joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001290
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140001bdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c26
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c28
xor al, al
add rsp, 0x28
ret

Function at 0x402b20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004503b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402b99
mov rcx, r10
call fcn.004029f0
test eax, eax
je 0x402b99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402b96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402b8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402b99
add r8, 0x28
cmp r8, r9
jne 0x402b78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1400034b6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400034ec
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1400034f4
mov esi, dword [rdx]
mov r9d, 4
jmp 0x1400034f9
xor r10d, r10d
jmp 0x1400035a7
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000351c
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140003533
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140003553
add r11, r8
jmp 0x140003677
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000361b
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400035c9
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14000362d
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140003633
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140003659
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140003673
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x14000f572
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor r8d, r8d
mov r9b, byte [rdx + r8]
xor r9b, byte [rcx + r8]
lea r10, [r8 + 1]
or al, r9b
mov r8, r10
cmp r10, 0xa
jne 0x14000f577
ret
Function at 0x140012830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400128c0
cmp r11, r10
ja 0x140012936
cmp r10, rdx
ja 0x14001294a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400128c2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400128a0
jmp 0x140012924
ja 0x1400128ca
mov r11, r10
cmp rax, r8
jne 0x140012864
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140012900
mov rdi, r8
sub ecx, edx
jns 0x14001291b
jmp 0x140012926
cmp r8, rsi
je 0x14001295b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140012926
xor al, 1
cmp rdi, rsi
jne 0x1400128e0
jmp 0x140012926
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x141635200]
mov rcx, r11
mov rdx, r10
call fcn.14007a920
ud2
lea r8, [0x141635200]
mov rcx, r10
call fcn.14007a6d0
ud2
lea rcx, [0x141640768]
lea r8, [0x1416351e8]
mov edx, 0x2b
call fcn.14007a740
ud2
Function at 0x1400145a3
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
not ecx
lea rax, [0x141635da0]
cmp r8, 0x40
jb 0x1400146d8
add rdx, 0x10
xor r10d, r10d
mov r9d, 0xff
cmp r8, 0xf
jbe 0x140014705
movzx esi, byte [rdx - 1]
movzx r11d, byte [rdx - 2]
mov r11d, dword [rax + r11*4 + 0x400]
xor r11d, dword [rax + rsi*4]
movzx esi, byte [rdx - 3]
xor r11d, dword [rax + rsi*4 + 0x800]
movzx esi, byte [rdx - 4]
xor r11d, dword [rax + rsi*4 + 0xc00]
movzx esi, byte [rdx - 5]
xor r11d, dword [rax + rsi*4 + 0x1000]
movzx esi, byte [rdx - 6]
xor r11d, dword [rax + rsi*4 + 0x1400]
movzx esi, byte [rdx - 7]
xor r11d, dword [rax + rsi*4 + 0x1800]
movzx esi, byte [rdx - 8]
xor r11d, dword [rax + rsi*4 + 0x1c00]
movzx esi, byte [rdx - 9]
xor r11d, dword [rax + rsi*4 + 0x2000]
movzx esi, byte [rdx - 0xa]
xor r11d, dword [rax + rsi*4 + 0x2400]
movzx esi, byte [rdx - 0xb]
xor r11d, dword [rax + rsi*4 + 0x2800]
movzx esi, byte [rdx - 0xc]
xor r11d, dword [rax + rsi*4 + 0x2c00]
mov esi, ecx
shr esi, 0x18
movzx edi, byte [rdx - 0xd]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3000]
mov esi, ecx
shr esi, 0x10
and esi, r9d
movzx edi, byte [rdx - 0xe]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3400]
inc r10
mov esi, ecx
shr esi, 8
and esi, r9d
movzx edi, byte [rdx - 0xf]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3800]
and ecx, r9d
movzx esi, byte [rdx - 0x10]
xor esi, ecx
mov ecx, r11d
xor ecx, dword [rax + rsi*4 + 0x3c00]
lea r11, [r8 - 0x10]
cmp r10, 4
jne 0x1400146c8
cmp r11, 0x3f
jbe 0x1400146d4
xor r10d, r10d
add rdx, 0x10
mov r8, r11
jmp 0x1400145c9
add r8, 0xfffffffffffffff0
test r8, r8
je 0x1400146fa
xor r9d, r9d
mov r10b, byte [rdx + r9]
xor r10b, cl
movzx r10d, r10b
shr ecx, 8
xor ecx, dword [rax + r10*4]
inc r9
cmp r8, r9
jne 0x1400146e0
not ecx
mov eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rax, [0x141635d88]
mov ecx, 0xf
mov rdx, r8
mov r8, rax
call fcn.14007a660
ud2
Function at 0x14001471e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x140014920
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x14007e520]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140014784
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x14007e530]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x1400148a2
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140014878
movdqa xmm1, xmmword [0x14007e530]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
movss xmm2, xmm0
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
xorps xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x14007e540], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14001493e
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400145a3
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14001ed70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.14000fa20
cmp rax, rcx
je 0x14001ed95
cmp rdx, 4
jae 0x14001ed98
xor eax, eax
xor r8d, r8d
jmp 0x14001ee30
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14007e4c0]
movdqa xmm3, xmmword [0x14007e4d0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14001edc0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14001ee47
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14001ee30
ret
Function at 0x14001fdb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14001fe0b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001fe0b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14001fe26
cmp eax, 0x42
jne 0x14001fe0b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14001fed6
cmp byte [r9 + r11], 0x5f
jne 0x14001fed6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14001ff3e
mov rcx, rsi
xor edx, edx
call fcn.14001b7e0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14001b7e0
test al, al
jne 0x14001ffd1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001fe62
lea rdx, [0x14163c5d3]
mov r8d, 1
call fcn.14000ffb0
test al, al
jne 0x14001ffd1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14001fe1a
xor r14d, r14d
lea rbx, [0x14163c988]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14001fe94
cmp byte [rax + rcx], 0x45
je 0x14001fff3
sub r14, 1
jb 0x14001feb9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001feb9
mov r8d, 2
mov rdx, rbx
call fcn.14000ffb0
test al, al
jne 0x14001ffd1
mov rcx, rsi
call fcn.14001cff0
test al, al
jne 0x14001ffd1
mov rax, qword [rsi]
test rax, rax
jne 0x14001fe80
jmp 0x14001fe1a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14001ff98
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14001ff32
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14001ff1c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14001ff0b
add dl, 0xa9
jmp 0x14001ff1a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14001ff98
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14001ff98
movzx edx, bl
add rax, rdx
jae 0x14001fee0
jmp 0x14001ff98
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14001ff98
cmp rax, rcx
jae 0x14001ff95
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14001ffeb
cmp qword [rsi + 0x20], 0
je 0x14001ffe4
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14001fdb0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14001fe1c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001ffd9
lea rax, [0x14163c938]
lea rdx, [0x14163c948]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.14000ffb0
test al, al
je 0x14001ffd9
mov dil, 2
jmp 0x14001fe1a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14001fe1a
mov dil, 1
xor r8d, r8d
jmp 0x14001ff9a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14001fe1a
Function at 0x1400254e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x14163f368]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140025553
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14002558a
test eax, eax
js 0x140025564
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14002557d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x14163f3d0]
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140024390
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.1400239c0
mov rcx, rax
call fcn.140023b00
mov ecx, 7
int 0x29
ud2
Function at 0x14002cc90
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140026120
invalid
dec dword [rax - 0x75]
and al, 0x20
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x14002cd47
invalid
lea eax, [rax]
add byte [rax], al
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
invalid
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.14002b5d0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x14002cd47
mov rcx, rdi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x14002cd19
test rsi, rsi
je 0x14002cd45
mov rcx, qword [0x14165a000]
xor esi, esi
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14002cd47
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x14002cd40
mov rcx, qword [0x14165a000]
xor edx, edx
ror byte [rcx - 0x77], cl
clc
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, rbx
jmp 0x14002cd47
xor esi, esi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400365b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140026120
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x140036626
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call case.0x1400280c4.466
mov rdi, qword [rsp + 0x28]
and al, 0x28
test rdi, rdi
je 0x140036634
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140036654
mov qword [rsi], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x140036645
mov rcx, qword [0x14165a000]
xor edx, edx
ror byte [rcx - 0x77], cl
clc
Function at 0x1400383c0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14165a0a0]
mov ecx, 0x10
mov edx, 8
call fcn.14000e2d0
test rax, rax
je 0x1400384b6
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400389c0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400384a8
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x18]
je 0x140038481
cmp qword [rax + 0x10], 0x11
jae 0x14003846a
mov r8, qword [rbp - 0x20]
jmp 0x140038472
mov r8, qword [rbp - 0x20]
mov r8, qword [r8 - 8]
mov rcx, qword [0x14165a000]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14165a000]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14007a3f0
ud2
Function at 0x140038f00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.1400793f0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov r14, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xfec], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r15, [rbp + 0xfec]
mov qword [rbp + 0xfc8], r15
lea r12, [0x14002f870]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xfb0]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x1400390ee
mov r13, qword [sym.imp.kernel32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov rdi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], r14
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfec], 0
je 0x140038fc7
cmp dword [rbp + 0xff0], 0
jne 0x140039103
mov ebx, dword [rbp + 0xff4]
test rbx, rbx
je 0x140039103
cmp ebx, 0x1000
ja 0x140039147
xor r14d, r14d
nop dword [rax + rax]
cmp r14, rbx
ja 0x140039133
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov r8d, ebx
sub r8d, r14d
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call rdi
test eax, eax
je 0x1400390f6
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfec], 0
je 0x140039070
cmp dword [rbp + 0xff0], 0
jne 0x1400390fc
mov eax, dword [rbp + 0xff4]
add r14, rax
cmp r14, rbx
jne 0x140039010
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov r14, qword [rbp + 0xfe0]
mov rcx, r14
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x140038fc7
call qword [sym.imp.kernel32.dll_GetLastError]
jmp 0x140039103
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, r14
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x14163f6b8]
mov rcx, r14
mov rdx, rbx
call fcn.14007a920
jmp 0x14003915b
lea r8, [0x14163f6b8]
mov edx, 0x1000
mov rcx, rbx
call fcn.14007a6d0
ud2
Function at 0x1400391b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400391f3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140029bc0]
mov qword [rbp - 0x28], rax
lea rax, [0x14163f808]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, [0x14163f840]
lea rcx, [rbp - 0x60]
call fcn.14007a5b0
ud2

Function at 0x140041f09
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140041f3c
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140041f41
call fcn.1400391b0
mov ecx, dword [0x14165a0a4]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov byte [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
mov qword [rcx + 0xb0], rdx
add rsp, 0x38
ret
Function at 0x14004da15
Capabilities:
Create directory

Disassembly:
test cl, cl
je case.0x14002c2c2.313
mov rcx, rdx
mov rdx, r8
mov edx, eax
jmp fcn.14002cd60
mov rcx, rdx
mov rdx, r8
jmp fcn.14002cc90

Function at 0x140050e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0x20
mov rsi, rcx
jb 0x140050ecc
mov rcx, qword [rcx + 0x20]
mov edx, 0x12
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rsi + 0x18]
mov edx, 0xc
mov rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rsi + 0x10]
mov edx, 7
add rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rsi + 8]
mov edx, 1
add rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rdx, qword [rsi + 8]
lea rcx, [rbx + rax]
call fcn.140050dd4
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.140050dd4
mov rdx, qword [rsi + 0x18]
mov rcx, rax
call fcn.140050dd4
mov rdx, qword [rsi + 0x20]
mov rcx, rax
call fcn.140050dd4
jmp 0x140050edd
mov rax, qword [rcx + 0x18]
movabs rcx, 0x27d4eb2f165667c5
add rax, rcx
mov r8, qword [rsi]
lea rdx, [rsi + 0x28]
xor r9d, r9d
lea rcx, [r8 + rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140050c60