joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001125d
Capabilities:
Create thread

Disassembly:
jmp 0x140011880
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001c178]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x140021015]
call fcn.140011361
mov dword [rbp + 0x64], 0
mov eax, dword [0x14001c11c]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
mov eax, dword [0x14001c11c]
mov r9d, 0xf
lea r8, str.helloworld123.
mov edx, eax
lea rcx, section..data
call fcn.14001119f
mov eax, dword [0x14001c11c]
mov r8d, eax
lea rdx, section..data
mov rcx, qword [rbp + 8]
call fcn.14001139d
mov eax, dword [0x14001c11c]
lea r9, [rbp + 0x64]
mov r8d, 0x20
mov edx, eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140011978
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140019c00]
call fcn.1400112f3
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400111a4
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014170
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014190
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400141a3
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400141cd
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141e1
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141f3
xor al, al
jmp 0x140014211
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001420f
xor al, al
jmp 0x140014211
mov al, 1
add rsp, 0x38
ret
Function at 0x18000ceb0
Capabilities:
Parse pe header

Disassembly:
push r12
push r13
sub rsp, 0x58
mov r13d, edx
mov r8d, r13d
lea rdx, [rsp + 0x38]
mov r9d, 0x40
mov r12, rcx
call fcn.18000d130
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18002ff10
mov rdx, rax
movzx eax, word [rdx]
cmp eax, 0x5a4d
je 0x18000ceff
lea rcx, [rsp + 0x38]
call fcn.180029b70
xor eax, eax
add rsp, 0x58
pop r13
pop r12
ret
mov r8d, dword [rdx + 0x3c]
mov rcx, r12
add r8d, r13d
lea rdx, [rsp + 0x20]
mov r9d, 0xf8
call fcn.18000d130
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
call fcn.180012c50
lea rcx, [rsp + 0x20]
call fcn.180029b70
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18002ff10
cmp dword [rax], 0x4550
jne 0x18000ceea
cmp dword [rax + 0x74], 0
ja 0x18000cf61
lea rcx, [rsp + 0x38]
call fcn.180029b70
xor eax, eax
add rsp, 0x58
pop r13
pop r12
ret
mov r12d, dword [rax + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180029b70
add r12d, r13d
mov eax, r12d
add rsp, 0x58
pop r13
pop r12
ret
Function at 0x180013c10
Capabilities:
Encode data using xor

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov r13, rdx
mov rdi, rcx
mov edx, dword [r13 + 0xc]
cmp edx, 4
jl 0x180013cd6
add edx, 0xfffffffc
lea rcx, [rsp + 0x20]
call fcn.180062df0
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.18002ff10
mov rcx, r13
mov edx, 4
mov r12, rax
call fcn.18002ff10
mov rcx, r12
mov rdx, rax
movsxd r8, dword [rsp + 0x2c]
call fcn.18006fcf0
mov rcx, r13
xor edx, edx
call fcn.18002ff10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r12d, dword [rax]
call fcn.18002ff10
movsxd rdx, dword [rsp + 0x2c]
mov r8, rdx
shr r8, 2
test rdx, 3
movsxd r8, r8d
lea r9, [r8 + 1]
cmovne r8, r9
xor edx, edx
test r8, r8
jle 0x180013cb2
inc rdx
xor dword [rax], r12d
add rax, 4
cmp rdx, r8
jl 0x180013ca3
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.180030bb0
lea rcx, [rsp + 0x20]
call fcn.180029b70
mov rax, rdi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
mov rcx, rdi
xor edx, edx
call fcn.180062df0
mov rax, rdi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x180030e30
Capabilities:
Parse pe header

Disassembly:
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x28
mov r13, rcx
mov r15, r8
mov r14, rdx
movzx eax, word [r13]
cmp eax, 0x5a4d
je 0x180030e7f
mov ecx, 0xd638f4c2
mov edx, 0x4356e835
call fcn.180059e30
test rax, rax
je 0x180030e6e
mov ecx, 0xc1
call rax
xor eax, eax
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movsxd r12, dword [r13 + 0x3c]
add r12, r13
cmp dword [r12], 0x4550
je 0x180030ebc
mov ecx, 0xd638f4c2
mov edx, 0x4356e835
call fcn.180059e30
test rax, rax
je 0x180030eab
mov ecx, 0xc1
call rax
xor eax, eax
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0xd638f4c2
mov edx, 0x9763054b
call fcn.180059e30
test rax, rax
je 0x180030ef0
mov r8d, 0x3000
mov r9d, 4
mov edx, dword [r12 + 0x50]
mov rcx, qword [r12 + 0x30]
call rax
mov rdi, rax
test rdi, rdi
jne 0x180030f29
mov ecx, 0xd638f4c2
mov edx, 0x9763054b
call fcn.180059e30
test rax, rax
je 0x180031055
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
mov edx, dword [r12 + 0x50]
call rax
mov rdi, rax
test rdi, rdi
je 0x180031055
mov ecx, 0x20
call fcn.1800315a0
mov rbp, rax
test rbp, rbp
je 0x180031081
xor r9d, r9d
mov rcx, rdi
mov qword [rbp + 8], rdi
mov rdx, r13
mov dword [rbp + 0x18], r9d
mov qword [rbp + 0x10], 0
mov byte [rbp + 0x1c], r9b
mov r8d, dword [r13 + 0x3c]
add r8d, dword [r12 + 0x54]
call fcn.18006fcf0
movsxd r9, dword [r13 + 0x3c]
mov rcx, r13
add r9, rdi
mov rdx, r12
mov r8, rbp
mov qword [rbp], r9
mov qword [r9 + 0x30], rdi
call fcn.1800310d0
mov rdx, rdi
sub rdx, qword [r12 + 0x30]
je 0x180030f99
mov rcx, rbp
call fcn.1800311b0
mov rcx, rbp
call fcn.180031290
test al, al
jne 0x180030fd9
mov rcx, rbp
call fcn.180031800
mov ecx, 0xd638f4c2
mov edx, 0x4356e835
call fcn.180059e30
test rax, rax
je 0x180030fc8
mov ecx, 0x45a
call rax
xor eax, eax
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, rbp
call fcn.180031690
mov rdx, qword [rbp]
mov r9d, dword [rdx + 0x28]
test r9, r9
je 0x180031043
add r9, rdi
mov rcx, rdi
mov edx, 1
mov r8, r14
call r9
test r15, r15
je 0x180031007
mov dword [r15], eax
test eax, eax
jne 0x18003103f
mov rcx, rbp
call fcn.180031800
mov ecx, 0xd638f4c2
mov edx, 0x4356e835
call fcn.180059e30
test rax, rax
je 0x18003102e
mov ecx, 0x45a
call rax
xor eax, eax
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov byte [rbp + 0x1c], 1
mov rax, rbp
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0xd638f4c2
mov edx, 0x4356e835
call fcn.180059e30
test rax, rax
je 0x180031070
mov ecx, 0xe
call rax
xor eax, eax
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0xd638f4c2
mov edx, 0x53fefddc
call fcn.180059e30
test rax, rax
je 0x1800310a2
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call rax
mov ecx, 0xd638f4c2
mov edx, 0x4356e835
call fcn.180059e30
test rax, rax
je 0x1800310bd
mov ecx, 0xe
call rax
xor eax, eax
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800310d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x58
mov rax, qword [r8]
mov r11, qword [r8 + 8]
movzx r9d, word [rax + 0x14]
lea r10, [rax + r9 + 0x18]
movzx eax, word [rax + 6]
xor r9d, r9d
test eax, eax
jle 0x1800311a8
mov qword [rsp + 0x50], rbx
mov rbx, r11
mov qword [rsp + 0x48], rsi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov rdi, rdx
mov qword [rsp + 0x38], r12
mov r12, r8
mov qword [rsp + 0x30], r13
mov r13d, r9d
mov qword [rsp + 0x28], r14
mov r14, r10
mov qword [rsp + 0x20], r15
mov r8d, dword [r14 + 0x10]
test r8d, r8d
jne 0x180031157
movsxd r8, dword [rdi + 0x38]
test r8, r8
jle 0x180031179
mov ecx, dword [r14 + 0xc]
xor edx, edx
add rcx, rbx
mov dword [r14 + 0x18], ecx
call fcn.180012b10
mov rax, qword [r12]
movzx eax, word [rax + 6]
jmp 0x180031179
mov r15d, dword [r14 + 0xc]
add r15, rbx
mov edx, dword [r14 + 0x14]
mov rcx, r15
add rdx, rsi
call fcn.18006fcf0
mov dword [r14 + 0x18], r15d
mov rax, qword [r12]
movzx eax, word [rax + 6]
inc r13d
add r14, 0x28
cmp r13d, eax
jl 0x180031129
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
add rsp, 0x58
ret

Function at 0x180031690
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180074a10]
mov qword [rsp + 0x20], rax
mov rdx, qword [0x180074a18]
mov qword [rsp + 0x28], rdx
mov r8, qword [0x180074a20]
mov qword [rsp + 0x30], r8
mov r9, qword [0x180074a28]
mov qword [rsp + 0x38], r9
mov r8, qword [rcx]
movabs rdx, 0xffffffff00000000
xor r10d, r10d
movzx eax, word [r8 + 0x14]
and rdx, qword [r8 + 0x30]
lea r11, [r8 + rax + 0x18]
movzx eax, word [r8 + 6]
test eax, eax
jle 0x1800317f7
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
mov rdi, r11
mov qword [rsp + 0x58], r12
mov r12, rdx
mov qword [rsp + 0x50], r13
mov r13, rcx
mov qword [rsp + 0x48], r14
mov rcx, r8
mov r14d, r10d
mov edx, dword [rdi + 0x24]
test edx, 0x2000000
jne 0x1800317c9
mov ebx, edx
mov r9d, edx
and ebx, 0x20000000
and r9d, 0x40000000
shr ebx, 0x1d
lea rsi, [rsp + 0x20]
shl rbx, 4
shr r9d, 0x1e
add rbx, rsi
lea rsi, [rbx + r9*8]
mov ebx, edx
and ebx, 0x80000000
shr ebx, 0x1f
mov ebx, dword [rsi + rbx*4]
mov esi, ebx
or esi, 0x200
test edx, 0x4000000
cmovne ebx, esi
mov esi, dword [rdi + 0x10]
test esi, esi
je 0x1800317c9
test dl, 0x40
je 0x180031784
mov esi, dword [rcx + 0x24]
jmp 0x18003178f
test edx, 0x80
je 0x18003178f
mov esi, dword [rcx + 0x20]
test esi, esi
jbe 0x1800317c9
mov ecx, 0xd638f4c2
mov edx, 0x8eab672e
call fcn.180059e30
test rax, rax
je 0x1800317ba
mov r8d, ebx
mov ecx, dword [rdi + 0x18]
mov rdx, rsi
or rcx, r12
lea r9, [rsp + 0x40]
call rax
mov dword [rdi + 0x18], 0
mov rcx, qword [r13]
movzx eax, word [rcx + 6]
inc r14d
add rdi, 0x28
cmp r14d, eax
jl 0x18003171c
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
add rsp, 0x78
ret
Function at 0x18003aa61
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x18003aa59
mov ecx, dword [r9 + 0xc]
test ecx, ecx
je 0x18003aa59
cdq
idiv ecx
movsxd r11, ecx
movsxd rax, eax
imul r11, rax
movsxd r10, edx
xor edx, edx
test eax, eax
jle 0x18003aa33
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
test ecx, ecx
jle 0x18003aa61
imul ecx, edx
add ecx, dword [r8 + 0x10]
movsxd r15, dword [r9 + 0x10]
add r15, qword [r9]
movsxd rcx, ecx
add rcx, qword [r8]
mov r15b, byte [r15 + rbp]
xor byte [rcx + rbp], r15b
inc rbp
mov ecx, dword [r9 + 0xc]
movsxd rcx, ecx
cmp rbp, rcx
jl 0x18003a9f8
inc edx
cmp edx, eax
jl 0x18003a9f2
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
xor edx, edx
test r10, r10
jle 0x18003aa59
movsxd rcx, dword [r8 + 0x10]
movsxd rax, dword [r9 + 0x10]
add rcx, qword [r8]
add rax, qword [r9]
add rcx, r11
mov al, byte [rax + rdx]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, r10
jl 0x18003aa3a
mov rax, r8
add rsp, 0x38
ret
inc edx
cmp edx, eax
jl 0x18003a9f2
jmp 0x18003aa29

Function at 0x18003dcf0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
sub rsp, 0x420
lea rbp, [0x180086018]
mov qword [rsp + 0x440], rcx
movsxd rdi, edx
cmp dword [rbp], 0xe32ca12
jne 0x18003dd1d
rdtsc
mov dword [0x180086018], eax
mov rax, qword [0x180086010]
push 0xffffffffffffffff
pop rsi
movabs rcx, 0xd24edba1558ea34d
cmp rax, rcx
je 0x18003dd7b
xor edx, edx
test rdi, rdi
jle 0x18003dd6c
mov r11d, dword [rbp]
mov r10, qword [rsp + 0x440]
mov ebp, esi
movzx ecx, byte [rdx + r10]
xor rbp, rcx
movzx r8d, bpl
inc rdx
shr esi, 8
mov r9d, dword [rax + r8*4]
xor r9d, r11d
xor esi, r9d
cmp rdx, rdi
jl 0x18003dd49
not esi
mov eax, esi
add rsp, 0x420
pop rbp
pop rdi
pop rsi
ret
mov ecx, 0x9ead0801
mov edx, 0x3f795175
call fcn.180059e30
test rax, rax
je 0x18003ddeb
mov ecx, 0x400
call fcn.180068700
mov qword [0x180086010], rax
xor ecx, ecx
mov edx, dword [rbp]
mov r11d, ecx
xor r10b, r10b
mov r9d, r11d
inc r10b
shr r9d, 1
mov r8d, r9d
xor r8d, 0xedb88320
test r11d, 1
mov r11d, r8d
jne 0x18003ddcd
mov r11d, r9d
cmp r10b, 8
jl 0x18003ddab
xor r11d, edx
mov dword [rax + rcx*4], r11d
inc rcx
cmp rcx, 0x100
jl 0x18003dda5
jmp 0x18003dd27
xor ecx, ecx
mov r10d, ecx
xor r9b, r9b
mov r8d, r10d
inc r9b
shr r8d, 1
mov ebp, r8d
xor ebp, 0xedb88320
test r10d, 1
mov r10d, ebp
jne 0x18003de14
mov r10d, r8d
cmp r9b, 8
jl 0x18003ddf3
mov dword [rsp + rcx*4 + 0x20], r10d
inc rcx
cmp rcx, 0x100
jl 0x18003dded
xor ecx, ecx
test rdi, rdi
jle 0x18003dd6c
mov r10, qword [rsp + 0x440]
mov r8d, esi
movzx ebp, byte [rcx + r10]
xor r8, rbp
movzx r9d, r8b
inc rcx
shr esi, 8
xor esi, dword [rsp + r9*4 + 0x20]
cmp rcx, rdi
jl 0x18003de3e
jmp 0x18003dd6c
Function at 0x18003dd15
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
sub rsp, 0x420
lea rbp, [0x180086018]
mov qword [rsp + 0x440], rcx
movsxd rdi, edx
cmp dword [rbp], 0xe32ca12
jne 0x18003dd1d
rdtsc
mov dword [0x180086018], eax
mov rax, qword [0x180086010]
push 0xffffffffffffffff
pop rsi
movabs rcx, 0xd24edba1558ea34d
cmp rax, rcx
je 0x18003dd7b
xor edx, edx
test rdi, rdi
jle 0x18003dd6c
mov r11d, dword [rbp]
mov r10, qword [rsp + 0x440]
mov ebp, esi
movzx ecx, byte [rdx + r10]
xor rbp, rcx
movzx r8d, bpl
inc rdx
shr esi, 8
mov r9d, dword [rax + r8*4]
xor r9d, r11d
xor esi, r9d
cmp rdx, rdi
jl 0x18003dd49
not esi
mov eax, esi
add rsp, 0x420
pop rbp
pop rdi
pop rsi
ret
mov ecx, 0x9ead0801
mov edx, 0x3f795175
call fcn.180059e30
test rax, rax
je 0x18003ddeb
mov ecx, 0x400
call fcn.180068700
