joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400afde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov byte [rsp + 0x23], r8b
mov r14, rdx
mov rsi, rcx
mov rax, rdx
shld rax, rcx, 0x3f
mov r8, rdx
shr r8, 1
add r8, rax
adc r8, 0
movabs r10, 0xcccccccccccccccd
mov rax, r8
mul r10
mov rcx, qword [rsp + 0x150]
xor r13d, r13d
cmp rsi, 0xa
mov rax, r14
sbb rax, 0
movabs r11, 0xcccccccccccccccc
mov byte [rsp + 0x24], r9b
jb 0x1400aff02
shr rdx, 2
lea rax, [rdx + rdx*4]
sub r8, rax
mov eax, esi
and eax, 1
lea rax, [rax + r8*2]
test rax, rax
jne 0x1400aff02
xor r13d, r13d
nop
mov r9, r14
mov rdi, rsi
mov rsi, r14
shld rsi, rdi, 0x3f
shr r14, 1
mov r8, rsi
add r8, r14
adc r8, 0
mov rax, r8
mul r10
shr rdx, 2
lea rax, [rdx + rdx*4]
sub r8, rax
sub rsi, r8
sbb r14, 0
mov r8, rsi
imul r8, r11
mov rax, rsi
mul r10
add rdx, r8
imul r14, r10
add r14, rdx
inc r13
mov rdx, r14
mov rsi, rax
shld rdx, rax, 0x3f
mov r8, r14
shr r8, 1
add r8, rdx
adc r8, 0
mov rax, r8
mul r10
cmp rdi, 0x64
sbb r9, 0
jb 0x1400aff02
shr rdx, 2
lea rax, [rdx + rdx*4]
sub r8, rax
mov eax, esi
and eax, 1
lea rax, [rax + r8*2]
test rax, rax
je 0x1400afe70
cmp qword [rcx + 0x10], 0
je 0x1400aff8c
mov r15, qword [rcx + 0x18]
cmp rsi, 0xa
mov rax, r14
sbb rax, 0
jb 0x1400aff93
xor ebx, ebx
mov r12d, 0x63
mov rdi, rsi
mov rcx, r14
mov rbp, r14
nop
mov r8, rcx
shld r8, rdi, 0x3f
shr rbp, 1
mov r9, r8
add r9, rbp
adc r9, 0
mov rax, r9
mul r10
shr rdx, 2
lea rax, [rdx + rdx*4]
sub r9, rax
sub r8, r9
sbb rbp, 0
mov r9, r8
imul r9, r11
mov rax, r8
mul r10
add rdx, r9
imul rbp, r10
add rbp, rdx
inc rbx
cmp r12, rdi
mov edx, 0
sbb rdx, rcx
mov rdi, rax
mov rcx, rbp
jb 0x1400aff30
jmp 0x1400aff95
xor edi, edi
jmp 0x1400b00bb
xor ebx, ebx
xor eax, eax
mov rdi, r15
sub rdi, rbx
cmovb rdi, rax
mov r9, rbx
sub r9, r15
cmovb r9, rax
cmp r9, 2
jb 0x1400b0029
add r9, r13
cmp rbx, r15
mov r12, r15
cmovb r12, rbx
not r12
add r12, rbx
mov rcx, qword [rsp + 0x150]
nop dword [rax]
shrd rsi, r14, 1
shr r14, 1
mov r8, rsi
add r8, r14
adc r8, 0
mov rax, r8
mul r10
shr rdx, 2
lea rax, [rdx + rdx*4]
sub r8, rax
sub rsi, r8
sbb r14, 0
mov r8, rsi
imul r8, r11
mov rax, rsi
mul r10
add rdx, r8
imul r14, r10
add r14, rdx
mov rsi, rax
dec r12
jne 0x1400affd0
dec r9
mov r13, r9
cmp rbx, r15
ja 0x1400b003a
jmp 0x1400b00bb
mov rcx, qword [rsp + 0x150]
cmp rbx, r15
jbe 0x1400b00bb
mov r8, r14
shld r8, rsi, 0x3f
mov rbx, r14
shr rbx, 1
mov r9, r8
add r9, rbx
adc r9, 0
Function at 0x1400bedf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x1400bee60
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140102294]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400beff0
mov rax, qword [0x140102298]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x1400beeac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x1400bef35
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x1400bee90
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x1400bf042
mov rax, qword [0x140102298]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140102298]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400bf025
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400bef2e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400befa0
add dword [0x140102294], 1
cmp ebx, 8
jae 0x1400bef61
test bl, 4
jne 0x1400bf000
test ebx, ebx
je 0x1400bef56
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400bf014
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x1400bef56
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x1400bef7a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140102298]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400bef2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x1400beeb7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x1400bef56
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x1400bef56
mov rax, qword [0x140102298]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x1400bf610
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140102300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401022e0]
test rbx, rbx
je 0x1400bf664
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400bf65b
test rsi, rsi
je 0x1400bf65b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400bf640
lea rcx, [0x140102300]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400bf8b0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x1400bf8c0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400bf8d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400bf911
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x1400bf908
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400bf913
add rax, 0x28
cmp rax, r9
jne 0x1400bf8f4
xor eax, eax
ret

Function at 0x1400bf9c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400efec0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400bfa2f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bfa2f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400bfa2d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400bfa24
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400bfa2f
add rdx, 0x28
cmp rdx, r9
jne 0x1400bfa10
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x1400bfb30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1400efec0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x1400bfb9f
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bfb9f
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x1400bfb9d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400bfb94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400bfba4
add rax, 0x28
cmp rax, r9
jne 0x1400bfb80
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400bfbc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400efec0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400bfc33
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bfc33
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400bfc33
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400bfc33
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x1400bfc27
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1400bfc40
add rdx, 0x28
cmp rdx, r10
jne 0x1400bfc13
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x1400bfc58
jmp 0x1400bfc30
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1400bfc66
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400bfc30
test r8d, r8d
jg 0x1400bfc50
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call fcn.10011f000
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100002960
add rsp, 0x28
jmp 0x100002454
Function at 0x1402037f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140203827
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140203801
ret

Function at 0x140203880
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1402038b8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140203891
ret
Function at 0x180001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180006090]
mov rdi, rcx
xor ebx, ebx
nop
test rax, rax
jne 0x180001090
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x72657375
mov dword [rbp - 0x2c], 0x642e3233
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], al
mov dword [rbp - 0x20], 0x6e616843
mov dword [rbp - 0x1c], 0x69576567
mov dword [rbp - 0x18], 0x776f646e
mov dword [rbp - 0x14], 0x7373654d
mov dword [rbp - 0x10], 0x46656761
mov dword [rbp - 0xc], 0x65746c69
mov dword [rbp - 8], 0x784572
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180006090], rax
test rax, rax
je 0x1800010a5
xor r9d, r9d
mov edx, ebx
mov rcx, rdi
lea r8d, [r9 + 1]
call rax
mov rax, qword [0x180006090]
inc ebx
cmp ebx, 0xc000
jb 0x180001020
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x1800010d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
lea rbp, [rax - 0x458]
sub rsp, 0x548
mov rdi, rcx
mov qword [0x180006098], rcx
dec edx
jne 0x180001290
test r8d, r8d
jne 0x18000128b
mov qword [rax - 0x20], rsi
xor esi, esi
lea r8, [rbp + 0x478]
lea rcx, [rbp + 0x30]
mov edx, 0x100
mov qword [rax - 0x28], r14
mov byte [rbp + 0x47e], sil
mov byte [rbp + 0x464], sil
mov dword [rbp + 0x478], 0x61636f4c
mov word [rbp + 0x47c], CreateWindowExA
mov dword [rbp + 0x460], 0x4e565354
mov dword [rbp + 0x468], 0x64255f
call qword [sym.imp.msvcrt.dll_strcpy_s]
lea r8, [rbp + 0x460]
lea rcx, [rbp + 0x30]
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcat_s]
lea r8, [rbp + 0x468]
lea rcx, [rbp + 0x30]
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcat_s]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rbp + 0x30]
xor eax, 0x2694
lea rcx, [rbp + 0x130]
mov r8d, eax
call fcn.1800022e0
lea rcx, [rbp + 0x232]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x230], si
call sub.msvcrt.dll_memset
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x130]
call fcn.1800035a0
mov r14, rax
test rax, rax
je 0x18000127c
mov rcx, rax
mov qword [rsp + 0x540], rbx
call fcn.1800034e0
mov rbx, rax
test rax, rax
je 0x18000124f
mov ecx, dword [rax]
test ecx, ecx
jne 0x180001232
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x30], sil
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov r8d, 0x100
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x30]
mov dword [rbx], 1
call fcn.180004da0
jmp 0x180001247
cmp ecx, 0xa
jne 0x180001247
mov dword [rax], 1
call fcn.1800020a0
mov esi, 1
mov rcx, rbx
call fcn.180003540
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x540]
mov eax, esi
mov rsi, qword [rsp + 0x538]
mov r14, qword [rsp + 0x530]
add rsp, 0x548
pop rdi
pop rbp
ret
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x180001262
call fcn.1800020a0
mov eax, 1
add rsp, 0x548
pop rdi
pop rbp
ret
Function at 0x180001840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
mov dword [rbp - 0x20], 0x6463627a
mov dword [rbp - 0x1c], 0x50676665
mov dword [rbp - 0x18], 0x744c4b4a
mov dword [rbp - 0x14], 0x51504f6a
mov dword [rbp - 0x10], 0x75747372
mov dword [rbp - 0xc], 0x79787776
mov dword [rbp - 8], 0x4359415a
mov dword [rbp - 4], 0x47464544
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.msvcrt.dll_srand]
call qword [sym.imp.msvcrt.dll_rand]
and eax, 0x80000007
jge 0x1800018b4
dec eax
or eax, 0xfffffff8
inc eax
add eax, 8
xor ebx, ebx
movsxd rdi, eax
test eax, eax
jle 0x1800018f0
call qword [sym.imp.msvcrt.dll_rand]
and eax, 0x8000001f
jge 0x1800018d4
dec eax
or eax, 0xffffffe0
inc eax
movsxd rcx, eax
inc rbx
movzx eax, byte [rbp + rcx - 0x20]
inc al
mov byte [rbx + rsi - 1], al
cmp rbx, rdi
jl 0x1800018c0
mov byte [rdi + rsi], 0
jmp 0x1800018f3
mov byte [rdi + rsi], bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1800020a0
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x368]
sub rsp, 0x468
xor esi, esi
lea r8, [rbp + 0x3a8]
lea rcx, [rsp + 0x60]
mov edx, 0x100
mov dword [rbp + 0x3a8], 0x61636f4c
mov word [rbp + 0x3ac], CreateWindowExA
mov ebx, esi
mov byte [rbp + 0x3ae], sil
mov dword [rbp + 0x3a0], 0x4e565354
mov byte [rbp + 0x3a4], sil
mov dword [rbp + 0x390], 0x64255f
call qword [sym.imp.msvcrt.dll_strcpy_s]
lea r8, [rbp + 0x3a0]
lea rcx, [rsp + 0x60]
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcat_s]
lea r8, [rbp + 0x390]
lea rcx, [rsp + 0x60]
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcat_s]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x60]
xor eax, 0x2694
lea rcx, [rbp + 0x60]
mov r8d, eax
call fcn.1800022e0
lea rcx, [rbp + 0x162]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x160], si
call sub.msvcrt.dll_memset
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x60]
call fcn.1800035a0
mov rdi, rax
test rax, rax
je 0x180002299
lea rax, [rsp + 0x58]
mov dword [rsp + 0x48], 4
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x398]
mov rcx, rdi
mov qword [rbp + 0x398], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x28], rax
call fcn.180002bd0
test eax, eax
jns 0x1800021ce
mov ecx, eax
call fcn.180003260
jmp 0x1800021f2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800021f2
mov eax, dword [rcx + 8]
mov ebx, dword [rcx + 4]
mov dword [0x180006058], eax
mov eax, dword [rcx + 0xc]
mov dword [0x18000605c], eax
call fcn.180003540
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180002299
mov qword [0x180006050], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowUnicode]
mov edx, 0xfffffffc
mov rcx, rbx
test eax, eax
je 0x180002257
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
lea r8, [0x180001ff0]
mov edx, 0xfffffffc
mov rcx, rbx
mov qword [0x180006070], rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
jmp 0x180002279
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
lea r8, [0x180001ff0]
mov edx, 0xfffffffc
mov rcx, rbx
mov qword [0x180006070], rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add rsp, 0x468
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, [rbp + 0x398]
lea r8, [0x180001b90]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov dword [rbp + 0x398], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800022d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x468
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180002390
Capabilities:
Create thread

Disassembly:
sub rsp, 0x98
test edx, edx
je 0x1800023cd
xor eax, eax
lea r8, [0x1800039d0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x98
ret
mov qword [rsp + 0x90], rbx
or rax, 0xffffffffffffffff
lea rbx, [0x1800060b0]
inc rax
cmp byte [rbx + rax], 0
jne 0x1800023e0
test rax, rax
jne 0x18000247f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
not eax
mov dword [rsp + 0xa8], 0x7825
mov r8d, eax
call fcn.1800039a0
xor eax, eax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov dword [rsp + 0x89], eax
mov word [rsp + 0x8d], ax
mov byte [rsp + 0x8f], al
call fcn.180004340
lea r8, [rsp + 0x50]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strcpy_s]
mov rbx, qword [rsp + 0x90]
xor eax, eax
add rsp, 0x98
ret
Function at 0x1800024c0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r12
push r15
sub rsp, 0x10
movsxd r15, dword [rcx + 0x3c]
mov r11d, r8d
mov r12, rdx
add r15, rcx
mov rbp, rcx
mov r9d, dword [r15 + 0xb0]
test r9d, r9d
je 0x18000263b
cmp dword [r15 + 0xb4], 0
je 0x18000263b
movzx eax, word [r15 + 0x14]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
lea rdx, [r15 + 0x18]
mov qword [rsp + 8], r13
add rdx, rax
mov qword [rsp], r14
cmp r9d, dword [rdx + 0xc]
jb 0x180002554
movzx r10d, word [r15 + 6]
xor r8d, r8d
test r10d, r10d
je 0x180002550
nop
mov ecx, dword [rdx + 0xc]
cmp r9d, ecx
jb 0x180002544
add ecx, dword [rdx + 8]
cmp r9d, ecx
jb 0x18000264a
inc r8d
add rdx, 0x28
cmp r8d, r10d
jb 0x180002530
or r9d, 0xffffffff
mov edi, r9d
lea r14, [r11 + rbp]
mov ecx, 0xa000
add rdi, rbp
mov r13d, 0xf000
nop dword [rax]
mov esi, dword [rdi + 4]
xor ebx, ebx
lea r11, [rdi + 8]
sub rsi, 8
shr rsi, 1
test esi, esi
jle 0x18000260f
nop dword [rax + rax]
movzx r8d, word [r11]
movzx eax, r8w
and ax, r13w
cmp ax, cx
jne 0x180002600
movsxd rcx, dword [rbp + 0x3c]
and r8d, 0xfff
add r8d, dword [rdi]
add rcx, rbp
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
cmp r8d, dword [rax + 0xc]
jb 0x1800025f0
movzx r10d, word [rcx + 6]
xor r9d, r9d
test r10d, r10d
je 0x1800025ec
mov edx, dword [rax + 0xc]
cmp r8d, edx
jb 0x1800025e0
add edx, dword [rax + 8]
cmp r8d, edx
jb 0x180002658
inc r9d
add rax, 0x28
cmp r9d, r10d
jb 0x1800025d0
or r8d, 0xffffffff
mov rax, r12
mov ecx, 0xa000
sub rax, qword [r15 + 0x30]
add qword [r8 + rbp], rax
add r11, 2
cmp r11, r14
jae 0x18000260f
inc ebx
cmp ebx, esi
jl 0x180002590
mov eax, dword [rdi + 4]
add rdi, rax
cmp rdi, r14
jae 0x180002623
cmp dword [rdi], 0
jne 0x180002570
mov r14, qword [rsp]
mov r13, qword [rsp + 8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x10
pop r15
pop r12
pop rbp
ret
mov eax, dword [rdx + 0x14]
sub eax, dword [rdx + 0xc]
add r9d, eax
jmp 0x180002554
mov ecx, dword [rax + 0x14]
sub ecx, dword [rax + 0xc]
add r8d, ecx
jmp 0x1800025f0