joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007470
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1806ee188]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x20
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1801927e0
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 8
jae 0x1801927ef
cmp edx, 4
jae 0x18019284c
jmp 0x1801928c4
mov eax, edx
shr eax, 3
add r8d, dword [rcx]
mov r10d, dword [rcx + 4]
xor r9d, r8d
rol r8d, 0x14
add r8d, r9d
rol r9d, 9
xor r9d, r8d
rol r8d, 0x1b
add r8d, r9d
rol r9d, 0x13
add r10d, r8d
mov r8d, r9d
xor r8d, r10d
rol r10d, 0x14
add r10d, r8d
rol r8d, 9
xor r8d, r10d
rol r10d, 0x1b
add r10d, r8d
rol r8d, 0x13
mov r9d, r8d
add rcx, 8
dec eax
mov r8d, r10d
jne 0x1801927f4
test dl, 4
je 0x18019286b
add r8d, dword [rcx]
xor r9d, r8d
rol r8d, 0x14
add r8d, r9d
rol r9d, 9
xor r9d, r8d
rol r8d, 0x1b
add r8d, r9d
rol r9d, 0x13
mov eax, edx
and rax, 7
mov eax, dword [rcx + rax - 4]
shr eax, 8
or eax, 0x80000000
mov ecx, edx
not ecx
shl ecx, 3
shr eax, cl
add eax, r8d
mov edx, r9d
xor edx, eax
rol eax, 0x14
add eax, edx
rol edx, 9
xor edx, eax
rol eax, 0x1b
add eax, edx
rol edx, 0x13
mov r8d, edx
xor r8d, eax
rol eax, 0x14
add eax, r8d
rol r8d, 9
xor r8d, eax
rol eax, 0x1b
add eax, r8d
mov r9d, r8d
rol r9d, 0x13
xor eax, r9d
ret
mov eax, 0x80
test dl, 1
je 0x1801928dd
mov eax, edx
and rax, 2
movzx eax, byte [rcx + rax]
or eax, 0x8000
test dl, 2
je 0x180192886
shl eax, 0x10
movzx ecx, word [rcx]
or eax, ecx
jmp 0x180192886
Function at 0x1802796e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0xa8]
test eax, eax
jne 0x180279705
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1802789a0
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x108]
mov rcx, rax
call fcn.1802789a0
mov rcx, rax
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.180280060

Function at 0x18027c260
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rbx, rbx
je 0x18027c295
lea rcx, [0x180442c20]
cmp qword [rcx - 8], 0
jne 0x18027c2a2
mov rcx, qword [0x1806d0b08]
mov rcx, qword [rcx + 0x10]
mov rdx, rbx
cmp dword [rcx], ecx
add rsp, 0x20
pop rbx
jmp 0x18027d540
call fcn.1802768f0
mov rcx, rax
call fcn.180007080
call fcn.180002b43
jmp 0x18027c27b
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
mov r8d, dword [rbx + 8]
mov edx, r8d
xor ecx, ecx
test r8d, r8d
jle 0x18027d57a
nop dword [rax]
mov eax, ecx
movzx eax, word [rbx + rax*2 + 0xc]
mov r10d, edx
shl r10d, 7
xor eax, r10d
add edx, eax
inc ecx
cmp r8d, ecx
jg 0x18027d560
mov r8d, edx
sar r8d, 0x11
sub edx, r8d
mov r8d, edx
sar r8d, 0xb
sub edx, r8d
mov r8d, edx
sar r8d, 5
mov edi, edx
sub edi, r8d
mov r8, qword [rsi + 8]
mov edx, edi
and edx, dword [rsi + 0x14]
cmp edx, dword [r8 + 8]
jae 0x18027d636
mov rbp, qword [r8 + rdx*8 + 0x10]
test rbp, rbp
je 0x18027d5f8
cmp dword [rbp + 0x18], edi
jne 0x18027d5ef
mov r8, qword [rbp + 8]
mov r8, qword [r8 + 8]
cmp byte [r8], r8b
cmp r8, rbx
je 0x18027d629
mov edx, dword [r8 + 8]
mov ecx, dword [rbx + 8]
cmp edx, ecx
jne 0x18027d5ef
lea rcx, [r8 + 0xc]
mov r8d, dword [r8 + 8]
add r8d, r8d
lea rdx, [rbx + 0xc]
call fcn.180198fe0
test eax, eax
jne 0x18027d629
mov rbp, qword [rbp + 0x10]
test rbp, rbp
jne 0x18027d5b7
lea rcx, [0x18047b840]
call fcn.180006b00
mov rbp, rax
lea rcx, [rbp + 8]
mov rdx, rbx
call fcn.180006d10
mov rcx, rsi
mov rdx, rbp
mov r8d, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.18027d7f0
mov rax, qword [rbp + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.18022d490
int3
Function at 0x18027d640
Capabilities:
Encode data using xor

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov esi, r8d
mov ecx, esi
xor eax, eax
test ecx, ecx
jle 0x18027d6a2
test rbx, rbx
je 0x18027d680
cmp dword [rbx + 8], ecx
jl 0x18027d680
mov edx, eax
movzx edx, word [rbx + rdx*2 + 0xc]
mov r8d, ecx
shl r8d, 7
xor edx, r8d
add ecx, edx
inc eax
cmp eax, esi
jl 0x18027d665
jmp 0x18027d6a2
cmp eax, dword [rbx + 8]
jae 0x18027d797
mov edx, eax
movzx edx, word [rbx + rdx*2 + 0xc]
mov r8d, ecx
shl r8d, 7
xor edx, r8d
add ecx, edx
inc eax
cmp eax, esi
jl 0x18027d680
mov eax, ecx
sar eax, 0x11
sub ecx, eax
mov eax, ecx
sar eax, 0xb
sub ecx, eax
mov eax, ecx
sar eax, 5
mov ebp, ecx
sub ebp, eax
mov rcx, qword [rdi + 8]
mov eax, ebp
and eax, dword [rdi + 0x14]
cmp eax, dword [rcx + 8]
jae 0x18027d797
mov rcx, qword [rcx + rax*8 + 0x10]
test rcx, rcx
je 0x18027d74a
cmp dword [rcx + 0x18], ebp
jne 0x18027d741
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 8]
mov r8d, dword [rdx + 8]
cmp r8d, esi
jne 0x18027d741
xor r10d, r10d
test r8d, r8d
jle 0x18027d78c
test rbx, rbx
je 0x18027d71d
cmp dword [rbx + 8], r8d
jl 0x18027d71d
mov r9d, r10d
movzx r11d, word [rdx + r9*2 + 0xc]
cmp r11w, word [rbx + r9*2 + 0xc]
jne 0x18027d741
inc r10d
cmp r8d, r10d
jg 0x18027d702
jmp 0x18027d78c
mov r9d, r10d
movzx r9d, word [rdx + r9*2 + 0xc]
cmp r10d, dword [rbx + 8]
jae 0x18027d797
mov r11d, r10d
cmp r9w, word [rbx + r11*2 + 0xc]
jne 0x18027d741
inc r10d
cmp r8d, r10d
jg 0x18027d71d
jmp 0x18027d78c
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x18027d6d5
lea rcx, [0x18047b840]
call fcn.180006b00
mov r14, rax
mov rcx, rbx
mov r8d, esi
xor edx, edx
cmp dword [rcx], ecx
call fcn.180175180
lea rcx, [r14 + 8]
mov rdx, rax
call fcn.180006d10
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
jmp fcn.18027d7f0
add rsp, 0x20
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.18022d490
int3

Function at 0x18027d7a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 8]
mov edx, eax
xor r8d, r8d
test eax, eax
jle 0x18027d7ce
nop dword [rax]
mov r10d, r8d
movzx r10d, word [rcx + r10*2 + 0xc]
mov r9d, edx
shl r9d, 7
xor r10d, r9d
add edx, r10d
inc r8d
cmp eax, r8d
jg 0x18027d7b0
mov eax, edx
sar eax, 0x11
sub edx, eax
mov eax, edx
sar eax, 0xb
sub edx, eax
mov eax, edx
sar eax, 5
mov ecx, edx
sub ecx, eax
mov eax, ecx
ret
Function at 0x1803c7160
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1803c71fd
xor eax, eax
cmp r8d, 4
jl 0x1803c71b1
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x1803c71f8
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x1803c71f1
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x1803c71e9
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x1803c71e1
add rax, 4
test r8d, r8d
jle 0x1803c73da
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x1803c71f8
inc rax
test r8d, r8d
jg 0x1803c71c0
jmp 0x1803c73da
add eax, 3
jmp 0x1803c73d5
add eax, 2
jmp 0x1803c73d5
inc eax
jmp 0x1803c73d5
jmp 0x1803c73d5
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1803c7316
add rax, 0x10
cmp rax, r10
jbe 0x1803c7220
mov eax, r8d
test al, 7
je 0x1803c73da
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1803c73da
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1803c73cc
mov ecx, 0x20
jmp 0x1803c73cf
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1803c73bd
mov r8d, 0x20
jmp 0x1803c73c1
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1803c73d5
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1803d2820
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x1803d2871
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x1803d2a9b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x1803d2865
inc edx
cmp edx, r9d
jl 0x1803d2845
jmp 0x1803d2a9b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [case.0x1803aa9c5.100]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x1803d29db
add rax, 0x10
cmp rax, r8
jb 0x1803d28b8
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1803d2a9b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180da6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x180da61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180da6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180da606f
add dl, dl
jne 0x180da6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180da60f6
xor eax, eax
add dl, dl
jne 0x180da60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180da61ad
add dl, dl
jne 0x180da60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180da60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180da607e
mov eax, 1
add dl, dl
jne 0x180da6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180da60fb
sub eax, ebx
mov ebx, 1
jne 0x180da614c
mov ecx, 1
add dl, dl
jne 0x180da612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180da613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180da6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180da607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180da6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180da6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180da615d
cmp eax, 0x7d00
jae 0x180da619b
cmp eax, 0x500
jb 0x180da6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180da607e
cmp eax, 0x7f
ja 0x180da619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180da607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180da61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180da607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x403c51
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x1090
call fcn.00433f20
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x14]
lea rax, [rbp - 0x10]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x403cb9
mov ecx, 0
call sub.msvcrt.dll__time64
mov esi, eax
call sub.msvcrt.dll_rand
movsxd rbx, eax
mov ecx, 0
call sub.msvcrt.dll__time64
lea rcx, [rax + 1]
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
add eax, esi
jmp 0x403de1
mov eax, dword [rbp - 0x14]
shr eax, 2
mov dword [rbp + 0x1000], eax
mov ecx, 0
call sub.msvcrt.dll__time64
mov dword [rbp + 0x1008], eax
mov dword [rbp + 0x1004], 0
mov dword [rbp + 0x100c], 0
jmp 0x403d99
mov eax, dword [rbp + 0x100c]
cdqe
mov eax, dword [rbp + rax*4 - 0x10]
test eax, eax
je 0x403d92
mov eax, dword [rbp + 0x100c]
cdqe
mov eax, dword [rbp + rax*4 - 0x10]
mov r8d, eax
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xff8], rax
cmp qword [rbp + 0xff8], 0
je 0x403d92
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xff8]
mov r8d, 0x48
mov rcx, rax
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x403d92
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x66666667
mov eax, ecx
imul edx
sar edx, 2
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
cmp edx, 4
jle 0x403d92
mov rax, qword [rbp - 0x50]
add dword [rbp + 0x1008], eax
mov dword [rbp + 0x1004], 1
add dword [rbp + 0x100c], 1
mov eax, dword [rbp + 0x100c]
cmp dword [rbp + 0x1000], eax
ja 0x403cee
cmp dword [rbp + 0x1004], 0
jne 0x403ddb
call sub.msvcrt.dll_rand
movsxd rbx, eax
mov ecx, 0
call sub.msvcrt.dll__time64
lea rcx, [rax + 1]
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
add dword [rbp + 0x1008], eax
mov eax, dword [rbp + 0x1008]
add rsp, 0x1090
pop rbx
pop rsi
pop rbp
ret
Function at 0x40f7a0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x40f86f
test rdx, rdx
je 0x40f856
lea eax, [r8 - 0x10]
and eax, 0xffffffef
jne 0x40f83d
mov r11d, dword [rdx]
test r9d, r9d
mov r10d, 0x14
cmove r9d, r10d
cmp r8d, 0x20
mov dword [rcx + 0x10], r11d
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov r10d, dword [rdx + 8]
lea rax, str.expand_16_byte_k
mov dword [rcx + 0x18], r10d
mov r11d, dword [rdx + 0xc]
mov dword [rcx + 0x1c], r11d
jne 0x40f801
lea rax, str.expand_32_byte_k
add rdx, 0x10
mov r8d, dword [rdx]
movdqu xmm0, xmmword [rax]
xor eax, eax
mov dword [rcx + 0x20], r8d
mov r10d, dword [rdx + 4]
mov dword [rcx + 0x24], r10d
mov r11d, dword [rdx + 8]
mov dword [rcx + 0x28], r11d
mov edx, dword [rdx + 0xc]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x88], r9d
mov dword [rcx + 0x84], 0
mov dword [rcx + 0x2c], edx
add rsp, 0x28
ret
lea rdx, str.src_stream_chacha_chacha_setup.c
lea rcx, str.keylen__32__keylen__16
mov r8d, 0x24
call fcn.00409b50
lea rdx, str.src_stream_chacha_chacha_setup.c
lea rcx, [0x004410b4]
mov r8d, 0x23
call fcn.00409b50
lea rdx, str.src_stream_chacha_chacha_setup.c
lea rcx, [0x004410a9]
mov r8d, 0x22
call fcn.00409b50
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42e7e0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00438878], eax
je 0x42e7fa
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x42ec30
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x42ec53
call fcn.004318c0
cmp eax, 1
je 0x42ec5e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
lea rbx, [rsp + 0x20]
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x42ece7
mov eax, 0x28
jmp 0x42ecba
add rax, 1
cmp rax, 0x6b
je 0x42ecd9
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x42ecb0
cmp eax, 0x6a
je 0x42ecd9
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
jmp 0x42ecc7

Function at 0x42ed80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x0044d470], 1
je 0x42ed96
call fcn.0042ecf0
mov ecx, dword [0x00438878]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x42edc0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0042eb70
cmp qword [0x00455050], 0
mov rsi, rax
je 0x42edaa
test rax, rax
je 0x42edaa
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
call fcn.0042ec30
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x42eea9
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
mov rdx, rsi
mov dword [rsi + 0xbc], 0
mov ecx, dword [0x00438878]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x42eea9
mov rbx, rsi
jmp 0x42edaa
call sub.msvcrt.dll_abort
nop
nop