joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14009ca45
test r9, r9
je 0x14009ca22
movsxd rcx, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div rcx
test rdx, rdx
jne 0x14009ca22
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
cmp ecx, 1
jne 0x14009c947
mov r15d, ebp
test rax, rax
je 0x14009c92a
nop dword [rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14009cab0
mov rcx, rdi
cmp byte [rbx + 8], bpl
je 0x14009ca68
mov eax, dword [rbx + 0x3d0]
mov edx, ebp
test eax, eax
jle 0x14009c8f8
lea r8, [rbx + 0x3f8]
sub r8, rdi
movzx eax, byte [r8 + rcx]
inc edx
xor byte [rcx], al
lea rcx, [rcx + 1]
mov eax, dword [rbx + 0x3d0]
cmp edx, eax
jl 0x14009c8e1
movsxd r8, eax
lea rcx, [rbx + 0x3f8]
mov rdx, rsi
call fcn.1400e0d60
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x14009c8b0
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
cmp ecx, 2
jne 0x14009c9df
mov r15d, ebp
test rax, rax
je 0x14009c92a
nop dword [rax + rax]
mov r8, rdi
lea rdx, [rbx + 0x3f8]
mov rcx, rbx
call fcn.14009d920
mov rax, rdi
cmp byte [rbx + 8], bpl
je 0x14009ca8b
mov ecx, dword [rbx + 0x3d0]
mov edx, ebp
test ecx, ecx
jle 0x14009c9a8
mov r8, rsi
sub r8, rdi
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
mov ecx, dword [rbx + 0x3d0]
cmp edx, ecx
jl 0x14009c991
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rbx + 0x3f8]
call fcn.1400e0d60
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x14009c960
jmp 0x14009c92a
test rax, rax
je 0x14009c92a
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14009cab0
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc ebp
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, ebp
cmp rcx, rax
jb 0x14009c9f0
jmp 0x14009c92a
mov rdx, qword [str.Data_not_multiple_of_Block_Size]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
Function at 0x14009d6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14009d8b5
test r9, r9
je 0x14009d892
movsxd r8, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div r8
test rdx, rdx
jne 0x14009d892
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
cmp ecx, 1
jne 0x14009d7b2
mov r15d, ebp
test rax, rax
je 0x14009d795
lea r14, [rbx + 0x3f8]
nop dword [rax + rax]
mov rax, r14
cmp byte [rbx + 8], bpl
je 0x14009d8d8
mov edx, ebp
test r8d, r8d
jle 0x14009d755
mov r8, rsi
sub r8, r14
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, dword [rbx + 0x3d0]
jl 0x14009d740
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.14009d920
movsxd r8, dword [rbx + 0x3d0]
mov rdx, rdi
mov rcx, r14
call fcn.1400e0d60
movsxd r8, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div r8
add rsi, r8
movsxd rcx, r15d
add rdi, r8
cmp rcx, rax
jb 0x14009d720
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
cmp ecx, 2
jne 0x14009d852
mov r15d, ebp
test rax, rax
je 0x14009d795
mov r8, rdi
lea rdx, [rbx + 0x3f8]
mov rcx, rbx
call fcn.14009d920
mov rcx, rdi
cmp byte [rbx + 8], bpl
je 0x14009d8fb
mov eax, dword [rbx + 0x3d0]
mov edx, ebp
test eax, eax
jle 0x14009d817
mov r8, rsi
sub r8, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc edx
xor byte [rcx], al
lea rcx, [rcx + 1]
mov eax, dword [rbx + 0x3d0]
cmp edx, eax
jl 0x14009d800
movsxd r8, eax
lea rcx, [rbx + 0x3f8]
mov rdx, rdi
call fcn.1400e0d60
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x14009d7c3
jmp 0x14009d795
test rax, rax
je 0x14009d795
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14009d920
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc ebp
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, ebp
cmp rcx, rax
jb 0x14009d860
jmp 0x14009d795
mov rdx, qword [str.Data_not_multiple_of_Block_Size]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.14009c7b0
lea rdx, [0x140157a50]
lea rcx, [rsp + 0x20]
call fcn.1400dfbc4
int3
Function at 0x1400a0d90
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x1400a1230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
movsxd rbx, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.1400e1410
mov r10d, 0x6f
mov dword [rbp + 0x1e0], 0x200
mov eax, 0x68
mov dword [rsp + 0x70], 0x740066
mov word [rbp - 0x76], ax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x30]
mov dword [rbp - 0x7a], 0x700061
lea r8d, [r10 + 3]
mov dword [rsp + 0x74], 0x43005c
mov word [rsp + 0x68], r8w
lea r12d, [r10 - 0x22]
mov word [rbp - 0x7c], r8w
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x6a], 0x73006f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], 0x410057
mov dword [rsp + 0x78], 0x790072
mov dword [rsp + 0x60], 0x4d005c
mov dword [rsp + 0x7c], 0x740070
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x80], 0x67006f
mov dword [rsp + 0x5c], 0x450052
mov dword [rsp + 0x50], 0x4f0053
mov dword [rsp + 0x54], 0x540046
mov dword [rbp - 0x74], 0x79
mov word [rsp + 0x6e], r10w
mov qword [rsp + 0x20], rax
call fcn.140099ef0
test eax, eax
jne 0x1400a1415
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x1e8]
mov eax, 0x68
mov dword [rsp + 0x40], 0x6e0069
mov word [rsp + 0x3e], ax
lea rdx, [rsp + 0x38]
lea rax, [rbp + 0x1e0]
mov dword [rsp + 0x4c], 0x64
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov dword [rsp + 0x44], 0x470065
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3a], 0x630061
mov dword [rsp + 0x48], 0x690075
mov word [rsp + 0x38], r12w
call fcn.14009a0c0
test eax, eax
je 0x1400a13f5
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call fcn.140099ef0
test eax, eax
jne 0x1400a1415
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e8]
lea rax, [rbp - 0x70]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14009a0c0
test eax, eax
jne 0x1400a1415
mov rdx, rbx
lea r8, [rbp - 0x70]
mov r9, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400fe168
mov rcx, qword [rsp + 0x30]
call fcn.140099a70
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a1560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcc0
lea rbp, [rsp + 0x30]
mov edi, 0x72
movsxd rsi, edx
mov eax, 0x43
mov word [rbp + 0x72], di
mov word [rbp + 0x6c], ax
mov r14, rcx
mov eax, 0x52
mov word [rbp + 0x48], di
mov word [rbp + 0x3c], ax
lea r11d, [rdi - 0xd]
mov eax, 0x4d
mov qword [rbp + 0xcd0], rbx
lea r10d, [rdi - 3]
mov word [rbp + 0x42], ax
mov eax, 0x72
mov dword [rbp + 0x6e], 0x720075
xor edx, edx
mov word [rbp + 0x10], ax
mov r8d, 0x800
mov dword [rbp + 0x56], 0x690057
lea rcx, [rbp + 0x490]
mov dword [rbp + 0x44], 0x630069
mov dword [rbp + 0x38], 0x410057
xor edi, edi
mov dword [rbp + 0x3e], 0x5c0045
mov dword [rbp + 0x30], 0x4f0053
mov dword [rbp + 0x4a], 0x73006f
mov dword [rbp + 0x4e], 0x66006f
mov dword [rbp + 0x7e], 0x730072
mov dword [rbp + 0x34], 0x540046
mov dword [rbp + 0x64], 0x4e0020
mov dword [rbp + 0x74], 0x6e0065
mov dword [rbp + 0x82], 0x6f0069
mov dword [rbp + 0x52], 0x5c0074
mov dword [rbp + 0x68], 0x5c0054
mov dword [rbp + 0x78], 0x560074
mov dword [rbp + 0x60], 0x730077
mov dword [rbp + 0x5a], 0x64006e
mov dword [rbp + 0x86], 0x6e
mov word [rbp + 0x5e], r10w
mov word [rbp + 0x7c], r11w
mov dword [rbp + 0x12], 0x64006f
mov dword [rbp + 0x16], 0x630075
mov dword [rbp + 0xc], 0x50006c
mov dword [rbp + 8], 0x610074
mov dword [rbp + 0x1a], 0x490074
mov dword [rbp + 4], 0x690067
mov dword [rbp + 0x1e], 0x64
mov dword [rbp], 0x690044
call fcn.1400e1410
lea rax, [rbp + 0xce8]
mov dword [rbp + 0xce0], 0x800
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000002
call fcn.140099ef0
test eax, eax
jne 0x1400a17e6
mov rcx, qword [rbp + 0xce8]
lea rax, [rbp + 0xce0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp]
lea rax, [rbp + 0x490]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.14009a0c0
test eax, eax
jne 0x1400a17da
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x400
call fcn.1400e1410
mov r8d, dword [rbp + 0xce0]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x490]
call fcn.1400a0e30
lea rcx, [rbp + 0x90]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x1400a1750
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400a17c5
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400a1782
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400deb40
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400a17c5
mov dword [rsp + 0x28], edx
lea r8, [rbp + 0x90]
xor edx, edx
mov word [rbx], di
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
mov rdi, rbx
mov rdx, rsi
mov r9, 0xffffffffffffffff
mov r8, rdi
mov rcx, r14
call fcn.1400fe168
mov rcx, qword [rbp + 0xce8]
call fcn.140099a70
mov rbx, qword [rbp + 0xcd0]
lea rsp, [rbp + 0xc90]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aee6a
Capabilities:
Packed with generic packer

Disassembly:
jl 0x1400aeedb
pop rsp
cmp eax, 0x2e2b7e35
invalid

Function at 0x1400d2fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400bb7f2
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400bb7d5
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400bb7c0

Function at 0x1400f0040
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400efd90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400efd90
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400efd90
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400efd90
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400efd90
cmp dword [rcx + 0x84], 0xe
jbe 0x1400efd90
cmp dword [rcx + 0xf8], esi
je 0x1400efd90
mov ecx, r14d
call fcn.1400eff54
mov ecx, 2
call fcn.1401000c4
nop
cmp byte [0x14015bf38], 0
jne 0x1400efe5a
mov r15d, 1
mov eax, r15d
xchg dword [0x14015bf28], eax
test ebx, ebx
jne 0x1400efe03
mov rdi, qword [0x1401590d8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14015bf30]
cmp rcx, rax
je 0x1400efdfa
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140006840]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14015c4c0]
jmp 0x1400efe0f
cmp ebx, r15d
jne 0x1400efe15
lea rcx, [0x14015c4d8]
call fcn.14010fb90
nop
test ebx, ebx
jne 0x1400efe2c
lea rdx, [0x14012d6d8]
lea rcx, [0x14012d6b8]
call fcn.14011011c
lea rdx, [0x14012d6e8]
lea rcx, [0x14012d6e0]
call fcn.14011011c
movzx eax, byte [0x14015bf38]
test esi, esi
cmove eax, r15d
mov byte [0x14015bf38], al
jmp 0x1400efe5a
mov ecx, 2
call fcn.140100118
test esi, esi
jne 0x1400efe71
mov ecx, r14d
call fcn.1400efe8c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400efd20
Function at 0x140118c78
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401188a4
call fcn.1400eeb2c
mov dword [rax], 0x16
call fcn.1400ee980
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14011888c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14011888c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401188d6
lock or dword [rax + 0x14], 0x10
jmp 0x14011888c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401188f3
mov rcx, qword [rbp + 0x10]
call fcn.14011a9c4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140115ab0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14011a04c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14011894a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14011888c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401189b6
mov rcx, qword [rbp + 0x10]
call fcn.140115ab0
cmp eax, 0xffffffff
je 0x14011899d
mov rcx, qword [rbp + 0x10]
call fcn.140115ab0
cmp eax, 0xfffffffe
je 0x14011899d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140115ab0
movsxd rdi, eax
lea rsi, [0x14015cd50]
mov rcx, rbx
sar rdi, 6
call fcn.140115ab0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401189a4
lea rax, [0x1401594a0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401189b6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401189ec
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401189e8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401189e8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14011888f
jmp 0x14011885c
Function at 0x180008e40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.18010be50
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180008ebe
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x180008e9e
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call fcn.18010e9d0
mov rcx, rdi
test eax, eax
je 0x180008eea
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008e91
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800eccc0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180008ec9
Function at 0x180011bd0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x850
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x180011c21
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, rax
mov rbp, qword [rdi + 0x18]
test rax, rax
jne 0x180011c3f
mov rsi, rdi
cmp rbp, 8
jb 0x180011c3f
mov rsi, qword [rdi]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call fcn.18010be50
mov r9, qword [rdi + 0x10]
cmp rbp, 8
jb 0x180011c5e
mov rdi, qword [rdi]
mov r8, rdi
mov edx, 0x3ff
lea rcx, [rsp + 0x40]
call fcn.18010e85c
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.MxStart.exe
mov rcx, rsi
call fcn.18010e9d0
test eax, eax
jne 0x180011cec
lea rdx, str.Maxthon.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180011db5
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x180011cd0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180004930
jmp 0x180011dd8
lea rdx, str.TSBrowserLauncher.exe
mov rcx, rsi
call fcn.18010e9d0
test eax, eax
jne 0x180011d54
lea rdx, str.TSBrowser.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180011db5
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x180011d40
lea rdx, [rsp + 0x40]
jmp 0x180011dcf
lea rdx, str.DCBrowserLauncher.exe
mov rcx, rsi
call fcn.18010e9d0
test eax, eax
jne 0x180011db5
lea rdx, str.DCBrowser.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180011db5
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x180011da4
lea rdx, [rsp + 0x40]
jmp 0x180011dcf
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
xor r8d, r8d
lea rdx, [0x180160958]
mov rcx, rbx
call fcn.180004930
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800eccc0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180015670
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
test rcx, rcx
je 0x180015820
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov ecx, dword [rax + 0x90]
test ecx, ecx
je 0x180015820
lea r14, [rsi + rcx]
cmp dword [r14], 0
je 0x180015820
lea r12, [0x180162fe8]
movabs r13, 0x8000000000000000
xor r15d, r15d
nop dword [rax + rax]
mov ebx, dword [r14 + 0xc]
add rbx, rsi
lea rcx, [0x180162fa0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rdx, [0x180162fa0]
mov rcx, rbx
call fcn.180121780
test eax, eax
jne 0x180015812
mov edi, dword [r14]
add rdi, rsi
mov rax, qword [rdi]
test rax, rax
je 0x180015812
js 0x180015802
cmp r12, r13
jae 0x180015802
lea rbx, [rsi + 2]
add rbx, rax
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x180015765
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.180012bb0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
mov rdx, r12
call fcn.180118e30
test eax, eax
jne 0x1800157b7
mov dword [rbp - 0x40], r15d
lea r9, [rbp - 0x40]
lea r8d, [rax + 0x40]
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18001584c
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1800157f2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800157ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800158b4
call fcn.1800ecd20
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x180015730
add r14, 0x14
cmp dword [r14], 0
jne 0x1800156f0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800eccc0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, str.kernel23
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.180111ab8
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180015897
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015892
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800158ae
call fcn.1800ecd20
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov al, 1
jmp 0x180015822
call fcn.18010e7e4
int3
call fcn.18010e7e4
int3