joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800af4f0
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdx, qword [0x18012c7e8]
mov rsi, rcx
mov rcx, qword [0x18012c7e0]
xor edi, edi
cmp rcx, rdx
jne 0x1800af534
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
jmp 0x1800af6c5
mov qword [rsp + 0xb0], r14
xorps xmm0, xmm0
mov r14, rdx
mov qword [rbp - 0x10], rdi
sub r14, rcx
movdqu xmmword [rbp - 0x20], xmm0
sub r14, 1
je 0x1800af5aa
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x1800af6e5
mov rdx, r14
mov qword [rsp + 0xa8], rbx
lea rcx, [rbp - 0x20]
call fcn.1800c4130
mov rbx, qword [rbp - 0x20]
mov r8, r14
mov rcx, rbx
xor edx, edx
call fcn.1800d0180
mov rdx, qword [0x18012c7e8]
lea rax, [rbx + r14]
mov rcx, qword [0x18012c7e0]
mov rbx, qword [rsp + 0xa8]
mov qword [rbp - 0x18], rax
mov r8d, 1
sub rdx, rcx
sub rdx, r8
je 0x1800af5e1
nop dword [rax + rax]
movzx ecx, byte [rcx + r8]
lea r8, [r8 + 1]
mov rax, qword [rbp - 0x20]
mov byte [rax + r8 - 2], cl
sub rdx, 1
je 0x1800af5e1
mov rcx, qword [0x18012c7e0]
jmp 0x1800af5c0
mov rax, qword [rbp - 0x20]
xor r9d, r9d
mov ecx, dword [rbp - 0x18]
xor r8d, r8d
sub ecx, eax
mov qword [rbp - 0x28], rax
inc ecx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rbp - 0x30], ecx
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1800af67c
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov qword [rbp - 0x18], rax
cmp dword [rbp - 0x40], edi
jbe 0x1800af66b
nop dword [rax + rax]
mov r8d, edi
add r8, qword [rbp - 0x38]
cmp rcx, qword [rbp - 0x10]
je 0x1800af650
movzx eax, byte [r8]
mov byte [rcx], al
mov rcx, qword [rbp - 0x18]
inc rcx
mov qword [rbp - 0x18], rcx
jmp 0x1800af660
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.1800c05e0
mov rcx, qword [rbp - 0x18]
inc edi
cmp edi, dword [rbp - 0x40]
jb 0x1800af630
mov rax, qword [rbp - 0x20]
mov qword [rsi], rax
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rcx
jmp 0x1800af6bd
mov rcx, qword [rbp - 0x20]
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
test rcx, rcx
je 0x1800af6bd
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800af6b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800af6df
call fcn.1800cd2cc
mov r14, qword [rsp + 0xb0]
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800cd010
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call fcn.1800dc358
int3
call fcn.1800c25e0
int3
Function at 0x1800af6f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x280
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 - 0x10], rbx
mov rbx, r8
mov qword [r11 - 0x20], rdi
mov rsi, rdx
mov qword [r11 - 0x30], r15
mov r15, rcx
cmp r8, r9
je 0x1800af77c
mov rdi, qword [r9 + 8]
mov rax, qword [r8 + 0x10]
mov qword [r11 - 0x18], rbp
mov rbp, qword [r9]
mov qword [r11 - 0x28], r14
sub rdi, rbp
mov r14, qword [r8]
sub rax, r14
cmp rdi, rax
jbe 0x1800af756
mov rdx, rdi
mov rcx, rbx
call fcn.1800c6750
mov r14, qword [rbx]
mov r8, rdi
mov rdx, rbp
mov rcx, r14
call fcn.1800d03a0
mov rbp, qword [rsp + 0x270]
lea rax, [r14 + rdi]
mov r14, qword [rsp + 0x260]
mov qword [rbx + 8], rax
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
mov dword [rsp + 0x34], 0x200
jb 0x1800af791
mov rdx, qword [rsi]
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15, qword [rsp + 0x258]
test eax, eax
jne 0x1800af804
xor edi, edi
cmp dword [rsp + 0x34], edi
jbe 0x1800af804
nop dword [rax + rax]
mov rdx, qword [rbx + 8]
movzx eax, byte [rsp + rdi + 0x40]
mov byte [rsp + 0x30], al
cmp rdx, qword [rbx + 0x10]
je 0x1800af7eb
mov byte [rdx], al
inc qword [rbx + 8]
jmp 0x1800af7f8
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.1800c05e0
mov eax, dword [rsp + 0x34]
inc rdi
cmp rdi, rax
jb 0x1800af7d0
mov rdx, qword [rsi + 0x18]
mov rdi, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x278]
cmp rdx, 0x10
jb 0x1800af84a
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1800af845
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800af876
mov rcx, r8
call fcn.1800cd2cc
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800cd010
add rsp, 0x280
pop rsi
ret
call fcn.1800dc358
int3
Function at 0x1800b5e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
lea rdx, [0x180129338]
lea rcx, [rsp + 0x60]
call fcn.1800bf440
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18008aa30
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.18008d5e0
mov r9, rbx
lea rcx, [rsp + 0x80]
mov r8, rax
call fcn.1800c2600
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800b5ead
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5ea8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b6024
call fcn.1800cd2cc
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
cmp rdx, 0x10
jb 0x1800b5f01
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5efc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b6024
call fcn.1800cd2cc
cmp qword [rsp + 0x98], 0x10
lea rcx, [rsp + 0x80]
cmovae rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800b5f57
test al, 0x10
je 0x1800b5f57
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1800bf440
lea rdx, [rsp + 0x80]
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1800bf440
mov rcx, rax
mov rdx, rbx
call fcn.1800b4a90
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1800b5f9a
mov rcx, qword [rsp + 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5f95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b602a
call fcn.1800cd2cc
mov rdx, qword [rdi + 0x18]
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0xf
mov byte [rsp + 0x80], 0
cmp rdx, 0x10
jb 0x1800b5ff0
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1800b5feb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b602a
mov rcx, r8
call fcn.1800cd2cc
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800cd010
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
call fcn.1800dc358
int3
call fcn.1800dc358
int3
Function at 0x1800c1060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800c1094
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800c1080
ret
Function at 0x1800e57e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800e5800
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800db4f4
or eax, 0xffffffff
jmp 0x1800e5802
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800e6f40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1800e6f1d
call fcn.1800db564
mov dword [rax], 0x16
call fcn.1800dc338
or eax, 0xffffffff
jmp 0x1800e6f3a
sub dword [rcx + 0x10], 1
jns 0x1800e6f2c
add rsp, 0x28
jmp 0x1800f1a80
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1800e6efc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x1800f1ab2
call fcn.1800db564
mov dword [rax], 0x16
call fcn.1800dc338
jmp 0x1800f1bcf
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800f1bcf
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1800f1bcf
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1800f1ae1
lock or dword [rcx + 0x14], 0x10
jmp 0x1800f1bcf
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1800f1af5
call fcn.1800f47fc
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.1800e5470
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.1800f3840
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1800f1bbd
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x1800f1b88
mov rcx, rdi
call fcn.1800e5470
cmp eax, esi
je 0x1800f1b73
mov rcx, rdi
call fcn.1800e5470
cmp eax, 0xfffffffe
je 0x1800f1b73
mov rcx, rdi
call fcn.1800e5470
movsxd rbx, eax
lea r14, [0x18012b590]
mov rcx, rdi
sar rbx, 6
call fcn.1800e5470
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1800f1b7a
lea rdx, [0x180126570]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800f1b88
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x1800f1bac
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x1800f1bac
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x1800f1bac
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x1800f1bd2
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400031e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003232
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003232
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003232
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003232
cmp dword [rcx + 0x84], 0xe
jbe 0x140003232
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003234
xor al, al
add rsp, 0x28
ret
Function at 0x140655058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406551df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140655089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065506f
add dl, dl
jne 0x140655096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406550f6
xor eax, eax
add dl, dl
jne 0x1406550a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406551ad
add dl, dl
jne 0x1406550b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406550c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406550d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406550dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406550ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14065507e
mov eax, 1
add dl, dl
jne 0x140655106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140655113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406550fb
sub eax, ebx
mov ebx, 1
jne 0x14065514c
mov ecx, 1
add dl, dl
jne 0x14065512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140655123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140655168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140655175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065515d
cmp eax, 0x7d00
jae 0x14065519b
cmp eax, 0x500
jb 0x140655196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065507e
cmp eax, 0x7f
ja 0x14065519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406551d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14065507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400183b1
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14002f8e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14006f0fb]
call fcn.1400196f3
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x14002f91e
mov rcx, qword [rbp + 0x100]
call fcn.140018447
nop
jmp 0x14002f93a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x14002f93a
mov rcx, qword [rbp + 0x100]
call fcn.140018b6d
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140018582
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14001ea30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14006f11e]
call fcn.1400196f3
nop
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc4], 0
jmp 0x14001eb06
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
cmp dword [rbp + 0xc4], eax
jae 0x14001eb7c
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0xa8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rdx, qword [rbp + 0x1e8]
mov rcx, qword [rbp + 0xe8]
call fcn.140019987
test eax, eax
jne 0x14001eb77
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
jmp 0x14001eb7e
jmp 0x14001eaf8
xor eax, eax
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140018776
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14001e6d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14006f11e]
call fcn.1400196f3
nop
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc4], 0
jmp 0x14001e7a6
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
cmp dword [rbp + 0xc4], eax
jae 0x14001e81c
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0xa8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rdx, qword [rbp + 0x1e8]
mov rcx, qword [rbp + 0xe8]
call fcn.140019987
test eax, eax
jne 0x14001e817
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
jmp 0x14001e81e
jmp 0x14001e798
xor eax, eax
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x14001899c
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
jmp 0x14003c220
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140061480]
xor rax, rbp
mov qword [rbp + 0x180], rax
lea rcx, [0x14006f11e]
call fcn.1400196f3
nop
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.140018159
lea rcx, [rbp + 0x124]
call fcn.140018af5
mov qword [rbp + 0x168], rax
mov rcx, qword [rbp + 0x1b8]
call fcn.1400189a1
add rax, 0x10
mov rcx, qword [rbp + 0x168]
mov r8, rcx
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140018d8e
nop
lea rcx, [rbp + 8]
call fcn.1400189a1
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 8]
call fcn.14001991e
mov qword [rbp + 0x170], rax
mov rcx, qword [rbp + 0x1b8]
call fcn.1400189a1
mov qword [rbp + 0x178], rax
mov rcx, qword [rbp + 0x1b8]
call fcn.14001991e
mov dword [rsp + 0x48], 1
lea rcx, [rbp + 0x44]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbp + 0x168]
mov dword [rsp + 0x38], ecx
mov rcx, qword [rbp + 0x170]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x178]
mov r8d, ecx
mov rdx, rax
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.140019360
test eax, eax
je 0x14003c37a
lea rdx, str.Encryption_failed
lea rcx, [rbp + 0x148]
call fcn.1400193d3
lea rdx, [0x14005fd88]
lea rcx, [rbp + 0x148]
call fcn.140019928
nop
mov eax, dword [rbp + 0x44]
mov edx, eax
lea rcx, [rbp + 8]
call fcn.140018c12
nop
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x1b8]
call fcn.140018fb4
nop
lea rcx, [rbp + 8]
call fcn.1400186bd
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x1400500d0]
call fcn.140019338
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.140018b3b
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x140018b6d
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140037500
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14006f0fb]
call fcn.1400196f3
nop
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x140037545
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x1400375d6
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x14003759b
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1400375a5
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14003753a
mov qword [rbp + 0x88], 0xe3
jmp 0x1400375f4
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x14003769d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x140037659
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140037663
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400375e3
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x1400376fd
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140037707
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x140018bbd
Capabilities:
Map section object

Disassembly:
jmp 0x140040a7c
jmp qword [sym.imp.ntdll.dll_NtMapViewOfSection]
Function at 0x140018d1b
Capabilities:
Terminate process

Disassembly:
jmp 0x140044000
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140018f78
Capabilities:
Create thread

Disassembly:
jmp 0x14003ce50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x14006f11e]
call fcn.1400196f3
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov rax, qword [rbp + 0x100]
mov r8, qword [rax + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14003cebf
mov edx, 0xffffffff
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140019004
Capabilities:
Parse pe header

Disassembly:
jmp 0x140043390
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400433b0
xor al, al
jmp 0x140043431
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400433c3
xor al, al
jmp 0x140043431
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400433ed
xor al, al
jmp 0x140043431
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140043401
xor al, al
jmp 0x140043431
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140043413
xor al, al
jmp 0x140043431
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14004342f
xor al, al
jmp 0x140043431
mov al, 1
add rsp, 0x38
ret