joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180064490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
movdqa xmm0, xmmword [0x18027abe0]
mov rsi, rdx
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x80], 0
movabs rbp, 0xaaaaaaaaaaaaaaab
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x80]
movzx r8d, byte [rsp + rax + 0x31]
mov rax, rbp
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x80]
shl dl, 3
sub cl, dl
mov edx, 0x53d0fa3b
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x31], dl
mov rax, qword [rsp + 0x80]
inc rax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
cmp rax, 0xe
jb 0x1800644d0
mov byte [rsp + 0x3f], 0
call fcn.1800016b0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x180064594
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180064594
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x1800645cd
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x1800645cd
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x31]
mov rcx, rax
call r8
mov r10, rax
test rax, rax
jne 0x180064603
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
movdqa xmm0, xmmword [0x18027b120]
mov ebx, 1
mov dword [rsp + 0x90], ebx
xor dil, dil
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xde048d
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x80]
nop dword [rax]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x80]
movzx r8d, byte [rsp + rax + 0x41]
mov rax, rbp
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x80]
shl dl, 3
sub cl, dl
mov edx, 0x3f761927
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x41], dl
mov rax, qword [rsp + 0x80]
inc rax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
cmp rax, 0x12
jb 0x180064640
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov byte [rsp + 0x53], dil
lea rdx, [rsp + 0x41]
mov rcx, rsi
call r10
test eax, eax
movzx ecx, dil
cmove ecx, ebx
mov rbx, qword [rsp + 0x88]
movzx eax, cl
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800646f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
movdqa xmm0, xmmword [0x18027b0f0]
xor eax, eax
mov byte [rbp + 7], al
xor r14d, r14d
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 0x67], r14
mov rsi, rdx
mov rax, qword [rbp + 0x67]
movabs r15, 0xaaaaaaaaaaaaaaab
nop word [rax + rax]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
movzx r8d, byte [rbp + rax - 8]
mov rax, r15
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x67]
shl dl, 3
sub cl, dl
mov edx, 0x4bf9d9fd
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 8], dl
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0xf
jb 0x180064740
mov byte [rbp + 7], r14b
call fcn.1800016b0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x1800647eb
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x1800647eb
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x180064824
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x180064824
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 8]
mov rcx, rax
call r8
mov rbx, rax
test rax, rax
je 0x180064939
call fcn.180064320
mov rdi, rax
test rax, rax
je 0x180064939
movdqa xmm0, xmmword [0x18027b370]
movdqa xmm1, xmmword [0x18027aee0]
movdqu xmmword [rbp + 8], xmm0
mov dword [rbp + 0x28], 0x23d62ce3
movdqu xmmword [rbp + 0x18], xmm1
mov dword [rbp + 0x2c], 0xf34f1088
mov dword [rbp + 0x30], 0xacf64b2f
mov word [rbp + 0x34], 0x96
mov qword [rbp + 0x67], r14
mov rax, qword [rbp + 0x67]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
movzx r8d, byte [rbp + rax + 9]
mov rax, r15
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x67]
shl dl, 3
sub cl, dl
mov edx, 0xf254393
sar edx, cl
xor dl, r8b
mov byte [rbp + rax + 9], dl
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0x2c
jb 0x1800648a0
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 9]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], r14d
mov byte [rbp + 0x35], r14b
call rbx
test eax, eax
jne 0x180064939
mov rdx, qword [rbp + 0x77]
call fcn.180064490
mov rcx, qword [rbp + 0x77]
movzx ebx, al
call rdi
movzx eax, bl
jmp 0x18006493b
xor al, al
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180232620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
movdqa xmm0, xmmword [0x18027ae10]
movabs r9, 0xaaaaaaaaaaaaaaab
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xca7242
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x50]
shl dl, 3
sub cl, dl
mov edx, 0x1717c7d8
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x12
jb 0x180232660
mov byte [rsp + 0x33], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x180232712
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180232712
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x18023274b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18023274b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180232780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
movdqa xmm0, xmmword [0x18027aba0]
movabs r9, 0xaaaaaaaaaaaaaaab
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x7a05b101
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xe
jb 0x1802327b0
mov byte [rsp + 0x2f], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x180232862
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180232862
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x18023289b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18023289b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1802328d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x20], 0x657f6aeb
mov byte [rsp + 0x2e], al
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 0x24], 0x28c40ce1
mov dword [rsp + 0x28], 0x9a3d25c
mov word [rsp + 0x2c], 0x18d7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x2795942c
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xd
jb 0x180232920
mov byte [rsp + 0x2e], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x1802329d2
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x1802329d2
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x180232a0b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x180232a0b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180232a40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x20], 0xde0986e7
mov byte [rsp + 0x2a], al
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 0x24], 0x541aafbc
mov word [rsp + 0x28], 0x6b6e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x4a3c0ec0
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 9
jb 0x180232a80
mov byte [rsp + 0x2a], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x180232b32
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180232b32
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x180232b6b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x180232b6b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180232ba0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
xor eax, eax
mov dword [rsp], 0xc5cfc3b6
mov byte [rsp + 8], al
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 4], 0x1fb2cb50
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
nop dword [rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
movzx r8d, byte [rsp + rax + 1]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x20]
shl dl, 3
sub cl, dl
mov edx, 0x2f699bf2
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 1], dl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp rax, 7
jb 0x180232bd0
mov byte [rsp + 8], 0
lea r8, [rsp + 1]
lea rcx, [0x18028a970]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
mov byte [rcx], dl
lea rcx, [rcx + 1]
test dl, dl
jne 0x180232c40
lea rax, [0x18028a970]
add rsp, 0x18
ret
Function at 0x18023b360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0xf6540ee6
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 0x24], 0x14d710a8
mov dword [rsp + 0x28], 0xfd6e6259
mov word [rsp + 0x2c], 0x83
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x736e164d
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xc
jb 0x18023b3b0
mov byte [rsp + 0x2d], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x18023b462
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18023b462
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x18023b49b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18023b49b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x48]
mov qword [0x180286958], rax
lea rax, [0x180286958]
add rsp, 0x30
pop rdi
ret
Function at 0x18023b700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor ecx, ecx
mov dword [rsp + 0x20], 0xf6540ee6
xorps xmm0, xmm0
mov qword [0x18028ae68], rcx
movdqu xmmword [0x18028ae58], xmm0
mov dword [rsp + 0x24], 0x14d710a8
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 0x28], 0xfd6e6259
mov word [rsp + 0x2c], 0x83
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x736e164d
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xc
jb 0x18023b760
mov byte [rsp + 0x2d], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x18023b812
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18023b812
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x18023b84b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18023b84b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x48]
mov qword [0x18028ae70], rax
lea rax, [0x18028ae58]
add rsp, 0x30
pop rdi
ret
Function at 0x18025dc28
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18025dc48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180254688
or eax, 0xffffffff
jmp 0x18025dc4a
xor eax, eax
add rsp, 0x28
ret
Function at 0x140036920
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003692d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003693d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140036925
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140036955
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140036942
sub eax, 3
jb 0x14003696f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400369a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140036996
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140036994
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140036983
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400368e2
jmp 0x14003692d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400369f2
cmp rsi, rcx
jae 0x1400369fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400369d9
cmp al, 0x8f
ja 0x1400369d9
cmp byte [rsi - 2], 0xf
je 0x1400369df
sub al, 0xe8
cmp al, 1
ja 0x1400369c3
cmp rsi, rcx
jae 0x1400369fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400369c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400369fa
lodsb al, byte [rsi]
jmp 0x1400369d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x34000]
mov eax, dword [rdi]
or eax, eax
je 0x140036a63
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x42cd8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140036a07
jns 0x140036a3c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140036a46
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140036a5d
mov qword [rbx], rax
add rbx, 8
jmp 0x140036a27
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140036abb
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x140008b0c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1401cf0c0]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov r15d, 4
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [r15 + rdi]
cmp dword [0x1401d1cd4], eax
jle 0x140008bc4
lea rcx, [0x1401d1cd4]
call fcn.140123300
cmp dword [0x1401d1cd4], 0xffffffff
jne 0x140008bc4
call qword [0x140128668]
mov edx, eax
or dword [0x1401d1cc4], 0xffffffff
mov dword [0x1401d0944], eax
mov ecx, 0x270
mov r8d, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
lea rax, [0x1401d0944]
mov dword [rax + r8*4], edx
inc r8
cmp r8, rcx
jb 0x140008b8f
mov dword [0x1401d0940], ecx
lea rcx, [0x1401d1cd4]
call fcn.140123294
mov eax, dword [r15 + rdi]
cmp dword [0x1401d1ce0], eax
jle 0x140008c02
lea rcx, [0x1401d1ce0]
call fcn.140123300
cmp dword [0x1401d1ce0], 0xffffffff
jne 0x140008c02
and dword [0x1401d1cd8], 0
mov dword [0x1401d1cdc], 0xf
lea rcx, [0x1401d1ce0]
call fcn.140123294
mov ebx, 8
mov eax, dword [r15 + rdi]
cmp dword [0x1401d1cd0], eax
jle 0x140008c44
lea rcx, [0x1401d1cd0]
call fcn.140123300
cmp dword [0x1401d1cd0], 0xffffffff
jne 0x140008c44
mov dword [0x1401d1cc8], ebx
mov dword [0x1401d1ccc], 0xb
lea rcx, [0x1401d1cd0]
call fcn.140123294
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x30]
call fcn.14012467c
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.14000d2b0
nop
lea rdx, [0x1400035d4]
lea rcx, [rsp + 0x40]
call qword [0x140128478]
lea r15, [0x1401d1cd8]
mov rcx, r15
call fcn.14000ec14
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [0x140128470]
sub rbx, 1
jne 0x140008c7f
lea rdx, [0x140152740]
lea rcx, [rsp + 0x40]
call fcn.14000e83c
mov ebx, 4
mov rcx, r15
call fcn.14000ec14
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [0x140128470]
sub rbx, 1
jne 0x140008cb0
lea rdx, [0x140152c44]
lea rcx, [rsp + 0x40]
call fcn.14000e83c
mov ebx, 3
mov edi, ebx
mov rcx, r15
call fcn.14000ec14
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [0x140128470]
sub rdi, 1
jne 0x140008ce3
lea rdx, [0x140152740]
lea rcx, [rsp + 0x40]
call fcn.14000e83c
lea rcx, [0x1401d1cc8]
call fcn.14000ec14
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [0x140128470]
mov rcx, r15
call fcn.14000ec14
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [0x140128470]
sub rbx, 1
jne 0x140008d28
lea rdx, [0x140152740]
lea rcx, [rsp + 0x40]
call fcn.14000e83c
mov ebx, 0xc
mov rcx, r15
call fcn.14000ec14
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [0x140128470]
sub rbx, 1
jne 0x140008d59
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14000dfa4
nop
lea rcx, [rbp - 0x38]
call fcn.14000d238
lea rcx, [rbp - 0x38]
call qword [0x1401285b0]
mov rax, rsi
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140122f80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret