joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c0a95f
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffc490c68b
cmp ebx, 2
push 0xffffffffc034d289
lea rsp, [rsp + 0x10]
jne 0x140c4f69f
mov rdx, rax
call fcn.140c2a396
dec edi
jmp fcn.140c2204f
push 0x60a87eba
cmp ebx, 3
call fcn.140c2fb33
ror edi, 2
jmp 0x140c4011c

Function at 0x140c14008
Capabilities:
Manually build aes constants

Disassembly:
lea rsp, [rsp + 0x20]
jne 0x140c217f0
call fcn.140c476d6
mov r10d, 0x6a37b901
mov si, word [r9 + r10 - 0x6a37b901]
btr r10w, r10w
mov edi, r10d
movsx r11d, di
mov cl, byte [r9 + rdi - 0x6a37b8ff]
ror r11d, 0x92
or edi, 0xc31cecbf
lea r9, [r10 + r9 - 0x6a37b8ff]
sal si, cl
movsx edx, di
push rdx
mov word [r10 + r9 - 0x6a37b901], si
dec byte [rsp + r10 - 0x6a37b8fe]
movsx eax, dil
jno 0x140c2f469
movzx ebx, byte [r11]
jmp 0x140c4fbe2

Function at 0x140c15a2f
Capabilities:
Manually build aes constants

Disassembly:
sar rdi, cl
lea r9, [rdi + r9 - 8]
mov qword [rsp + rdi], r11
mov qword [r9 + rdi*4], r10
xchg cl, sil
jnp 0x140c1e987
pop rdx
jae fcn.140c0c7ab
bswap r10d
movsx eax, dil
bswap rax
sub r10d, 0xef01aa10
lea rdi, [rdx*2 + 0x2a96370c]
neg r10d
rol rax, 0xb7
push r8
sar eax, 0xf5
sbb dil, dil
movzx r8d, dx
xor dword [rsp + r8 - 0xff9c], r10d
lea rsi, [rdx + rdi*8 + 0x6db29981]
pop r8
inc dl
movsxd r10, r10d
add rbp, r10
mov r10d, dword [r9 + riz]
push rdx
dec sil
pop rsi
add r9, 4
or di, 0x23a2
movzx r11d, word [rbx + riz]
setl dil
adc rbx, 2
bts di, si
lea rcx, [rsi*2 + 0x30ab5c8d]
and rax, rcx
xor r11w, r8w
xadd dl, dh
or dil, 0xe
adc r11w, 0xd923
rol r11w, 1
add r11w, 0x2f2b
xor edi, 0xef131b2a
jo 0x140c30a70
rol r11w, 1
neg ax
xor r8w, r11w
btr rdx, rdx
add r11, rsp
mul dx
mov dword [r11 + rax*2 - 0x6157c120], r10d
cdq
call fcn.140c08c75
inc edi
bswap edi
push rsi
ror dl, 0x44
dec edi
mul rsi
shr qword [rsp + rdx*8], cl
not word [rsp + rdx + 3]
ror edi, 3
push r11
pop r10
neg edi
pop r11
imul rcx, r10
xor r11w, si
ror edi, 1
rol eax, cl
bts r11w, 0x9e
push r8
cbw
xor dword [rsp + rdx], edi
pop r8
movsxd rdi, edi
add rbp, rdi
xor rdx, rbp
jmp rdx
bts rcx, rsi
pop rsi
bswap edi
setb sil
push r10
rol edi, 2
not r11b
mov qword [rsp + r10*4 - 0x10fd0], r8
shl r11b, 0xe6
inc rax
sar si, 0xc2
xor dword [rsp + rdx*4 + 0x10fd0], edi
btc rdx, 0xf
ror rax, 0x81
pop r8
xadd dl, ch
or r10d, edx
jno 0x140c4757e
mov esi, 0x8a311138
lea rdx, [rsi + rsi*8 - 0x36de6ace]
mov rcx, qword [r9 + riz]
mov rdi, qword [r9 + riz + 8]
mov r10d, esi
movzx eax, sil
btr r10, r10
lea r9, [r9 + rax - 0x30]
adc r10w, dx
mov r11d, r10d
adc rcx, rdi
ror ax, 0xa9
add r11w, r10w
btr r10w, dx
mov qword [rax + r9 - 0x1c00], rcx
lea rcx, [rdx + 0x1218ac23]
setae dl
mov edi, dword [rbx + rax*4 - 0x7000]
bt r10, 0xb8
setae sil
lea rbx, [rbx + rax*2 - 0x37fc]
mul r11d
jb 0x140c3837f
cmovae ecx, eax
xor edi, r8d
cwde
jmp 0x140c2fbd7
movsxd rdi, edi
dec sil
xadd r10, rdx
add rbp, rdi
jmp rbp
Function at 0x140c16156
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + r11*2 - 0x576dffde], ecx
mov r8, qword [rsp + r11 - 0x2bb6ffeb]
movsx eax, r10b
push rdi
movsxd rcx, ecx
mul word [rsp + r11*2 - 0x576dffe5]
mov qword [rsp + r11 - 0x2bb6ffeb], rdi
seto byte [rsp + r11 - 0x2bb6ffeb]
add rbp, rcx
push rdi
btc rax, r11
bt di, r10w
mov rdi, qword [r9 + r11*2 - 0x576dffe6]
shl edx, 0x27
and si, dx
add r10, rdx
mov dx, word es:[r11 + rdi - 0x2bb6fff3]
js 0x140c47dda

Function at 0x140c27348
Capabilities:
Manually build aes constants

Disassembly:
push 0x74178b0d
seto byte [rsp + 2]
cmp ebx, 1
call fcn.140c159b0

Function at 0x140c286e6
Capabilities:
Manually build aes constants

Disassembly:
mov edx, 0x469b3aab
xor di, r8w
inc di
mov qword [rsp + rdx - 0x469b3aab], rdx
sar cx, cl
ror di, cl
dec ecx
cwd
js 0x140c40420
xor di, 0xdcad
dec word [rsp + rax - 0x2f]
add di, 0x5f37
cwd
inc rcx
inc byte [rsp + rax - 0x32]
xor r8w, di
not rcx
push rcx
ror byte [rsp + rax*2 - 0x60], 0xa5
lea rdi, [rsp + rdi + 0x10]
mul word [rsp + rax - 0x27]
mov rax, qword [rdi + rax*2 - 0x1ff9a]
ror word [rsp + rdx - 0x469b0025], 0x28
lea r9, [r9 + rdx - 0x469b003a]
xadd word [rsp + rdx - 0x469b0025], dx
push rsi
mov qword [rdx + r9 - 0x469bff00], rax
mov edx, dword [rbx + rdx - 0x469bff00]
adc rbx, 4
mov qword [rsp + 2], 0xffffffffb80eddbf
rol dword [rsp + 6], cl
xor edx, r8d
movzx r11d, sil
push rcx
ror edx, 2
rol rcx, 0x85
lea edx, [rdx + r11*4 - 0x652ac064]
and qword [rsp + r11 - 0x28], rsi
add ecx, esi
inc dword [rsp + rcx*2 - 0x48eaa1f]
ror edx, 1
mov eax, dword [rsp + rcx*8 - 0x123aa889]
xchg ecx, eax
sub cx, si
inc edx
rol byte [rsp + rcx - 0x9fb1], 0xc1
xchg word [rsp + rcx - 0x9fa5], cx
add dword [rsp + rcx*4 - 0x39c8b], 0xfda87996
xor edx, 0x34064135
sal sil, 0x24
rol rcx, cl
neg word [rsp + r11 - 0x1d]
lea edx, [rdx + rsi - 0x437991b1]
add word [rsp + r11*2 - 0x65], r11w
call fcn.140c0b9cc
Function at 0x140c2a533
Capabilities:
Encode data using base64

Disassembly:
xadd ecx, edi
xor esi, 0x192fd82d
pop rax
mul r10d
ror esi, 1
xor esi, 0x6605c431
inc esi
bswap r10
push r8
shr cl, 0x65
lea rax, [rdx + r10 + 0x5c2146bb]
mul r11w
xor dword [rsp + rcx*2 - 0x1ff700e], esi
not al
pop r8
not r11b
xor al, dh
and r10b, 0xa5
movsxd rsi, esi
btc eax, eax
add rbp, rsi
add r11w, cx
xchg r11, rdx
cdqe
ja fcn.140c0c7ab
mov esi, dword [r9]
mov r10d, 0x496e0b2
mov r11d, 0xd521f138
mov cl, byte [r9 + r10*2 - 0x92dc160]
sub r11d, r10d
mov eax, 0xd2a94804
xor r11d, eax
lea r9, [r9 + r10*2 - 0x92dc162]
sar r11w, 0x47
sal esi, cl
xor r10d, r11d
movsx edx, r10b
mov dword [r9 + r10 - 0x6b4e003], esi
xor al, 0x2b
cwd
sal r11, 0x43
mov edi, dword [r10 + rbx - 0x6b4e003]
push rax
jne 0x140c19e58
mov edi, dword [rbx]
mov eax, 0x10ad2b02
movsx ecx, ax
lea rbx, [rbx + rax*2 - 0x215a5600]
mov edx, 0xb792660e
bt rdx, rax
xor edi, r8d
lea rdx, [rdx + rdx - 0x625056d1]
inc edi
xchg ecx, eax
bswap edi
ror dl, 0xc5
mul edx
inc dx
dec edi
ror edi, 3
lea r11, [rax*8 + 0xaba6a6]
neg rdx
neg edi
dec ax
btr rax, rax
movsx esi, cl
ror edi, 1
add r11, rcx
push r8
movzx r8d, sil
dec cl
xor dword [rsp + rdx*4 + 0x8a0], edi
cbw
pop r8
sub eax, ecx
and r11, 0xffffffffe5b94804
inc dx
movsxd rdi, edi
mov r10d, 0xe586bb97
or esi, edx
adc rbp, rdi
rol si, 0x61
call fcn.140c498e9
movsxd rdx, edx
add rbp, rdx
lea rdx, [r11 + r11 - 0x7d5c2aeb]
mov rdx, qword [r9 + riz]
mov r11, qword [r9 + riz + 8]
dec word [rsp + 8]
call fcn.140c519d3
lea rdi, [rsp + rdi + 8]
shl r11w, cl
mov qword [rsp + rsi*2 - 0x38357200], rcx
movzx r11w, byte [rdi + rax*2 - 0x1224]
mov word [r9 + rax*2 - 0x122a], r11w
div byte [rsp + rax*4 - 0x2447]
mul qword [rsp + rax - 0x660c]
xor r10b, 0xb9
lea r9, [r9 + rsi - 0x1c1ab906]
mov r11d, dword [rsp + rsi - 0x1c1ab8ff]
mov esi, dword [rsi + rbx - 0x1c1ab8fb]
movzx edi, r11b
lea rbx, [rbx + r10*2 - 0x125]
or byte [rsp + r10*2 - 0x12e], al
xor esi, r8d
xadd r11, rdi
ror esi, 1
neg esi
not esi
not r10w
jmp 0x140c161b6

Function at 0x140c2ac46
Capabilities:
Authenticate hmac

Disassembly:
btr si, 0x36
mov qword [rsp + rsi*4], 0xffffffffeb820c90
sbb al, 0x30
and ecx, ecx
xor r8b, al
shr dword [rsp + rsi*2 + 2], 0x5c
lea rax, [rsp + rax + 8]
sub di, word [rsp + rsi + 6]
mov edx, esi
sbb edi, 0xd8a65591
mov byte [rsi + rax], r10b
mov r10d, dword [rbx + rsi*2 + 1]
sbb dword [rsp + rsi*8 + 3], r11d
lea rbx, [rbx + rdx + 5]
or dword [rsp + rsi], esi
xor r10d, r8d
and word [rsp + rsi + 2], si
neg si
xor ecx, dword [rsp + rdx + 2]
ror r10d, 3
not r10d
shr r11w, 0xe4
bswap r10d
rol r10d, 2
rol rdx, cl
mov qword [rsp + rsi*2], r8
dec r11w
bts r11d, 0x97
xor dword [rsp + rdx], r10d
sar di, 0x21
mov r8d, 0xd831d727
pop r8
movsxd r10, r10d
neg edi
call fcn.140c44626

Function at 0x140c2d164
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
sub rsp, rcx
push 0xffffffffbd1b6d39
inc dword [rsp + 2]
ror dword [rsp + 3], 0x67
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
push 0xffffffff840b45a6
not word [rsp + 2]
lea rsp, [rsp + 8]
add rsp, rcx
push 0x7d0c2f2f
jmp 0x140c3a978
sar byte [rsp + 7], 0xc1
test ebx, ebx
call fcn.140c50328
Function at 0x140c2d23f
Capabilities:
Manually build aes constants

Disassembly:
rol cx, 1
lea rdi, [r11 + 0x4320326]
neg r10d
xor r8w, cx
call fcn.140c2d2ec

Function at 0x140c3eb31
Capabilities:
Manually build aes constants

Disassembly:
mov eax, dword [rdx + rbx]
sub dil, r10b
mov qword [rsp + rdx], rsi
xor edi, esi
lea rbx, [rdx + rbx + 4]
dec rcx
xor eax, r8d
add r10w, dx
or rdx, r11
ror eax, 1
inc sil
ror dword [rsp + rdx - 0xf51e], cl
add dword [rsp + rdx*4 - 0x3d47a], 0x77ab5195
neg eax
inc r11d
rol edi, cl
shl rdi, 0xc4
not eax
bswap rsi
xor eax, 0x192fd82d
ror eax, 1
btc r10, 0x9c
xchg r11, rsi
xchg qword [rsp + rsi - 0xf519], r10
xor eax, 0x6605c431
sal cl, 0xc4
adc eax, r11d
mov qword [rsp + rsi - 0xf519], r8
add rcx, rdx
xor dword [rsp + rsi - 0xf519], eax
lea r8, [rdx*2 - 0x17447fb]
call fcn.140c0867b

Function at 0x140c4a313
Capabilities:
Encode data using xor

Disassembly:
push rcx
mov qword [rsp], 0x532228cb
call fcn.140c1fca3
lea rsp, [rsp + 0x38]
jmp 0x1409135c9
Function at 0x140006710
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push r12
push r14
sub rsp, 0x78
xor r12d, r12d
lea rcx, [0x14003ba60]
mov qword [rax - 0x58], r12
xor r9d, r9d
mov dword [rax - 0x60], 0x80
mov edx, 0x40000000
mov dword [rax - 0x68], 4
lea r8d, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140006891
mov qword [rsp + 0x70], rbx
lea r9d, [r12 + 2]
mov qword [rsp + 0x68], rbp
xor r8d, r8d
mov qword [rsp + 0x60], rsi
xor edx, edx
mov qword [rsp + 0x58], rdi
mov rcx, rax
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
lea r8d, [r12 + 0xe]
mov rcx, r14
lea rdx, str.DRV64:
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r15, [rsp + 0x98]
call fcn.140006700
mov r9, qword [rsp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
mov rsi, rax
mov qword [rsp + 0x20], r12
mov rcx, qword [rax]
or rcx, 2
call fcn.14000e3b0
test eax, eax
mov rbx, 0xffffffffffffffff
cmovs eax, ebx
add eax, 3
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.140008a88
mov r9, qword [rsp + 0x90]
mov r8, rdi
mov rcx, qword [rsi]
mov rdx, rax
mov qword [rsp + 0x28], r15
mov rbp, rax
mov qword [rsp + 0x20], r12
call fcn.14000e5e8
lea r8, [0x140033410]
mov rdx, rdi
mov rcx, rbp
call fcn.14000ee00
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
nop
cmp word [rbp + rbx*2 + 2], r12w
lea rbx, [rbx + 1]
jne 0x140006850
lea r8d, [rbx + rbx]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call fcn.140008a54
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
pop r14
pop r12
ret
Function at 0x140012fd8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140012d3c
Function at 0x140104e10
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140104e1d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140104e2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140104e15
lea eax, [rcx + 1]
jmp 0x140104e3b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140104e4e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140104e34
sub eax, 3
jb 0x140104e6e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140104ebd
sar eax, 1
movsxd rbp, eax
jb 0x140104ea4
jmp 0x140104e7c
add ebx, ebx
jne 0x140104e7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140104ea4
inc ecx
add ebx, ebx
jne 0x140104e8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140104ea4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140104e9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140104e8c
add ecx, 2
jmp 0x140104ea9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140104dd2
jmp 0x140104e1d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xb6a00
mov dl, 0x21
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140104f0d
cmp rsi, rcx
jae 0x140104f15
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140104ef4
cmp al, 0x8f
ja 0x140104ef4
cmp byte [rsi - 2], 0xf
je 0x140104efa
sub al, 0xe8
cmp al, 1
ja 0x140104ede
cmp rsi, rcx
jae 0x140104f15
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140104ee4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140104f15
lodsb al, byte [rsi]
jmp 0x140104ef4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x101000]
mov eax, dword [rdi]
or eax, eax
je 0x140104f7e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1051dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140104f22
jns 0x140104f57
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140104f61
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140104f78
mov qword [rbx], rax
add rbx, 8
jmp 0x140104f42
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140104fb8
cmp al, 0xef
ja 0x140104faa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140104f8a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140104f99
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14010500c
sub rsp, 0xffffffffffffff80
jmp 0x140060560
Function at 0x1800088c0
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x58
cmp edx, 1
jne 0x180008a97
mov dword [rsp + 0x48], 0x15a
lea rax, [0x1800051f0]
add rax, 0x15a
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d640
mov dword [rsp + 0x48], 0x14a
lea rax, [0x180007e70]
add rax, 0x14a
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d640
cmp dword [0x1800d2574], 0x2e2521c0
jne 0x180008a68
xor edx, edx
mov qword [rsp + 0x50], rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ValidateRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDisplayAutoRotationPreferences]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReplyMessage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_DdeCreateDataHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeAddData]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCmpStringHandles]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformationEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PackDDElParam]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassInfoExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlUnwind]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x48], 0x196
lea rax, [0x180007220]
add rax, 0x196
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d640
mov eax, 1
add rsp, 0x58
ret
Function at 0x180008f40
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x180008f64
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x180008ff2
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180008fc0
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x180008fc0
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.180063450
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180008fdd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180008fe5
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x180008f81
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x1800090d0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x180009009
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000900b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000903d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180063450
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800090cd
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180009078
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x1800090ae
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18004cf24
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x1800090cd
cmp rsi, rax
ja 0x180009081
test rsi, rsi
je 0x1800090cd
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18004cf24
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x180048c10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x180048c47
call fcn.18004d888
mov dword [rax], 0x16
call fcn.18004d714
xor eax, eax
jmp 0x180048cd5
mov rdx, r9
mov rcx, r8
call fcn.180048bac
mov rbx, rax
test rax, rax
je 0x180048cd2
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x180048ad8]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x180048cbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18004d7fc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180048ca6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180048cb5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.180053794
jmp 0x180048cd2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180048ccf
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18004f5a0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18004f60f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18004f60f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18004f60f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18004f60f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18004f60f
cmp dword [rcx + 0x84], 0xe
jbe 0x18004f60f
cmp dword [rcx + 0xf8], 0
je 0x18004f60f
mov ecx, ebx
call fcn.18004f6c0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18004f49c
nop
cmp dword [rbp + 0x20], 0
je 0x18004f65d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18004f668
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x18004f5a0
Function at 0x1800505dc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1800505f2
mov al, 1
jmp 0x180050652
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180050603
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180050650
mov ecx, dword [rcx + 0x18]
nop
call fcn.18005b618
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180050650
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180050650
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180050650
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180050652
xor al, al
add rsp, 0x20
pop rbx
ret