joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e4e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14007e4e8
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
mov r14, r8
xor ecx, ecx
mov rdi, rdx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rcx + rdi]
movabs rdx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rdx
cmp rcx, 8
jb 0x14007e512
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rsi, edx
mov rcx, qword [rax + rsi*8]
test rcx, rcx
je 0x14007e55c
mov rax, qword [rdi]
cmp qword [rcx + 8], rax
je 0x14007e55e
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14007e54e
xor ecx, ecx
test rcx, rcx
jne 0x14007e5ac
mov ecx, 0x18
call fcn.140002c52
mov qword [rsp + 0x30], rax
mov r8, rax
test rax, rax
je 0x14007e58e
and qword [rax], 0
mov rax, qword [rdi]
mov qword [r8 + 8], rax
mov rax, qword [r14]
mov qword [r8 + 0x10], rax
jmp 0x14007e591
xor r8d, r8d
mov rcx, qword [rbx + 8]
mov rax, r8
mov rdx, qword [rcx + rsi*8]
mov qword [r8], rdx
mov rcx, qword [rbx + 8]
mov qword [rcx + rsi*8], r8
inc dword [rbx + 4]
jmp 0x14007e5ae
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400975d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400975d4
mov qword [rsp + 8], rbx
xor r8d, r8d
mov r11, rdx
mov r10d, r8d
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [r10 + rdx]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x1400975ef
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x140097639
mov eax, dword [r11]
cmp dword [rdx + 8], eax
je 0x14009763c
mov rdx, qword [rdx]
test rdx, rdx
jne 0x14009762c
mov rdx, r8
mov rbx, qword [rsp + 8]
test rdx, rdx
setne al
ret

Function at 0x1400a3070
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400a3070
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140136ce0]
xor ecx, ecx
lea r8, [0x140136cd8]
lea rdx, str.FlsAlloc
call fcn.1400a2ad0
mov rbx, rax
test rax, rax
je 0x1400a30b0
mov rcx, rax
call fcn.140004ae3
mov rcx, rdi
call rbx
jmp 0x1400a30b6
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a3144
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400a3144
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140136d00]
mov ecx, 2
lea r8, [0x140136cf8]
lea rdx, str.FlsGetValue
call fcn.1400a2ad0
mov rdi, rax
test rax, rax
je 0x1400a3185
mov rcx, rax
call fcn.140004ae3
mov ecx, ebx
call rdi
jmp 0x1400a318d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a31b0
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400a31b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140136d10]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140136d08]
call fcn.1400a2ad0
mov rsi, rax
test rax, rax
je 0x1400a31fc
mov rcx, rax
call fcn.140004ae3
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1400a3207
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e37a4
Capabilities:
Create thread

Disassembly:
jmp 0x1400e37a4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
test r8, r8
jne 0x1400e37d4
call fcn.1400053e4
mov dword [rax], 0x16
call fcn.140007b26
xor eax, eax
jmp 0x1400e3854
mov rdx, r9
mov rcx, r8
call fcn.1400e3558
mov rbx, rax
test rax, rax
je 0x1400e3824
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400e32e4]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1400e3864
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006e6f
xor edi, edi
test rbx, rbx
je 0x1400e3851
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400e383a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400e3849
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140008bf7
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e3874
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
xor ebx, ebx
jmp 0x1400e3826
Function at 0x140107cc4
Capabilities:
Print debug messages

Disassembly:
jmp 0x140107cc4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.140005943
cmp eax, 2
sete dil
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140107d11
test rbx, rbx
je 0x140107d05
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test dil, dil
je 0x140107d48
mov eax, 4
jmp 0x140107d57
test dil, dil
je 0x140107d48
call fcn.140001c6c
test al, al
je 0x140107d48
call fcn.140008297
test al, al
jne 0x140107d3e
bts esi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, esi
call fcn.1400069a1
jmp 0x140107d57
call fcn.140003774
mov rcx, rax
jmp 0x140107d2e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140114af0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x1401733f0]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x140114b48
cmp word [rdx], r9w
jne 0x140114b48
or byte [rax + rdi + 0x38], 4
jmp 0x140114b4d
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x140114d03
lea rbp, [rdx + 2]
mov edx, 0xd
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x140114ce5
cmp ax, dx
je 0x140114b8f
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x140114c30
cmp rbp, r12
jae 0x140114bb5
cmp word [rbp], r9w
jne 0x140114bb0
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x140114c30
mov word [rbx], dx
jmp 0x140114b7e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x80]
add rsi, 2
add rbp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140114cc9
cmp dword [rsp + 0x90], 0
je 0x140114cc9
lea r10, [0x1401733f0]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x140114c7a
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x140114c3e
mov word [rbx], r9w
add rbx, 2
mov edx, 0xd
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x140114b69
jmp 0x140114d03
mov ecx, 0xd
mov word [rsp + 0x88], ax
mov word [rbx], cx
add rbx, 2
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x140114c54
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
jmp 0x140114c23
cmp word [rsp + 0x80], r9w
jne 0x140114c8a
cmp rbx, r14
je 0x140114c1b
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.1400097fa
mov r9d, 0xa
lea r10, [0x1401733f0]
cmp word [rsp + 0x80], r9w
je 0x140114c23
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x140114c28
mov edx, 0xd
lea r10, [0x1401733f0]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x140114c28
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
test al, 0x40
jne 0x140114cf9
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x140114d03
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, 2
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005d9b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f0ce8]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005da52
lea rcx, [0x1400f0ce0]
xor edx, edx
call fcn.140052240
mov eax, dword [0x1400f0cf8]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005da16
lea rcx, [0x1400f0cf0]
xor edx, edx
add rsp, 0x28
jmp fcn.140052240
lea rcx, [0x1400f0cf8]
call fcn.14005dc30
cmp dword [0x1400f0cf8], 0xffffffff
jne 0x14005da04
mov qword [0x1400f0cf0], 0
lea rcx, [0x1400f0cf0]
xor edx, edx
call fcn.140030c00
lea rcx, [0x1400f0cf8]
call fcn.14005dcc8
jmp 0x14005da04
lea rcx, [0x1400f0ce8]
call fcn.14005dc30
cmp dword [0x1400f0ce8], 0xffffffff
jne 0x14005d9d5
mov qword [0x1400f0ce0], 0
lea rcx, [0x1400f0ce0]
xor edx, edx
call fcn.140030c00
lea rcx, [0x1400f0ce8]
call fcn.14005dcc8
jmp 0x14005d9d5
Function at 0x14008e7e0
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x140029920

Function at 0x1400aae20
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14005dad8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400aae90]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140069e30
mov qword [rbx], rax
test rax, rax
je 0x1400aae77
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x401eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
test r8, r8
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
jne 0x401ee0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, dword [0x0044f360]
test ecx, ecx
jle 0x4020b7
mov rax, qword [0x0044f358]
xor ebp, ebp
nop word [rax + rax]
mov rdx, qword [rax + 8]
cmp rbx, rdx
jb 0x401f1d
mov r8, qword [rax + 0x10]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x402030
add ebp, 1
add rax, 0x18
cmp ebp, ecx
jne 0x401f00
mov rcx, rbx
call fcn.00402530
test rax, rax
mov r12, rax
je 0x4020be
movsxd rbp, ebp
lea r13, [rbp + rbp*2]
shl r13, 3
mov rbp, r13
add rbp, qword [0x0044f358]
mov qword [rbp + 0x10], rax
mov dword [rbp], 0
call fcn.00402620
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x50]
mov qword [rbp + 8], rax
mov rax, qword [0x0044f358]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r13 + 8]
call rbp
test rax, rax
je 0x4020cd
mov eax, dword [rsp + 0x74]
cmp eax, 4
jne 0x401ff0
add dword [0x0044f360], 1
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rbp
test rax, rax
je 0x4020ea
mov eax, dword [rsp + 0x44]
cmp eax, 4
jne 0x402040
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
cmp eax, 0x40
je 0x401fa0
mov r9, qword [0x0044f358]
mov r8d, 0x40
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add r9, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401fa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401e40
nop dword [rax]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x401fa7
cmp eax, 0x40
je 0x401fc9
lea r9, [rsp + 0x8c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x44]
cmp eax, 0x40
je 0x401ecd
cmp eax, 4
je 0x401ecd
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x8c]
mov rcx, qword [rsp + 0x20]
call rbp
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor ebp, ebp
jmp 0x401f28
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00401e40
mov rax, qword [0x0044f358]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r13 + 8]
call fcn.00401e40
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.00401e40
nop
nop

Function at 0x402410
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
je 0x402420
repz ret
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x402419
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x402aa0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0044f940]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0044f968]
test rbx, rbx
je 0x402af4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rdi
mov rbp, rax
call rsi
test eax, eax
jne 0x402aeb
test rbp, rbp
je 0x402aeb
mov rax, qword [rbx + 8]
mov rcx, rbp
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402ad0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x0044f940]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x180002b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x180014010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x88]
movss xmm0, dword [rax]
movss dword [rsp + 0x38], xmm0
mov rax, qword [rsp + 0x88]
movss xmm0, dword [rax + 4]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rsp + 0x88]
movss xmm0, dword [rax + 8]
movss dword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
add rax, 4
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
add rax, 8
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call fcn.180002b40
mov rcx, qword [rsp + 0x80]
call fcn.180002a80
mulss xmm0, dword [0x180011e38]
movss dword [rsp + 0x28], xmm0
mov rax, qword [rsp + 0x90]
movss xmm0, dword [rax]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
mulss xmm0, dword [rsp + 0x28]
mov rax, qword [rsp + 0x90]
movss dword [rax], xmm0
mov rcx, qword [rsp + 0x80]
call fcn.180002af0
mulss xmm0, dword [0x180011e38]
movss dword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x90]
movss xmm0, dword [rax + 4]
movss dword [rsp + 0x2c], xmm0
movss xmm0, dword [rsp + 0x2c]
mulss xmm0, dword [rsp + 0x30]
mov rax, qword [rsp + 0x90]
movss dword [rax + 4], xmm0
mov rax, qword [rsp + 0x90]
movss xmm0, dword [rax + 8]
mulss xmm0, dword [0x180011e40]
mov rax, qword [rsp + 0x90]
movss dword [rax + 8], xmm0
mov rax, qword [rsp + 0x90]
movss xmm0, dword [0x180011e40]
comiss xmm0, dword [rax + 8]
jbe 0x180002d49
mov rax, qword [rsp + 0x90]
movss xmm0, dword [rax]
comiss xmm0, dword [0x180011e34]
jbe 0x180002d49
mov rcx, qword [rsp + 0x80]
call fcn.180002a80
mov rax, qword [rsp + 0x90]
comiss xmm0, dword [rax]
jbe 0x180002d49
mov rax, qword [rsp + 0x90]
movss xmm0, dword [rax + 4]
comiss xmm0, dword [0x180011e34]
jbe 0x180002d49
mov rcx, qword [rsp + 0x80]
call fcn.180002af0
mov rax, qword [rsp + 0x90]
comiss xmm0, dword [rax + 4]
jbe 0x180002d49
mov dword [rsp + 0x20], 1
jmp 0x180002d51
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000b170
add rsp, 0x78
ret
Function at 0x18000bfd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18000c0d8
cmp qword [rsp + 0x38], 1
je 0x18000c011
jmp 0x18000c0dd
mov ecx, 0x20
call fcn.18000b190
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18000c05f
mov edx, 0x20
mov rcx, qword [rsp + 0x30]
call fcn.1800022d0
call fcn.180001b80
mov rcx, rax
call fcn.180001b40
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.180001880
mov qword [rsp + 0x40], rax
jmp 0x18000c068
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [0x180014998], rax
mov r8d, 4
lea rdx, [0x18000c0f0]
mov rcx, qword [0x180014998]
call fcn.180001990
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x70]
lea r8, [0x18000c1a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18000c0d6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000c0dd
call fcn.18000c170
mov eax, 1
add rsp, 0x68
ret
Function at 0x4137b0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x0046cf00]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x0046cff8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x413831
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x0046cff8]
jmp 0x41384d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x0046cff8], r11
mov qword [0x0046cf98], rax
mov rax, qword [0x0046b048]
mov qword [0x0046ce70], r11
mov qword [0x0046cf80], rdi
mov dword [0x0046ce60], 0xc0000409
mov dword [0x0046ce64], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x0046b040]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00454798]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x0046b048]
jne 0x4528a9
rol rcx, 0x10
test cx, 0xffff
jne 0x4528a5
ret
ror rcx, 0x10
jmp 0x4137b0

Function at 0x414010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub rsp, 0x48
cmp r8d, 1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov rdi, rdx
mov rbx, rcx
jge 0x414057
lea rax, str.Key_Length_should_be_at_least_1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.0042df90
lea rdx, [0x004693b8]
lea rcx, [rsp + 0x28]
call fcn.0042e260
int3
xor eax, eax
inc rcx
nop
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x414060
mov byte [rbx + 0x201], 0
mov byte [rbx + 0x202], 0
lea r10, [rbx + 1]
mov r11d, 0x100
nop
nop
nop
movzx eax, byte [rbx + 0x201]
mov qword [rbx + 0x208], r10
inc r10
movzx ecx, byte [rax + rdi]
add cl, byte [r10 - 1]
add byte [rbx + 0x202], cl
movzx eax, byte [rbx + 0x202]
lea rax, [rax + rbx + 1]
mov qword [rbx + 0x210], rax
movzx eax, byte [r10 - 1]
mov byte [rbx + 0x218], al
mov rax, qword [rbx + 0x210]
movzx ecx, byte [rax]
mov byte [r10 - 1], cl
movzx eax, byte [rbx + 0x218]
mov rcx, qword [rbx + 0x210]
mov byte [rcx], al
movzx eax, byte [rbx + 0x201]
inc eax
cdq
idiv r8d
dec r11
mov byte [rbx + 0x201], dl
jne 0x414090
lea rcx, [rbx + 0x101]
lea rdx, [rbx + 1]
mov r8d, 0x100
call fcn.0042a950
mov rdi, qword [rsp + 0x68]
mov byte [rbx + 0x201], 0
mov byte [rbx + 0x202], 0
mov byte [rbx], 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x4142c0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], eax
mov rax, rcx
ret
Function at 0x416220
Capabilities:
Get file size

Disassembly:
mov r11, rsp
sub rsp, 0x1b8
mov rax, qword [0x0046b048]
mov qword [rsp + 0x190], rax
mov rax, qword [0x00454b50]
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, rcx
lea rcx, [rsp + 0x60]
mov qword [r11 + 0x20], rsi
mov qword [rcx], rax
mov rax, qword [str.z5p6i7ea8p9n0]
mov qword [r11 - 8], rdi
mov qword [rcx + 8], rax
mov eax, dword [0x00454b60]
mov edx, 0x16
mov dword [rcx + 0x10], eax
movzx eax, word [0x00454b64]
mov qword [r11 - 0x10], r12
mov word [rcx + 0x14], ax
lea rcx, [rsp + 0x60]
call fcn.0040bde0
lea rdx, [rsp + 0x80]
mov r8d, 0x104
mov esi, dword [rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r12d, r12d
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 3]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.00421850
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x1c8]
sub edi, dword [rax + 0x10]
lea rax, [0x00453650]
mov qword [rsp + 0x48], r12
sub edi, esi
mov rsi, qword [rsp + 0x1d8]
mov dword [rsp + 0x50], r12d
sub edi, 0x10
test rcx, rcx
mov dword [rsp + 0x58], r12d
mov r12, qword [rsp + 0x1a8]
mov dword [rbp + 0xa8], edi
mov rdi, qword [rsp + 0x1b0]
mov rbp, qword [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
je 0x41635b
call fcn.0042a7a0
mov rcx, qword [rsp + 0x190]
call fcn.00452890
add rsp, 0x1b8
ret