joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800013d0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x490
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, rcx
xor edi, edi
lea rcx, [0x18001e030]
call fcn.180006440
mov r9, rbx
lea rcx, [rsp + 0x270]
mov r8, rax
mov edx, 0x104
mov rsi, rax
call fcn.180001370
test rsi, rsi
je 0x180001441
mov r8d, dword [rsi - 8]
lea rcx, [rsi - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rsi - 8]
call fcn.180005280
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001542
lea rcx, [0x18001e048]
mov qword [rsp + 0x4a8], rbp
call fcn.180006440
lea rcx, [0x18001e058]
mov rbp, rax
call fcn.180006440
mov rbx, rax
test byte [rsp + 0x20], 0x10
je 0x1800014db
lea rax, [rsp + 0x4c]
mov r8, rbp
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800014b4
add rax, 2
test ecx, ecx
jne 0x1800014a0
test edx, edx
je 0x1800014dd
lea rax, [rsp + 0x4c]
mov r8, rbx
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800014d7
add rax, 2
test ecx, ecx
jne 0x1800014c3
test edx, edx
je 0x1800014dd
inc edi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180001487
test rbx, rbx
je 0x180001510
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
test rbp, rbp
je 0x180001531
mov r8d, dword [rbp - 8]
lea rcx, [rbp - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbp - 8]
call fcn.180005280
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0x4a8]
mov eax, edi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180006c40
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180001570
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x258
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1800015cb
lea rcx, [rsp + 0x30]
call fcn.1800013d0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180006c40
add rsp, 0x258
ret
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180006c40
add rsp, 0x258
ret
Function at 0x1800015f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x298], r14
lea rcx, [0x18001e070]
xor r14d, r14d
mov edi, r14d
call fcn.180006440
mov rbp, rax
mov r9d, 0x108
lea rax, [rsp + 0x48]
mov rdx, rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001787
lea rcx, [0x18001e0e0]
mov qword [rsp + 0x290], rsi
call fcn.180006440
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov rsi, rax
mov qword [rsp + 0x20], r14
mov ebx, r14d
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180001753
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001716
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000170b
inc edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r14
inc ebx
mov qword [rsp + 0x28], r14
mov edx, ebx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800016c0
test rsi, rsi
je 0x180001774
mov r8d, dword [rsi - 8]
lea rcx, [rsi - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rsi - 8]
call fcn.180005280
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
test rbp, rbp
je 0x1800017b0
mov r8d, dword [rbp - 8]
lea rcx, [rbp - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbp - 8]
call fcn.180005280
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180006c40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800017e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rcx, [0x18001e100]
call fcn.180006440
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rbx, rbx
je 0x180001826
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
lea rcx, [0x18001e130]
call fcn.1800062d0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rbx, rbx
je 0x180001865
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
lea rcx, [rsp + 0x20]
test rdi, rdi
je 0x180001880
call rdi
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180001d60
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x180001e23
cmp dword [rsp + 0x30], 1
jle 0x180001e23
lea rcx, [0x18001e2c0]
mov qword [rsp + 0x38], rsi
call fcn.180006440
mov esi, dword [rsp + 0x30]
mov r9d, 1
mov r11, rax
cmp esi, r9d
jle 0x180001dfb
lea r10, [rbx + 8]
nop
mov rax, qword [r10]
mov r8, r11
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180001de4
add rax, 2
test ecx, ecx
jne 0x180001dd0
test edx, edx
je 0x180001df6
inc r9d
add r10, 8
cmp r9d, esi
jl 0x180001dc0
jmp 0x180001dfb
mov edi, 1
mov rsi, qword [rsp + 0x38]
test r11, r11
je 0x180001e23
mov r8d, dword [r11 - 8]
lea rbx, [r11 - 8]
add r8, 8
xor edx, edx
mov rcx, rbx
call fcn.180008090
mov rcx, rbx
call fcn.180005280
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180001e30
Capabilities:
Hash data with crc32

Disassembly:
mov r9d, edx
mov r10, rcx
not r8d
test edx, edx
je 0x180001efb
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor r8d, eax
mov eax, r8d
and al, 1
neg al
sbb ecx, ecx
shr r8d, 1
and ecx, 0xedb88320
xor ecx, r8d
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb r8d, r8d
shr ecx, 1
and r8d, 0xedb88320
xor r8d, ecx
add r9d, 0xffffffff
jne 0x180001e50
not r8d
mov eax, r8d
ret

Function at 0x180001f30
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001f6d
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180001f10]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180001f6d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180002cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r13, qword [rsp + 0x1a0]
mov r15, rcx
lea rcx, [rsp + 0x20]
mov rdi, r8
mov r12d, edx
xor ebx, ebx
call fcn.180005ca0
mov r14, rax
test rax, rax
je 0x180002e6c
mov qword [rsp + 0x180], rbp
mov ebp, dword [rsp + 0x20]
mov qword [rsp + 0x188], rsi
lea ecx, [rbp + 0x400]
call fcn.180005210
mov rsi, rax
test rax, rax
je 0x180002e54
mov eax, dword [r15]
lea rcx, [rsi + 0x20]
mov dword [rsi + 4], eax
mov r8d, ebp
mov eax, dword [r15 + 4]
mov rdx, r14
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], 2
mov dword [rsi + 0x10], 2
mov dword [rsi + 0x14], r12d
call fcn.180015600
mov dword [rsi + 0x1c], ebp
lea rcx, [rsi + 4]
add ebp, 3
mov dword [rsi + 0x18], 0x20
and ebp, 0xfffffffc
xor r8d, r8d
add ebp, 0x20
lea edx, [rbp - 4]
call fcn.180001e30
mov dword [rsi], eax
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], bl
jne 0x180002dc1
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800056a0
mov r10d, ebp
test ebp, ebp
je 0x180002e4d
movzx edx, byte [rsp + 0x31]
mov r9, rsi
movzx r8d, byte [rsp + 0x30]
nop dword [rax]
inc r8b
lea r9, [r9 + 1]
mov byte [rsp + 0x30], r8b
movzx eax, r8b
lea r8, [rsp + 0x32]
add r8, rax
add dl, byte [r8]
mov byte [rsp + 0x31], dl
movzx ecx, byte [r8]
movzx eax, dl
lea rdx, [rsp + 0x32]
add rdx, rax
movzx eax, byte [rdx]
mov byte [r8], al
mov byte [rdx], cl
movzx edx, byte [rsp + 0x31]
movzx r8d, byte [rsp + 0x30]
movzx ecx, byte [rsp + rdx + 0x32]
add cl, byte [rsp + r8 + 0x32]
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x32]
xor byte [r9 - 1], cl
sub r10, 1
jne 0x180002df0
mov rbx, rsi
mov dword [r13], ebp
mov rcx, r14
call fcn.180005280
mov rsi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x180]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180006c40
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800034b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r13, qword [rsp + 0x1a0]
mov r15, rcx
lea rcx, [rsp + 0x20]
mov rdi, r8
mov r12d, edx
xor ebx, ebx
call fcn.180002ea0
mov r14, rax
test rax, rax
je 0x18000362c
mov qword [rsp + 0x180], rbp
mov ebp, dword [rsp + 0x20]
mov qword [rsp + 0x188], rsi
lea ecx, [rbp + 0x400]
call fcn.180005210
mov rsi, rax
test rax, rax
je 0x180003614
mov eax, dword [r15]
lea rcx, [rsi + 0x20]
mov dword [rsi + 4], eax
mov r8d, ebp
mov eax, dword [r15 + 4]
mov rdx, r14
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], 2
mov dword [rsi + 0x10], 3
mov dword [rsi + 0x14], r12d
call fcn.180015600
mov dword [rsi + 0x1c], ebp
lea rcx, [rsi + 4]
add ebp, 3
mov dword [rsi + 0x18], 0x20
and ebp, 0xfffffffc
xor r8d, r8d
add ebp, 0x20
lea edx, [rbp - 4]
call fcn.180001e30
mov dword [rsi], eax
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], bl
jne 0x180003581
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800056a0
mov r10d, ebp
test ebp, ebp
je 0x18000360d
movzx edx, byte [rsp + 0x31]
mov r9, rsi
movzx r8d, byte [rsp + 0x30]
nop dword [rax]
inc r8b
lea r9, [r9 + 1]
mov byte [rsp + 0x30], r8b
movzx eax, r8b
lea r8, [rsp + 0x32]
add r8, rax
add dl, byte [r8]
mov byte [rsp + 0x31], dl
movzx ecx, byte [r8]
movzx eax, dl
lea rdx, [rsp + 0x32]
add rdx, rax
movzx eax, byte [rdx]
mov byte [r8], al
mov byte [rdx], cl
movzx edx, byte [rsp + 0x31]
movzx r8d, byte [rsp + 0x30]
movzx ecx, byte [rsp + rdx + 0x32]
add cl, byte [rsp + r8 + 0x32]
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x32]
xor byte [r9 - 1], cl
sub r10, 1
jne 0x1800035b0
mov rbx, rsi
mov dword [r13], ebp
mov rcx, r14
call fcn.180005280
mov rsi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x180]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180006c40
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180003660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
xor ebx, ebx
call fcn.180002720
mov rsi, rax
test rax, rax
je 0x180003735
mov rcx, rax
mov qword [rsp + 0x68], rdi
call fcn.1800026a0
mov rdi, rax
test rax, rax
je 0x180003728
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rax
mov qword [rsp + 0x60], rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000371b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rbx
mov r8d, r14d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180003712
cmp dword [rsp + 0x78], r14d
mov eax, 1
cmove ebx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180005280
mov rbp, qword [rsp + 0x60]
mov rcx, rsi
call fcn.180005280
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x180003750
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, qword [rsp + 0x1a8]
mov rax, r8
mov r8d, dword [rsp + 0x1a0]
mov edi, edx
mov r13, qword [rsp + 0x1b8]
mov rbx, rcx
mov rcx, rax
mov rdx, r9
xor esi, esi
call fcn.180003660
mov ecx, 0x400
mov r15d, eax
call fcn.180005210
mov r14, rax
test rax, rax
je 0x180003955
mov ecx, dword [rbx]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 8], ecx
lea rcx, [0x18001e5e0]
mov qword [rsp + 0x180], r12
mov dword [rax + 0xc], 2
mov dword [rax + 0x10], 5
mov dword [rax + 0x14], edi
test r15d, r15d
jne 0x1800037f1
lea rcx, [0x18001e5f0]
call fcn.1800062d0
or rdi, 0xffffffffffffffff
mov rbx, rax
mov r8, rdi
inc r8
cmp byte [rbx + r8], sil
jne 0x180003800
lea rcx, [r14 + 0x20]
mov rdx, rbx
call fcn.1800011e0
mov r15d, eax
test rbx, rbx
je 0x180003839
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
lea ebx, [r15 + 3]
mov dword [r14 + 0x18], 0x20
and ebx, 0xfffffffc
mov dword [r14 + 0x1c], r15d
add ebx, 0x20
lea rcx, [r14 + 4]
xor r8d, r8d
lea edx, [rbx - 4]
call fcn.180001e30
mov r12, qword [rsp + 0x180]
mov dword [r14], eax
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], sil
jne 0x180003870
mov word [rsp + 0x20], si
mov rax, rsi
mov byte [rsp + rax + 0x22], al
inc rax
cmp rax, 0x100
jb 0x180003881
xor r9b, r9b
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rsp + rsi + 0x22]
lea rcx, [rsp + 0x22]
xor edx, edx
mov rax, rsi
div rdi
movzx eax, byte [rdx + rbp]
add al, r8b
add r9b, al
movzx eax, r9b
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + rsi + 0x22], al
inc rsi
mov byte [rcx], r8b
cmp rsi, 0x100
jb 0x1800038a0
mov r11d, ebx
test ebx, ebx
je 0x18000394c
movzx r9d, byte [rsp + 0x21]
mov r10, r14
movzx eax, byte [rsp + 0x20]
nop
inc al
lea r8, [rsp + 0x22]
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x22]
movzx eax, al
lea r10, [r10 + 1]
add r8, rax
add r9b, byte [r8]
mov byte [rsp + 0x21], r9b
movzx ecx, byte [r8]
movzx eax, r9b
add rdx, rax
movzx eax, byte [rdx]
mov byte [r8], al
mov byte [rdx], cl
movzx r9d, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
movzx edx, byte [rsp + r9 + 0x22]
add dl, byte [rsp + rax + 0x22]
movzx ecx, dl
movzx edx, byte [rsp + rcx + 0x22]
xor byte [r10 - 1], dl
sub r11, 1
jne 0x1800038f0
mov dword [r13], ebx
mov rax, r14
jmp 0x180003958
mov rax, rsi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180006c40
add rsp, 0x140
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180003980
Capabilities:
Read file on windows

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x50
mov r12, rdx
xor ebx, ebx
call fcn.180002720
mov r15, rax
test rax, rax
je 0x180003aa6
mov rcx, rax
mov qword [rsp + 0x40], r14
call fcn.1800026a0
mov r14, rax
test rax, rax
je 0x180003a99
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 7]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
mov qword [rsp + 0x70], rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180003a8c
lea r9d, [rbx + 2]
mov qword [rsp + 0x48], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
cmp eax, 0x40000000
ja 0x180003a7e
mov ecx, edi
mov qword [rsp + 0x78], rsi
call fcn.180005210
mov rsi, rax
test rax, rax
je 0x180003a79
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180003a71
cmp dword [rsp + 0x80], edi
jne 0x180003a71
test r12, r12
je 0x180003a6c
mov dword [r12], edi
mov rbx, rsi
jmp 0x180003a79
mov rcx, rsi
call fcn.180005280
mov rsi, qword [rsp + 0x78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x48]
mov rcx, r14
call fcn.180005280
mov rbp, qword [rsp + 0x70]
mov rcx, r15
call fcn.180005280
mov r14, qword [rsp + 0x40]
mov rax, rbx
add rsp, 0x50
pop r15
pop r12
pop rbx
ret
Function at 0x180003d60
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, word [rcx]
xor esi, esi
mov rbx, rcx
movabs r14, 0x100002600
test ax, ax
je 0x180003dbc
nop dword [rax]
cmp ax, 0x20
ja 0x180003dbc
movzx eax, ax
bt r14, rax
jae 0x180003dbc
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x180003da0
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rbx + rax*2], si
jne 0x180003dc3
mov qword [rsp + 0x268], rbp
cmp rax, 2
jb 0x180003f10
lea rcx, [0x18001e660]
call fcn.180006440
mov r8d, 2
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call fcn.18000a104
test eax, eax
jne 0x180003eef
movzx eax, word [rbx + 4]
add rbx, 4
test ax, ax
je 0x180003e2f
cmp ax, 0x20
ja 0x180003e2f
movzx eax, ax
bt r14, rax
jae 0x180003e2f
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x180003e13
mov rax, rdi
inc rax
cmp word [rbx + rax*2], si
jne 0x180003e32
test rax, rax
je 0x180003eef
movzx ecx, word [rbx]
mov edx, esi
mov word [rsp + 0x20], si
cmp cx, 0x22
jne 0x180003e85
movzx eax, word [rbx + 2]
test ax, ax
je 0x180003eb8
mov rcx, rsi
mov r8, rsi
cmp ax, 0x22
je 0x180003eb8
inc rcx
mov word [rsp + r8 + 0x20], ax
inc edx
lea r8, [rcx + rcx]
movzx eax, word [r8 + rbx + 2]
test ax, ax
jne 0x180003e63
jmp 0x180003eb8
test cx, cx
je 0x180003eb8
mov r8, rsi
mov r9, rsi
cmp cx, 0x20
ja 0x180003e9f
movzx eax, cx
bt r14, rax
jb 0x180003eb8
inc r8
mov word [rsp + r9 + 0x20], cx
inc edx
lea r9, [r8 + r8]
movzx ecx, word [r9 + rbx]
test cx, cx
jne 0x180003e90
movsxd rax, edx
add rax, rax
cmp rax, 0x208
jae 0x180003f3e
mov word [rsp + rax + 0x20], si
lea rax, [rsp + 0x20]
inc rdi
cmp word [rax + rdi*2], si
jne 0x180003ed4
test rdi, rdi
je 0x180003eef
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
test rbp, rbp
je 0x180003f10
mov r8d, dword [rbp - 8]
lea rcx, [rbp - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbp - 8]
call fcn.180005280
mov eax, esi
mov rbp, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180006c40
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop r14
pop rdi
pop rsi
ret
call fcn.180006d6c
int3
Function at 0x180004db0
Capabilities:
Copy file
Delete file
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x670
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x180023d18]
lea rdx, [rsp + 0x240]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [0x18001e6e0]
call fcn.180006440
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rbx, rbx
je 0x180004e45
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
lea rcx, [0x18001e700]
call fcn.1800062d0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rbx, rbx
je 0x180004e84
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
lea rdx, [rsp + 0x30]
xor ecx, ecx
call rdi
test eax, eax
je 0x180004e9c
cmp eax, 0xb7
jne 0x180004fe0
lea rcx, [0x18001e720]
call fcn.180006440
lea rcx, [0x18001e740]
mov rdi, rax
call fcn.180006440
lea rdx, [rsp + 0x30]
mov rbx, rax
sub rdx, 2
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x180004ec3
mov ecx, dword [0x18001e760]
mov r8, rdi
cmp dword [0x180023ccc], 0
mov dword [rdx], ecx
lea rcx, [rsp + 0x30]
cmovne r8, rax
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180004ef0
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180004f00
test rbx, rbx
je 0x180004f33
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rbx - 8]
call fcn.180005280
test rdi, rdi
je 0x180004f54
mov r8d, dword [rdi - 8]
lea rcx, [rdi - 8]
add r8, 8
xor edx, edx
call fcn.180008090
lea rcx, [rdi - 8]
call fcn.180005280
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180004fe0
cmp dword [0x180023ccc], 0
lea r8, [0x18001e764]
je 0x180004fd1
mov qword [rsp + 0x28], r8
lea rax, [0x18001e770]
lea r8, str.__s___s__s
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x450]
call fcn.180001370
lea r8, [rsp + 0x450]
mov rcx, rsi
lea rdx, str.rundll32.exe
call fcn.1800068a0
jmp 0x180004fe2
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1800068a0
jmp 0x180004fe2
xor eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.180006c40
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret