joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f560
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140035be0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14001f580
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14001f588
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14001f580
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14001f5dd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14001f5d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14001f580
add rax, 0x28
cmp rax, r9
jne 0x14001f5c0
xor eax, eax
ret

Function at 0x14001f5e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140035be0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14001f5ff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14001f608
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14001f5ff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14001f6a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140035be0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14001f6bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14001f6c8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400078a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140007920
cmp r11, r10
ja 0x140007997
cmp r10, rdx
ja 0x1400079a9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140007922
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140007900
jmp 0x140007984
ja 0x14000792a
mov r11, r10
cmp rax, r8
jne 0x1400078ce
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140007960
mov rdi, r8
sub ecx, edx
jns 0x14000797b
jmp 0x140007986
cmp r8, rsi
je 0x1400079b8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140007986
xor al, 1
cmp rdi, rsi
jne 0x140007940
jmp 0x140007986
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400299f0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140029810
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140029af0
int3

Function at 0x14000bc70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000bc95
cmp rax, rcx
je 0x14000bc9b
cmp rdx, 4
jae 0x14000bca2
xor eax, eax
xor r8d, r8d
jmp 0x14000bd40
pop rbp
jmp fcn.140004d50
xor eax, eax
jmp 0x14000bd57
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14002b4c0]
movdqa xmm3, xmmword [0x14002b4d0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000bcd0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000bd57
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000bd40
pop rbp
ret
Function at 0x14001e9d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140014430
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x14001ea0e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x14001ea34
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.14001e8f0
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x14001ea4d
lea rcx, [rbp - 8]
call fcn.14000f3b0
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001ea70
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x14001ea40
mov qword [rsi], rbx
test r14, r14
je 0x14001ea40
mov rcx, qword [0x140079140]
xor edx, edx
mov r8, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
Function at 0x1400246c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140024828
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x1400246fd
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140024812
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400247f5
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rbp + 4], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rbp + 4]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x14002475c
mov eax, dword [rbp + 4]
mov ecx, 2
test rax, rax
je 0x14002479f
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x1400247a3
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x40], rax
movabs rcx, 0xffffffff00000000
and rcx, rax
movabs rdx, 0x6d00000000
cmp rcx, rdx
je 0x1400247a7
movabs rdx, 0x3e500000000
cmp rcx, rdx
jne 0x1400247d1
lea rax, [rbp - 8]
jmp 0x1400247b3
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400247d7
mov qword [rbp - 8], 1
lea rax, [rbp - 0x10]
mov qword [rax], 0
lea rcx, [rbp - 0x40]
call fcn.14000f3b0
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
cmp rcx, 2
jne 0x1400247e2
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
test rcx, rcx
jne 0x140024745
mov ecx, 1
jmp 0x14002474f
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14002a290
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x14002470a
mov r8d, 0x10
mov rcx, rbx
call fcn.14002a290
mov rax, qword [rbx]
jmp 0x1400246fd
mov qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14002a570
int3
Function at 0x1800293e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x60
mov rbx, rcx
mov dword [rax - 0x28], 0
mov qword [rax - 0x20], rcx
mov qword [rax - 0x18], r8
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov eax, dword [rdx + 0x118]
shl eax, 0x10
or eax, dword [rdx + 0x11c]
cmp eax, 0x60000
jb 0x18002943b
call fcn.180028f40
mov r8, qword [rax + 0xe0]
jmp 0x180029447
call fcn.180028f40
mov r8, qword [rax + 0xd8]
lea rdx, [rsp + 0x48]
mov ecx, dword [rbx]
call r8
mov dword [rsp + 0x40], 0
jmp 0x18002945b
mov eax, dword [rsp + 0x40]
add rsp, 0x60
pop rbx
ret

Function at 0x180029470
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x1800294c8
call fcn.180028f40
add rax, 0x138
jmp 0x1800294d1
call fcn.180029250
add rax, 0x28
mov qword [rax], rbx
mov rax, qword gs:[0x30]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rbx + 8]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x18002950d
call fcn.180028f40
add rax, 0x128
jmp 0x180029516
call fcn.180029250
add rax, 0x18
mov qword [rax], rdi
mov rax, qword [rsi]
mov rdi, qword [rax + 0x38]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x180029550
call fcn.180028f40
add rax, 0x130
jmp 0x180029559
call fcn.180029250
add rax, 0x20
mov qword [rax], rdi
call fcn.180029250
mov ecx, dword [rsp + 0x80]
xor edi, edi
mov byte [rsp + 0x38], 1
mov r9, rbx
mov qword [rsp + 0x30], rdi
mov r8, rbp
mov dword [rax + 0x30], ecx
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsi]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.18002dbe0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x1800295c6
call fcn.180028f40
add rax, 0x138
jmp 0x1800295cf
call fcn.180029250
add rax, 0x28
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov qword [rax], rdi
mov eax, 1
mov rdi, qword [rsp + 0x68]
mov dword [rcx], 1
add rsp, 0x40
pop r14
ret
Function at 0x18002be60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x180041880]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18002be9c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.180028098
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18002bf58
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18002bfbe
test ebx, ebx
jne 0x18002bfbe
lea ecx, [rax + 2]
call fcn.180028098
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180025f60
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x18002c840
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x180041880]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov rdi, rdx
mov esi, ecx
test rdx, rdx
je 0x18002c8ac
mov edx, 0x2d
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x18002c8ac
xor ebx, ebx
lea r8, [rsp + 0x120]
mov ecx, ebx
mov rdx, rdi
nop
movsx eax, byte [rdx]
test al, al
je 0x18002c8dc
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x18002c890
bt dword [0x180036fa8], 0
lea rdx, str.setlocale
lea rcx, [0x180041a78]
call fcn.18002efb0
test rax, rax
je 0x18002c9b5
mov rdx, rdi
mov ecx, esi
call rax
jmp 0x18002c9b5
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x18002c9da
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x18002c8ac
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18002c8ac
movsxd rcx, eax
lea r8, [rsp + 0x320]
mov edx, 0x5f
mov r9d, 0x100
sub r9d, eax
mov word [rsp + rcx*2 + 0x31e], dx
lea r8, [r8 + rcx*2]
mov edx, 0x1002
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18002c8ac
lea rax, [rsp + 0x320]
lea rcx, [rsp + 0x20]
movzx edx, word [rax]
test dx, dx
je 0x18002c9a3
mov byte [rcx], dl
inc ebx
inc rcx
add rax, 2
cmp ebx, 0x100
jne 0x18002c983
jmp 0x18002c8ac
movsxd rax, ebx
lea rdi, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
jmp 0x18002c8ac
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.180025f60
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18002746c
int3
Function at 0x18002e110
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x18002e168
call fcn.180028f40
mov ecx, dword [rax + 0x2c0]
jmp 0x18002e170
call fcn.180029250
mov ecx, dword [rax + 0x10]
mov rdi, qword [rsp + 0xa0]
test ecx, ecx
jne 0x18002e1ac
mov eax, dword [rbx]
cmp eax, 0xe06d7363
je 0x18002e1ac
cmp eax, 0x80000029
jne 0x18002e19c
cmp dword [rbx + 0x18], 0xf
jne 0x18002e1a3
cmp qword [rbx + 0x60], 0x19930520
je 0x18002e1ac
cmp eax, 0x80000026
je 0x18002e1ac
test byte [rdi], 0x20
jne 0x18002e337
mov r8d, dword [rbx + 4]
test r8b, 0x66
je 0x18002e270
movsxd rax, dword [rdi + 8]
test eax, eax
je 0x18002e337
mov rdx, rax
lea r9, [0x180000000]
add rdx, qword [rsi + 8]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r9 + 0x35390]
movzx ecx, byte [rcx + r9 + 0x353a0]
sub rdx, rax
mov eax, dword [rdx - 4]
shr eax, cl
test eax, eax
je 0x18002e337
cmp dword [rsp + 0xa8], 0
jne 0x18002e337
test r8b, 0x20
je 0x18002e25d
mov eax, dword [rbx]
cmp eax, 0x80000026
jne 0x18002e23e
mov r8, qword [rsi + 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.180030400
mov r9d, eax
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.18002d3a0
jmp 0x18002e337
cmp eax, 0x80000029
jne 0x18002e25d
mov r9d, dword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.18002d3a0
jmp 0x18002e337
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.180028ac0
jmp 0x18002e337
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.18002cf30
cmp dword [rsp + 0x40], 0
jne 0x18002e291
test byte [rdi], 0x40
je 0x18002e337
cmp dword [rbx], 0xe06d7363
jne 0x18002e2fd
cmp dword [rbx + 0x18], 3
jb 0x18002e2fd
cmp dword [rbx + 0x20], 0x19930522
jbe 0x18002e2fd
mov rax, qword [rbx + 0x30]
cmp dword [rax + 8], 0
je 0x18002e2fd
call fcn.180029010
mov rcx, qword [rbx + 0x30]
movsxd rdx, dword [rcx + 8]
add rax, rdx
je 0x18002e2fd
movzx ecx, byte [rsp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x38], ecx
mov r8, r14
mov rcx, qword [rsp + 0xb0]
mov rdx, rbp
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call rax
jmp 0x18002e33c
mov rax, qword [rsp + 0xb0]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov eax, dword [rsp + 0xa8]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rcx, rbx
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
call fcn.18002e360
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140004bc7
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140011fb0
mov r15, qword [0x14001f45c]
cmp r15, 1
jne 0x140004c96
push qword [0x14001f54c]
pop rcx
call fcn.14000d17c
mov r15, rax
and r15, r15
jle 0x140004c2c
mov rcx, qword [0x14001f54c]
call fcn.14000d184
mov rcx, qword [0x14001f54c]
call fcn.14000d198
or rax, rax
je 0x140004c2c
mov rbp, qword [0x14001f554]
push qword [rbp + 0x10]
pop rcx
call fcn.14000d58c
jmp 0x140004c09
push qword [0x14001f53c]
pop rcx
call fcn.14000d17c
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004c96
push 5
push 0
push 1
push qword [0x14001f53c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140008c40
mov rcx, qword [0x14001f53c]
call fcn.14000d184
mov rcx, qword [0x14001f53c]
call fcn.14000d198
or rax, rax
je 0x140004c96
mov rbp, qword [0x14001f544]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004c73
mov rax, 1
jmp 0x140004ca2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006178
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001e180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140020140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001f588]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x14001f588]
call fcn.140011838
lea rcx, [0x140020140]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xchg esp, eax
mov edx, dword [rbp - 0x1380fbe9]
invalid
test eax, 0x1fe46ca6
ret
and dword [rdx], ebp
invalid
sub byte [rcx + 0x46], al
shl dword [rsi - 0x2a], cl
and ch, byte [rbx*2 - 0x63f39863]
invalid
mov ebp, 0xa525fab1
invalid
invalid
and al, byte [rdi + 0x37129612]
invalid
invalid
mov edi, 0x90cfc322
cmp al, 0xd5
adc eax, 0x297ef79b
movabs byte [0xebef1cc3504409cc], al
mov edi, 0x87188d90
invalid
Function at 0x14001f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x48
mov r11, rcx
mov r10, rdx
xor ecx, ecx
cmp r8, 0xffffffffffffffff
jne 0x14001f065
movzx eax, byte [rdx]
mov r8d, ecx
test al, al
je 0x14001f057
nop dword [rax]
imul ecx, ecx, 0x1003f
inc r8
movzx eax, al
add ecx, eax
movzx eax, byte [rdx + r8]
test al, al
jne 0x14001f040
mov edx, ecx
test r8, r8
jne 0x14001f092
xor eax, eax
add rsp, 0x48
ret
mov rdx, rcx
test r8, r8
je 0x14001f057
nop dword [rax]
movzx eax, byte [rdx + r10]
test al, al
je 0x14001f08b
imul ecx, ecx, 0x1003f
inc rdx
add ecx, eax
cmp rdx, r8
jb 0x14001f070
jmp 0x14001f057
mov ecx, reloc.WS2_32.dll_recvfrom
mov edx, ecx
mov eax, r9d
mov qword [rsp + 0x40], rbx
xor eax, ecx
mov qword [rsp + 0x20], r10
mov ebx, 0xffffffff
mov dword [rsp + 0x28], r8d
cmp r9d, ebx
mov dword [rsp + 0x30], r9d
lea rcx, [r11 + 0x110]
cmove eax, edx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], eax
call fcn.14001de20
test rax, rax
je 0x14001f0d3
mov ebx, dword [rax + 0xc]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret

Function at 0x1400234e0
Capabilities:
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140660880]
xor rax, rsp
mov qword [rbp + 0x47], rax
cmp dword [0x1406619b8], 0
jne 0x1400235d6
xorps xmm0, xmm0
mov word [rsp + 0x20], 2
xor eax, eax
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x22], xmm0
mov dword [rbp + 9], eax
movups xmmword [rbp - 0x77], xmm0
mov word [rbp + 0xd], ax
movups xmmword [rbp - 0x67], xmm0
movups xmmword [rbp - 0x57], xmm0
movups xmmword [rbp - 0x47], xmm0
movups xmmword [rbp - 0x37], xmm0
movups xmmword [rbp - 0x27], xmm0
movups xmmword [rbp - 0x17], xmm0
movups xmmword [rbp - 7], xmm0
call fcn.140022880
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rbp - 0x79]
mov eax, dword [rbp + 0x37]
movaps xmmword [0x140661920], xmm0
movaps xmmword [0x140661930], xmm1
movaps xmm1, xmmword [rbp - 0x59]
movaps xmmword [0x140661950], xmm1
movaps xmm1, xmmword [rbp - 0x39]
movaps xmmword [0x140661970], xmm1
movaps xmm1, xmmword [rbp - 0x19]
mov dword [rbp - 0x69], eax
movaps xmm0, xmmword [rbp - 0x69]
movaps xmmword [0x140661940], xmm0
movaps xmm0, xmmword [rbp - 0x49]
movaps xmmword [0x140661960], xmm0
movaps xmm0, xmmword [rbp - 0x29]
movaps xmmword [0x140661980], xmm0
movaps xmm0, xmmword [rbp - 9]
movaps xmmword [0x140661990], xmm1
movsd xmm1, qword [rbp + 7]
movaps xmmword [0x1406619a0], xmm0
movsd qword [0x1406619b0], xmm1
mov dword [0x1406619b8], 1
lea rax, [0x140661920]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140233310
add rsp, 0x100
pop rbp
ret

Function at 0x1400272d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
movzx r9d, r8b
mov r10, rcx
shr rax, 6
lea rax, [rcx + rax*8]
movzx ecx, dl
and cl, 0x3f
mov rdx, 0xffffffffffffffff
shl rdx, cl
lea rcx, [r9 - 1]
xor rcx, qword [rax]
and rdx, rcx
jne 0x14002730d
nop
add rax, 8
lea rdx, [r9 - 1]
xor rdx, qword [rax]
je 0x140027300
sub rax, r10
sar rax, 3
bsf rcx, rdx
shl rax, 6
add rax, rcx
ret
Function at 0x140029450
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 0x18]
mov rax, rdx
test r9, r9
je 0x14002947e
cmp r8, 0xffffffffffffffff
jne 0x140029470
inc r8
cmp byte [rdx + r8], 0
jne 0x140029466
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
add rsp, 0x28
ret
Function at 0x140032710
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140660880]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1406619c8]
nop
test eax, eax
jne 0x140032786
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
dec eax
mov ecx, eax
shr ecx, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or eax, ecx
mov ecx, eax
shr ecx, 4
or ecx, eax
mov edx, ecx
shr edx, 8
or edx, ecx
mov eax, edx
shr eax, 0x10
or eax, edx
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x20]
mov qword [0x1406619d0], rax
mov eax, 1
xchg dword [0x1406619c8], eax
mov rax, qword [0x1406619d0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140233310
add rsp, 0x68
ret