mov qword [0x180086010], rax
xor ecx, ecx
mov edx, dword [rbp]
mov r11d, ecx
xor r10b, r10b
mov r9d, r11d
inc r10b
shr r9d, 1
mov r8d, r9d
xor r8d, 0xedb88320
test r11d, 1
mov r11d, r8d
jne 0x18003ddcd
mov r11d, r9d
cmp r10b, 8
jl 0x18003ddab
xor r11d, edx
mov dword [rax + rcx*4], r11d
inc rcx
cmp rcx, 0x100
jl 0x18003dda5
jmp 0x18003dd27
xor ecx, ecx
mov r10d, ecx
xor r9b, r9b
mov r8d, r10d
inc r9b
shr r8d, 1
mov ebp, r8d
xor ebp, 0xedb88320
test r10d, 1
mov r10d, ebp
jne 0x18003de14
mov r10d, r8d
cmp r9b, 8
jl 0x18003ddf3
mov dword [rsp + rcx*4 + 0x20], r10d
inc rcx
cmp rcx, 0x100
jl 0x18003dded
xor ecx, ecx
test rdi, rdi
jle 0x18003dd6c
mov r10, qword [rsp + 0x440]
mov r8d, esi
movzx ebp, byte [rcx + r10]
xor r8, rbp
movzx r9d, r8b
inc rcx
shr esi, 8
xor esi, dword [rsp + r9*4 + 0x20]
cmp rcx, rdi
jl 0x18003de3e
jmp 0x18003dd6c
Function at 0x180058090
Capabilities:
Encode data using xor

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov r13, rdx
mov rdi, rcx
mov rcx, r13
call fcn.1800196f0
test al, al
je 0x1800580c2
mov rcx, rdi
xor edx, edx
call fcn.180062df0
mov rax, rdi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
mov edx, dword [r13 + 0xc]
lea rcx, [rsp + 0x20]
add edx, 4
call fcn.180062df0
push 4
pop rdx
lea rcx, [rsp + 0x20]
call fcn.18002ff10
mov rcx, r13
xor edx, edx
mov r12, rax
call fcn.18002ff10
mov rcx, r12
mov rdx, rax
movsxd r8, dword [r13 + 0xc]
call fcn.18006fcf0
xor ecx, ecx
xor edx, edx
call fcn.180027be0
mov r12d, eax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.18002ff10
movsxd r8, dword [rsp + 0x2c]
mov rdx, r8
shr rdx, 2
test r8, 3
movsxd rdx, edx
lea r9, [rdx + 1]
cmovne rdx, r9
xor r10d, r10d
test rdx, rdx
jle 0x180058149
inc r10
xor dword [rax], r12d
add rax, 4
cmp r10, rdx
jl 0x18005813a
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.180030bb0
lea rcx, [rsp + 0x20]
call fcn.180029b70
jmp 0x1800580b5
Function at 0x180062090
Capabilities:
Terminate process

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x120
mov r12b, r8b
mov rdi, rdx
mov r13, rcx
xor edx, edx
lea rcx, [rsp + 0xb8]
push 0x68
pop r8
call fcn.180012b10
xor edx, edx
lea rcx, [rsp + 0xa0]
push 0x18
pop r8
mov dword [rcx + 0x18], 0x68
call fcn.180012b10
xor edx, edx
lea rcx, [rsp + 0x78]
mov qword [rcx], 0
mov dword [rcx + 8], 0
call fcn.18005a8e0
mov rdx, qword [r13]
lea rcx, [rsp + 0x78]
call fcn.180026a00
mov rcx, rax
mov rdx, qword [rdi]
call fcn.180026a00
mov rax, rsp
xor r8d, r8d
xor r9d, r9d
lea rcx, [rsp + 0x50]
mov rdx, qword [rcx + 0x28]
mov dword [rax + 0x20], 0x80
call fcn.180026ba0
xor r8d, r8d
lea rcx, [rsp + 0x50]
lea rdx, [rcx + 0x38]
call fcn.180062740
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.180072210
lea rcx, [rsp + 0x88]
call fcn.180026b50
test al, al
jne 0x1800621b7
lea rcx, [rsp + 0x88]
call fcn.180029b70
cmp byte [rsp + 0x70], 0
je 0x18006216f
lea rcx, [rsp + 0x68]
call fcn.180059db0
mov rcx, qword [rsp + 0x50]
call fcn.180018460
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
call fcn.180018460
mov qword [rsp + 0x78], 0
xor eax, eax
mov dword [rsp + 0x80], 0
add rsp, 0x120
pop r13
pop r12
pop rdi
ret
lea rcx, [rsp + 0x88]
call fcn.180062330
test al, al
jne 0x1800621e8
lea rcx, [rsp + 0x88]
call fcn.180029b70
cmp byte [rsp + 0x70], 0
je 0x18006216f
lea rcx, [rsp + 0x68]
call fcn.180059db0
jmp 0x18006216f
mov ecx, 0xd638f4c2
mov edx, 0xc2286446
call fcn.180059e30
test rax, rax
je 0x18006224e
mov r13, rsp
xor edi, edi
mov rcx, qword [rsp + 0x78]
mov rdx, rcx
xor r8d, r8d
xor r9d, r9d
lea r10, [rsp + 0xb8]
mov qword [r13 + 0x20], rdi
lea r11, [rsp + 0xa0]
mov dword [r13 + 0x28], 0xc
mov qword [r13 + 0x30], rdi
mov qword [r13 + 0x38], rdi
mov qword [r13 + 0x40], r10
mov qword [r13 + 0x48], r11
call rax
test eax, eax
je 0x180062245
xor edi, edi
jmp 0x180062251
call fcn.1800735f4
mov edi, eax
jmp 0x180062251
push 0x7f
pop rdi
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x180062266
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp edi, 0x2e4
jne 0x1800622d6
test r12b, r12b
je 0x1800622ff
lea rcx, [rsp + 0x88]
call fcn.180029b70
cmp byte [rsp + 0x70], 0
je 0x180062295
lea rcx, [rsp + 0x68]
call fcn.180059db0
mov rcx, qword [rsp + 0x50]
call fcn.180018460
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
call fcn.180018460
mov qword [rsp + 0x78], 0
push 1
pop rax
mov dword [rsp + 0x80], 0
jmp 0x1800621aa
test edi, edi
jne 0x1800622ff
test r12b, r12b
jne 0x1800622ff
lea rcx, [rsp + 0x88]
call fcn.180029b70
cmp byte [rsp + 0x70], 0
je 0x180062295
lea rcx, [rsp + 0x68]
call fcn.180059db0
jmp 0x180062295
lea rcx, [rsp + 0x88]
call fcn.180029b70
cmp byte [rsp + 0x70], 0
je 0x18006216f
lea rcx, [rsp + 0x68]
call fcn.180059db0
jmp 0x18006216f
Function at 0x180062a50
Capabilities:
Enumerate pe sections

Disassembly:
push r14
push r15
sub rsp, 0x28
mov r15d, edx
xor edx, edx
mov r14, rcx
call fcn.18002ff10
mov rcx, r14
mov edx, dword [rax + 0x3c]
call fcn.18002ff10
mov rdx, rax
xor ecx, ecx
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
jbe 0x180062aa5
mov r9d, dword [rax + 0xc]
cmp r15d, r9d
jb 0x180062a9b
mov r8d, dword [rax + 8]
add r9d, r8d
cmp r15d, r9d
jb 0x180062ab0
inc ecx
add rax, 0x28
cmp ecx, edx
jb 0x180062a86
xor eax, eax
add rsp, 0x28
pop r15
pop r14
ret
add rsp, 0x28
pop r15
pop r14
ret
Function at 0x180063a60
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push rbx
push r14
push r15
push rbp
sub rsp, 0x248
mov r14, rcx
movsxd rbx, r9d
mov rbp, r8
mov r15d, edx
test r14, r14
je 0x180063c3a
test r15d, r15d
je 0x180063c3a
test rbp, rbp
je 0x180063c3a
test rbx, rbx
je 0x180063c3a
cmp qword [rsp + 0x290], 0
jne 0x180063ab7
cmp qword [rsp + 0x298], 0
je 0x180063c3a
mov rcx, r14
mov edx, r15d
call fcn.18003dcf0
cmp eax, 0xd2490422
je 0x180063adf
mov r8d, 1
cmp eax, 0x7598502c
mov eax, 0
cmove r8d, eax
jmp 0x180063ae2
xor r8d, r8d
xor r9d, r9d
mov eax, r9d
xor edx, edx
idiv r15d
mov byte [rsp + r9 + 0x140], r9b
movsxd rdx, edx
mov r10b, byte [rdx + r14]
mov byte [rsp + r9 + 0x40], r10b
inc r9
cmp r9, 0x100
jl 0x180063ae5
xor edx, edx
xor ecx, ecx
xor eax, eax
nop dword [rax + rax]
nop dword [rax + rax]
movzx r11d, byte [rsp + rdx + 0x140]
inc ecx
movzx r10d, byte [rsp + rdx + 0x40]
add r11d, r10d
add rax, r11
movzx eax, al
mov r15b, byte [rsp + rdx + 0x140]
mov r14b, byte [rsp + rax + 0x140]
mov byte [rsp + rdx + 0x140], r14b
inc rdx
mov byte [rsp + rax + 0x140], r15b
cmp ecx, 0x100
jl 0x180063b20
xor r10d, r10d
mov r15d, 1
xor r9d, r9d
test rbx, rbx
jle 0x180063c3a
mov qword [rsp + 0x30], rdi
mov r14, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x298]
mov qword [rsp + 0x38], rsi
mov rsi, rbp
mov qword [rsp + 0x28], r12
mov rbp, rbx
mov qword [rsp + 0x20], r13
mov ebx, r8d
mov r13, r9
mov r12, r10
movzx r15d, r15b
mov r11b, byte [rsp + r15 + 0x140]
movzx eax, r11b
add r13, rax
movzx r13d, r13b
mov cl, byte [rsp + r13 + 0x140]
mov byte [rsp + r15 + 0x140], cl
mov byte [rsp + r13 + 0x140], r11b
mov al, byte [rsp + r15 + 0x140]
add al, r11b
movzx ecx, byte [r12 + rsi]
test ebx, ebx
je 0x180063bff
movzx eax, al
movzx r11d, byte [rsp + rax + 0x140]
xor ecx, r11d
test rdi, rdi
je 0x180063c0f
mov rdx, r14
call rdi
test al, al
jne 0x180063c26
jmp 0x180063c1b
mov rax, qword [rsp + 0x290]
mov byte [r12 + rax], cl
inc r12
inc r15
cmp r12, rbp
jl 0x180063bad
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
add rsp, 0x248
pop rbp
pop r15
pop r14
pop rbx
ret
Function at 0x180063b7a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r14
push r15
push rbp
sub rsp, 0x248
mov r14, rcx
movsxd rbx, r9d
mov rbp, r8
mov r15d, edx
test r14, r14
je 0x180063c3a
test r15d, r15d
je 0x180063c3a
test rbp, rbp
je 0x180063c3a
test rbx, rbx
je 0x180063c3a
cmp qword [rsp + 0x290], 0
jne 0x180063ab7
cmp qword [rsp + 0x298], 0
je 0x180063c3a
mov rcx, r14
mov edx, r15d
call fcn.18003dcf0
cmp eax, 0xd2490422
je 0x180063adf
mov r8d, 1
cmp eax, 0x7598502c
mov eax, 0
cmove r8d, eax
jmp 0x180063ae2
xor r8d, r8d
xor r9d, r9d
mov eax, r9d
xor edx, edx
idiv r15d
mov byte [rsp + r9 + 0x140], r9b
movsxd rdx, edx
mov r10b, byte [rdx + r14]
mov byte [rsp + r9 + 0x40], r10b
inc r9
cmp r9, 0x100
jl 0x180063ae5
xor edx, edx
xor ecx, ecx
xor eax, eax
nop dword [rax + rax]
nop dword [rax + rax]
movzx r11d, byte [rsp + rdx + 0x140]
inc ecx
movzx r10d, byte [rsp + rdx + 0x40]
add r11d, r10d
add rax, r11
movzx eax, al
mov r15b, byte [rsp + rdx + 0x140]
mov r14b, byte [rsp + rax + 0x140]
mov byte [rsp + rdx + 0x140], r14b
inc rdx
mov byte [rsp + rax + 0x140], r15b
cmp ecx, 0x100
jl 0x180063b20
xor r10d, r10d
mov r15d, 1
xor r9d, r9d
test rbx, rbx
jle 0x180063c3a
mov qword [rsp + 0x30], rdi
mov r14, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x298]
mov qword [rsp + 0x38], rsi
mov rsi, rbp
mov qword [rsp + 0x28], r12
mov rbp, rbx
mov qword [rsp + 0x20], r13
mov ebx, r8d
mov r13, r9
mov r12, r10
movzx r15d, r15b
mov r11b, byte [rsp + r15 + 0x140]
movzx eax, r11b
add r13, rax
movzx r13d, r13b
mov cl, byte [rsp + r13 + 0x140]
mov byte [rsp + r15 + 0x140], cl
mov byte [rsp + r13 + 0x140], r11b
mov al, byte [rsp + r15 + 0x140]
add al, r11b
movzx ecx, byte [r12 + rsi]
test ebx, ebx
je 0x180063bff
movzx eax, al
movzx r11d, byte [rsp + rax + 0x140]
xor ecx, r11d
test rdi, rdi
je 0x180063c0f
mov rdx, r14
call rdi
test al, al
jne 0x180063c26
jmp 0x180063c1b
mov rax, qword [rsp + 0x290]
mov byte [r12 + rax], cl
inc r12
inc r15
cmp r12, rbp
jl 0x180063bad
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
add rsp, 0x248
pop rbp
pop r15
pop r14
pop rbx
ret