joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400512d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r12, r9
mov rcx, r8
mov r14, rdx
call fcn.1400165f0
mov r8d, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x20]
add rcx, 0x18
mov r15d, eax
lea r9d, [r8 + r8]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
je 0x140051476
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x58], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x60], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x140051360
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x1400513c2
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x50], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x140051380
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x140051403
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x140061e59]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140061e5a]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400513d0
mov rcx, qword [rsp + 0x70]
call fcn.1400165f0
mov r9, qword [rbx]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, r12
call qword [r9 + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbx]
test rdi, rdi
jne 0x140051432
mov edi, dword [rsi + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov r8d, dword [rsi + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rsi + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [fcn.140053702]
mov rdi, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov eax, reloc.WLDAP32.dll_Ordinal_27
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x1400515a0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006e700]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_26
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400515ec
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1400516be
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140051630
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x1400516be
mov rcx, rbp
call fcn.1400165f0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14005169a
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400516aa
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400516bc
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052620
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140052470
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1400524d5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x140052480
ret

Function at 0x1400529f8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400531c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140053212
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140053212
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140053212
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140053212
cmp dword [rcx + 0x84], 0xe
jbe 0x140053212
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140053214
xor al, al
add rsp, 0x28
ret
Function at 0x14016f6e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14016f70d
xor al, al
jmp 0x14016f86f
mov rax, qword [0x1401906c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401906c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401906d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401906d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401906e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401906e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401906f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401906f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140190700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14016f861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14016f7b9
mov r11d, 2
jmp 0x14016f7dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14016f7d3
mov r11d, 1
jmp 0x14016f7dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14016f885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14016f822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14016f83a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14016f84a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14016f858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14016f7a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14016f86a
Function at 0x180001000
Capabilities:
Compute adler32 checksum

Disassembly:
mov r9d, ecx
mov r10, rdx
shr r9d, 0x10
movzx ecx, cx
cmp r8, 1
jne 0x180001044
movzx edx, byte [rdx]
add edx, ecx
cmp edx, 0xfff1
lea r8d, [rdx - 0xfff1]
cmovb r8d, edx
lea eax, [r8 + r9]
cmp eax, 0xfff1
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, r8d
mov eax, ecx
ret
test rdx, rdx
jne 0x18000104d
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x18000109c
test r8, r8
je 0x180001073
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x180001060
cmp ecx, 0xfff1
lea r8d, [rcx - 0xfff1]
mov eax, 0x80078071
cmovb r8d, ecx
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
ret
cmp r8, 0x15b0
jb 0x180001177
mov r11, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 0xc
imul rax, r11, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
add edx, 0xffffffff
jne 0x1800010e0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
sub r11, 1
jne 0x1800010d0
test r8, r8
je 0x180001229
cmp r8, 8
jb 0x1800011f0
mov rdx, r8
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
