joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141090058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410901df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141090089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14109006f
add dl, dl
jne 0x141090096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410900f6
xor eax, eax
add dl, dl
jne 0x1410900a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410901ad
add dl, dl
jne 0x1410900b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410900c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410900d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410900dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410900ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14109007e
mov eax, 1
add dl, dl
jne 0x141090106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141090113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410900fb
sub eax, ebx
mov ebx, 1
jne 0x14109014c
mov ecx, 1
add dl, dl
jne 0x14109012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14109013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141090123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14109007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141090168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141090175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14109015d
cmp eax, 0x7d00
jae 0x14109019b
cmp eax, 0x500
jb 0x141090196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14109007e
cmp eax, 0x7f
ja 0x14109019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14109007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410901d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14109007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x160b827
Capabilities:
Encode data using xor

Disassembly:
push r10
pushfq
movabs r10, 0x4dbc438d6d127e08
lea r10, [r10 + r10*4 + 0x29b6132]
or r10w, 0x2787
push rcx
mov qword [rsp + 0x20], 0x2763c1d
not r10w
movabs rcx, 0x404a02494477789c
push r14
add ecx, 0x147810ee
movabs r14, 0x4841206d40ed1397
mov r14, qword [rsp]
sub cx, 0x5549
xor r10w, 0x3e8b
test r10b, 0x80
not r10d
setne r10b
sub rcx, 0x2c28231d
lea r10, [r10*2 + 0x579c082e]
neg r10b
mov r10, qword [rsp + 0x18]
sub cl, 0xd9
jle 0x160b85a
lea rcx, [rcx*8 + 0x6a720898]
lea rcx, [rcx*4 + 0x4c1969ca]
mov rcx, qword [rsp + 8]
call fcn.01b94770
mov eax, 0xd82b109d
invalid
Function at 0x1805ea058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805ea1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1805ea089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805ea06f
add dl, dl
jne 0x1805ea096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805ea0f6
xor eax, eax
add dl, dl
jne 0x1805ea0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805ea1ad
add dl, dl
jne 0x1805ea0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ea0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ea0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ea0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805ea0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1805ea07e
mov eax, 1
add dl, dl
jne 0x1805ea106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ea113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805ea0fb
sub eax, ebx
mov ebx, 1
jne 0x1805ea14c
mov ecx, 1
add dl, dl
jne 0x1805ea12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805ea13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805ea123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805ea07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1805ea168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805ea175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805ea15d
cmp eax, 0x7d00
jae 0x1805ea19b
cmp eax, 0x500
jb 0x1805ea196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805ea07e
cmp eax, 0x7f
ja 0x1805ea19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805ea07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805ea1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1805ea07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800011b0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov r8, qword [rcx]
mov rbp, rcx
mov ecx, dword [rcx + 0x68]
movzx eax, word [r8 + 0x14]
mov r15, qword [r8 + 0x30]
dec rcx
mov r11d, dword [rax + r8 + 0x20]
lea r9, [rax + r8 + 0x18]
movabs rax, 0xffffffff00000000
and r15, rax
mov eax, dword [r9 + 0x10]
not rcx
or r11, r15
and rcx, r11
test eax, eax
jne 0x180001210
mov edx, dword [r9 + 0x24]
test dl, 0x40
je 0x180001208
mov eax, dword [r8 + 0x20]
jmp 0x180001210
test dl, dl
jns 0x180001210
mov eax, dword [r8 + 0x24]
mov edx, dword [r9 + 0x24]
mov ebx, 1
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov r10d, eax
mov r14d, ebx
lea rdi, [0x180068cd0]
mov qword [rsp + 0x68], r13
cmp bx, word [r8 + 6]
jae 0x180001387
lea rbx, [r9 + 0x4c]
nop word [rax + rax]
mov esi, dword [rbp + 0x68]
mov r12d, dword [rbx - 0x1c]
mov eax, dword [rbx - 0x14]
or r12, r15
lea rdi, [rsi - 1]
not rdi
and rdi, r12
test eax, eax
jne 0x180001283
mov r9d, dword [rbx]
test r9b, 0x40
je 0x18000127a
mov eax, dword [r8 + 0x20]
jmp 0x180001283
test r9b, r9b
jns 0x180001283
mov eax, dword [r8 + 0x24]
mov r13d, eax
cmp rcx, rdi
je 0x180001341
lea rax, [r10 + r11]
cmp rax, rdi
ja 0x180001341
test r10, r10
je 0x180001334
bt edx, 0x19
jae 0x1800012e7
cmp r11, rcx
jne 0x180001334
cmp dword [r8 + 0x38], esi
je 0x1800012c7
xor edx, edx
mov rax, r10
div rsi
test rdx, rdx
jne 0x180001334
mov r9, qword [rbp + 0x58]
mov r8d, 0x4000
mov rdx, r10
mov rcx, r11
call qword [rbp + 0x30]
mov edx, dword [rbx]
mov r11, r12
mov rcx, rdi
mov r10, r13
jmp 0x180001362
mov eax, edx
shr eax, 0x1d
and eax, 1
movsxd rcx, eax
mov eax, edx
shr eax, 0x1e
and eax, 1
cdqe
lea rcx, [rax + rcx*2]
mov eax, edx
shr eax, 0x1f
lea rcx, [rax + rcx*2]
lea rax, [0x180068cd0]
mov r8d, dword [rax + rcx*4]
bt edx, 0x1a
jae 0x18000131f
bts r8d, 9
lea r9, [rsp + 0x50]
mov rdx, r10
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800013ac
mov edx, dword [rbx]
mov r11, r12
mov rcx, rdi
mov r10, r13
jmp 0x180001362
mov eax, dword [rbx]
bt eax, 0x19
jae 0x180001353
bt edx, 0x19
jae 0x180001353
or edx, eax
jmp 0x180001359
or edx, eax
btr edx, 0x19
mov r10, r13
sub r10, r11
add r10, r12
mov r8, qword [rbp]
inc r14d
add rbx, 0x28
movzx eax, word [r8 + 6]
cmp r14d, eax
jl 0x180001250
mov ebx, 1
lea rdi, [0x180068cd0]
test r10, r10
je 0x1800013f6
bt edx, 0x19
jae 0x1800013b0
cmp r11, rcx
jne 0x1800013f6
mov r9, qword [rbp + 0x58]
mov r8d, 0x4000
mov rdx, r10
mov rcx, r11
call qword [rbp + 0x30]
jmp 0x1800013f6
xor eax, eax
jmp 0x1800013f8
mov eax, edx
shr eax, 0x1d
and eax, 1
movsxd rcx, eax
mov eax, edx
shr eax, 0x1e
and eax, 1
cdqe
lea rcx, [rax + rcx*2]
mov eax, edx
shr eax, 0x1f
lea rcx, [rax + rcx*2]
mov r8d, dword [rdi + rcx*4]
bt edx, 0x1a
jae 0x1800013e1
bts r8d, 9
lea r9, [rsp + 0x50]
mov rdx, r10
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800013ac
mov eax, ebx
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x180003e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2080
call fcn.180009160
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2070], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.180003900
lea rdi, [0x18000ded0]
lea rbx, [rsp + 0x2020]
lea rax, [0x18000ded4]
mov esi, 0x40
sub rbx, rdi
sub rsi, rax
xor ebp, ebp
lea rcx, [rsp + 0x20]
call fcn.180001c30
lea r11, [rdi + 4]
mov ecx, 4
nop word [rax + rax]
mov eax, dword [rbx + r11 - 4]
add r11, 0x10
xor eax, dword [r11 + rbp - 0x14]
mov dword [r11 - 0x14], eax
mov eax, dword [rbx + r11 - 0x10]
xor eax, dword [r11 + rbp - 0x10]
mov dword [r11 - 0x10], eax
mov eax, dword [rbx + r11 - 0xc]
xor eax, dword [r11 + rbp - 0xc]
mov dword [r11 - 0xc], eax
mov eax, dword [rbx + r11 - 8]
xor eax, dword [r11 + rbp - 8]
dec rcx
mov dword [r11 - 8], eax
jne 0x180003ef0
add rdi, 0x40
sub rbx, 0x40
lea rax, [rsi + rdi + 4]
cmp rax, 0x5ae00
jbe 0x180003ed2
mov rcx, qword [rsp + 0x2070]
xor rcx, rsp
call fcn.1800042c0
lea r11, [rsp + 0x2080]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800048a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1800042da
rol rcx, 0x10
test cx, 0xffff
jne 0x1800042d6
repz ret
ror rcx, 0x10
jmp 0x180004800
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180068dc0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180068eb8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180004885
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180068dc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800048a7
mov rax, qword [rsp + 0x88]
mov qword [0x180068eb8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180068e58], rax
mov rax, qword [0x180068eb8]
mov qword [0x180068d30], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180068e40], rax
mov dword [0x180068d20], 0xc0000409
mov dword [0x180068d24], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000d008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180068db8], eax
mov ecx, 1
call fcn.180007110
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000a268]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180068db8], 0
jne 0x18000492e
mov ecx, 1
call fcn.180007110
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180008b84
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180005808
xor ebx, ebx
cmp qword [0x180069ce8], rbx
mov rdi, rax
jne 0x180008c97
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180008d6e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008d6e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180069ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180069cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180069cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180069d08], rax
test rax, rax
je 0x180008c8e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180069d00], rax
jmp 0x180008c9e
mov rax, qword [0x180069d00]
jmp 0x180008ca5
mov rax, qword [0x180069d00]
mov r11, qword [0x180069d08]
cmp rax, rdi
je 0x180008d0c
cmp r11, rdi
je 0x180008d0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180069d08]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180008d0c
test rax, rax
je 0x180008d0c
call rsi
test rax, rax
je 0x180008d06
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180008d06
test byte [rsp + 0x40], 1
jne 0x180008d0c
bts ebp, 0x15
jmp 0x180008d4c
mov rcx, qword [0x180069cf0]
cmp rcx, rdi
je 0x180008d4c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180008d4c
call rax
mov rbx, rax
test rax, rax
je 0x180008d4c
mov rcx, qword [0x180069cf8]
cmp rcx, rdi
je 0x180008d4c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180008d4c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180069ce8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180008d6e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180008d70
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800042c0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov r10, rdx
mov r12, rcx
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov edx, 0x1afffb16
xor r14d, r14d
mov r15d, 0x99b82b1e
jmp 0x180001070
mov edx, 0x6992377e
xor esi, esi
xor edi, edi
xor r13d, r13d
nop dword [rax + rax]
cmp edx, 0xe619f67b
jle 0x1800010c0
cmp edx, 0x1afffb15
jle 0x180001180
cmp edx, 0x1afffb16
je 0x180001227
cmp edx, 0x6992377e
jne 0x1800012a2
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], r13d
mov eax, dword [rsp + 0x30]
cmp eax, r8d
mov edx, 0x395f5f02
cmovb edx, r15d
jmp 0x180001070
cmp edx, 0xa6aeaa9a
jg 0x1800011b0
cmp edx, 0x976784de
je 0x180001248
cmp edx, 0x99b82b1e
jne 0x180001070
mov eax, dword [rsp + 0x3c]
lea edx, [rax + 1]
lea ebp, [rax + 0x100]
test edx, edx
cmovns ebp, edx
and ebp, 0xffffff00
neg ebp
lea r13d, [rax + rbp]
add r13d, 1
movsxd rax, r13d
movzx edx, byte [rsp + rax + 0x150]
movzx ebp, dl
mov edi, dword [rsp + 0x38]
lea esi, [rdi + rbp]
add esi, 0xff
add edi, ebp
cmovns esi, edi
and esi, 0xffffff00
sub edi, esi
movsxd rbp, edi
movzx ecx, byte [rsp + rbp + 0x150]
mov byte [rsp + rax + 0x150], cl
mov byte [rsp + rbp + 0x150], dl
movzx eax, byte [rsp + rax + 0x150]
add eax, edx
movzx eax, al
movzx eax, byte [rsp + rax + 0x150]
movsxd rcx, dword [rsp + 0x30]
xor byte [r12 + rcx], al
mov esi, dword [rsp + 0x30]
add esi, 1
mov edx, 0x6992377e
jmp 0x180001070
cmp edx, 0xe619f67c
je 0x18000126d
cmp edx, 0xec40a0d7
jne 0x180001070
mov edx, 0x976784de
xor ebx, ebx
xor r11d, r11d
jmp 0x180001070
cmp edx, 0xa6aeaa9b
je 0x18000105c
cmp edx, 0xbda6206d
jne 0x180001070
movsxd rcx, dword [rsp + 0x2c]
movzx edx, byte [rsp + rcx + 0x150]
mov ebx, edx
add ebx, dword [rsp + 0x34]
movzx ebp, byte [rsp + rcx + 0x50]
lea r11d, [rbx + rbp]
add r11d, 0xff
add ebx, ebp
cmovns r11d, ebx
and r11d, 0xffffff00
sub ebx, r11d
movsxd rbp, ebx
movzx eax, byte [rsp + rbp + 0x150]
mov byte [rsp + rcx + 0x150], al
mov byte [rsp + rbp + 0x150], dl
mov r11d, dword [rsp + 0x2c]
add r11d, 1
mov edx, 0x976784de
jmp 0x180001070
mov dword [rsp + 0x28], r14d
mov edx, dword [rsp + 0x28]
cmp edx, 0x100
mov edx, 0xec40a0d7
mov eax, 0xe619f67c
cmovl edx, eax
jmp 0x180001070
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x2c], r11d
mov edx, dword [rsp + 0x2c]
cmp edx, 0x100
mov edx, 0xa6aeaa9b
mov eax, 0xbda6206d
cmovl edx, eax
jmp 0x180001070
mov eax, dword [rsp + 0x28]
movsxd rbp, dword [rsp + 0x28]
mov byte [rsp + rbp + 0x150], al
mov eax, dword [rsp + 0x28]
xor edx, edx
div r9d
movzx eax, byte [r10 + rdx]
mov byte [rsp + rbp + 0x50], al
mov r14d, dword [rsp + 0x28]
add r14d, 1
mov edx, 0x1afffb16
jmp 0x180001070
cmp edx, 0x395f5f02
jne 0x180001070
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180004a80
mov rax, r12
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180001530
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
mov ecx, 0x5f67e05e
mov eax, 0x531b687b
nop word cs:[rax + rax]
nop
cmp ecx, 0x5f67e05e
je 0x18000157a
cmp ecx, 0x6c3c270c
je 0x18000158e
cmp ecx, 0x531b687b
jne 0x180001560
jmp 0x180001593
mov ecx, dword [rsp + 0x24]
cmp ecx, 0xb7
mov ecx, 0x6c3c270c
cmove ecx, eax
jmp 0x180001560
add rsp, 0x28
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1800015a0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20a
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov eax, 0xd78c171
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r15d, 0xa66526ef
mov r12d, 0x63adaf8c
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xd78c170
jle 0x180001650
cmp eax, 0x63adaf8c
je 0x180001703
cmp eax, 0x25560e56
je 0x1800016c1
cmp eax, 0xd78c171
jne 0x180001610
cmp qword [rsp + 0x38], 0
mov eax, 0x25560e56
cmove eax, r12d
xor r13d, r13d
jmp 0x180001610
cmp eax, 0xa66526ef
je 0x1800016e0
cmp eax, 0xc318a29
jne 0x180001610
mov rcx, qword [rsp + 0x38]
lea rdx, [0x18001807e]
call rdi
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call rdi
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
cmp rax, 0xffffffffffffffff
sete bl
mov rcx, rax
call rbp
mov eax, 0xa66526ef
jmp 0x180001610
mov rdx, qword [rsp + 0x38]
mov ecx, 0x104
call r14
test eax, eax
mov eax, 0xc318a29
cmove eax, r15d
xor ebx, ebx
jmp 0x180001610
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x63adaf8c
mov r13d, ebx
jmp 0x180001610
mov eax, r13d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180001720
Capabilities:
Delete file
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20a
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, 0x10ab1cae
mov r15d, 0x6b05833f
mov r12, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdi, [0x18001807e]
mov rbx, qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rbp, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r14d, 0xb5533a0c
cmp eax, 0x10ab1cad
jle 0x1800017c0
cmp eax, 0x6b05833f
je 0x1800017eb
cmp eax, 0x5df783e4
je 0x180001802
cmp eax, 0x10ab1cae
jne 0x180001790
cmp qword [rsp + 0x28], 0
mov eax, 0xfa1f1e99
cmove eax, r14d
jmp 0x180001790
cmp eax, 0xb5533a0c
je 0x180001827
cmp eax, 0xfa1f1e99
jne 0x180001790
mov rdx, qword [rsp + 0x28]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov eax, 0x5df783e4
cmove eax, r15d
jmp 0x180001790
call r12
mov r8, qword [rsp + 0x30]
mov rcx, rax
xor edx, edx
call r13
mov eax, 0xb5533a0c
jmp 0x180001790
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call rbx
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call rbx
mov rcx, qword [rsp + 0x28]
call rbp
mov eax, 0x6b05833f
jmp 0x180001790
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000ce14
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000ce44
xor eax, eax
jmp 0x18000cf07
mov rbp, rbx
cmp word [rax], si
je 0x18000ce69
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000ce50
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000ce4c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000cd64
movsxd r14, eax
test eax, eax
jne 0x18000cea7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000ce3d
mov rcx, r14
call fcn.18000d4c0
mov rdi, rax
test rax, rax
jne 0x18000cec0
xor ecx, ecx
call fcn.18000af88
jmp 0x18000ce9c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000cd64
test eax, eax
jne 0x18000cef1
mov rcx, rdi
call fcn.18000af88
jmp 0x18000cefb
xor ecx, ecx
call fcn.18000af88
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x408090
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x005d30a0], 0
je 0x40814b
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.00410a40
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x005a60c8]
call fcn.00410a40
mov rcx, rsi
mov rdx, qword [0x005a60c8]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.00410a40
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x408160
xor rcx, rcx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret