joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b2d90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [0x1400e5020]
mov rdi, rax
test rax, rax
jne 0x1400b2dd2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400b2e19
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400b2e72
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400b2e30
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400b2eb3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400c63ca]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400c63cb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400b2e80
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400b2ed0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400b2f0a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400b2f0f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400b2f58
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400b2f58
dec r8
sub rdx, 1
jne 0x1400b2f3e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400b4808
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b4852
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b4852
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b4852
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b4852
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b4852
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b4854
xor al, al
add rsp, 0x28
ret
Function at 0x1800c7490
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x180212a58]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, rdx
mov rbp, rcx
xor esi, esi
test rdx, rdx
je 0x1800c755b
movsx edx, byte [rdx]
test dl, dl
je 0x1800c755b
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x1800c74e0
cmp rax, 1
jne 0x1800c7502
cmp dl, 0x43
je 0x1800c75c7
mov eax, 0xfffffffe
jmp 0x1800c7653
cmp rax, 2
jne 0x1800c7519
lea eax, [rdx - 0x61]
cmp eax, 0x1a
jae 0x1800c7551
movsx eax, byte [rdi + 1]
sub eax, 0x61
jmp 0x1800c754c
cmp rax, 5
jne 0x1800c7551
lea eax, [rdx - 0x61]
cmp eax, 0x1a
jae 0x1800c7551
movsx eax, byte [rdi + 1]
sub eax, 0x61
cmp eax, 0x1a
jae 0x1800c7551
cmp byte [rdi + 2], 0x5f
jne 0x1800c7551
movsx eax, byte [rdi + 3]
sub eax, 0x41
cmp eax, 0x1a
jae 0x1800c7551
movsx eax, byte [rdi + 4]
sub eax, 0x41
cmp eax, 0x1a
jb 0x1800c75c7
mov eax, 0xfffffffe
jmp 0x1800c7653
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
mov r9d, 0x100
lea r8, [rsp + 0x30]
mov edx, 0x59
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, 3
jne 0x1800c75a8
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
mov r9d, 0xfc
lea r8, [rsp + 0x33]
mov edx, 0x5a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, 3
jne 0x1800c75a8
mov byte [rsp + 0x32], 0x5f
jmp 0x1800c75c2
mov edx, 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTLocaleQueryNormalizedBaseLocaleName]
mov esi, eax
test eax, eax
js 0x1800c7653
lea rdi, [rsp + 0x30]
mov r8, rbp
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.180157340
nop
lea r14, vtable.util::AutoWriteLock.0
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.180157720
nop
lea rcx, [rbp + 0x30]
mov rdx, rdi
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1800c762b
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov r8, rdi
mov rcx, rbp
call fcn.1800c7680
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rbp + 0x18]
jne 0x1800c7610
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.180157800
lea rax, vtable.util::AutoWriteLockBase.0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.180157530
nop
mov eax, esi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18010fb80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800ca050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x18
mov r11, rdx
cmp rdx, 0xffffffffffffffff
je 0x1800ca231
mov rdi, qword [rcx + 0x28]
mov rsi, qword [rcx + 0x30]
cmp rdi, rsi
je 0x1800ca231
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], r12
movabs r12, 0xcccccccccccccccd
mov qword [rsp + 0x10], r13
movabs r13, 0x47ae147ae147ae15
mov qword [rsp + 8], r14
xor r14d, r14d
mov qword [rsp], r15
mov r8d, r14d
sub rsi, rdi
movabs r15, 0x624dd2f1a9fbe77
nop dword [rax]
xor bpl, bpl
nop dword [rax]
nop word [rax + rax]
mov bl, 1
mov eax, r8d
mov rcx, r11
inc r8d
movzx r9d, byte [rax + rdi]
test r9b, 0x10
je 0x1800ca0fc
mov rax, r12
mul r11
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
jmp 0x1800ca14c
test r9b, 0x20
je 0x1800ca121
mov rax, r13
mul r11
mov rax, r11
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x64
sub rcx, rax
jmp 0x1800ca14c
test r9b, 0x40
je 0x1800ca14c
cmp r11, 0x3e8
jb 0x1800ca14c
mov rax, r15
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
cmp rcx, 0x3e8
jae 0x1800ca130
movzx edx, byte [r8 + rdi]
mov eax, r9d
and eax, 7
inc r8d
cmp eax, 4
jne 0x1800ca175
movzx r10d, byte [r8 + rdi]
lea eax, [r8 + 1]
mov r8d, eax
cmp rcx, rdx
jb 0x1800ca17f
cmp rcx, r10
jmp 0x1800ca1b3
cmp eax, 1
jne 0x1800ca19f
cmp rcx, rdx
je 0x1800ca1b5
xor al, al
movzx ecx, al
movzx eax, cl
xor al, 1
and r9b, 8
movzx edx, al
cmove edx, ecx
test bl, bl
je 0x1800ca1b9
test dl, dl
je 0x1800ca1b9
mov bl, 1
jmp 0x1800ca1bb
cmp eax, 2
jne 0x1800ca1ab
cmp rcx, rdx
jb 0x1800ca1b5
jmp 0x1800ca17f
cmp eax, 3
jne 0x1800ca17f
cmp rcx, rdx
ja 0x1800ca17f
mov al, 1
jmp 0x1800ca181
xor bl, bl
mov eax, r8d
cmp rax, rsi
je 0x1800ca1d3
cmp byte [rax + rdi], 0xfd
mov ecx, eax
jne 0x1800ca1d6
inc r8d
jmp 0x1800ca0d2
mov ecx, r8d
test bpl, bpl
jne 0x1800ca1df
test bl, bl
je 0x1800ca1e2
mov bpl, 1
cmp rax, rsi
je 0x1800ca1f5
cmp byte [rdi + rcx], 0xfe
jne 0x1800ca1f5
inc r8d
jmp 0x1800ca0d0
test bpl, bpl
jne 0x1800ca20a
inc r14
cmp rax, rsi
jae 0x1800ca20a
inc r8d
jmp 0x1800ca0c0
mov r13, qword [rsp + 0x10]
mov rax, r14
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
add rsp, 0x18
pop rdi
pop rsi
ret
xor eax, eax
add rsp, 0x18
pop rdi
pop rsi
ret
Function at 0x180157930
Capabilities:
Query or enumerate registry value

Disassembly:
cmp rdx, 0x1000
jb 0x180157a71
push rbx
sub rsp, 0x40
movabs rax, 0xffff800000000000
mov rbx, rdx
test rax, rdx
jne 0x180157a6c
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rdx], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ole32.dll_StringFromIID]
test eax, eax
jne 0x180157a67
lea rax, [rsp + 0x38]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.Interface
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180157a5c
mov rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
lea r9d, [rdi + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180157a51
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180157a46
cmp dword [rsp + 0x60], 1
jne 0x180157a46
mov edx, dword [rsp + 0x58]
xor ecx, ecx
inc edx
shr edx, 1
inc edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
lea rcx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rbx], rax
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180157a46
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
Function at 0x140001660
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400016a2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400016aa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400016bb
jmp 0x1400016d2
xor r10d, r10d
jmp 0x14000175d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400016d2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400016e9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140001709
add r11, r8
jmp 0x14000183b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400017d2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140001780
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400017f0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140001802
jmp 0x14000181d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000181d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140001837
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000a830
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14000a8d0
jmp 0x14000a8bf
jae 0x14000a98f
cmp r8, 0x201
jae 0x14000a8d0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14000a927
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x14000a8ff
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140020610
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14000a950
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000a9fb
mov r8d, r13d
cmp r12, r8
jne 0x14000a8b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000aa2f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000a8bf
jmp 0x14000a8d0
cmp r14, r8
jb 0x14000aa49
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14000bea0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14000a9e4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140003d20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14000a9cf
jmp 0x14000a9e4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400216f0
jmp 0x14000aa5e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140021aa0
ud2
Function at 0x140010160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140025aa0]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140010198
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400101f6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140010223
test eax, eax
js 0x140010202
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140010219
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14000bce0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140009070
mov ecx, 7
int 0x29
ud2
Function at 0x14001cf10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14001cf9a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001cf90
cmp r10, r11
jb 0x14001d016
cmp r10, rdx
ja 0x14001d028
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14001cf92
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001cf70
jmp 0x14001cff7
ja 0x14001cf9a
mov r11, r10
cmp rax, r8
jne 0x14001cf37
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14001cffb
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001cfd0
mov r8, r10
sub ecx, r9d
jns 0x14001cfee
jmp 0x14001cffd
cmp r10, rdx
je 0x14001d00a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001cffd
xor al, 1
cmp r8, rdx
jne 0x14001cfb0
jmp 0x14001cffd
xor eax, eax
jmp 0x14001cffd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400215d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140021b10
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140021aa0
int3

Function at 0x14001ea18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ea62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001ea62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001ea62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001ea62
cmp dword [rcx + 0x84], 0xe
jbe 0x14001ea62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001ea64
xor al, al
add rsp, 0x28
ret
Function at 0x140001a70
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov eax, 0x444e1802
call fcn.140001a92

Function at 0x140003b90
Capabilities:
Enumerate process modules
Link many functions at runtime
Parse credit card information

Disassembly:
mov eax, 0x20d8
call fcn.140048680
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x80], rax
xor eax, eax
cmc
dec eax
cmp eax, ecx
call fcn.140003bb7

Function at 0x140006db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
add rax, 0xffffffff9a3d14cd
add rax, 0x6f6e8fa1
dec rax
mov rax, rcx
call fcn.140006df3
Function at 0x14000a5d0
Capabilities:
Accept command line arguments
Check if file exists
Create a process with modified i/o handles and window
Delete file
Parse pe header
Read file on windows
Set current directory

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2b80
call fcn.140048680
sub rsp, rax
mov rax, r8
mov rax, rcx
mov eax, 0x3f20ff07
call fcn.14000a602

Function at 0x140049240
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004928a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004928a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004928a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004928a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004928a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004928c
xor al, al
add rsp, 0x28
ret

Function at 0x14005daa8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14005d897
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005d897
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005d897
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005d897
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005d897
cmp dword [rcx + 0x84], 0xe
jbe 0x14005d897
cmp dword [rcx + 0xf8], 0
je 0x14005d897
mov ecx, ebx
call fcn.14005d9c8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14005d614
cmp dword [rbp + 0x20], 0
je 0x14005d8e4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005d8ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x14005d830
Function at 0xe085f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xe085fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xe0860d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xe085f5
lea eax, [rcx + 1]
jmp 0xe0861b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xe0862e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xe08614
sub eax, 3
jb 0xe0864e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xe0869d
sar eax, 1
movsxd rbp, eax
jb 0xe08684
jmp 0xe0865c
add ebx, ebx
jne 0xe0865a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe08684
inc ecx
add ebx, ebx
jne 0xe0866a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe08684
call r11
adc ecx, ecx
add ebx, ebx
jne 0xe0867d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xe0866c
add ecx, 2
jmp 0xe08689
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00e085b2
jmp 0xe085fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xbba00
mov dl, 0x17
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xe086e9
cmp rsi, rcx
jae 0xe086f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xe086d0
cmp al, 0x8f
ja 0xe086d0
cmp byte [rsi - 2], 0xf
je 0xe086d6
sub al, 0xe8
cmp al, 1
ja 0xe086ba
cmp rsi, rcx
jae 0xe086f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xe086c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xe086f1
lodsb al, byte [rsi]
jmp 0xe086d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa04000]
mov eax, dword [rdi]
or eax, eax
je 0xe0874e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa08000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xe086fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xe08748
mov qword [rbx], rax
add rbx, 8
jmp 0xe0871e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xe08792
cmp al, 0xef
ja 0xe0877a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xe0875a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xe08769
mov eax, dword [rdi]
add rdi, 4
jmp 0xe08769
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xe087e6
sub rsp, 0xffffffffffffff80
jmp 0x470560