sub rdx, 1
jne 0x180001190
test r8, r8
je 0x180001203
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x1800011f0
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
shl r9d, 0x10
or r9d, ecx
mov eax, r9d
ret
Function at 0x1800016e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x1800016f6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x1800511f0]
not ecx
test r8d, r8d
je 0x180001729
test r9b, 3
je 0x180001729
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc r9
xor ecx, dword [rbx + rax*4]
sub r10, 1
jne 0x180001708
cmp r10, 4
jb 0x180001786
mov r11, r10
shr r11, 2
imul rax, r11, 0xfffffffffffffffc
add r10, rax
nop dword [rax]
xor ecx, dword [r9]
add r9, 4
mov r8d, ecx
mov eax, ecx
shr rax, 0x10
movzx ecx, al
mov eax, r8d
shr rax, 8
movzx edx, al
mov eax, r8d
shr rax, 0x18
mov ecx, dword [rbx + rcx*4 + 0x400]
xor ecx, dword [rbx + rdx*4 + 0x800]
xor ecx, dword [rbx + rax*4]
movzx eax, r8b
xor ecx, dword [rbx + rax*4 + 0xc00]
sub r11, 1
jne 0x180001740
test r10, r10
je 0x1800017ac
nop dword [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [rbx + rax*4]
sub r10, 1
jne 0x180001790
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x18000a1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x18000a923
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18000a207
jmp 0x18000a935
call fcn.18000b1d3
mov dword [rsp + 0x84], eax
jmp 0x18000a947
xor eax, eax
jmp 0x18000a623
mov qword [rsp + 0x40], 0
jmp 0x18000a981
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jne 0x18000a3de
jmp 0x18000a3d7
mov eax, dword [rsp + 0x48]
inc eax
jmp 0x18000a630
mov dword [rsp + 0xa8], 0x726774c
mov dword [rsp + 0xac], 0xe553a458
jmp 0x18000a5a3
movsxd rax, dword [rsp + 0x48]
mov ecx, dword [rsp + rax*4 + 0xa8]
cmp si, si
cmp esi, esi
je 0x18000a594
call fcn.18000acb7
movsxd rcx, dword [rsp + 0x48]
jmp 0x18000a640
mov dword [rsp + 0xb0], 0xc38ae110
mov dword [rsp + 0x48], 0
jmp 0x18000a634
imul rax, rax, 0
mov rax, qword [rsp + rax + 0x138]
jmp 0x18000a5d9
imul rax, rax, 1
mov rax, qword [rsp + rax + 0x138]
jmp 0x18000a5eb
mov qword [rsp + 0xd0], rax
mov eax, 8
cmp ax, ax
je 0x18000a5cb
mov qword [rsp + 0xb8], rax
mov eax, 8
jmp 0x18000a55a
add eax, dword [rcx + 0x20]
mov dword [rsp + 0x78], eax
cmp si, si
je 0x18000a56b
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 3
jge 0x18000a64d
jmp 0x18000a583
mov qword [rsp + rcx*8 + 0x138], rax
jmp 0x18000a4ba
mov eax, 8
jmp 0x18000a5bd
add rcx, rax
mov rax, rcx
jmp 0x18000a87e
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x30]
jmp 0x18000a8c1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp cx, cx
je 0x18000a8ac
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x30]
cmp cx, cx
je 0x18000a8b7
add eax, dword [rcx + 0x10]
mov rcx, qword [rsp + 0x30]
jmp 0x18000a5fd
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
cmp bl, bl
je 0x18000a8ce
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x30]
jmp 0x18000a89f
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x40]
cmp sp, sp
je 0x18000a8d6
add rcx, rax
mov rax, rcx
jmp 0x18000a86f
add rcx, rax
mov rax, rcx
jmp 0x18000a88d
mov rcx, qword [rsp + 0x90]
call fcn.18000b0ed
jmp 0x18000a1f5
lea rcx, [rsp + 0x160]
call fcn.18000aa0d
jmp 0x18000a3ec
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
jmp 0x18000a975
push rsi
push rdi
cmp al, al
je 0x18000a958
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x40], rax
jmp 0x18000a207
mov eax, dword [rsp + 0x84]
mov rcx, qword [rsp + 0x40]
jmp 0x18000a867
sub rsp, 0x1b8
mov edx, 0x19
jmp 0x18000a911
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x40]
jmp 0x18000a8ff
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
jmp 0x18000a92f
mov qword [rsp + 0x90], 0
lea rax, [fcn.18000b1d3]
jmp 0x18000a966

Function at 0x18000a2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp bp, bp
je 0x18000a319
mov rdx, qword [rsp + 0x30]
mov edx, dword [rdx + 8]
cmp al, al
je 0x18000a321
add rdx, rcx
mov rcx, rdx
jmp 0x18000a2f5
mov r8, qword [rsp + 0x50]
add r8, rdx
jmp 0x18000a345
mov rdx, r8
mov r8, qword [rsp + 0x30]
cmp di, di
Function at 0x18000a350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x38], eax
jae 0x18000a227
jmp 0x18000a67a
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xf8], rax
jmp 0x18000a657
inc eax
mov dword [rsp + 0x38], eax
jmp 0x18000a218
mov r8d, dword [r8 + 0x10]
add rdx, r8
cmp al, al
je 0x18000a338
mov rdx, rcx
mov rax, qword [rsp + 0xc8]
jmp 0x18000a32b
mov rcx, rax
call fcn.18000b342
jmp 0x18000a60d
mov qword [rsp + 0xc8], rdx
mov r8d, eax
jmp 0x18000a30c
je 0x18000a301
mov dword [rsp + 0x38], 0
jmp 0x18000a218
mov eax, dword [rsp + 0x38]
jmp 0x18000a2dd
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 8]
jmp 0x18000a7f9
mov rax, rcx
mov ecx, 4
cmp sp, sp
je 0x18000a6ca
movsxd rcx, dword [rsp + 0x38]
xor edx, edx
jmp 0x18000a664
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
cmp dh, dh
je 0x18000a6ba
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
jmp 0x18000a61a
mov eax, ecx
movsxd rcx, dword [rsp + 0x38]
jmp 0x18000a688
mov ecx, dword [rsp + 0x88]
xor ecx, eax
jmp 0x18000a697
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax + 0x2c]
cmp dx, dx
je 0x18000a6a0
movzx eax, byte [rcx + rax]
mov dword [rsp + 0x88], eax
cmp cx, cx
je 0x18000a671
div rcx
mov rax, rdx
jmp 0x18000a6ab
Function at 0x18000acb7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x18000ae58
mov dword [rsp + 8], ecx
sub rsp, 0xa8
jmp 0x18000ae7f
mov qword [rsp + 0x60], 0
mov rax, qword gs:[0x60]
cmp ax, ax
je 0x18000ae31
Function at 0x18000bfa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [r8 + 0x180]
mov r10, rcx
mov dword [rsp + 0x10], 0x3020100
mov rbx, r8
mov ecx, dword [rsp + 0x10]
mov r9d, 1
mov dword [r8 + 0x188], ecx
nop dword [rax + rax]
mov eax, r9d
add ecx, 0x4040404
inc r9d
mov dword [r8 + rax*4 + 0x188], ecx
cmp r9d, r11d
jbe 0x18000bfd0
xor r8d, r8d
test edx, edx
je 0x18000c041
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10]
or r8d, eax
movzx ecx, byte [rax + rbx + 0x188]
mov byte [r10], cl
mov byte [rbx + 0x187], cl
nop dword [rax + rax]
movzx ecx, byte [rax + rbx + 0x187]
mov rdx, rax
sub rax, 1
mov byte [rdx + rbx + 0x188], cl
jns 0x18000c020
inc r10
sub r9, 1
jne 0x18000c000
shr r8d, 2
mov dword [rbx + 0x180], r8d
mov rbx, qword [rsp + 8]
ret
Function at 0x18003d810
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rcx
cmp r8, 0x20
jb 0x18003d9c0
mov r10d, dword [rcx + 0x1c]
movzx edx, byte [r9]
inc edx
movzx eax, byte [r9 + 1]
imul edx, r10d
inc eax
movzx r8d, byte [r9 + 2]
movzx ecx, byte [r9 + 3]
inc r8d
inc ecx
add edx, eax
imul edx, r10d
add r8d, edx
movzx edx, byte [r9 + 4]
inc edx
imul r8d, r10d
add ecx, r8d
imul ecx, r10d
add edx, ecx
movzx ecx, byte [r9 + 5]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 6]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 7]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 8]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 9]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0xa]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0xb]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0xc]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0xd]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0xe]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0xf]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x10]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x11]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x12]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x13]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x14]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x15]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x16]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x17]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x18]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x19]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x1a]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x1b]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x1c]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x1d]
imul edx, r10d
inc ecx
add ecx, edx
movzx edx, byte [r9 + 0x1e]
imul ecx, r10d
inc edx
add edx, ecx
movzx ecx, byte [r9 + 0x1f]
imul edx, r10d
inc ecx
add ecx, edx
mov dword [r11], ecx
ret
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r9d, r9d
mov rbx, r8
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
xor edi, edi
lea rax, [rsp + 0x90]
sub rbx, rax
lea rcx, [rsp + 0x90]
mov edx, 0x105
mov r9d, edi
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x140001073
movzx eax, word [rbx + rcx]
test ax, ax
je 0x140001073
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140001051
test rdx, rdx
jne 0x140001082
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], di
test r9d, r9d
js 0x140001172
lea rbx, [rsp + 0x90]
cmp word [rsp + 0x90], di
je 0x1400010b8
cmp word [rbx], 0x3a
je 0x1400010b1
add rbx, 2
cmp word [rbx], di
jne 0x1400010a0
jmp 0x1400010b8
mov word [rbx], di
add rbx, 2
cmp word [rbx], di
je 0x1400010d6
lea rdx, str._ProcessID
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x1400010de
lea rbx, [rsp + 0x90]
lea rax, [rsp + 0x30]
mov edx, 0x29
sub rbx, rax
lea rcx, [rsp + 0x30]
mov r8d, edi
lea rax, [rdx + 0x7fffffd5]
test rax, rax
je 0x140001115
movzx eax, word [rbx + rcx]
test ax, ax
je 0x140001115
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400010f3
test rdx, rdx
jne 0x140001124
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], di
test r8d, r8d
js 0x140001172
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_IIDFromString]
test eax, eax
js 0x140001172
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
js 0x140001172
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_com_private_l1_1_0.dll_CoRegisterSurrogateEx]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140001470
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2b0
pop rdi
ret
Function at 0x140001b1c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140004620], eax
call fcn.140001860
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140004620], 0
jne case.default.0x140001b72
mov ecx, 1
call fcn.140001860
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
xchg ebp, eax
adc dword [rax], eax
add al, ah
add byte es:[rax], al
movabs al, byte [0xf8000011bd000011]
add byte es:[rax], al
rcl byte [rcx]
add byte [rax], al
in eax, dx
adc dword [rax], eax
add al, bh
add byte es:[rax], al
lock adc dword [rax], eax
add byte [rbx + 0x34000012], bl
invalid