joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011f7d0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x50]
mov eax, 0x150
call fcn.14016df80
sub rsp, rax
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rbp + 0x40], rax
movups xmm2, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rdx + 0x10]
lea rdx, [rbp - 0x10]
movd eax, xmm2
movups xmmword [rbp], xmm0
and al, 0xf8
psrldq xmm0, 8
movups xmmword [rbp - 0x10], xmm2
mov byte [rbp - 0x10], al
movq rax, xmm0
shr rax, 0x38
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xf], al
call fcn.140121f70
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov edx, dword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov edx, dword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov edx, dword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov edx, dword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov edx, dword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov edx, dword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov edx, dword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov edx, dword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov edx, dword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.14011fdb0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.140120030
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140121660
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14016d990
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rbp
ret
Function at 0x140132c20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
mov eax, 0xb0
call fcn.14016df80
sub rsp, rax
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r14, r8
mov dword [rbp - 0x11], 0x61707865
mov rsi, rdx
mov dword [rbp - 0xd], 0x3320646e
mov rdi, rcx
mov dword [rbp - 9], 0x79622d32
mov dword [rbp - 5], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbp - 1], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm1
movups xmmword [rbp + 0x1f], xmm0
test r8, r8
je 0x140132db4
mov qword [rsp + 0xd8], rbx
nop dword [rax + rax]
mov ebx, 0x40
lea rdx, [rbp - 0x11]
cmp r14, rbx
lea rcx, [rbp - 0x51]
cmovb rbx, r14
call fcn.140132de0
xor eax, eax
test rbx, rbx
je 0x140132d9a
cmp rbx, 0x20
jb 0x140132d65
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rbp + rbx - 0x52]
cmp rdi, rcx
ja 0x140132ce8
lea rcx, [rbp - 0x51]
cmp rdx, rcx
jae 0x140132d65
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x140132cf9
cmp rdx, rsi
jae 0x140132d65
lea rcx, [rbp - 0x51]
mov rdx, rsi
sub rdx, rcx
mov r9, rbx
lea rcx, [rbp - 0x51]
and r9, 0xffffffffffffffe0
mov r8, rdi
sub r8, rcx
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x51]
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x51]
lea rcx, [r8 + rax]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x41]
movdqu xmmword [rbp + rcx - 0x51], xmm1
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x41]
lea rcx, [r8 + rax]
add rax, 0x20
pxor xmm1, xmm0
movdqu xmmword [rbp + rcx - 0x41], xmm1
cmp rax, r9
jb 0x140132d20
cmp rax, rbx
jae 0x140132d9a
lea rcx, [rbp - 0x51]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rbp - 0x51]
sub r9, rcx
nop
lea rdx, [rbp - 0x51]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
cmp rax, rbx
jb 0x140132d80
inc dword [rbp + 0x1f]
add rdi, rbx
add rsi, rbx
sub r14, rbx
jne 0x140132ca0
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14016d990
mov rsi, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x140137f19
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14013810a
push rbx
mov eax, 0xd0
call fcn.14016df80
sub rsp, rax
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1401303f0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140130140
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.14012cbf0
mov rcx, r15
call fcn.1401303f0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140130140
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14012cbf0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x140137f80
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14016d990
add rsp, 0xd0
pop rbx
ret
Function at 0x1401583b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov eax, 0x20
call fcn.14016df80
sub rsp, rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
call fcn.1401582a0
test rax, rax
je 0x140158479
cmp dword [rsp + 0x38], 0
jg 0x140158479
cmp dword [rsp + 0x3c], 0
jg 0x140158479
mov rcx, qword [rbx + 0x98]
movzx eax, word [rcx + 0x1bc]
add ax, ax
mov word [rcx + 0x1bc], ax
mov rax, qword [rbx + 0x98]
cmp word [rax + 0x1bc], 0x3c
jbe 0x140158420
mov ecx, 0x3c
mov word [rax + 0x1bc], cx
mov rcx, rbx
call fcn.1401587a0
mov rcx, rbx
call fcn.140157e80
test eax, eax
jns 0x14015843d
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 0x98]
inc dword [rax + 0x1a8]
mov rax, qword [rbx + 0x98]
cmp dword [rax + 0x1a8], 2
jbe 0x140158464
mov dword [rax + 0x1a8], 1
mov rcx, rbx
call fcn.1401587a0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14015ed70
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14015e970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.14016df80
sub rsp, rax
mov edi, edx
mov rbx, rcx
test edx, edx
jle 0x14015e9b8
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov edx, 0x153
lea ecx, [rax - 0x1c]
lea r8d, [rax + 0x14]
call fcn.1400a6360
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call fcn.140158490
test eax, eax
je 0x14015e9e2
mov rcx, rbx
call fcn.140149f30
mov rcx, rbx
test eax, eax
jne 0x14015e9ef
call fcn.140114f10
mov rcx, rax
mov edx, 1
call fcn.1400ad6c0
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1401583b0
Function at 0x1401688e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xc0
call fcn.14016df80
sub rsp, rax
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov eax, dword [rdx + 8]
xor r12d, r12d
mov dword [rsp + 0x20], eax
mov r13, rdx
sub eax, r8d
mov edi, r8d
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov ebp, r12d
mov dword [rsp + 0x24], eax
cmp dword [rdx + 0xc], r8d
jae 0x140168950
mov r8d, 0x4d4
lea rdx, [0x1401dd240]
lea rcx, str.assertion_failed:_rec__orig_len___md_size
call fcn.1400b6150
cmp edi, 0x40
jbe 0x14016896e
mov r8d, 0x4d5
lea rdx, [0x1401dd240]
lea rcx, str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.1400b6150
mov ecx, dword [r13 + 0xc]
lea rax, [rsp + 0x30]
neg rax
lea r14, [rsp + 0x30]
and eax, 0x3f
add r14, rax
lea eax, [rdi + 0x100]
cmp ecx, eax
jbe 0x140168999
mov ebp, ecx
sub ebp, edi
sub ebp, 0x100
mov r8, rdi
xor edx, edx
mov rcx, r14
mov ebx, r12d
mov r15, rdi
call fcn.14016ef40
mov r10d, dword [r13 + 0xc]
mov r9d, r12d
cmp ebp, r10d
jae 0x140168a46
mov esi, dword [rsp + 0x20]
mov r11d, esi
mov r15, qword [r13 + 0x18]
neg r11d
mov r13d, dword [rsp + 0x24]
nop
mov eax, ebp
lea ecx, [r11 + rbp]
xor ecx, esi
xor eax, r13d
lea r8d, [rax - 1]
not eax
shr eax, 0x1f
shr r8d, 0x1f
and r8d, eax
mov eax, ebp
xor eax, esi
neg r8d
or ecx, eax
or r12d, r8d
xor ecx, ebp
mov eax, ebp
shr ecx, 0x1f
and r8d, r9d
neg ecx
or ebx, r8d
and r12d, ecx
inc ebp
movzx edx, byte [rax + r15]
movzx eax, r12b
mov ecx, r9d
and al, dl
inc r9d
or byte [rcx + r14], al
mov ecx, r9d
sub ecx, edi
mov eax, edi
xor ecx, edi
xor eax, r9d
or ecx, eax
xor ecx, r9d
shr ecx, 0x1f
neg ecx
and r9d, ecx
cmp ebp, r10d
jb 0x1401689d0
mov rsi, qword [rsp + 0x28]
mov r15, rdi
test edi, edi
je 0x140168a86
nop word [rax + rax]
mov ecx, ebx
lea rsi, [rsi + 1]
mov eax, ebx
inc ebx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rcx + r14]
mov ecx, ebx
sub ecx, edi
mov byte [rsi - 1], al
xor ecx, edi
mov eax, edi
xor eax, ebx
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
sub r15, 1
jne 0x140168a50
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14016d990
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140169550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x20
call fcn.14016df80
sub rsp, rax
mov rax, qword [rcx + 8]
lea esi, [r9 + 1]
mov rbx, rdx
mov r10, rcx
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x68], 1
je 0x1401695ae
mov edx, dword [rdx + 8]
lea eax, [rsi + r8]
cmp eax, edx
jbe 0x140169597
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov eax, r8d
sub edx, r8d
add qword [rbx + 0x18], rax
add qword [rbx + 0x20], rax
sub dword [rbx + 0xc], r8d
mov dword [rbx + 8], edx
jmp 0x1401695b3
cmp esi, dword [rdx + 8]
ja 0x14016958a
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
dec ecx
mov qword [rsp + 0x38], rdi
movzx edi, byte [rcx + rax]
mov rcx, qword [r10 + 0x110]
call fcn.140143410
mov rcx, rax
call fcn.1400b4410
bt eax, 0x15
jae 0x1401695fc
or eax, 0xffffffff
sub eax, edi
mov rdi, qword [rsp + 0x38]
add dword [rbx + 8], eax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov r10d, dword [rbx + 8]
lea ecx, [rdi + rsi]
mov esi, 0x100
mov r8d, r10d
sub r8d, ecx
mov eax, r10d
xor r8d, ecx
xor eax, ecx
or r8d, eax
xor r8d, r10d
shr r8d, 0x1f
dec r8d
cmp r10d, esi
cmovb esi, r10d
xor r9d, r9d
test esi, esi
je 0x140169680
mov r11d, edi
mov qword [rsp + 0x30], rbp
mov rbp, qword [rbx + 0x18]
shr r11d, 0x1f
mov eax, r9d
mov ecx, edi
sub ecx, r9d
shr eax, 0x1f
shr ecx, 0x1f
xor cl, al
xor al, r11b
or cl, al
mov eax, r10d
sub eax, r9d
xor cl, r11b
dec cl
dec eax
movzx edx, cl
inc r9d
movzx ecx, byte [rax + rbp]
xor ecx, edi
and edx, ecx
not edx
and r8d, edx
cmp r9d, esi
jb 0x140169641
mov rbp, qword [rsp + 0x30]
not r8d
movzx eax, r8b
lea ecx, [rax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [rdi + 1]
mov rdi, qword [rsp + 0x38]
neg ecx
and eax, ecx
sub r10d, eax
mov eax, ecx
and eax, 1
mov dword [rbx + 8], r10d
mov rbx, qword [rsp + 0x40]
not ecx
or eax, ecx
add rsp, 0x20
pop rsi
ret
Function at 0x140170088
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14016fe5c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14016fe5c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14016fe5c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14016fe5c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14016fe5c
cmp dword [rcx + 0x84], 0xe
jbe 0x14016fe5c
cmp dword [rcx + 0xf8], esi
je 0x14016fe5c
mov ecx, r14d
call fcn.14016ffa4
mov ecx, 2
call fcn.140181dd8
nop
cmp byte [0x140274200], 0
jne 0x14016ff26
mov r15d, 1
mov eax, r15d
xchg dword [0x1402741f0], eax
test ebx, ebx
jne 0x14016fecf
mov rdi, qword [0x140271510]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1402741f8]
cmp rcx, rax
je 0x14016fec6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140003490]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1402744a8]
jmp 0x14016fedb
cmp ebx, r15d
jne 0x14016fee1
lea rcx, [0x1402744c0]
call fcn.140181a2c
nop
test ebx, ebx
jne 0x14016fef8
lea rdx, [0x14019ac38]
lea rcx, [0x14019ac18]
call fcn.14018146c
lea rdx, [0x14019ac48]
lea rcx, [0x14019ac40]
call fcn.14018146c
movzx eax, byte [0x140274200]
test esi, esi
cmove eax, r15d
mov byte [0x140274200], al
jmp 0x14016ff26
mov ecx, 2
call fcn.140181e2c
test esi, esi
jne 0x14016ff3d
mov ecx, r14d
call fcn.14016ff58
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14016fdec

Function at 0x14017c580
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14017c5a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401749bc
or eax, 0xffffffff
jmp 0x14017c5a2
xor eax, eax
add rsp, 0x28
ret

Function at 0x14017c5a8
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14017c5c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401749bc
or eax, 0xffffffff
jmp 0x14017c5ca
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401860d8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140185f78
call fcn.140174a2c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14017454c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140185f60
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140185f60
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140185faa
lock or dword [rax + 0x14], 0x10
jmp 0x140185f60
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140185fc7
mov rcx, qword [rbp + 0x10]
call fcn.14018c2c8
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140180360
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140182ea0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14018601e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140185f60
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14018608a
mov rcx, qword [rbp + 0x10]
call fcn.140180360
cmp eax, 0xffffffff
je 0x140186071
mov rcx, qword [rbp + 0x10]
call fcn.140180360
cmp eax, 0xfffffffe
je 0x140186071
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140180360
movsxd rdi, eax
lea rsi, [0x1402748a0]
mov rcx, rbx
sar rdi, 6
call fcn.140180360
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140186078
lea rax, [0x140271820]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14018608a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401860c0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401860bc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401860bc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140185f63
jmp 0x140185f30

Function at 0x140186124
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140186101
call fcn.140174a2c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14017454c
or eax, 0xffffffff
jmp 0x14018611e
sub dword [rcx + 0x10], 1
jns 0x140186110
add rsp, 0x28
jmp fcn.1401860d8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401860e0
Function at 0x140002c00
Capabilities:
Create directory
Set file attributes

Disassembly:
test r8, r8
je 0x140002cf4
push rbx
push rdi
sub rsp, 0x28
mov rcx, qword [rdx + 0x18]
mov rdi, r8
mov qword [rsp + 0x40], rbp
mov rbx, rdx
mov qword [rsp + 0x20], rsi
mov rax, rdx
cmp rcx, 8
jb 0x140002c2f
mov rax, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov esi, 0x5c
cmp word [rax + rdx*2 - 2], si
je 0x140002c68
cmp rdx, rcx
jae 0x140002c5d
lea rax, [rdx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rcx, 8
jb 0x140002c58
mov rax, qword [rbx]
mov dword [rax + rdx*2], esi
jmp 0x140002c68
mov r9d, esi
mov rcx, rbx
call fcn.1400049a0
mov rdx, rdi
mov rcx, rbx
call fcn.140004500
mov rdx, qword [rbx + 0x18]
mov rax, rbx
cmp rdx, 8
jb 0x140002c83
mov rax, qword [rbx]
mov rcx, qword [rbx + 0x10]
cmp word [rax + rcx*2 - 2], si
je 0x140002cb7
cmp rcx, rdx
jae 0x140002cac
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 8
jb 0x140002ca7
mov rax, qword [rbx]
mov dword [rax + rcx*2], esi
jmp 0x140002cb7
mov r9d, esi
mov rcx, rbx
call fcn.1400049a0
cmp qword [rbx + 0x18], 8
mov rcx, rbx
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
jb 0x140002cce
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbx + 0x18], 8
jb 0x140002ce0
mov rbx, qword [rbx]
mov edx, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140005dd0
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2088
call fcn.14000a4c0
sub rsp, rax
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rsp + 0x2070], rax
mov rsi, r8
lea rbx, [rsp + 0x70]
mov ebp, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r9d, edi
lea rdx, [0x14002a4a8]
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400074a0
movzx eax, byte [rsp + 0x40]
test al, al
je 0x140005e5d
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x70]
sub rcx, rdx
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx], al
inc rbx
movzx eax, byte [rcx + rbx]
test al, al
jne 0x140005e50
test rsi, rsi
je 0x140005e7d
movzx eax, byte [rsi]
test al, al
je 0x140005e7d
sub rsi, rbx
nop dword [rax]
mov byte [rbx], al
inc rbx
movzx eax, byte [rsi + rbx]
test al, al
jne 0x140005e70
mov rax, qword [rsp + 0x20d8]
lea rdi, [0x14000b7f8]
test rax, rax
lea rsi, [rsp + 0x206e]
lea r15, [rsp + 0x20e0]
cmovne rdi, rax
sub rsi, rbx
mov qword [rsp + 0x20d8], rdi
call fcn.1400013f0
mov qword [rsp + 0x30], r15
mov r8, rsi
mov qword [rsp + 0x28], 0
mov rdx, rbx
mov qword [rsp + 0x20], rdi
mov rdi, 0xffffffffffffffff
mov rcx, qword [rax]
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
test eax, eax
cmovs eax, edi
cdqe
cmp rax, rsi
cmovbe rsi, rax
mov word [rbx + rsi], 0xa
mov rax, qword [r14]
mov edi, dword [rax]
cmp ebp, 8
jne 0x140005f07
cmp dword [r14 + 0x10], 2
je 0x140005f07
or edi, 2
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x140005f93
cmp dword [rbx], 0
je 0x140005f93
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14002e8f0], eax
jle 0x140005f68
lea rcx, [0x14002e8f0]
call fcn.1400094c0
cmp dword [0x14002e8f0], 0xffffffff
jne 0x140005f68
movzx eax, byte [rbx + 1]
lea rcx, [0x14002e8f0]
sub al, byte [rbx + 3]
sub al, byte [rbx + 2]
add al, byte [rbx]
mov byte [0x14002e880], al
call fcn.140009460
cmp byte [rsp + 0x70], 0
lea rbx, [rsp + 0x70]
je 0x140005f8a
movzx eax, byte [0x14002e880]
nop dword [rax + rax]
xor byte [rbx], al
inc rbx
cmp byte [rbx], 0
jne 0x140005f80
lea rax, [rsp + 0x70]
sub ebx, eax
jmp 0x140005f95
xor ebx, ebx
test dil, 1
je 0x140005fa6
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test dil, 2
je 0x140005fbc
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140006220
mov rcx, qword [rsp + 0x2070]
xor rcx, rsp
call fcn.140009310
add rsp, 0x2088
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret