joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001e60
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x180076100]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180001f1a
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, [0x18005f690]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x180001ec9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180028200
add rsp, 0x58
ret
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x180001eb1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80000000
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180028200
add rsp, 0x58
ret

Function at 0x180008040
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x180076100]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x28], 0x101
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1800080fd
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18001d980
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.180020880
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x180008125
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800080f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008141
call fcn.18002825c
jmp 0x180008125
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x18005f688]
mov rcx, rbx
call fcn.180006de0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180028200
add rsp, 0x270
pop rbx
ret
call fcn.18002e4dc
int3
Function at 0x180008150
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x180076100]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x28], 0x10
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x18000820f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18001d980
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.180020880
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x180008237
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008208
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008250
call fcn.18002825c
jmp 0x180008237
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x18005f688]
mov rcx, rbx
call fcn.180006de0
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180028200
add rsp, 0x80
pop rbx
ret
call fcn.18002e4dc
int3
Function at 0x180008920
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180076100]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, eax
xorps xmm0, xmm0
test eax, eax
jne 0x180008987
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x18005f688]
mov rcx, rsi
call fcn.180006de0
jmp 0x180008a73
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
lea r14, [rbp*2]
test r14, r14
jne 0x1800089a4
mov rdi, r15
jmp 0x1800089e1
cmp r14, 0x1000
jb 0x1800089d6
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x180008b73
call fcn.180028220
test rax, rax
je 0x180008b6d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800089e1
mov rcx, r14
call fcn.180028220
mov rdi, rax
mov qword [rsp + 0x50], rdi
lea rbx, [r14 + rdi]
mov qword [rsp + 0x60], rbx
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.18004d690
mov qword [rsp + 0x58], rbx
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x180008a9d
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x18005f688]
mov rcx, rsi
call fcn.180006de0
nop
test rdi, rdi
je 0x180008a73
sub rbx, rdi
sar rbx, 1
add rbx, rbx
mov rax, rdi
cmp rbx, 0x1000
jb 0x180008a68
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008b6d
mov rdx, rbx
mov rcx, rdi
call fcn.18002825c
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180028200
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18001d980
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rsi
call fcn.180020880
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x180008b17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008b12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008b67
call fcn.18002825c
movdqa xmm0, xmmword [0x18006b5e0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
test rdi, rdi
je 0x180008a73
sub rbx, rdi
sar rbx, 1
add rbx, rbx
mov rax, rdi
cmp rbx, 0x1000
jb 0x180008a68
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008b6d
jmp 0x180008a68
call fcn.18002e4dc
nop
call fcn.18002e4dc
int3
call fcn.180001280
int3
Function at 0x180009390
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
lea rcx, [rsp + 0x50]
call fcn.180008150
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1800093b4
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x1800093d2
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180006de0
nop
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
lea rcx, [rdi + 1]
mov eax, 2
mul rcx
cmovb rax, rbx
mov rcx, rax
call fcn.1800288a0
mov rbx, rax
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbx + rdi*2], si
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1800094aa
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800094a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009552
call fcn.18002825c
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1800094f6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800094f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000954c
call fcn.18002825c
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180009538
test rbx, rbx
je 0x180009524
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.18002e4dc
nop
call fcn.18002e4dc
nop
int3
Function at 0x180009680
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov dword [rsp + 0x30], esi
cmp qword [rcx + 0x18], 0xf
jbe 0x18000969f
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], sil
jne 0x1800096c0
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.180006de0
nop
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
lea rcx, [rdi + 1]
mov eax, 2
mul rcx
cmovb rax, rbx
mov rcx, rax
call fcn.1800288a0
mov rbx, rax
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbx + rdi*2], si
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180009773
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180009773
xor bl, bl
jmp 0x180009775
mov bl, 1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1800097ae
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800097a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800097c6
call fcn.18002825c
test bl, bl
setne al
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
call fcn.18002e4dc
int3

Function at 0x1800097d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0xf
jbe 0x1800097de
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800097f3
shr eax, 4
and al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x18000fb00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13f0
call fcn.180028fd0
sub rsp, rax
mov rax, qword [0x180076100]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov edi, r8d
mov ebp, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov edx, 0x26
mov r8d, 0x27
lea rcx, [rsp + 0x30]
call fcn.180013cc0
nop
call fcn.18002781c
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x18000fb80
mov dword [rsp + 0x50], 0x270
mov r14d, dword [rsp + 0x40]
dec r14d
mov r12d, 0x80000000
xor ebp, r12d
xor edi, r12d
sub edi, ebp
lea rcx, [rsp + 0x50]
cmp edi, 0xffffffff
jne 0x18000fbd0
call fcn.1800266d0
mov ecx, eax
jmp 0x18000fc09
inc edi
call fcn.1800266d0
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x18000fc05
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x18000fc05
lea rcx, [rsp + 0x50]
call fcn.1800266d0
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x18000fbf1
shr rcx, 0x20
lea eax, [rcx + rbp]
xor eax, r12d
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
jle 0x18000fcfd
xor r14d, r12d
mov ebp, eax
nop word [rax + rax]
lea rcx, [rsp + 0x50]
cmp r14d, 0x7fffffff
jne 0x18000fc57
call fcn.1800266d0
mov ecx, eax
jmp 0x18000fc98
lea edi, [r14 - 0x7fffffff]
call fcn.1800266d0
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x18000fc94
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x18000fc94
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.1800266d0
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x18000fc80
shr rcx, 0x20
lea eax, [rcx + r12]
xor eax, r12d
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
cdqe
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18000fce3
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x18000fcd8
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18000fcf3
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.180021ac0
sub rbp, 1
jne 0x18000fc40
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x18000fd36
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fd31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fd65
call fcn.18002825c
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.180028200
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.18002e4dc
int3
Function at 0x18001c710
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18001c734
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x18001c7c2
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18001c790
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18001c790
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.18004cf50
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001c7ad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18001c7b5
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18001c751
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x18001c8a0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18001c7d9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001c7db
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001c80d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.18004cf50
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18001c89d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001c848
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18001c87e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.180036400
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18001c89d
cmp rsi, rax
ja 0x18001c851
test rsi, rsi
je 0x18001c89d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.180036400
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x1800266d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180026731
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800266f0
mov ecx, dword [r9]
jmp 0x18002681b
cmp ecx, 0x4e0
jb 0x18002681b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180026750
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800267a0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x18002dedc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18002df4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18002df4b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002df4b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18002df4b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18002df4b
cmp dword [rcx + 0x84], 0xe
jbe 0x18002df4b
cmp dword [rcx + 0xf8], 0
je 0x18002df4b
mov ecx, ebx
call fcn.18002dffc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18002ddd8
nop
cmp dword [rbp + 0x20], 0
je 0x18002df99
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18002dfa4
int3
xor r8d, r8d
xor edx, edx
jmp 0x18002dedc
Function at 0x18002e098
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18002df4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18002df4b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002df4b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18002df4b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18002df4b
cmp dword [rcx + 0x84], 0xe
jbe 0x18002df4b
cmp dword [rcx + 0xf8], 0
je 0x18002df4b
mov ecx, ebx
call fcn.18002dffc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18002ddd8
nop
cmp dword [rbp + 0x20], 0
je 0x18002df99
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18002dfa4
int3
xor r8d, r8d
xor edx, edx
jmp 0x18002dedc

Function at 0x18003c058
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18003c06e
mov al, 1
jmp 0x18003c0ce
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18003c07f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18003c0cc
mov ecx, dword [rcx + 0x18]
nop
call fcn.180047660
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18003c0cc
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18003c0cc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18003c0cc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18003c0ce
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18003dd60
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18003dd80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180035b18
or eax, 0xffffffff
jmp 0x18003dd82
xor eax, eax
add rsp, 0x28
ret

Function at 0x18003f54c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180028fd0
sub rsp, rax
mov rax, qword [0x180076100]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18003bf38
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18003f59b
mov rax, rbp
jmp 0x18003f6a3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x78b80]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180040f6c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x78b80]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18003f69f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003f69f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180040f6c
test rax, rax
js 0x18003f69f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18003f69f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18003f691
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18003f691
cmp byte [rcx], 0xd
jne 0x18003f677
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18003f686
cmp byte [rcx + 1], 0xa
jne 0x18003f686
inc rcx
jmp 0x18003f686
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x76530]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18003f659
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18003f6a3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180028200
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret