joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006acb0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180199a80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x18006aeaa
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18006ae9e
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x18006ae30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x44], eax
jne 0x18006ae30
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x40], eax
je 0x18006ae30
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x18006ad99
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1801d6488]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x18006ad97
mov dword [rsp + 0x20], 0
jmp 0x18006ae4f
jmp 0x18006ae07
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x18006ae07
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801d6488]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18006adfa
mov dword [rsp + 0x20], 0
jmp 0x18006ae4f
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x40]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18006ad14
cmp dword [rsp + 0x20], 0
je 0x18006ae69
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18006ae69
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x18006ae9e
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x18006ae9e
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801d6488]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180123a40
add rsp, 0x68
ret
Function at 0x18006aed0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.18006acb0
test eax, eax
jne 0x18006af29
mov dword [rsp + 0x24], 9
jmp 0x18006afac
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18006afac
mov dword [rsp + 0x20], 0
jmp 0x18006af48
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18006afac
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18006afaa
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.18006ab00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x18006af3e
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x18006afc0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18006b051
mov dword [rsp + 0x20], 0
jmp 0x18006afe8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18006b039
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18006b037
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x18006afde
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801d6488]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x38
ret
Function at 0x18006b060
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x1801dd320]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18006b0ca
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18006b0f3
mov eax, 0xa
jmp 0x18006b226
cmp dword [rsp + 0x68], 0
je 0x18006b15e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18006b15c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x18006b1ac
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18006b18f
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
nop
jmp 0x18006b1ac
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
nop
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret
Function at 0x18006ba50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x18006bab1
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x18006bab1
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x18006bad9
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x1801dd318]
mov qword [rsp + 0x20], rax
jmp 0x18006bb04
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18006bb3e
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x18006bb24
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x18006bb26
jmp 0x18006baf7
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x18006bb3c
mov rax, qword [rsp + 0x20]
jmp 0x18006bcb0
jmp 0x18006baf7
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x18006bba7
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.18006b850
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18006bb7a
jmp 0x18006bba7
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18006bba5
jmp 0x18006bba7
jmp 0x18006bb4b
cmp qword [rsp + 0x20], 0
jne 0x18006bc18
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x18006bc18
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.18006b930
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18006bbeb
jmp 0x18006bc18
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18006bc16
jmp 0x18006bc18
jmp 0x18006bbbc
cmp qword [rsp + 0x20], 0
je 0x18006bcab
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x18006bc4b
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x1801dd318]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x1801dd318], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x18006c450
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18006c4a9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18006c4a9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18006c4a9
xor eax, eax
jmp 0x18006c4f0
mov dword [rsp], 1
jmp 0x18006c4ba
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x18006c4eb
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18006c4e9
xor eax, eax
jmp 0x18006c4f0
jmp 0x18006c4b2
mov eax, 1
add rsp, 0x18
ret
Function at 0x18007ef20
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x180134980]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x18007efae
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x18007ef52
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x18007efc0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x180134980]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x18007f0c4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x18007f0bf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x18007f094
cmp qword [rsp + 0x38], 2
jb 0x18007f094
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18007f094
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18007f094
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18007f007
jmp 0x18007f156
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x18007f156
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18007f12c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18007f12c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18007f12c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18007f0c4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1800ecc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov r8, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x38]
call fcn.1800e9e90
mov r8, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x40]
call fcn.1800e9e90
vmovss xmm0, dword [rsp + 0x3c]
vucomiss xmm0, dword [0x1801352b4]
je 0x1800ecce2
vmovss xmm0, dword [rsp + 0x44]
vdivss xmm0, xmm0, dword [rsp + 0x3c]
vmovss dword [rsp + 0x30], xmm0
jmp 0x1800eccec
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x30], xmm0
vmovss xmm0, dword [rsp + 0x38]
vucomiss xmm0, dword [0x1801352b4]
je 0x1800ecd10
vmovss xmm0, dword [rsp + 0x40]
vdivss xmm0, xmm0, dword [rsp + 0x38]
vmovss dword [rsp + 0x34], xmm0
jmp 0x1800ecd1a
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x34], xmm0
vmovss xmm2, dword [rsp + 0x30]
vmovss xmm1, dword [rsp + 0x34]
lea rcx, [rsp + 0x58]
call fcn.18001a620
movsxd rax, dword [rsp + 0xe8]
imul rax, rax, 0x14
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx + 0x28]
mov qword [rsp + 0x48], rax
movsxd rax, dword [rsp + 0xf0]
imul rax, rax, 0x14
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x118]
test eax, eax
je 0x1800ece7f
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x70]
call fcn.1800ea090
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x60]
call fcn.1800ea140
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x1800ecdc9
mov rax, qword [rsp + 0x20]
add rax, 0x14
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x1800ece7a
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x20]
vmovss xmm2, dword [rax + 4]
mov rax, qword [rsp + 0x20]
vmovss xmm1, dword [rax]
lea rcx, [rsp + 0x80]
call fcn.18001a620
mov r8, qword [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1800e9e90
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1800ea590
mov r8, rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x98]
call fcn.1800e9e30
mov qword [rsp + 0x78], rax
mov r9, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.1800ea1f0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
jmp 0x1800ecdbb
jmp 0x1800ecf1b
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
jmp 0x1800ece99
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x28], rax
jae 0x1800ecf1b
mov rax, qword [rsp + 0x28]
vmovss xmm2, dword [rax + 4]
mov rax, qword [rsp + 0x28]
vmovss xmm1, dword [rax]
lea rcx, [rsp + 0xa8]
call fcn.18001a620
mov r8, qword [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1800e9e90
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1800ea590
mov r8, rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xc0]
call fcn.1800e9e30
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
jmp 0x1800ece8b
add rsp, 0xd8
ret
Function at 0x180123808
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180123842
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180123847
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180123890
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18013eb50]
cmp byte [rcx + rax], 0
je 0x180123890
dec r8
sub rdx, 1
jne 0x180123876
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x100], rax
movsd xmm0, qword [0x140002260]
lea rsi, [0x140002290]
movzx eax, byte [0x140002268]
xor ebx, ebx
movsd qword [rsp + 0x20], xmm0
mov edi, ebx
mov byte [rsp + 0x28], al
nop dword [rax + rax]
mov eax, ebx
lea rcx, str.x_02x
and eax, 7
movzx eax, byte [rsp + rax + 0x20]
xor al, byte [rdi + rsi]
movzx edx, al
mov byte [rsp + rdi + 0x30], dl
call fcn.140001010
inc ebx
lea rdi, [rdi + 1]
cmp ebx, 0x145
jb 0x1400010c0
xor ecx, ecx
mov edx, 0xcd
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [rsp + 0x30]
mov r8, rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rax + 0x80]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax + 0x50], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rax + 0x60], xmm0
mov rax, qword [rcx + 0x40]
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm1
movups xmmword [rdx + 0x30], xmm0
mov qword [rdx + 0x40], rax
mov eax, dword [rcx + 0x48]
mov dword [rdx + 0x48], eax
movzx eax, byte [rcx + 0x4c]
mov byte [rdx + 0x4c], al
call r8
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400011d0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140001a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001adc
xor al, al
add rsp, 0x28
ret
Function at 0x1800c7dd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1800c7de0
test al, 1
je 0x1800c7dfb
test al, 2
jne 0x1800c7dfb
xor rax, 3
ret
ud2

Function at 0x1800ca400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800d2860
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1800d28aa
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.1800c79f0
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1800d28d5
mov eax, 1
jmp 0x1800d2a43
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.1800c79f0
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1800d2a0c
mov eax, 1
jmp 0x1800d2a43
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1800d292f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.180094f90
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.1800c79f0
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x1800d28a0
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1800d2a15
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x1800d2a5f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.1800dc2b0
mov r13, rdx
test rax, rax
je 0x1800d2a19
mov rcx, r13
call fcn.1800d2500
cmp al, 0xd
jne 0x1800d2a3e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x1800d29bc
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x1800d29a0
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800d2906
test rax, rax
je 0x1800d2906
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1800d29ee
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1800d28f0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.180094f90
jmp 0x1800d28f0
cmp al, 2
jne 0x1800d2a57
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x1800d2a43
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1800d2a2d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x1800d2a5f
cmp rax, rcx
ja 0x1800d2a5f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2