joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800017e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbp, rcx
movabs rcx, 0xffffffff00000000
mov rsi, qword [r8 + 0x30]
movzx eax, word [r8 + 0x14]
xor edi, edi
and rsi, rcx
cmp di, word [r8 + 6]
jae 0x1800018df
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r12
lea r12, [0x18000df50]
lea rbx, [rax + r8 + 0x3c]
nop word [rax + rax]
mov r9d, dword [rbx]
mov eax, r9d
mov edx, r9d
mov r10d, r9d
shr eax, 0x1d
shr edx, 0x1e
shr r10d, 0x1f
and eax, 1
and edx, 1
bt r9d, 0x19
jae 0x18000186a
mov ecx, dword [rbx - 0x1c]
mov edx, dword [rbx - 0x14]
mov r8d, 0x4000
or rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800018be
movsxd rcx, eax
movsxd rax, edx
lea rdx, [rax + rcx*2]
lea rcx, [r10 + rdx*2]
mov r10d, dword [r12 + rcx*4]
bt r9d, 0x1a
jae 0x180001888
bts r10d, 9
mov eax, dword [rbx - 0x14]
test eax, eax
jne 0x1800018a8
test r9b, 0x40
je 0x18000189b
mov eax, dword [r8 + 0x20]
jmp 0x1800018a4
test r9b, r9b
jns 0x1800018be
mov eax, dword [r8 + 0x24]
test eax, eax
je 0x1800018be
mov ecx, dword [rbx - 0x1c]
lea r9, [rsp + 0x40]
mov edx, eax
or rcx, rsi
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbp]
inc edi
add rbx, 0x28
movzx eax, word [r8 + 6]
cmp edi, eax
jl 0x180001830
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001b20
Capabilities:
Parse pe header

Disassembly:
push r12
sub rsp, 0x30
mov eax, 0x5a4d
mov r12, rcx
cmp word [0x18000df70], ax
je 0x180001b40
xor eax, eax
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x50], rsi
movsxd rsi, dword [0x18000dfac]
mov qword [rsp + 0x20], r13
lea r13, [0x18000df70]
add rsi, r13
cmp dword [rsi], 0x4550
je 0x180001b76
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x30
pop r12
ret
mov edx, dword [rsi + 0x50]
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x2000
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x180001bbd
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x180001cb6
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x1000
mov rcx, rbp
mov rdi, rax
mov qword [rax + 8], rbp
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rsi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r13
add r8d, dword [0x18000dfac]
mov rcx, rax
mov rbx, rax
call fcn.180005100
movsxd rax, dword [0x18000dfac]
mov rdx, rdi
add rax, rbx
mov rcx, rsi
mov qword [rdi], rax
mov qword [rax + 0x30], rbp
call fcn.1800016f0
mov rbx, qword [rsp + 0x40]
mov rdx, rbp
sub rdx, qword [rsi + 0x30]
je 0x180001c66
mov rcx, rdi
call fcn.1800018f0
mov rcx, rdi
call fcn.1800019a0
test eax, eax
je 0x180001ca7
mov rcx, rdi
call fcn.1800017e0
mov r11, qword [rdi]
mov eax, dword [r11 + 0x28]
test eax, eax
je 0x180001ca2
add rax, rbp
je 0x180001ca7
mov r8, r12
mov edx, 1
mov rcx, rbp
call rax
test eax, eax
je 0x180001ca7
mov dword [rdi + 0x1c], 1
mov rax, rdi
jmp 0x180001cb1
mov rcx, rdi
call fcn.180001cd0
xor eax, eax
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
add rsp, 0x30
pop r12
ret
Function at 0x18000245b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x180001dba
rol rcx, 0x10
test cx, 0xffff
jne 0x180001db6
repz ret
ror rcx, 0x10
jmp 0x1800023b4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180054640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180054738]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180002439
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180054640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000245b
mov rax, qword [rsp + 0x88]
mov qword [0x180054738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800546d8], rax
mov rax, qword [0x180054738]
mov qword [0x1800545b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800546c0], rax
mov dword [0x1800545a0], 0xc0000409
mov dword [0x1800545a4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000d008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180054638], eax
mov ecx, 1
call fcn.180004404
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180008278]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180054638], 0
jne 0x1800024e2
mov ecx, 1
call fcn.180004404
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180004b58
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800033ac
xor ebx, ebx
cmp qword [0x180055540], rbx
mov rdi, rax
jne 0x180004c6b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180004d42
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004d42
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180055540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180055548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180055550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180055560], rax
test rax, rax
je 0x180004c62
lea rdx, [0x180008e80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180055558], rax
jmp 0x180004c72
mov rax, qword [0x180055558]
jmp 0x180004c79
mov rax, qword [0x180055558]
mov r11, qword [0x180055560]
cmp rax, rdi
je 0x180004ce0
cmp r11, rdi
je 0x180004ce0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180055560]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180004ce0
test rax, rax
je 0x180004ce0
call rsi
test rax, rax
je 0x180004cda
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180004cda
test byte [rsp + 0x40], 1
jne 0x180004ce0
bts ebp, 0x15
jmp 0x180004d20
mov rcx, qword [0x180055548]
cmp rcx, rdi
je 0x180004d20
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180004d20
call rax
mov rbx, rax
test rax, rax
je 0x180004d20
mov rcx, qword [0x180055550]
cmp rcx, rdi
je 0x180004d20
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180004d20
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180055540]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180004d42
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180004d44
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001da0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180001390
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800013bf
xor eax, eax
mov qword [0x180005630], rcx
mov qword [rsp + 0x28], rax
lea r8, section..text
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400110a5
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011be0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x5a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14001e0b8]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002400f]
call fcn.1400113d4
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011c92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAllocEx_Failed_With_Error_:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011dec
mov rdx, qword [rbp + 8]
lea rcx, str._i__Allocated_Memory_At_:_0x_p__n
call fcn.1400111bd
lea rcx, str.___Press__Enter__To_Write_Payload_...
call fcn.1400111bd
call qword [sym.imp.ucrtbased.dll_getchar]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x150]
mov r8, qword [rbp + 0x148]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011ced
mov rax, qword [rbp + 0x150]
cmp qword [rbp + 0x28], rax
je 0x140011d08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____WriteProcessMemory_Failed_With_Error_:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011dec
mov rdx, qword [rbp + 0x28]
lea rcx, str._i__Successfully_Written__d_Bytes_n
call fcn.1400111bd
mov r8, qword [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x148]
call fcn.140011307
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x150]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140011d70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtectEx_Failed_With_Error_:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011dec
lea rcx, str.___Press__Enter__To_Run_...
call fcn.1400111bd
call qword [sym.imp.ucrtbased.dll_getchar]
lea rcx, str._i__Executing_Payload_...
call fcn.1400111bd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140011ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateRemoteThread_Failed_With_Error_:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011dec
lea rcx, str.___DONE___n
call fcn.1400111bd
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001b1f0]
call fcn.14001135c
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140011230
Capabilities:
Terminate process

Disassembly:
jmp 0x140012800
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112bc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014fb0
xor al, al
jmp 0x140015031
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014fc3
xor al, al
jmp 0x140015031
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014fed
xor al, al
jmp 0x140015031
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015001
xor al, al
jmp 0x140015031
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015013
xor al, al
jmp 0x140015031
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001502f
xor al, al
jmp 0x140015031
mov al, 1
add rsp, 0x38
ret
Function at 0x1400376c0
Capabilities:
Encode data using xor

Disassembly:
adc esp, dword [rbx - 0x71012b4c]
push rbx
adc eax, 0x26661d53
xor byte [rsi - 0x57083548], dl
movabs al, byte [0x44358017cb340d42]
sub dl, dl
sal ebx, cl
xchg r15d, eax
in al, dx
invalid

Function at 0x14008ed70
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
push r15
push r12
push rbp
push r13
push rbx
push r14
sub rsp, 0x1a8
lea rax, [rsp + 0xb0]
mov cx, 0xda75
mov dword [rsp + 0x190], 0x6a880e50
mov qword [rsp + 0x180], 0x6859dfca
mov dl, byte [rsp + 0x1a7]
mov byte [rsp + 0x17f], 0x24
mov byte [rsp + 0x1a7], 0x52
mov word [rsp + 0x17c], 0xcd05
mov r8, qword [rsp + 0x198]
mov r9, r8
add r9, 0xffffffff90323605
movzx r10d, word [rsp + 0x17c]
mov r11w, r10w
mov esi, 0x402a
sub esi, r10d
mov di, si
mov qword [rsp + 0x198], r9
mov word [rsp + 0x76], di
mov esi, dword [rsp + 0x194]
mov ebx, esi
not ebx
mov ebp, dword [rsp + 0x190]
xor ebp, 0x76e5b3c
mov dword [rsp + 0x194], ebx
mov dword [rsp + 0x70], ebp
mov r9, qword [rsp + 0x180]
and al, 0x80
add dword [rax], eax
add byte [rbp + 0x73379899], bh
Function at 0x140092710
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov ax, 0xe65c
mov word [rsp + 0x64], 0x4ec7
mov dword [rsp + 0x54], 0x9b8de6c
mov dl, byte [rsp + 0x67]
mov r8w, word [rsp + 0x64]
sub ax, r8w
mov word [rsp + 0x52], ax
mov r9d, dword [rsp + 0x54]
xor r9d, 0x9b8de6c
mov r10, qword [0x14009d1a0]
mov dword [rsp + 0x4c], r9d
cmp r10, 0
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x3f], dl
mov qword [rsp + 0x30], r10
je 0x14009279e
jmp 0x1400927a7
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov ecx, dword [rsp + 0x54]
add ecx, 0xf6472195
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x2c], ecx
mov rcx, rax
mov rdx, qword [rsp + 0x30]
call rdx
mov r8d, dword [rsp + 0x2c]
mov dword [rsp + 0x4c], r8d
mov byte [rsp + 0x67], 0xbd
mov eax, dword [rsp + 0x4c]
add rsp, 0x68
ret
mov ax, word [rsp + 0x64]
xor ax, 0x144
cmp ax, word [rsp + 0x52]
ja 0x1400927a7
jmp 0x140092768
Function at 0x180005d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180005dd1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180005d90
mov ecx, dword [r9]
jmp 0x180005eb8
cmp ecx, 0x4e0
jb 0x180005eb8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180005df0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180005e40
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800073b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x180089a20]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x180007429
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1800073d0
test r8, r8
je 0x18000744d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x180007430
not ecx
mov eax, ecx
ret
Function at 0x180023a20
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, qword [0x1800ac638]
mov edx, 0xfffffff0
mov rcx, rdi
mov byte [0x1800ac738], 1
mov byte [0x1800ac610], 0
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov edx, 3
mov rcx, rdi
mov qword [0x1800acbd8], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov edx, 0xfffffff0
mov rcx, rdi
and rax, 0xffffffffff30ffff
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x20], eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]

Function at 0x180023ae0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, qword [0x1800ac638]
mov edx, 0xfffffff0
mov r8, qword [0x1800acbd8]
mov rcx, rdi
mov byte [0x1800ac738], 0
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x30], 4
lea r9d, [rbx - 0xf1]
cdq
mov dword [rsp + 0x28], 0x1e2
sub eax, edx
mov dword [rsp + 0x20], 0x358
sar eax, 1
mov rdx, rdi
mov rcx, rdi
lea r8d, [rax - 0x1ac]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180025c90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180025ced
lea rbx, [0x18008f6e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180025cd4
cmp r10, 2
jb 0x180025cd4
cmp byte [r9], r8b
jne 0x180025cd4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180025cb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180025d2f
lea rbx, [0x18008f6e0]
cmp r8b, 0x23
jne 0x180025d13
cmp byte [r9], r8b
jne 0x180025d13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180025d00
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180025e90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180025eaa
mov qword [r8], 0
lea rdx, [0x180089098]
call fcn.180025d40
mov rbx, rax
test rax, rax
jne 0x180025eca
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180025fa1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180025fa1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180025fa1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180025fa1
cmp rdi, 0xffffffffffffffff
je 0x180025fa1
mov rax, qword [0x1800ab640]
test rax, rax
je 0x180025f3e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180025fa1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180025f8e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800ab640]
test rax, rax
je 0x180025f83
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180025faa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180025f9c
mov qword [r14], rdi
mov rax, rsi
jmp 0x180025fac
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret