eax, dword [r9 + r8*4 + 0x10]
xor dword [r9 + rdx*4 + 0x10], eax
mov eax, dword [r9 + r8*4 + 0x30]
xor dword [r9 + rdx*4 + 0x30], eax
mov eax, dword [r9 + rdx*4 + 0x30]
xor dword [r9 + r8*4 + 0x30], eax
mov eax, dword [r9 + r8*4 + 0x30]
xor dword [r9 + rdx*4 + 0x30], eax
sub ebx, 1
jne 0x180036142
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x18003b440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 8
mov qword [rsp + 0x20], rbp
xor ebp, ebp
mov qword [rsp + 0x30], r12
mov ebx, ebp
or r11d, 0xffffffff
mov qword [rsp + 0x38], r13
mov qword [rsp], r14
mov r10, rcx
mov esi, ebp
mov byte [rcx + 0x16f], bl
mov byte [rcx + 0x16e], bl
mov byte [rcx + 0x16d], bl
mov byte [rcx + 0x16c], bl
mov r14d, r11d
mov r9d, ebp
mov r12, rdx
mov r13d, r8d
test r8d, r8d
je 0x18003b4eb
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov edi, dword [r12]
lea eax, [r14 + r14*2]
dec r13d
movzx ecx, di
add ecx, eax
mov eax, edi
sar eax, 0x10
lea r14d, [rcx + rcx*2]
movzx eax, ax
add r14d, eax
test edi, edi
jns 0x18003b4c9
mov eax, edi
not eax
jmp 0x18003b4cb
mov eax, edi
or ebp, eax
mov eax, edi
and r11d, edi
and eax, 1
or esi, edi
add r12, 4
neg eax
xor eax, edi
or ebx, eax
test r13d, r13d
jne 0x18003b4a0
mov rdi, qword [rsp + 0x28]
and dword [r10 + 0x18], 0xff83ffff
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov eax, dword [r10 + 0x18]
mov dword [r10 + 0xc8], r14d
mov r14, qword [rsp]
test ebp, ebp
je 0x18003b51d
add eax, 0x40000
shr ebp, 1
jne 0x18003b510
mov dword [r10 + 0x18], eax
mov eax, dword [r10 + 0x18]
mov rbp, qword [rsp + 0x20]
test eax, 0x7c0000
jne 0x18003b53e
btr eax, 8
mov dword [r10 + 0x18], eax
xor eax, eax
add rsp, 8
pop rsi
pop rbx
ret
test sil, 1
jne 0x18003b56f
xor ecx, ecx
nop word [rax + rax]
shr esi, 1
add eax, 0xfffc0000
inc cl
inc r9d
test sil, 1
je 0x18003b550
mov byte [r10 + 0x16d], cl
mov dword [r10 + 0x18], eax
jmp 0x18003b5cc
test r11b, 1
je 0x18003b5a0
xor ecx, ecx
nop word [rax + rax]
shr r11d, 1
add eax, 0xfffc0000
inc cl
inc r9d
test r11b, 1
jne 0x18003b580
mov byte [r10 + 0x16e], cl
mov dword [r10 + 0x18], eax
jmp 0x18003b5cc
test bl, 2
jne 0x18003b5cc
xor ecx, ecx
nop word [rax + rax]
shr ebx, 1
add eax, 0xfffc0000
inc cl
inc r9d
test bl, 2
je 0x18003b5b0
mov byte [r10 + 0x16f], cl
mov dword [r10 + 0x18], eax
mov r11d, dword [r10 + 0x18]
mov ecx, r11d
shr ecx, 0x12
mov eax, ecx
and eax, 0x1f
cmp al, 0x17
jbe 0x18003b604
and cl, 0x1f
and r11d, 0xff83ffff
sub cl, 0x17
movzx eax, cl
add r9d, eax
add r11d, 0x5c0000
mov byte [r10 + 0x16c], al
mov dword [r10 + 0x18], r11d
test r9d, r9d
je 0x18003b630
or dword [r10 + 0x18], 0x100
test r8d, r8d
je 0x18003b630
nop word [rax + rax]
mov ecx, r9d
add rdx, 4
sar dword [rdx - 4], cl
sub r8d, 1
jne 0x18003b620
movzx eax, byte [r10 + 0x16c]
add rsp, 8
pop rsi
pop rbx
ret
Function at 0x1800499a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor edi, edi
mov ebx, r8d
mov r10d, edx
mov r11, rcx
test edx, edx
je 0x180049a91
lea rsi, [0x180000000]
nop dword [rax]
mov eax, dword [r11]
dec r10d
add r11, 4
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
mov eax, r8d
shr eax, 9
add r8d, eax
cmp r8d, 0x100
jae 0x180049a1e
movsx edx, byte [r8 + rsi + 0x737a0]
mov ecx, 9
sub ecx, edx
shl edx, 8
shl r8d, cl
add edi, edx
movzx eax, r8b
movzx ecx, byte [rax + rsi + 0x738a0]
add edi, ecx
jmp 0x180049a88
mov eax, r8d
cmp r8d, 0x10000
jae 0x180049a3b
shr rax, 8
movsx edx, byte [rax + rsi + 0x737a0]
add edx, 8
jmp 0x180049a64
cmp r8d, 0x1000000
jae 0x180049a55
shr rax, 0x10
movsx edx, byte [rax + rsi + 0x737a0]
add edx, 0x10
jmp 0x180049a64
shr rax, 0x18
movsx edx, byte [rax + rsi + 0x737a0]
add edx, 0x18
lea ecx, [rdx - 9]
shl edx, 8
mov r9d, r8d
shr r9, cl
movzx eax, r9b
movzx ecx, byte [rax + rsi + 0x738a0]
add ecx, edx
add edi, ecx
test ebx, ebx
je 0x180049a88
cmp ecx, ebx
jge 0x180049aa3
test r10d, r10d
jne 0x1800499d0
mov eax, edi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
or eax, 0xffffffff
ret
Function at 0x18004dfa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
cmp dword [rcx + 0x24], 2
jne 0x18004e009
cmp dword [rcx + 0x20], 1
jne 0x18004e009
mov rdi, qword [rcx]
cmp byte [rdi], 0
jne 0x18004e009
mov eax, dword [rdi + 0x1c]
mov dword [rcx + 0x28], eax
mov byte [rdi + 0x20], 0
movsxd rdx, dword [rdi + 0x1c]
mov rcx, qword [rdi + 8]
call fcn.180059a30
mov qword [rdi + 8], rax
mov qword [rbx + 0x18], rax
call fcn.18005a320
movsxd r8, dword [rbx + 0x28]
lea r9, [rax + 0x30]
mov edx, 1
mov rcx, qword [rbx + 0x18]
call fcn.18005aa54
cmp dword [rbx + 0x24], 0
jne 0x18004e035
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18004e07a
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x18004e07a
mov r8d, dword [rbx + 0x58]
test r8d, r8d
je 0x18004e07a
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
jmp 0x18004e07a
cmp dword [rbx + 0x20], 0
jne 0x18004e05a
cmp byte [rbx + 0x10], 0
je 0x18004e04a
mov rcx, qword [rbx + 0x18]
call fcn.1800597e8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18004e07a
call fcn.18005822c
jmp 0x18004e07a
mov rdi, qword [rbx]
test rdi, rdi
je 0x18004e07a
cmp byte [rdi + 0x20], 0
je 0x18004e071
mov rcx, qword [rdi + 8]
call fcn.1800597e8
mov rcx, rdi
call fcn.18005822c
nop
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x18004e090
call fcn.180058a20
mov qword [rbx + 0x50], 0
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18004e0a0
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18004e0af
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18004e2b0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov rdi, rcx
cmp dword [rcx + 0x20], 0
jne 0x18004e3e5
mov ecx, 0x28
call fcn.180058920
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18004e321
mov dword [rax + 0x14], 0x10000
mov dword [rax + 0x1c], 0
mov byte [rax], 0
mov byte [rax + 0x20], 1
mov dword [rax + 0x10], 0x10000
mov ecx, 0x10000
call fcn.180059828
mov qword [rbx + 8], rax
test rax, rax
jne 0x18004e323
mov byte [rbx], 1
jmp 0x18004e323
xor ebx, ebx
mov edx, 1
mov ecx, 0x100000
call fcn.18005b064
mov rbp, rax
test rax, rax
je 0x18004e38d
call fcn.18005a320
mov r9, rax
mov edx, 1
mov r8d, 0x100000
mov rcx, rbp
call fcn.18005a860
test eax, eax
jle 0x18004e38d
nop dword [rax]
mov r8d, eax
mov rdx, rbp
mov rcx, rbx
call fcn.18004de10
call fcn.18005a320
mov r9, rax
mov edx, 1
mov r8d, 0x100000
mov rcx, rbp
call fcn.18005a860
test eax, eax
jg 0x18004e360
cmp byte [rbx], 0
je 0x18004e3a3
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x28], 0
jmp 0x18004e3c2
mov byte [rbx + 0x20], 0
movsxd rdx, dword [rbx + 0x1c]
mov rcx, qword [rbx + 8]
call fcn.180059a30
mov qword [rbx + 8], rax
mov qword [rdi + 0x18], rax
mov eax, dword [rbx + 0x1c]
mov dword [rdi + 0x28], eax
cmp byte [rbx + 0x20], 0
je 0x18004e3d1
mov rcx, qword [rbx + 8]
call fcn.1800597e8
mov rcx, rbx
call fcn.18005822c
mov rcx, rbp
call fcn.1800597e8
mov byte [rdi + 0x10], 1
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.18004e1f0
Function at 0x18005bd1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18008b590]
jne 0x18005826a
rol rcx, 0x10
test cx, 0xffff
jne 0x180058266
repz ret
ror rcx, 0x10
jmp 0x18005bc74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18008e030]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18008e128]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005bcf9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18008e030]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18005bd1b
mov rax, qword [rsp + 0x88]
mov qword [0x18008e128], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18008e0c8], rax
mov rax, qword [0x18008e128]
mov qword [0x18008dfa0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18008e0b0], rax
mov dword [0x18008df90], 0xc0000409
mov dword [0x18008df94], 1
mov rax, qword [0x18008b590]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18008b598]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18008e028], eax
mov ecx, 1
call fcn.18005ce58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800706c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18008e028], 0
jne 0x18005bda2
mov ecx, 1
call fcn.18005ce58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18005f618
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.180061f04
nop
cmp dword [0x18008e8e8], 1
je 0x18005f5c4
mov dword [0x18008e8e4], 1
mov byte [0x18008e8e0], r12b
test ebx, ebx
jne 0x18005f5b0
mov rcx, qword [0x180091190]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18005f59d
mov rcx, qword [0x180091188]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x18005f53c
call fcn.18005c9b0
cmp qword [rdi], rax
jne 0x18005f53c
jmp 0x18005f522
cmp rdi, rsi
jb 0x18005f59d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.18005c9b0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x180091190]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x180091188]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x18005f57b
cmp r13, rax
je 0x18005f59b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x18005f522
lea rdx, [0x1800704a0]
lea rcx, [0x180070488]
call fcn.18005f36c
lea rdx, [0x1800704b0]
lea rcx, [0x1800704a8]
call fcn.18005f36c
nop
test r12d, r12d
je 0x18005f5d3
mov ecx, 8
call fcn.180061e04
test r12d, r12d
jne 0x18005f5fe
mov dword [0x18008e8e8], 1
lea ecx, [r12 + 8]
call fcn.180061e04
mov ecx, r15d
call fcn.18005f300
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18005f48c