joyce8/EMBER2024-capa huggingface dataset:
Function at 0x170053050
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call sym.ntdll.dll_RtlUnicodeStringToOemSize
lea edx, [rax - 1]
mov word [rsi], dx
test bl, bl
je 0x1700530ab
mov word [rsi + 2], ax
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
mov r8d, eax
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x1700530ee
movzx edx, word [rsi]
jmp 0x1700530c7
movzx ecx, word [rsi + 2]
xor ebx, ebx
cmp eax, ecx
jbe 0x1700530c7
test cx, cx
je 0x1700530f5
add ecx, 0xffffffff
mov word [rsi], cx
mov ebx, 0x80000005
mov edx, ecx
mov rcx, qword [rsi + 8]
movzx edx, dx
mov r9, qword [rdi + 8]
movzx eax, word [rdi]
mov dword [rsp + 0x20], eax
xor r8d, r8d
call sym.ntdll.dll_RtlUnicodeToOemN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
mov byte [rax + rcx], 0
jmp 0x1700530fa
mov ebx, 0xc0000017
jmp 0x1700530fa
mov ebx, 0x80000005
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x1700531e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx + 8]
movzx r8d, word [rdi]
lea rcx, [rsp + 0x34]
call sym.ntdll.dll_RtlUnicodeToMultiByteSize
mov eax, dword [rsp + 0x34]
lea edx, [rax + 1]
mov word [rsi], ax
test bl, bl
je 0x170053249
mov word [rsi + 2], dx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, edx
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x17005328c
movzx eax, word [rsi]
jmp 0x170053265
movzx ecx, word [rsi + 2]
xor ebx, ebx
cmp edx, ecx
jbe 0x170053265
test cx, cx
je 0x170053293
add ecx, 0xffffffff
mov word [rsi], cx
mov ebx, 0x80000005
mov eax, ecx
mov rcx, qword [rsi + 8]
movzx edx, ax
mov r9, qword [rdi + 8]
movzx eax, word [rdi]
mov dword [rsp + 0x20], eax
xor r8d, r8d
call sym.ntdll.dll_RtlUpcaseUnicodeToMultiByteN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
mov byte [rax + rcx], 0
jmp 0x170053298
mov ebx, 0xc0000017
jmp 0x170053298
mov ebx, 0x80000005
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1700532b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
call sym.ntdll.dll_RtlUnicodeStringToOemSize
add eax, 0xffffffff
mov word [rdi], ax
test bl, bl
je 0x17005330b
mov word [rdi + 2], ax
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
mov r8d, eax
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rdi + 8], rax
test rax, rax
je 0x170053340
movzx eax, word [rdi]
jmp 0x170053324
movzx ecx, word [rdi + 2]
xor ebx, ebx
cmp eax, ecx
jbe 0x170053324
mov word [rdi], cx
mov ebx, 0x80000005
mov eax, ecx
test cx, cx
je 0x170053345
mov rcx, qword [rdi + 8]
movzx edx, ax
mov r9, qword [rsi + 8]
movzx eax, word [rsi]
mov dword [rsp + 0x20], eax
xor r8d, r8d
call sym.ntdll.dll_RtlUpcaseUnicodeToOemN
jmp 0x170053345
mov ebx, 0xc0000017
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1700577b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x180
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
mov r14d, r8d
mov rdi, rdx
mov r15, rcx
lea rcx, [rsp + 0x22]
mov word [rsp + 0x20], 0x53
movzx r9d, byte [rdx]
mov edx, 0xab
call fcn.1700578e0
cdqe
lea rbx, [rsp + rax*2]
add rbx, 0x22
lea r12, [rsp + 0x20]
mov rax, rbx
sub rax, r12
sar rax, 1
mov edx, 0xac
sub rdx, rax
mov r9d, dword [rdi + 4]
bswap r9d
mov rcx, rbx
call fcn.1700578e0
cdqe
lea rbx, [rbx + rax*2]
cmp byte [rdi + 1], 0
je 0x170057861
xor esi, esi
nop dword [rax]
mov rax, rbx
sub rax, r12
sar rax, 1
mov edx, 0xac
sub rdx, rax
mov r9d, dword [rdi + rsi*4 + 8]
mov rcx, rbx
call fcn.1700578e0
cdqe
lea rbx, [rbx + rax*2]
add rsi, 1
movzx eax, byte [rdi + 1]
cmp rsi, rax
jb 0x170057830
sub rbx, r12
add rbx, 2
mov edi, ebx
lea eax, [rbx - 2]
mov word [r15], ax
test r14b, r14b
je 0x1700578a6
mov word [r15 + 2], bx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r15 + 8], rax
test rax, rax
jne 0x1700578b8
mov eax, 0xc0000017
jmp 0x1700578ca
movzx ecx, word [r15 + 2]
mov eax, 0x80000005
cmp ebx, ecx
ja 0x1700578ca
mov rax, qword [r15 + 8]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8, rdi
call sym.ntdll.dll_memcpy
xor eax, eax
lea rsp, [rbp + 0x100]
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x170057d68
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x4f8
mov qword [rsp + 0x500], rcx
lea rcx, [rsp + 0x20]
call sym.ntdll.dll_RtlCaptureContext
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x500]
mov qword [rdx + 0x98], rax
mov rcx, qword [rax]
mov qword [rdx + 0x80], rcx
mov rax, qword [rsp + 0x4f8]
mov qword [rdx + 0xf8], rax
mov qword [rcx + 0x10], rax
mov r8d, 1
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
cmp byte [rax + 2], 0
jne 0x170057dd0
call fcn.170057e40
call sym.ntdll.dll_NtRaiseException
mov rcx, rax
call sym.ntdll.dll_RtlRaiseStatus
Function at 0x17005aaf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x648
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
mov rdi, r9
mov r12, r8
mov esi, edx
mov r15d, ecx
test byte [0x17008d980], 8
je 0x17005ab55
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r15d
lea rdx, [0x17008d980]
lea r8, [0x1700795c2]
lea r9, str.__u___u___p___p__n
mov ecx, 3
call fcn.170058710
lea rbx, [rsp + 0x170]
mov rcx, rbx
call sym.ntdll.dll_RtlCaptureContext
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x88], rax
test rdi, rdi
je 0x17005ab8e
mov dword [rdi], 0
xor ebx, ebx
add esi, r15d
je 0x17005aced
mov qword [rsp + 0x40], rdi
lea rdi, [rsp + 0x48]
lea r13, [rsp + 0x170]
xor r14d, r14d
jmp 0x17005abbb
add ebx, 1
cmp esi, ebx
je 0x17005ac6a
xor ecx, ecx
mov rdx, rdi
mov r8, r13
call fcn.17005a520
test eax, eax
jne 0x17005ad1c
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x17005ac6a
test al, 7
jne 0x17005ac22
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x10]
jb 0x17005ac22
mov rcx, qword [rcx + 8]
cmp rax, rcx
ja 0x17005ac22
cmp qword [rsp + 0x208], rcx
je 0x17005ac6a
cmp ebx, r15d
jb 0x17005abb0
mov rax, qword [rsp + 0x268]
movzx ecx, r14w
lea edx, [r14 + 1]
mov qword [r12 + rcx*8], rax
mov r14d, edx
jmp 0x17005abb0
test byte [0x17008d980], 2
je 0x17005ac6a
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d980]
lea r8, [0x1700795c2]
lea r9, str.invalid_frame__p___p__p__n
mov ecx, 1
call fcn.170058710
movzx ebx, r14w
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x17005aced
test r14w, r14w
je 0x17005aced
lea eax, [rbx*8]
xor ecx, ecx
nop word [rax + rax]
mov rdx, qword [r12 + rcx*8]
imul edi, edx, 0x5bd1e995
shr rdx, 0x20
mov esi, edi
shr esi, 0x18
xor esi, edi
imul edi, esi, 0x5bd1e995
imul esi, edx, 0x5bd1e995
mov edx, esi
shr edx, 0x18
xor edx, esi
imul edx, edx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
imul eax, eax, 0x5bd1e995
xor eax, edx
add rcx, 1
cmp ebx, ecx
jne 0x17005ac90
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov dword [r8], ecx
test byte [0x17008d980], 8
je 0x17005ad1c
movzx eax, bx
mov dword [rsp + 0x20], eax
lea rdx, [0x17008d980]
lea r8, [0x1700795c2]
lea r9, str.captured__hu_frames_n
mov ecx, 3
call fcn.170058710
mov eax, ebx
lea rsp, [rbp + 0x5c8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x170065f30
Capabilities:
Execute syscall

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx]
cmp dword [rcx + 0x18], 0
je 0x170065f5b
lea rcx, str.t__runcount__0
lea rdx, str._data_rock3_wine_builds_wine_7_dlls_ntdll_threadpool.c
mov r8d, 0x22f
call fcn.1700240e0
cmp dword [rsi + 0x40], 0
jne 0x170065f7a
lea rcx, str.t__destroy
lea rdx, str._data_rock3_wine_builds_wine_7_dlls_ntdll_threadpool.c
mov r8d, 0x230
call fcn.1700240e0
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rax
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x170065fa1
xor edx, edx
call sym.ntdll.dll_NtSetEvent
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
cmp dword [rdi + 0x40], 0
je 0x170065fcc
lea rax, [rdi + 0x30]
cmp qword [rdi + 0x30], rax
je 0x170065fd3
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x48]
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp sym.ntdll.dll_NtSetEvent
Function at 0x17006a4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
xor r13d, r13d
cmp r8d, 0x24
ja 0x17006a669
mov ebx, r8d
cmp r8d, 1
je 0x17006a669
mov r14, rdx
mov rdi, rcx
test rdx, rdx
je 0x17006a501
mov qword [r14], rdi
movzx eax, word [rdi]
cmp eax, 0xff
ja 0x17006a538
lea rcx, str._________h______________________H
nop word cs:[rax + rax]
nop dword [rax]
movzx edx, ax
test byte [rcx + rdx*2], 8
je 0x17006a538
movzx eax, word [rdi + 2]
add rdi, 2
cmp eax, 0x100
jb 0x17006a520
mov r15b, 1
cmp ax, 0x2b
je 0x17006a558
cmp ax, 0x2d
jne 0x17006a54e
add rdi, 2
xor r15d, r15d
test ebx, 0xffffffef
jne 0x17006a596
jmp 0x17006a564
add rdi, 2
test ebx, 0xffffffef
jne 0x17006a596
movzx ecx, word [rdi]
call fcn.17006a690
mov ecx, 0xa
test eax, eax
je 0x17006a57c
test ebx, ebx
cmove ebx, ecx
jmp 0x17006a596
movzx eax, word [rdi + 2]
or eax, 0x20
cmp ax, 0x78
jne 0x17006a67d
add rdi, 4
mov ebx, 0x10
movzx ecx, word [rdi]
test cx, cx
je 0x17006a669
call fcn.17006a690
test eax, eax
setns cl
cmp eax, ebx
setl r12b
and r12b, cl
xor r13d, r13d
cmp r12b, 1
jne 0x17006a65b
add rdi, 2
xor ecx, ecx
mov rdx, rdi
nop dword [rax + rax]
mov rdi, rdx
mov esi, eax
neg esi
test r15b, r15b
cmovne esi, eax
je 0x17006a610
mov r13d, 0x7fffffff
mov eax, 0x7fffffff
xor edx, edx
idiv ebx
cmp ecx, eax
jg 0x17006a63b
imul ecx, ebx
mov r13d, 0x7fffffff
mov eax, 0x7fffffff
sub eax, esi
cmp ecx, eax
jle 0x17006a636
jmp 0x17006a63b
mov r13d, 0x80000000
mov eax, 0x80000000
cdq
idiv ebx
cmp ecx, eax
jl 0x17006a63b
imul ecx, ebx
mov r13d, 0x80000000
mov eax, 0x80000000
sub eax, esi
cmp ecx, eax
jl 0x17006a63b
add esi, ecx
mov r13d, esi
movzx ecx, word [rdi]
test cx, cx
je 0x17006a65b
call fcn.17006a690
test eax, eax
js 0x17006a65b
lea rdx, [rdi + 2]
mov ecx, r13d
cmp eax, ebx
jl 0x17006a5d0
test r14, r14
je 0x17006a669
xor r12b, 1
jne 0x17006a669
mov qword [r14], rdi
mov eax, r13d
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
jmp 0x17006a575
Function at 0x17006a8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
xor eax, eax
cmp r8d, 0x24
ja 0x17006aa07
mov ebx, r8d
cmp r8d, 1
je 0x17006aa07
mov r15, rdx
mov rdi, rcx
test rdx, rdx
je 0x17006a8e0
mov qword [r15], rdi
movzx eax, word [rdi]
cmp eax, 0xff
ja 0x17006a918
lea rcx, str._________h______________________H
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx edx, ax
test byte [rcx + rdx*2], 8
je 0x17006a918
movzx eax, word [rdi + 2]
add rdi, 2
cmp eax, 0x100
jb 0x17006a900
mov sil, 1
cmp ax, 0x2b
je 0x17006a937
cmp ax, 0x2d
jne 0x17006a92d
add rdi, 2
xor esi, esi
test ebx, 0xffffffef
jne 0x17006a975
jmp 0x17006a943
add rdi, 2
test ebx, 0xffffffef
jne 0x17006a975
movzx ecx, word [rdi]
call fcn.17006a690
mov ecx, 0xa
test eax, eax
je 0x17006a95b
test ebx, ebx
cmove ebx, ecx
jmp 0x17006a975
movzx eax, word [rdi + 2]
or eax, 0x20
cmp ax, 0x78
jne 0x17006aa18
add rdi, 4
mov ebx, 0x10
movzx ecx, word [rdi]
test cx, cx
je 0x17006a9f8
mov dword [rsp + 0x24], esi
call fcn.17006a690
test eax, eax
setns cl
cmp eax, ebx
setl r12b
and r12b, cl
xor r14d, r14d
cmp r12b, 1
jne 0x17006a9e4
add rdi, 2
xor r14d, r14d
mov r13d, 0xffffffff
mov rcx, rdi
nop dword [rax]
mov esi, r14d
imul esi, ebx
add esi, eax
cmovb esi, r13d
mov rdi, rcx
mov eax, ebx
mul r14d
mov r14d, esi
cmovo r14d, r13d
movzx ecx, word [rcx]
test cx, cx
je 0x17006a9e4
call fcn.17006a690
test eax, eax
js 0x17006a9e4
lea rcx, [rdi + 2]
cmp eax, ebx
jl 0x17006a9b0
test r15, r15
je 0x17006a9f2
xor r12b, 1
jne 0x17006a9f2
mov qword [r15], rdi
mov esi, dword [rsp + 0x24]
jmp 0x17006a9fb
xor r14d, r14d
mov eax, r14d
neg eax
test sil, sil
cmovne eax, r14d
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
jmp 0x17006a954
Function at 0x17006aa30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
xor esi, esi
cmp r8d, 0x24
ja 0x17006ac1a
mov r15d, r8d
cmp r8d, 1
je 0x17006ac1a
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x17006aa70
mov qword [rbx], rdi
movzx eax, word [rdi]
cmp eax, 0xff
ja 0x17006aaa8
lea rcx, str._________h______________________H
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx edx, ax
test byte [rcx + rdx*2], 8
je 0x17006aaa8
movzx eax, word [rdi + 2]
add rdi, 2
cmp eax, 0x100
jb 0x17006aa90
mov r13b, 1
cmp ax, 0x2b
je 0x17006aac9
cmp ax, 0x2d
jne 0x17006aabe
add rdi, 2
xor r13d, r13d
test r15d, 0xffffffef
jne 0x17006ab0b
jmp 0x17006aad6
add rdi, 2
test r15d, 0xffffffef
jne 0x17006ab0b
movzx ecx, word [rdi]
call fcn.17006a690
mov ecx, 0xa
test eax, eax
je 0x17006aaf0
test r15d, r15d
cmove r15d, ecx
jmp 0x17006ab0b
movzx eax, word [rdi + 2]
or eax, 0x20
cmp ax, 0x78
jne 0x17006ac2e
add rdi, 4
mov r15d, 0x10
movzx ecx, word [rdi]
test cx, cx
je 0x17006ac00
mov qword [rsp + 0x30], rbx
call fcn.17006a690
test eax, eax
setns cl
cmp eax, r15d
setl dl
and dl, cl
mov byte [rsp + 0x2f], dl
cmp dl, 1
jne 0x17006ac04
movsxd r14, r15d
movabs r12, 0x7fffffffffffffff
add rdi, 2
xor ecx, ecx
mov rdx, rdi
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rdi, rdx
mov ebx, eax
neg ebx
test r13b, r13b
cmovne ebx, eax
je 0x17006aba0
mov rax, r12
xor edx, edx
idiv r14
mov rsi, r12
cmp rcx, rax
jg 0x17006abdd
imul rcx, r14
movsxd rax, ebx
mov rdx, r12
sub rdx, rax
mov rsi, r12
cmp rcx, rdx
jle 0x17006abd7
jmp 0x17006abdd
movabs rax, 0x8000000000000000
cqo
idiv r14
cmp rcx, rax
jge 0x17006abc0
lea rsi, [r12 + 1]
jmp 0x17006abdd
imul rcx, r14
movsxd rax, ebx
lea rsi, [r12 + 1]
mov rdx, rsi
sub rdx, rax
cmp rcx, rdx
jl 0x17006abdd
add rax, rcx
mov rsi, rax
movzx ecx, word [rdi]
test cx, cx
je 0x17006ac06
call fcn.17006a690
test eax, eax
js 0x17006ac06
lea rdx, [rdi + 2]
mov rcx, rsi
cmp eax, r15d
jl 0x17006ab60
jmp 0x17006ac06
xor esi, esi
jmp 0x17006ac1a
xor esi, esi
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x17006ac1a
xor byte [rsp + 0x2f], 1
jne 0x17006ac1a
mov qword [rax], rdi
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
jmp 0x17006aae7
Function at 0x17006ac40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
xor eax, eax
cmp r8d, 0x24
ja 0x17006adc7
mov r12d, r8d
cmp r8d, 1
je 0x17006adc7
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x17006ac80
mov qword [rsi], rdi
movzx eax, word [rdi]
cmp eax, 0xff
ja 0x17006acb8
lea rcx, str._________h______________________H
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx edx, ax
test byte [rcx + rdx*2], 8
je 0x17006acb8
movzx eax, word [rdi + 2]
add rdi, 2
cmp eax, 0x100
jb 0x17006aca0
mov bl, 1
cmp ax, 0x2b
je 0x17006acd7
cmp ax, 0x2d
jne 0x17006accc
add rdi, 2
xor ebx, ebx
test r12d, 0xffffffef
jne 0x17006ad19
jmp 0x17006ace4
add rdi, 2
test r12d, 0xffffffef
jne 0x17006ad19
movzx ecx, word [rdi]
call fcn.17006a690
mov ecx, 0xa
test eax, eax
je 0x17006acfe
test r12d, r12d
cmove r12d, ecx
jmp 0x17006ad19
movzx eax, word [rdi + 2]
or eax, 0x20
cmp ax, 0x78
jne 0x17006add8
add rdi, 4
mov r12d, 0x10
movzx ecx, word [rdi]
test cx, cx
je 0x17006ad9c
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x30], rsi
call fcn.17006a690
test eax, eax
setns cl
cmp eax, r12d
setl r13b
and r13b, cl
cmp r13b, 1
jne 0x17006ada1
movsxd rsi, r12d
add rdi, 2
xor r14d, r14d
mov r15, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax + rax]
mov rdi, rcx
mov rcx, r14
imul rcx, rsi
mov ebx, eax
add rbx, rcx
cmovb rbx, r15
mov rax, rsi
mul r14
mov r14, rbx
cmovo r14, r15
movzx ecx, word [rdi]
test cx, cx
je 0x17006ada4
call fcn.17006a690
test eax, eax
js 0x17006ada4
lea rcx, [rdi + 2]
cmp eax, r12d
jl 0x17006ad60
jmp 0x17006ada4
xor r14d, r14d
jmp 0x17006adbb
xor r14d, r14d
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x17006adb7
xor r13b, 1
jne 0x17006adb7
mov qword [rax], rdi
mov ebx, dword [rsp + 0x2c]
mov rax, r14
neg rax
test bl, bl
cmovne rax, r14
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
jmp 0x17006acf5
Function at 0x180008fc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.18010e5a0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000903e
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x18000901e
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call fcn.180111120
mov rcx, rdi
test eax, eax
je 0x18000906a
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180009011
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800ef410
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180009049
Function at 0x180011d20
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x850
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x180011d71
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, rax
mov rbp, qword [rdi + 0x18]
test rax, rax
jne 0x180011d8f
mov rsi, rdi
cmp rbp, 8
jb 0x180011d8f
mov rsi, qword [rdi]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call fcn.18010e5a0
mov r9, qword [rdi + 0x10]
cmp rbp, 8
jb 0x180011dae
mov rdi, qword [rdi]
mov r8, rdi
mov edx, 0x3ff
lea rcx, [rsp + 0x40]
call fcn.180110fac
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.MxStart.exe
mov rcx, rsi
call fcn.180111120
test eax, eax
jne 0x180011e3c
lea rdx, str.Maxthon.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180011f05
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x180011e20
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180004aa0
jmp 0x180011f28
lea rdx, str.TSBrowserLauncher.exe
mov rcx, rsi
call fcn.180111120
test eax, eax
jne 0x180011ea4
lea rdx, str.TSBrowser.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180011f05
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x180011e90
lea rdx, [rsp + 0x40]
jmp 0x180011f1f
lea rdx, str.DCBrowserLauncher.exe
mov rcx, rsi
call fcn.180111120
test eax, eax
jne 0x180011f05
lea rdx, str.DCBrowser.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180011f05
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x180011ef4
lea rdx, [rsp + 0x40]
jmp 0x180011f1f
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
xor r8d, r8d
lea rdx, [0x180163950]
mov rcx, rbx
call fcn.180004aa0
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800ef410
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800158e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
test rcx, rcx
je 0x180015a90
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov ecx, dword [rax + 0x90]
test ecx, ecx
je 0x180015a90
lea r14, [rsi + rcx]
cmp dword [r14], 0
je 0x180015a90
lea r12, [0x180165fc8]
movabs r13, 0x8000000000000000
xor r15d, r15d
nop dword [rax + rax]
mov ebx, dword [r14 + 0xc]
add rbx, rsi
lea rcx, [0x180165f80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rdx, [0x180165f80]
mov rcx, rbx
call fcn.180123ed0
test eax, eax
jne 0x180015a82
mov edi, dword [r14]
add rdi, rsi
mov rax, qword [rdi]
test rax, rax
je 0x180015a82
js 0x180015a72
cmp r12, r13
jae 0x180015a72
lea rbx, [rsi + 2]
add rbx, rax
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1800159d5
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.180012d00
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
mov rdx, r12
call fcn.18011b580
test eax, eax
jne 0x180015a27
mov dword [rbp - 0x40], r15d
lea r9, [rbp - 0x40]
lea r8d, [rax + 0x40]
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180015abc
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180015a62
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015a5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015b24
call fcn.1800ef470
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x1800159a0
add r14, 0x14
cmp dword [r14], 0
jne 0x180015960
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800ef410
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, str.kernel23
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.180114208
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180015b07
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015b02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015b1e
call fcn.1800ef470
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov al, 1
jmp 0x180015a92
call fcn.180110f34
int3
call fcn.180110f34
int3