joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c7db
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.004b34e0
xorps xmm15, xmm15
mov r14, qword [0x00737998]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x51c6ea
nop dword [rax]
cmp rdx, 0x40
ja 0x51c7cd
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x51c659
mov rax, rdx
mov rcx, rsi
nop
call fcn.00469a20
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x51c6c1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0051cc00
xorps xmm15, xmm15
mov r14, qword [0x00737998]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x51c7c2
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x51c6f7
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x51c775
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.0051cc00
xorps xmm15, xmm15
mov r14, qword [0x00737998]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x51c7b8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x51c7b4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00469a20
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.00469120
mov rax, rdx
mov ecx, 0x40
call fcn.00469120
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00466d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0051c5a0
Function at 0x520980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x520b8b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x520aa4
cmp rdx, 0x40
ja 0x520b7d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x520a14
mov rax, rdx
mov rcx, rsi
call fcn.00469a20
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x520a80
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00520e00
xorps xmm15, xmm15
mov r14, qword [0x00737998]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x520b75
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x520aa7
mov r8, rcx
cmp r8, 0x40
jl 0x520b25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00520e00
xorps xmm15, xmm15
mov r14, qword [0x00737998]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x520b68
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x520b64
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00469a20
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.00469120
mov rax, rdx
mov ecx, 0x40
call fcn.00469120
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00466d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00520980
Function at 0x14098d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14098d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14098d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098d06f
add dl, dl
jne 0x14098d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098d0f6
xor eax, eax
add dl, dl
jne 0x14098d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098d1ad
add dl, dl
jne 0x14098d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14098d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14098d07e
mov eax, 1
add dl, dl
jne 0x14098d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098d0fb
sub eax, ebx
mov ebx, 1
jne 0x14098d14c
mov ecx, 1
add dl, dl
jne 0x14098d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14098d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14098d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14098d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098d15d
cmp eax, 0x7d00
jae 0x14098d19b
cmp eax, 0x500
jb 0x14098d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098d07e
cmp eax, 0x7f
ja 0x14098d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14098d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14098d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.1017f000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x180002700
Capabilities:
Create process on windows
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
jb 0x180002722
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r8, rdi
jb 0x18000272f
mov r8, qword [rcx]
mov ecx, 0x72
xor edx, edx
call fcn.180001020
lea ecx, [rdx + 0x75]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x74]
call fcn.180001020
lea ecx, [rdx + 0x6d]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x6c]
call fcn.180001020
lea ecx, [rdx + 0x5f]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x5e]
call fcn.180001020
lea ecx, [rdx + 0x70]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x6f]
call fcn.180001020
xor ecx, ecx
mov word [rsp + 0x38], ax
lea edx, [rcx + 5]
call fcn.180001020
lea edx, [rcx + 6]
mov word [rsp + 0x3a], ax
movzx ecx, word [0x18000776c]
call fcn.180001020
movzx ecx, word [0x18000776e]
mov edx, 7
mov word [rsp + 0x3c], ax
call fcn.180001020
movzx ecx, word [0x180007770]
mov edx, 8
mov word [rsp + 0x3e], ax
call fcn.180001020
movzx ecx, word [0x180007772]
mov edx, 9
mov word [rsp + 0x40], ax
call fcn.180001020
movzx ecx, word [0x180007774]
mov edx, 0xa
mov word [rsp + 0x42], ax
call fcn.180001020
mov word [rsp + 0x44], ax
mov r10d, 0x133
xor eax, eax
mov word [rsp + 0x46], ax
xor esi, esi
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r10 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0xb
jb 0x180002810
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov word [rsp + 0x46], si
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180002880
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18000287b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800028e9
mov rcx, r8
call fcn.180005e0c
mov word [rdi], si
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1800028ca
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1800028c5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800028e9
mov rcx, r8
call fcn.180005e0c
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800028f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18000a008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x180002921
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1800029c2
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180002994
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18000298f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002a4a
mov rcx, r8
call fcn.180005e0c
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180005a30
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x180002a07
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180002a03
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1800029fe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002a4a
mov rcx, r8
call fcn.180005e0c
xor al, al
jmp 0x180002996
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x41200
mov qword [rsp + 0x20], rbp
lea rdx, [0x18000c440]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x180002959
jmp 0x1800029cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180002a60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18000a008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x180002a91
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x180002b32
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180002b04
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180002aff
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002bba
mov rcx, r8
call fcn.180005e0c
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180005a30
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x180002b77
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180002b73
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180002b6e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002bba
mov rcx, r8
call fcn.180005e0c
xor al, al
jmp 0x180002b06
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2400
mov qword [rsp + 0x20], rbp
lea rdx, [0x18000a040]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x180002ac9
jmp 0x180002b3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180003fb0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rsi
mov rbp, rcx
mov rsi, r8
sub rbp, qword [r8 + 0x30]
je 0x180004137
test byte [r8 + 0x5e], 0x40
jne 0x180003fcf
xor eax, eax
pop rsi
pop rbp
ret
movzx eax, word [rsi + 0x14]
lea rdx, [rsi + 0x18]
mov r8d, dword [r8 + 0xb0]
add rdx, rax
movzx eax, word [rsi + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x180004137
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x180004008
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x180004019
add rdx, 0x28
cmp rdx, r9
jb 0x180003ff6
mov eax, 1
pop rsi
pop rbp
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r14
mov r14d, dword [rsi + 0xb4]
add rbx, r8
mov qword [rsp + 0x30], r15
lea r15, [0x18004d640]
add rbx, r15
add r14, rbx
test rbx, rbx
je 0x180004128
cmp rbx, r14
jae 0x180004128
mov qword [rsp + 0x20], rdi
nop dword [rax]
mov eax, dword [rbx + 4]
test eax, eax
je 0x180004123
add eax, 0xfffffff8
shr eax, 1
je 0x180004114
lea r11, [rbx + 8]
mov edi, eax
nop dword [rax]
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x1800040a2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x1800040ae
cmp ax, 0xa
jne 0x180004106
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x1800040fb
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x1800040e2
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x1800040ed
add rax, 0x28
cmp rax, r10
jb 0x1800040d0
jmp 0x1800040fb
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, r15
jne 0x1800040fe
mov rcx, r15
movzx eax, r8w
add qword [rax + rcx], rbp
add r11, 2
sub rdi, 1
jne 0x180004080
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r14
jb 0x180004060
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x30]
mov eax, 1
pop rsi
pop rbp
ret
Function at 0x180004f80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180004fb1
xor eax, eax
lea r8, [0x180004d00]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180005760
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.180001020
lea edx, [rcx - 0x5b]
mov word [rsp + 0x40], ax
call fcn.180001020
lea ecx, [rdx + 0x2d]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.180001020
lea ecx, [rdx + 0x5a]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.180001020
lea ecx, [rdx + 0x42]
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x41]
call fcn.180001020
lea ecx, [rdx + 0x45]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x44]
call fcn.180001020
lea ecx, [rdx + 0x4c]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4b]
call fcn.180001020
lea ecx, [rdx + 0x3e]
mov word [rsp + 0x4c], ax
lea edx, [rcx - 0x3d]
call fcn.180001020
lea ecx, [rdx + 0x4f]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x4e]
call fcn.180001020
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.180001020
lea edx, [rcx + 0xa]
mov word [rsp + 0x52], ax
movzx ecx, word [0x1800078a4]
call fcn.180001020
movzx ecx, word [0x1800078a6]
mov edx, 0xb
mov word [rsp + 0x54], ax
call fcn.180001020
movzx ecx, word [0x1800078a8]
mov edx, 0xc
mov word [rsp + 0x56], ax
call fcn.180001020
movzx ecx, word [0x1800078aa]
mov edx, 0xd
mov word [rsp + 0x58], ax
call fcn.180001020
movzx ecx, word [0x1800078ac]
mov edx, 0xe
mov word [rsp + 0x5a], ax
call fcn.180001020
movzx ecx, word [0x1800078ae]
mov edx, 0xf
mov word [rsp + 0x5c], ax
call fcn.180001020
movzx ecx, word [0x1800078b0]
mov edx, 0x10
mov word [rsp + 0x5e], ax
call fcn.180001020
movzx ecx, word [0x1800078b2]
mov edx, 0x11
mov word [rsp + 0x60], ax
call fcn.180001020
movzx ecx, word [0x1800078b4]
mov edx, 0x12
mov word [rsp + 0x62], ax
call fcn.180001020
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x1800058e0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
add rsp, 0x70
pop rbx
ret
Function at 0x1400113c0
Capabilities:
Terminate process

Disassembly:
jmp 0x14001f170
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret