joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002fc0
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, qword [0x140006a30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rsi, [rsp + 0x3c]
xor eax, eax
mov rdi, rcx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov dword [rsp + 0x3c], eax
call fcn.1400017e0
cmp eax, 0x6f
je 0x14000300a
xor eax, eax
jmp 0x14000308c
mov edx, dword [rsp + 0x3c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbx, rax
je 0x140003003
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
lea r12, [rsp + 0x42]
xor ecx, ecx
mov rsi, rbx
call fcn.1400017e0
cmp dword [rsi + 0x58], 6
jne 0x140003075
mov eax, dword [rsi + 0x50]
mov r8d, 3
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x42], eax
mov ax, word [rsi + 0x54]
mov word [rsp + 0x46], ax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x140003075
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x14000308c
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x14000303d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140003003
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rbp]
je 0x14000309c
call fcn.1400028b0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140003140
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [0x140006a30]
mov rsi, qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call rsi
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
call rsi
mov edx, dword [rsp + 0x30]
xor eax, eax
cmp dword [rsp + 0x28], edx
jne 0x14000318e
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x2c], eax
sete al
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
je 0x14000319d
call fcn.1400028b0
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x1400031b0
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x160
mov rdi, qword [0x140006a30]
xor edx, edx
mov rax, qword [rdi]
mov qword [rsp + 0x158], rax
xor eax, eax
mov rsi, rcx
mov ecx, 2
mov dword [rsp + 0x28], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rbp, [rsp + 0x28]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
lea r12, [rsp + 0x54]
test eax, eax
jne 0x140003208
xor eax, eax
jmp 0x14000322a
mov rdx, rbp
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140003204
mov rdx, rsi
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
jne 0x140003208
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x158]
sub rdx, qword [rdi]
je 0x14000323c
call fcn.1400028b0
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140003250
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x140006a30]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x48], 1
setbe al
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
je 0x140003288
call fcn.1400028b0
add rsp, 0x60
pop rbx
ret

Function at 0x140003290
Capabilities:
Get local ipv4 addresses

Disassembly:
sub rsp, 0x28
lea rcx, [0x140006090]
call fcn.140002fc0
test al, al
jne 0x140003304
lea rcx, [0x140006094]
call fcn.140002fc0
test al, al
jne 0x140003304
lea rcx, [0x140006098]
call fcn.140002fc0
test al, al
jne 0x140003304
lea rcx, [0x14000609c]
call fcn.140002fc0
test al, al
jne 0x140003304
lea rcx, [0x1400060a0]
call fcn.140002fc0
test al, al
jne 0x140003304
lea rcx, [0x1400060a4]
call fcn.140002fc0
test al, al
jne 0x140003304
lea rcx, [0x1400060a8]
add rsp, 0x28
jmp fcn.140002fc0
mov al, 1
add rsp, 0x28
ret

Function at 0x140003310
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, qword [0x140006a30]
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x28], 0x40
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rsp + 0x30], 0x7fffffff
setbe al
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rbx]
je 0x140003354
call fcn.1400028b0
add rsp, 0x70
pop rbx
ret

Function at 0x140003560
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, qword [0x140006a30]
lea rsi, section..rdata
mov rax, qword [rbx]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, rcx
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea r10, [rsp + 0x148]
mov r11, rdx
lea rbp, [rsp + 0x48]
mov rdx, rax
mov byte [rax + r10], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx + 0x28]
mov byte [rax + rbp - 1], dl
cmp rax, 0x100
jne 0x1400035ab
mov r12, r10
xor esi, esi
xor r13d, r13d
mov edi, 0x100
movzx eax, byte [r12]
movzx edx, byte [rbp + rsi]
inc rsi
add eax, r13d
add eax, edx
cdq
idiv edi
movsxd rcx, edx
mov rdx, r12
inc r12
mov r13, rcx
add rcx, r10
call fcn.140002f40
cmp rsi, 0x100
jne 0x1400035d5
lea rdi, [r9 + r11]
xor ebp, ebp
xor r12d, r12d
cmp rdi, r9
je 0x140003665
lea eax, [rbp + 1]
cdq
idiv esi
movsxd r13, edx
movzx eax, byte [rsp + r13 + 0x148]
lea rcx, [r10 + r13]
mov rbp, r13
add eax, r12d
cdq
idiv esi
movsxd r14, edx
lea rdx, [r10 + r14]
mov r12, r14
call fcn.140002f40
mov cl, byte [rsp + r14 + 0x148]
add cl, byte [rsp + r13 + 0x148]
movzx ecx, cl
mov al, byte [rsp + rcx + 0x148]
xor byte [r9], al
inc r9
jmp 0x140003610
mov rax, qword [rsp + 0x248]
sub rax, qword [rbx]
je 0x140003677
call fcn.1400028b0
mov rax, r11
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140104f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140104f31
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140104f48
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140104f99
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140105011
mov rcx, rbp
call fcn.1400eb530
cmp rbx, 0xfff
jbe 0x140104ff1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140105032
cmp rbx, rax
ja 0x140104fc0
test rdi, rdi
je 0x140105011
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x140105014
jne 0x14050f496
invalid
xor eax, dword [rax]
fcos
movabs al, byte [0x39fae0fc38fc8dfb]
add byte [rdi], cl
inc byte [rsi]
add byte [rax + rax - 0x55], bh
std
jle 0x14050f4ac
jle 0x14050f4af
call qword [rsi - 2]
xchg esp, eax
std
push rax
std
push rsi
invalid
Function at 0x140105040
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140105061
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1401050dc
test rax, rax
jle 0x1401050bc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1401050dc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1401050dc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
lahf
Function at 0x140d710b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140d71237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d710e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d710c7
add dl, dl
jne 0x140d710ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d7114e
xor eax, eax
add dl, dl
jne 0x140d710fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d71205
add dl, dl
jne 0x140d7110e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d7111b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d71128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d71135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d71142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d710d6
mov eax, 1
add dl, dl
jne 0x140d7115e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d7116b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d71153
sub eax, ebx
mov ebx, 1
jne 0x140d711a4
mov ecx, 1
add dl, dl
jne 0x140d71186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d71193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d7117b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d710d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d711c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d711cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d711b5
cmp eax, 0x7d00
jae 0x140d711f3
cmp eax, 0x500
jb 0x140d711ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d710d6
cmp eax, 0x7f
ja 0x140d711f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d710d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d7122a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d710d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180043fd0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x98
mov r9d, 0x88
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800a4c70
xor r9d, r9d
mov dword [rsp + 0x28], 0xd7
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18004cc60
xor r9d, r9d
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov rbx, qword [rax]
lea ecx, [r9 + 0x69]
mov edi, dword [rbx + 0x28]
call fcn.18004dcd0
movsxd rcx, dword [rsp + 0xb0]
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x40]
lea rax, str.dummy
shl rcx, 4
add rcx, rax
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x50]
mov r8d, 0x19
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call fcn.18003e270
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str._3d:
mov rcx, rax
call fcn.1800bc2a0
mov rbx, qword [rsp + 0x48]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
xor edx, edx
mov rcx, rax
mov r8d, 0xe5
call fcn.18000b340
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x18004dcd0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea ebx, [rcx + 0x13]
mov r13, r9
mov dword [rsp + 0x80], ebx
cmp ecx, ebx
mov ebx, dword [rsp + 0x80]
mov r12, rdx
mov r14d, ecx
jae 0x18004ddfe
mov rsi, qword [rsp + 0x30]
lea r15d, [rcx - 0x56]
mov ebp, dword [rsp + 0x80]
lea rdx, [0x180000000]
mov eax, dword [rsp + 0x80]
nop dword [rax]
cmp r15d, 0x13
ja case.default.0x18004dd45
mov ecx, dword [rdx + r15*4 + 0x4df40]
add rcx, rdx
jmp rcx
mov ecx, dword [r8 + 0xc]
mov eax, dword [r13 + 0xc]
add rcx, rax
shr rsi, 0x20
jmp 0x18004df21
mov dword [r12 + 0x14], esi
shr rsi, 0x20
jmp case.0x18004dd45.18
mov eax, dword [r13 + 8]
mov ecx, dword [r8 + 8]
add rsi, rax
add rsi, rcx
mov dword [r12 + 8], esi
jmp case.0x18004dd45.18
mov esi, dword [r8]
mov eax, dword [r13]
add rsi, rax
mov dword [r12], esi
jmp case.0x18004dd45.18
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], ebp
mov edx, 0xe7
mov rcx, r12
call fcn.18004e890
mov r8, qword [rsp + 0x90]
lea rdx, [0x180000000]
jmp case.0x18004dd45.18
mov ecx, dword [r8 + 0x14]
mov eax, dword [r13 + 0x14]
add rcx, rax
shr rsi, 0x20
jmp 0x18004df21
mov dword [r12 + 4], esi
jmp case.0x18004dd45.18
mov qword [r12], 0
jmp case.0x18004dd45.18
mov ecx, 0xca
nop
mov eax, ecx
sub eax, 0xca
je 0x18004de18
cmp eax, 1
jne 0x18004de1a
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, ebp
inc ecx
cmp ecx, 0xcc
jb 0x18004ddf0
mov dword [r12 + 0x10], esi
jmp case.0x18004dd45.18
shr rsi, 0x20
mov rdx, r12
mov ecx, 0x29
call fcn.1800953e0
mov r8, qword [rsp + 0x90]
lea rdx, [0x180000000]
lea ebp, [rsi + rax]
jmp case.0x18004dd45.18
mov ecx, dword [r8 + 0x10]
mov eax, dword [r13 + 0x10]
add rcx, rax
shr rsi, 0x20
jmp 0x18004df21
cmp ebp, 1
jbe case.0x18004dd45.18
mov edi, 0x120
cmp edi, 0x120
je 0x18004de8f
cmp edi, 0x5d60
jne 0x18004debf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x1800c867b]
mov rcx, rax
lea rdx, str.fword_ptr
lea rax, str.Protecting_0_1__because_Pointer__Weak_Vulnerable
mov qword [rsp + 0x20], rax
call fcn.1800bc2a0
add edi, 0x5c40
cmp edi, 0xb880
jbe 0x18004de78
mov r8, qword [rsp + 0x90]
lea rdx, [0x180000000]
jmp case.0x18004dd45.18
mov eax, dword [r13 + 0x1c]
mov ecx, dword [r8 + 0x1c]
add rsi, rax
add rsi, rcx
mov dword [r12 + 0x1c], esi
jmp case.0x18004dd45.18
mov dword [r12 + 0x18], esi
shr rsi, 0x20
jmp case.0x18004dd45.18
mov ecx, dword [r8 + 4]
mov eax, dword [r13 + 4]
add rcx, rax
shr rsi, 0x20
jmp 0x18004df21
mov dword [r12 + 0xc], esi
jmp case.0x18004dd45.18
mov eax, dword [r13 + 0x18]
mov ecx, dword [r8 + 0x18]
add rsi, rax
add rsi, rcx
mov eax, dword [rsp + 0x80]
inc r14d
inc r15d
cmp r14d, eax
jb 0x18004dd30
jmp 0x18004ddfe
Function at 0x18005e9e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
imul r13d, ecx, 0x521
mov rsi, r9
mov rbp, r8
mov rax, rdx
mov r15d, ecx
mov edi, ecx
cmp ecx, r13d
ja 0x18005ec65
movzx r14d, byte [rsp + 0xd0]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x50]
xor r9d, r9d
cmp edi, 0x507c
ja 0x18005eb66
je 0x18005eb38
cmp edi, 0x1980
ja 0x18005eae8
je 0x18005ea97
mov eax, edi
sub eax, 0x40
je 0x18005ea7a
sub eax, 0x45
je 0x18005ea6d
cmp eax, 0x45
jne 0x18005ec41
mov r14b, 1
jmp 0x18005ec41
mov dword [rsp + 0x58], 4
jmp 0x18005ec41
xor edx, edx
mov qword [rsp + 0x20], rsi
mov r9, rbp
xor ecx, ecx
lea r8d, [rdx + 0x28]
call fcn.180044360
mov rbx, rax
jmp 0x18005ec41
test rbx, rbx
je 0x18005ead0
nop dword [rax]
mov rax, qword [rbx]
test rax, rax
je 0x18005eada
mov r8, rbp
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18005eac3
inc rax
test ecx, ecx
jne 0x18005eab0
test edx, edx
je 0x18005eada
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x18005eaa0
mov qword [rsp + 0x50], r9
jmp 0x18005ec41
mov rax, qword [rbx + 8]
mov qword [rsp + 0x50], rax
jmp 0x18005ec41
cmp edi, 0x32c0
je 0x18005ec65
cmp edi, 0x34fe
jne 0x18005ec41
mov rcx, qword [rax]
xor r8d, r8d
mov r9, rsi
lea edx, [r8 + 0x63]
call fcn.180059040
mov qword [rsp + 0x60], rax
mov r9, rsi
lea rax, [rsp + 0x58]
xor r8d, r8d
mov edx, 0x112
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.180081770
jmp 0x18005ec41
mov qword [rsp + 0x28], r9
lea r8, [0x180017df0]
mov dword [rsp + 0x20], r9d
xor edx, edx
mov r9, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
call sub.IMM32.dll_ImmCreateContext
mov r12, rax
jmp 0x18005ec41
cmp edi, 0xefe0
ja 0x18005ec1d
je 0x18005ebfb
cmp edi, 0x6977
je 0x18005ebe4
cmp edi, 0x9df0
je 0x18005ebb4
cmp edi, 0xa02e
jne 0x18005ec41
cmp qword [rsi], 0
je 0x18005ec60
movzx eax, r14b
test r12, r12
mov ecx, r9d
cmovne ecx, eax
movzx r14d, cl
jmp 0x18005ec41
mov qword [rsp + 0x40], r9
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x38], r9
xor r8d, r8d
mov qword [rsp + 0x30], r9
xor edx, edx
mov dword [rsp + 0x28], 0x4f
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call fcn.18004df90
jmp 0x18005ec41
mov r9, rsi
lea rdx, [rsp + 0x58]
mov r8, rbp
mov ecx, 0xb1
call fcn.1800207b0
jmp 0x18005ec41
xor edx, edx
mov dword [rsp + 0xd0], 1
lea r9, [rsp + 0xd0]
mov r8, rsi
lea ecx, [rdx + 0x4b]
call fcn.180023f20
jmp 0x18005ec41
cmp edi, 0x13f92
je 0x18005ec2f
cmp edi, 0x18f44
je 0x18005ec65
jmp 0x18005ec41
test r14b, r14b
je 0x18005ec3c
mov rcx, r12
call sub.IMM32.dll_ImmDestroyContext
mov byte [rsp + 0x50], 1
imul eax, r15d, 0x65
add edi, eax
cmp edi, r13d
ja 0x18005ec65
mov rax, qword [rsp + 0xd8]
jmp 0x18005ea2d
mov byte [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a5ae0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea r13d, [rcx - 0xd]
mov rbp, r9
mov r14, r8
mov rdi, rdx
mov r15d, ecx
cmp ecx, r13d
jbe case.0x1800a5b3f.5
lea r12d, [rcx - 0x55]
xor esi, esi
lea rdx, [0x180000000]
cmp r12d, 0x42
ja case.0x1800a5b3f.13
movzx eax, byte [rdx + r12 + 0xa5d88]
mov ecx, dword [rdx + rax*4 + 0xa5d50]
add rcx, rdx
jmp rcx
and byte [0x1800e7511], 0xfe
jmp case.0x1800a5b3f.13
cmp qword [0x1800e74c8], rsi
jne case.0x1800a5b3f.13
mov ebx, 0xce
nop
mov eax, ebx
sub eax, 0xce
je 0x1800a5b74
cmp eax, 1
je case.0x1800a5b3f.5
jmp 0x1800a5b85
lea rcx, str.set_com.sun.management.jmxremote.autodiscovery
call fcn.1800bc300
mov qword [rsp + 0x30], rsi
inc ebx
cmp ebx, 0xd0
jb 0x1800a5b60
jmp 0x1800a5d02
mov r9d, 0x60
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.180022320
jmp 0x1800a5d02
test rdi, rdi
je case.0x1800a5b3f.5
movaps xmm0, xmmword [0x1800c25e0]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1800c25f0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1800c2600]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1800c2610]
movups xmmword [rdi + 0x30], xmm1
jmp case.0x1800a5b3f.13
mov ecx, 0x61
mov eax, ecx
sub eax, 0x60
je case.0x1800a5b3f.5
cmp eax, 1
jne 0x1800a5c05
mov dword [rsp + 0x30], esi
dec ecx
cmp ecx, 0x5f
ja 0x1800a5bf1
xor r8d, r8d
xor edx, edx
mov ecx, 0x87
call fcn.180005620
jmp 0x1800a5d02
xorps xmm0, xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xc0], xmm0
mov qword [rdi + 0x48], rsi
mov qword [rdi + 0x40], rsi
jmp case.0x1800a5b3f.13
mov qword [rsp + 0x28], rsi
mov r9d, 0x5d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call fcn.1800a9eb0
jmp 0x1800a5d02
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 0xda
call fcn.180084d50
jmp 0x1800a5d02
test rdi, rdi
je case.0x1800a5b3f.13
mov ebx, 0x37
cmp ebx, 0x37
je 0x1800a5cb6
cmp ebx, 0x1847
jne 0x1800a5cd9
mov rdx, qword [rdi + 0x18]
jmp 0x1800a5cc4
mov rcx, qword [rdi + 8]
mov rdx, rbp
call r14
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x1800a5cd9
mov r9, rbp
mov r8, r14
mov ecx, 0x97
call fcn.1800a5ae0
add ebx, 0x1810
cmp ebx, 0x3020
jbe 0x1800a5ca3
jmp 0x1800a5d02
mov r9, qword [0x1800e74c8]
xor edx, edx
mov r8, rdi
lea ecx, [rdx + 0x40]
call fcn.18005e9e0
mov qword [rsp + 0x30], rax
lea rdx, [0x180000000]
dec r15d
dec r12d
cmp r15d, r13d
ja 0x1800a5b22
jmp case.0x1800a5b3f.5
cmp qword [rdi], rsi
setne sil
mov dword [rsp + 0x30], esi
mov rax, qword [rsp + 0x30]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000e090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000e120
cmp r10, r11
jb 0x14000e196
cmp r10, rdx
ja 0x14000e1aa
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000e122
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000e100
jmp 0x14000e184
ja 0x14000e12a
mov r11, r10
cmp rax, r8
jne 0x14000e0c4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000e160
mov rdi, r8
sub ecx, edx
jns 0x14000e17b
jmp 0x14000e186
cmp r8, rsi
je 0x14000e1bb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000e186
xor al, 1
cmp rdi, rsi
jne 0x14000e140
jmp 0x14000e186
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14003dd00
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14003da90
ud2
lea rcx, [0x140067483]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14003db10
ud2