joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f650
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x14002f6c5
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x14002f6eb
mov rcx, rdx
jmp 0x14002f6f2
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14002f72a
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x14002f704
mov rax, qword [rax]
jmp 0x14002f6e1
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x14002f716
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret

Function at 0x140037a20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rdi
mov word [rcx], di
mov byte [rcx + 0x20], dil
mov dword [rsp + 0x20], 1
mov rcx, qword [rcx + 0x10]
mov rdx, rcx
mov esi, 0x104
cmp rcx, rsi
jae 0x140037a82
mov rax, rcx
shr rax, 1
add rdx, rax
cmp rdx, rsi
cmovb rdx, rsi
cmp rdx, rcx
ja 0x140037aa0
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x140037a97
mov rax, qword [rbx]
jmp 0x140037a9a
mov rax, rbx
mov word [rax + rdx*2], di
jmp 0x140037aae
xor r8d, r8d
sub rdx, rcx
mov rcx, rbx
call fcn.1400308b0
cmp qword [rbx + 0x18], 8
jb 0x140037aba
mov rdx, qword [rbx]
jmp 0x140037abd
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r9, qword [rbx + 0x10]
mov rcx, rdi
cmp qword [rbx + 0x18], 8
jb 0x140037ad8
mov rdx, qword [rbx]
jmp 0x140037ae0
mov rdx, rbx
nop dword [rax + rax]
cmp rcx, r9
ja 0x140037af1
movzx eax, word [rdx + rcx*2]
inc rcx
test ax, ax
jne 0x140037ae0
lea rdx, [rcx - 1]
cmp rdx, r9
ja 0x140037b13
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x140037b0a
mov rax, qword [rbx]
jmp 0x140037b0d
mov rax, rbx
mov word [rax + rdx*2], di
jmp 0x140037b21
xor r8d, r8d
sub rdx, r9
mov rcx, rbx
call fcn.1400308b0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140038660
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x140038680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x40
xor bpl, bpl
test r8b, r8b
mov rbx, rdx
mov edx, 2
mov eax, 4
cmovne eax, edx
cmp qword [rcx + 0x18], 8
jb 0x1400386af
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
lea edx, [r9 + 4]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400386ef
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp qword [rbx + 0x18], 0x10
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x60], 0
jb 0x140038705
mov rbx, qword [rbx]
lea r9, [rsp + 0x60]
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
movzx ebx, bpl
test eax, eax
cmovne ebx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x58]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140039150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r8d, r8w
jmp 0x140039160
push rsi
push rdi
push r14
sub rsp, 0x10
movsxd rax, dword [rdx + 0x3c]
mov rdi, r8
mov r11, rdx
mov esi, dword [rax + rdx + 0x88]
test esi, esi
je 0x140039273
mov r14d, dword [rax + rdx + 0x8c]
test r14d, r14d
je 0x140039273
lea rcx, [rdx + rsi]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, dword [rcx + 0x20]
mov qword [rsp + 0x40], r12
mov r12d, dword [rcx + 0x1c]
mov qword [rsp + 8], r13
mov r13d, dword [rcx + 0x14]
mov qword [rsp], r15
mov r15d, dword [rcx + 0x24]
mov eax, 0xffff0000
add r12, rdx
add r15, rdx
add rbp, rdx
test rax, r8
jne 0x1400391da
movzx eax, r8w
sub eax, dword [rcx + 0x10]
jmp 0x140039252
movsxd rbx, dword [rcx + 0x18]
xor r10d, r10d
mov r9d, r10d
test rbx, rbx
jle 0x140039222
nop dword [rax]
mov eax, dword [rbp + r9*4]
mov r8, rdi
add rax, r11
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140039213
inc rax
test ecx, ecx
jne 0x140039200
test edx, edx
je 0x140039245
inc r9
inc r10d
cmp r9, rbx
jl 0x1400391f0
xor eax, eax
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret
test r10d, r10d
js 0x140039222
movsxd rax, r10d
movzx eax, word [r15 + rax*2]
test eax, eax
js 0x140039222
cmp eax, r13d
jge 0x140039222
cdqe
mov ecx, dword [r12 + rax*4]
cmp ecx, esi
jbe 0x14003926d
lea eax, [r14 + rsi]
cmp ecx, eax
jb 0x140039222
lea rax, [r11 + rcx]
jmp 0x140039224
xor eax, eax
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret
Function at 0x140039160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r8d, r8w
jmp 0x140039160
push rsi
push rdi
push r14
sub rsp, 0x10
movsxd rax, dword [rdx + 0x3c]
mov rdi, r8
mov r11, rdx
mov esi, dword [rax + rdx + 0x88]
test esi, esi
je 0x140039273
mov r14d, dword [rax + rdx + 0x8c]
test r14d, r14d
je 0x140039273
lea rcx, [rdx + rsi]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, dword [rcx + 0x20]
mov qword [rsp + 0x40], r12
mov r12d, dword [rcx + 0x1c]
mov qword [rsp + 8], r13
mov r13d, dword [rcx + 0x14]
mov qword [rsp], r15
mov r15d, dword [rcx + 0x24]
mov eax, 0xffff0000
add r12, rdx
add r15, rdx
add rbp, rdx
test rax, r8
jne 0x1400391da
movzx eax, r8w
sub eax, dword [rcx + 0x10]
jmp 0x140039252
movsxd rbx, dword [rcx + 0x18]
xor r10d, r10d
mov r9d, r10d
test rbx, rbx
jle 0x140039222
nop dword [rax]
mov eax, dword [rbp + r9*4]
mov r8, rdi
add rax, r11
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140039213
inc rax
test ecx, ecx
jne 0x140039200
test edx, edx
je 0x140039245
inc r9
inc r10d
cmp r9, rbx
jl 0x1400391f0
xor eax, eax
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret
test r10d, r10d
js 0x140039222
movsxd rax, r10d
movzx eax, word [r15 + rax*2]
test eax, eax
js 0x140039222
cmp eax, r13d
jge 0x140039222
cdqe
mov ecx, dword [r12 + rax*4]
cmp ecx, esi
jbe 0x14003926d
lea eax, [r14 + rsi]
cmp ecx, eax
jb 0x140039222
lea rax, [r11 + rcx]
jmp 0x140039224
xor eax, eax
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret

Function at 0x1400392e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140039310
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140039320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, 0x5a4d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp word [rdx], ax
je 0x140039351
xor eax, eax
jmp 0x140039366
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
je 0x140039362
xor eax, eax
jmp 0x140039366
mov eax, dword [rax + rdx + 0x50]
mov rcx, qword [rcx]
mov r9d, 0x3000
mov r8d, eax
xor edx, edx
mov ebp, eax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x1400393de
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.140049ef0
mov r9, rbx
mov r8, r14
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.1400397c0
mov rdx, rbx
mov rcx, rsi
call fcn.140039560
mov rdx, rbx
mov rcx, rsi
call fcn.140039480
xor r8d, r8d
test al, al
jne 0x1400393e2
mov rcx, qword [rsi]
mov r9d, 0x8000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140039405
movsxd rax, dword [rbx + 0x3c]
mov edx, 1
mov rcx, rbx
mov qword [rax + rbx + 0x30], rbx
movsxd rax, dword [rbx + 0x3c]
mov r9d, dword [rax + rbx + 0x28]
add r9, rbx
call r9
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140039480
Capabilities:
Link function at runtime on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rdx + 0x3c]
mov rbp, rdx
mov esi, dword [rax + rdx + 0x90]
add rsi, 0xc
add rsi, rdx
cmp dword [rsi], 0
je 0x14003953a
movabs r14, 0x8000000000000000
movabs r15, 0x7fffffffffffffff
nop word [rax + rax]
mov ebx, dword [rsi]
add rbx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400394f7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140039555
mov ebx, dword [rsi + 4]
add rbx, rbp
cmp qword [rbx], 0
je 0x140039531
mov rax, qword [rbx]
mov rcx, rdi
test r14, rax
je 0x140039516
and rax, r15
mov rdx, rax
jmp 0x14003951d
lea rdx, [rbp + 2]
add rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rbx, 8
mov qword [rbx - 8], rax
cmp qword [rbx], 0
jne 0x140039503
add rsi, 0x14
cmp dword [rsi], 0
jne 0x1400394d0
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x14003953c
Function at 0x140042920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sar r8, 1
add r8, r8
je 0x140042964
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140042950
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret

Function at 0x14004a284
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
test dword [reloc.WS2_32.dll_accept], 0x80000000
je 0x14004a2a7
mov ecx, dword [0x1400d31d4]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, rax
test rax, rax
jne 0x14004a2af
call fcn.14005de1c
mov rcx, rax
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax + 0x38]

Function at 0x1400511e4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400d31d4]
xor edx, edx
jmp fcn.140052604

Function at 0x140051ae4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400d31d4]
jmp fcn.140052604

Function at 0x140051c34
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x1400677d0
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r13, r9
mov r12, r8
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov qword [rax + 8], rcx
call fcn.14004b79c
nop
mov edi, dword [rbx + 4]
mov esi, dword [rbx + 4]
dec esi
mov eax, dword [rbx]
cmp esi, eax
jl 0x1400677aa
lea ebp, [rsi + 1]
movsxd r15, esi
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
mov r14, qword [rax + rcx*8]
test r14, r14
je 0x1400677a0
mov rdx, r12
mov rcx, r14
call qword [rsp + 0x78]
test al, al
je 0x1400677a0
mov rdx, r12
mov rcx, r14
call r13
test al, al
je 0x1400677a0
cmp ebp, edi
jne 0x140067790
dec edi
jmp 0x1400677a0
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
and qword [rax + rcx*8], 0
dec esi
dec ebp
mov eax, dword [rbx]
cmp esi, eax
jge 0x140067756
xchg dword [rbx + 4], edi
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14004b7e4
add rcx, 0xb0
jmp 0x14006770c

Function at 0x140052604
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140052617
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x20]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14004d6a8
lea rdx, [0x1400be5b0]
lea rcx, [rsp + 0x20]
call fcn.140048f3c
int3

Function at 0x140055fc8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140055e30

Function at 0x1400675d4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x140067690]
add rcx, 0x40
jmp fcn.14005f6b8
Function at 0x140067668
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x1400676a0]
add rcx, 0x40
jmp fcn.14005f6b8
Function at 0x1800043c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1800043f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180004660
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800046a0
sub r9, 1
jne 0x180004690
mov bpl, reloc.WS2_32.dll_listen
lea rdi, [rsi + 0xd0]
lea r14, [0x1800e4650]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x180004740
inc r8
sub r9, 1
jne 0x180004730
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x180004780
sub r8, 1
jne 0x180004770
mov rcx, rbx
call fcn.1800043c0
sub rdi, 0x10
add bpl, 0xff
jne 0x1800046d0
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x180004820
inc r8
sub r9, 1
jne 0x180004810
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x180004850
sub rdx, 1
jne 0x180004842
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800260a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xab7], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x180026169
cmp qword [rcx + 0x268], 0
je 0x18002611e
mov qword [rsp + 0x40], rbx
call fcn.180014010
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.180014360
mov rcx, qword [rdi + 0x1e0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x268]
movzx edx, bl
mov rcx, rdi
call fcn.180014360
mov rbx, qword [rsp + 0x40]
jmp 0x180026169
mov ecx, esi
test edx, edx
je 0x18002612e
sub ecx, 1
je 0x18002612e
cmp ecx, 1
jne 0x180026169
mov r9, qword [rdi + 0x1d8]
lea rax, [0x1800c7240]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.18009daf4
mov r9, qword [rdi + 0x1d8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call fcn.18009daf4
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x180027f20
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1800a9a64
cdqe
add rsp, 0x28
ret
Function at 0x180028210
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1800c7470]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x18002823a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x1800c7480]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800c7490]
mov rcx, rbx
mov r14, rax
call fcn.18009fcc0
test rax, rax
je 0x18002829d
mov rcx, rbx
test r14, r14
je 0x180028287
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1800282d5
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800282d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x180028398
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x180028300
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x18002838a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18002838a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x180028330
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x180028344
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x180028360
mov rcx, rdi
test r14, r14
je 0x180028381
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x180028387
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.18009de5c]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret