joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012070
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140012110
jmp 0x1400120ff
jae 0x1400121cf
cmp r8, 0x201
jae 0x140012110
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140012167
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14001213f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14002c020
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140012190
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001223b
mov r8d, r13d
cmp r12, r8
jne 0x1400120f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001226f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400120ff
jmp 0x140012110
cmp r14, r8
jb 0x140012289
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140014e50
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140012224
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140004360
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14001220f
jmp 0x140012224
lea rcx, str.internal_error:_entered_unreachable_code_rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002d3a0
jmp 0x14001229e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14002d750
ud2
Function at 0x14001ba20
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14001d310
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14001ba80
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.14001def0
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x14001ba8c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001bab6
test rdi, rdi
je 0x14001bae2
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140004360
xor eax, eax
jmp 0x14001ba83
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14001ba83
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140004360
jmp 0x14001ba80
xor eax, eax
jmp 0x14001ba83

Function at 0x14001c230
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1400315e8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14001c268
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001c2bf
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14001c2cc
xor edx, edx
xor eax, eax
jmp 0x14001c2f6
cmp eax, 0x103
je 0x14001c300
test eax, eax
js 0x14001c2df
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14001c2f6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140031648]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140014a30
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140010730
mov ecx, 7
int 0x29
ud2
Function at 0x14001c350
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1400315e8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14001c388
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001c3e6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001c413
test eax, eax
js 0x14001c3f2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14001c409
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140031648]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140014a30
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140010730
mov ecx, 7
int 0x29
ud2
Function at 0x1400299a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x140029a2a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140029a20
cmp r11, r10
ja 0x140029aa6
cmp r10, rdx
ja 0x140029ab8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140029a22
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140029a00
jmp 0x140029a87
ja 0x140029a2a
mov r11, r10
cmp rax, r8
jne 0x1400299c7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x140029a8b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140029a60
mov r8, r10
sub ecx, r9d
jns 0x140029a7e
jmp 0x140029a8d
cmp r10, rdx
je 0x140029a9a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140029a8d
xor al, 1
cmp r8, rdx
jne 0x140029a40
jmp 0x140029a8d
xor eax, eax
jmp 0x140029a8d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14002d260
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002d7c0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002d750
int3

Function at 0x14002b3e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b432
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b432
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b432
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b432
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b432
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002b434
xor al, al
add rsp, 0x28
ret
Function at 0x14076f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14076f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14076f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076f06f
add dl, dl
jne 0x14076f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076f0f6
xor eax, eax
add dl, dl
jne 0x14076f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076f1ad
add dl, dl
jne 0x14076f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14076f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14076f07e
mov eax, 1
add dl, dl
jne 0x14076f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076f0fb
sub eax, ebx
mov ebx, 1
jne 0x14076f14c
mov ecx, 1
add dl, dl
jne 0x14076f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14076f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14076f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14076f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076f15d
cmp eax, 0x7d00
jae 0x14076f19b
cmp eax, 0x500
jb 0x14076f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076f07e
cmp eax, 0x7f
ja 0x14076f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14076f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14076f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140132cbc
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
and edx, 0xaf12ea1
call rcx
jnp 0x1401330cd
rcl r14d, 0x84
rcr r14d, 0x9e
neg rdi
and r15d, 0x372aefbd
je 0x140132cf2
jne 0x140132cf2
push rdi
test r8d, 0xd285bff9
cmp r9, rdi
int3
jmp 0x140133001
and ecx, 0x23228e3d
popfq
lea r8d, [rcx - 0x5c48]
rcr ebp, 0xb5
rcl ebp, 0x55
jmp 0x140132c77
and byte [rax - 0x73], cl
push rsp
and al, 0x48
jmp 0x1401334c0
call r12
cmp eax, 0xc0000096
jne 0x1401330db
nop
jmp rcx

Function at 0x140133755
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xchg r10, r15
jmp 0x14013373f
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140133469
jmp 0x140133619
mov rax, qword [rax]
jmp 0x1401331b4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x5113dfaa
lea rdx, [r10 + r9*4]
jmp 0x1401335ea
mov r15, qword [rax + 0x30]
xchg r15, r10
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140133469
jne 0x140133768
je 0x140133768
bswap r10
int3
jmp 0x140133299
Function at 0x18001c610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001c644
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001c630
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x180028fb0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180028870
test al, al
je 0x18002922d
lea rcx, [0x1800ed880]
call fcn.180058bc0
test al, al
jne 0x180029078
lea rcx, [0x1800ed820]
call fcn.180058bc0
test al, al
je 0x180029015
call fcn.180058820
test al, al
sete al
jmp 0x18002905e
lea rcx, [0x1800ed940]
call fcn.180058bc0
test al, al
je 0x180029031
call fcn.180058870
test al, al
sete al
jmp 0x18002905e
lea rcx, [0x1800ed8e0]
call fcn.180058bc0
test al, al
je 0x180029064
lea rcx, [rsp + 0x90]
call fcn.180011960
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x180029078
call fcn.180058820
mov byte [rsp + 0x20], al
jmp 0x180029070
lea rcx, [0x1800ed9a0]
call fcn.180058bc0
test al, al
je 0x18002922d
lea rcx, [0x1800ed820]
call fcn.180058bc0
test al, al
je 0x180029093
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.180029270
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x1800290df
mov r8d, ebx
jmp 0x1800290ec
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x1800290e2
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800126e0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180072730
nop
cmp qword [rsp + 0x48], 8
jb 0x18002911f
mov rcx, qword [rsp + 0x30]
call fcn.18008c220
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180011b60
nop
call fcn.180048760
mov dl, 1
mov ecx, 0x2718
call fcn.18002aa00
lea rcx, [0x1800ed820]
call fcn.180058bc0
test al, al
je 0x18002917f
xor edx, edx
lea rcx, [0x180059ca0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x180059ca0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x180029196
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18002919e
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180049860
nop
cmp qword [rsp + 0xc8], 8
jb 0x1800291c5
mov rcx, qword [rsp + 0xb0]
call fcn.18008c220
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002922d
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18002922d
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18002922d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.180062800
mov rcx, qword [0x1800ed788]
test rcx, rcx
je 0x180029247
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800ae4e0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x180047170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5b3e
lea r8, [0x1800ef5e0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xf]
mov dword [rsp + 0x20], 0x5b505b7b
mov dword [rsp + 0x24], 0x5b4c5b5d
mov dword [rsp + 0x28], 0x5b4e5b47
mov dword [rsp + 0x2c], 0x5b735b4a
mov dword [rsp + 0x30], 0x5b4d5b5b
mov dword [rsp + 0x34], 0x5b5f5b4d
mov dword [rsp + 0x38], 0x5b5b5b59
mov qword [rsp + 0x3c], r9
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800585e0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ae4e0
add rsp, 0x130
pop rbp
ret

Function at 0x180047380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x4f4b
lea r8, [0x1800ef620]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xf]
mov dword [rsp + 0x20], 0x4f2e4f0f
mov dword [rsp + 0x24], 0x4f394f28
mov dword [rsp + 0x28], 0x4f3b4f32
mov dword [rsp + 0x2c], 0x4f064f3f
mov dword [rsp + 0x30], 0x4f384f2e
mov dword [rsp + 0x34], 0x4f2a4f38
mov dword [rsp + 0x38], 0x4f2e4f2c
mov qword [rsp + 0x3c], r9
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800585e0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ae4e0
add rsp, 0x130
pop rbp
ret
Function at 0x180047590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ef660]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x16]
mov r9d, 0x4358
mov dword [rsp + 0x20], 0x433d431c
mov dword [rsp + 0x24], 0x433d4334
mov dword [rsp + 0x28], 0x433d432c
mov dword [rsp + 0x2c], 0x433d430b
mov dword [rsp + 0x30], 0x432d433b
mov dword [rsp + 0x34], 0x4331432a
mov dword [rsp + 0x38], 0x4321432c
mov dword [rsp + 0x3c], 0x4337431b
mov dword [rsp + 0x40], 0x432c4336
mov dword [rsp + 0x44], 0x4320433d
mov qword [rsp + 0x48], 0x4358432c
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.1800585e0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ae4e0
add rsp, 0x130
pop rbp
ret
Function at 0x180058710
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x180058774
xor al, al
jmp 0x1800587f7
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180074400
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800587af
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1800587f3
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x1800587f3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x1800587f3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800ae4e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret