joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180054950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], 0x3a
mov byte [rsp + 0x30], 0xc4
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0xe5
mov byte [rsp + 0x33], 0xb7
mov byte [rsp + 0x34], 0xd6
mov byte [rsp + 0x35], 0xc2
mov byte [rsp + 0x36], 0x85
mov byte [rsp + 0x37], 0x4e
mov byte [rsp + 0x38], 0xcb
mov byte [rsp + 0x39], 0x48
mov byte [rsp + 0x3a], 0xea
mov byte [rsp + 0x3b], 0xa0
mov byte [rsp + 0x3c], 0xd3
mov byte [rsp + 0x3d], 0xcc
mov byte [rsp + 0x3e], 0x84
mov byte [rsp + 0x3f], 0x44
mov byte [rsp + 0x40], 0xf1
mov byte [rsp + 0x41], 0x71
mov byte [rsp + 0x42], 0xdf
mov byte [rsp + 0x43], 0x94
mov byte [rsp + 0x44], 0xc8
mov byte [rsp + 0x45], 0xcd
mov byte [rsp + 0x46], 0x93
mov byte [rsp + 0x47], 0x44
mov byte [rsp + 0x48], 0xe0
mov byte [rsp + 0x49], 0x76
mov byte [rsp + 0x4a], 0xdf
mov byte [rsp + 0x4b], 0x80
mov byte [rsp + 0x4c], 0xd4
mov byte [rsp + 0x4d], 0xd1
mov byte [rsp + 0x4e], 0x85
mov byte [rsp + 0x4f], 0x4e
mov byte [rsp + 0x50], 0xf9
mov byte [rsp + 0x51], 0x71
mov byte [rsp + 0x52], 0xd5
mov byte [rsp + 0x53], 0xa6
mov byte [rsp + 0x54], 0xd3
mov byte [rsp + 0x55], 0xd0
mov byte [rsp + 0x56], 0x9e
mov byte [rsp + 0x57], 0x44
mov byte [rsp + 0x58], 0xf9
mov byte [rsp + 0x59], 0x59
mov byte [rsp + 0x5a], 0xd3
mov byte [rsp + 0x5b], 0xac
mov byte [rsp + 0x5c], 0xcd
mov byte [rsp + 0x5d], 0xca
mov byte [rsp + 0x5e], 0x94
mov byte [rsp + 0x5f], 0x42
mov byte [rsp + 0x60], 0xf2
mov byte [rsp + 0x61], 0x76
mov byte [rsp + 0x62], 0xdf
mov byte [rsp + 0x63], 0x90
mov byte [rsp + 0x64], 0xd8
mov byte [rsp + 0x65], 0xd0
mov byte [rsp + 0x66], 0x83
mov byte [rsp + 0x67], 0x4e
mov byte [rsp + 0x68], 0xfa
mov byte [rsp + 0x69], 5
mov eax, 0x1380
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x180054b33
mov eax, 0x1380
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x18086947c]
mov rcx, qword gs:[0x58]
mov edx, 0x1380
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x710
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180006a00
lea rcx, [0x180063950]
call fcn.180015b60
nop
mov eax, 0x710
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180015a20
add rsp, 0x88
ret
Function at 0x180054ce0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], 0x3a
mov byte [rsp + 0x30], 0x1e
mov byte [rsp + 0x31], 0x18
mov byte [rsp + 0x32], 0x49
mov byte [rsp + 0x33], 0xaf
mov byte [rsp + 0x34], 0xe6
mov byte [rsp + 0x35], 0x7e
mov byte [rsp + 0x36], 0x7f
mov byte [rsp + 0x37], 0x60
mov byte [rsp + 0x38], 0x11
mov byte [rsp + 0x39], 0x3a
mov byte [rsp + 0x3a], 0x46
mov byte [rsp + 0x3b], 0xb8
mov byte [rsp + 0x3c], 0xe3
mov byte [rsp + 0x3d], 0x70
mov byte [rsp + 0x3e], 0x7e
mov byte [rsp + 0x3f], 0x6a
mov byte [rsp + 0x40], 0x2b
mov byte [rsp + 0x41], 3
mov byte [rsp + 0x42], 0x73
mov byte [rsp + 0x43], 0x8c
mov byte [rsp + 0x44], 0xf8
mov byte [rsp + 0x45], 0x71
mov byte [rsp + 0x46], 0x69
mov byte [rsp + 0x47], 0x6a
mov byte [rsp + 0x48], 0x3a
mov byte [rsp + 0x49], 4
mov byte [rsp + 0x4a], 0x73
mov byte [rsp + 0x4b], 0x98
mov byte [rsp + 0x4c], 0xe4
mov byte [rsp + 0x4d], 0x6d
mov byte [rsp + 0x4e], 0x7f
mov byte [rsp + 0x4f], 0x60
mov byte [rsp + 0x50], 0x23
mov byte [rsp + 0x51], 3
mov byte [rsp + 0x52], 0x79
mov byte [rsp + 0x53], 0xbe
mov byte [rsp + 0x54], 0xe3
mov byte [rsp + 0x55], 0x6c
mov byte [rsp + 0x56], 0x64
mov byte [rsp + 0x57], 0x6a
mov byte [rsp + 0x58], 0x23
mov byte [rsp + 0x59], 0x2b
mov byte [rsp + 0x5a], 0x7f
mov byte [rsp + 0x5b], 0xb4
mov byte [rsp + 0x5c], 0xfd
mov byte [rsp + 0x5d], 0x76
mov byte [rsp + 0x5e], 0x6e
mov byte [rsp + 0x5f], 0x6c
mov byte [rsp + 0x60], 0x28
mov byte [rsp + 0x61], 4
mov byte [rsp + 0x62], 0x73
mov byte [rsp + 0x63], 0x88
mov byte [rsp + 0x64], 0xe8
mov byte [rsp + 0x65], 0x6c
mov byte [rsp + 0x66], 0x79
mov byte [rsp + 0x67], 0x60
mov byte [rsp + 0x68], 0x20
mov byte [rsp + 0x69], 0x77
mov eax, 0xc14
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x180054ec3
mov eax, 0xc14
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x18086947c]
mov rcx, qword gs:[0x58]
mov edx, 0xc14
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xa30
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180006a00
lea rcx, [0x1800639b0]
call fcn.180015b60
nop
mov eax, 0xa30
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180015a20
add rsp, 0x88
ret
Function at 0x180054f00
Capabilities:
Lock the desktop
Query or enumerate registry value

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x60
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 4
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.180054ce0
mov rcx, rax
call fcn.180006a90
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x180054fbb
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x41]
call fcn.180054b70
mov rcx, rax
call fcn.180006a70
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180055066
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x42]
call fcn.180054950
mov rcx, rax
call fcn.1800069a0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180055066
lea rax, [rsp + 0x43]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x43]
call fcn.1800547e0
mov rcx, rax
call fcn.180006980
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x48], 0
jne 0x18005507d
call qword [sym.imp.USER32.dll_LockWorkStation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1800550d0
cmp dword [rsp + 0x70], 0
je 0x1800550c5
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x44]
call fcn.1800546c0
mov rcx, rax
call fcn.180006960
mov rdx, rax
lea rcx, [0x1808690b0]
call fcn.1800114a0
lea rdx, [0x1800117f0]
mov rcx, rax
call fcn.180008b00
mov ecx, 0x3f0
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x60
pop rdi
ret
Function at 0x1800568a0
Capabilities:
Open clipboard

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800568bc
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x28
ret
Function at 0x1800572e0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x180057319
mov eax, dword [rsp + 0x30]
jmp 0x180057476
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1800676c0]
mov r8d, 1
xor edx, edx
lea rcx, [0x1800676d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x180057353
mov eax, dword [rsp + 0x30]
jmp 0x180057476
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
lea r8, [rsp + 0x48]
lea rdx, [0x1800676a0]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x180057382
mov eax, dword [rsp + 0x30]
jmp 0x180057476
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
lea r8, [rsp + 0x50]
lea rdx, [0x1800676b0]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1800573b1
mov eax, dword [rsp + 0x30]
jmp 0x180057476
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x60]
call qword [rax + 0x68]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1800573f4
mov eax, dword [rsp + 0x30]
jmp 0x180057476
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x180057436
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
lea r8, [rsp + 0x34]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x48]
jmp 0x18005743c
mov eax, dword [rsp + 0x30]
jmp 0x180057476
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x34]
add rsp, 0x78
ret
Function at 0x1800575c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0x10
mov byte [rsp + 0x30], 0x4f
mov byte [rsp + 0x31], 0x77
mov byte [rsp + 0x32], 0x7c
mov byte [rsp + 0x33], 0xec
mov byte [rsp + 0x34], 0xd
mov byte [rsp + 0x35], 0x1e
mov byte [rsp + 0x36], 0x30
mov byte [rsp + 0x37], 0x45
mov byte [rsp + 0x38], 0x76
mov byte [rsp + 0x39], 0x7a
mov byte [rsp + 0x3a], 0x3d
mov byte [rsp + 0x3b], 0xc2
mov byte [rsp + 0x3c], 0x4c
mov byte [rsp + 0x3d], 0x3a
mov byte [rsp + 0x3e], 0x21
mov byte [rsp + 0x3f], 0x21
mov eax, 0x49c
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800576ce
mov eax, 0x49c
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x18086947c]
mov rcx, qword gs:[0x58]
mov edx, 0x49c
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x12c8
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180004450
lea rcx, [0x180063620]
call fcn.180015b60
nop
mov eax, 0x12c8
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180015a20
add rsp, 0x58
ret
Function at 0x180057830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0x1d
mov byte [rsp + 0x30], 0xe9
mov byte [rsp + 0x31], 0x43
mov byte [rsp + 0x32], 0x8b
mov byte [rsp + 0x33], 0x14
mov byte [rsp + 0x34], 5
mov byte [rsp + 0x35], 0x46
mov byte [rsp + 0x36], 0x53
mov byte [rsp + 0x37], 0x46
mov byte [rsp + 0x38], 0x9b
mov byte [rsp + 0x39], 0x26
mov byte [rsp + 0x3a], 0x98
mov byte [rsp + 0x3b], 0x3b
mov byte [rsp + 0x3c], 0x1c
mov byte [rsp + 0x3d], 0x47
mov byte [rsp + 0x3e], 0x16
mov byte [rsp + 0x3f], 0x64
mov byte [rsp + 0x40], 0xeb
mov byte [rsp + 0x41], 0x22
mov byte [rsp + 0x42], 0xb3
mov byte [rsp + 0x43], 4
mov byte [rsp + 0x44], 0x14
mov byte [rsp + 0x45], 0x50
mov byte [rsp + 0x46], 0x53
mov byte [rsp + 0x47], 0x46
mov byte [rsp + 0x48], 0xae
mov byte [rsp + 0x49], 7
mov byte [rsp + 0x4a], 0xb6
mov byte [rsp + 0x4b], 0xc
mov byte [rsp + 0x4c], 0x75
mov eax, 0xbec
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18005797f
mov eax, 0xbec
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x18086947c]
mov rcx, qword gs:[0x58]
mov edx, 0xbec
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xd88
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180008260
lea rcx, [0x180063680]
call fcn.180015b60
nop
mov eax, 0xd88
mov eax, eax
mov ecx, dword [0x18086947c]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180015a20
add rsp, 0x68
ret

Function at 0x180057d20
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
add rsp, 0x38
ret
Function at 0x180058f80
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.18005a2e0
mov dword [rsp + 0x70], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18005a2e0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180059054
cmp dword [rsp + 0x100], 0
je 0x18005902e
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
add rsp, 0xe8
ret

Function at 0x1800590c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x70]
call fcn.1800090c0
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x1800591de
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
je 0x1800591d3
mov eax, dword [rsp + 0x40]
inc eax
mov eax, eax
mov ecx, eax
call fcn.180015a84
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800591bf
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x58], eax
jne 0x1800591bf
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax], 0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.180008e20
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.180015a40
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.180008f00
mov eax, dword [rsp + 0x44]
or eax, 1
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x70]
call fcn.180008e50
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180015a20
add rsp, 0xa8
ret
Function at 0x14005c490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005c49d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005c4ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14005c495
lea eax, [rcx + 1]
jmp 0x14005c4bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005c4ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14005c4b4
sub eax, 3
jb 0x14005c4ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005c53d
sar eax, 1
movsxd rbp, eax
jb 0x14005c524
jmp 0x14005c4fc
add ebx, ebx
jne 0x14005c4fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005c524
inc ecx
add ebx, ebx
jne 0x14005c50a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005c524
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14005c51d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005c50c
add ecx, 2
jmp 0x14005c529
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14005c452
jmp 0x14005c49d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x49000
mov dl, 0xb
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14005c589
cmp rsi, rcx
jae 0x14005c591
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14005c570
cmp al, 0x8f
ja 0x14005c570
cmp byte [rsi - 2], 0xf
je 0x14005c576
sub al, 0xe8
cmp al, 1
ja 0x14005c55a
cmp rsi, rcx
jae 0x14005c591
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14005c560
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005c591
lodsb al, byte [rsi]
jmp 0x14005c570
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5a000]
mov eax, dword [rdi]
or eax, eax
je 0x14005c5fa
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5c774]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005c59e
jns 0x14005c5d3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14005c5dd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14005c5f4
mov qword [rbx], rax
add rbx, 8
jmp 0x14005c5be
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005c634
cmp al, 0xef
ja 0x14005c626
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14005c606
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14005c615
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005c688
sub rsp, 0xffffffffffffff80
jmp 0x1400076b6
Function at 0x180001760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x1800018f1
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x1800018f1
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x1800017fb
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180001918
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180001812
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x180001812
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180001825
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x180001872
mov r9d, eax
cmp eax, 0x800
jae 0x18000183f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x180001872
cmp eax, 0x10000
jae 0x180001859
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x180001872
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x1800018f1
add qword [r14], 2
test sil, sil
jne 0x180001893
cmp r10d, 3
jae 0x18000189f
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x1800018ce
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x1800018b0
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x1800017af
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x1800018ff