joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800fd1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x28
mov qword [rsp + 0x70], rbx
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor edi, edi
lea r13, [0x1801881e0]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x1800fd20f
nop dword [rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x1800fd200
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x1800fd226
mov r15d, ebp
jmp 0x1800fd22f
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x70]
jne 0x1800fd368
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x1800fd368
movsd xmm2, qword [0x1802bace8]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x1800fd27a
test r11d, r11d
jne 0x1800fd2cf
mov r11d, ebp
inc rdx
jmp 0x1800fd260
test byte [r8 + r13 + 1], 0x10
je 0x1800fd2cf
test r10d, r10d
jne 0x1800fd291
cmp r8b, 0x30
jne 0x1800fd291
inc esi
jmp 0x1800fd2c2
inc r10d
cmp r10d, 0x1e
jg 0x1800fd2bf
test byte [rcx + r13 + 1], 2
je 0x1800fd2a7
add ecx, 0xffffffd0
jmp 0x1800fd2ad
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1800fd2c2
inc r9d
test r11d, r11d
je 0x1800fd2ca
dec r9d
inc rdx
jmp 0x1800fd260
lea eax, [rsi + r10]
test eax, eax
je 0x1800fd368
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x1800fd34e
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x1800fd300
mov eax, 2
jmp 0x1800fd30e
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x1800fd368
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x1800fd320
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x1800fd35a
xorps xmm1, xmmword [0x1802bb100]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x1800fd36b
xorps xmm0, xmm0
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180105e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
cmp r8, 0x28
ja 0x180105e67
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.180105cb0
movabs rax, 0x7fffffffffffffe7
cmp rbp, rax
jae 0x180105ef4
mov qword [rsp + 0x30], rbx
lea r9, [r8 + 0x19]
xor edx, edx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov rdi, qword [rcx + 0x18]
lea r8d, [rdx + 4]
mov ebx, dword [rdi + 0x50]
call fcn.1800fae90
movzx ecx, byte [rdi + 0x54]
mov r8, rbp
and cl, 3
mov rdx, r14
mov rsi, rax
mov byte [rax + 9], cl
mov byte [rax + 8], 0x14
mov rcx, qword [rdi + 0x58]
mov qword [rax], rcx
lea rcx, [rax + 0x18]
mov qword [rdi + 0x58], rax
mov dword [rax + 0xc], ebx
mov byte [rax + 0xa], 0
mov byte [rax + rbp + 0x18], 0
mov qword [rax + 0x10], rbp
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.1800fae70
int3
Function at 0x180114d30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180114da3
lea ecx, [rdx + 7]
mov qword [rsp + 0x40], rdi
call fcn.18011b7e4
xor edi, edi
lea r8, [0x180115db0]
mov qword [rsp + 0x28], rdi
mov r9, rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
mov qword [rax], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [rdi + 8]
call fcn.18011b7e4
mov qword [rsp + 0x28], rdi
lea r8, [0x180114690]
mov r9, rax
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov qword [rax], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180117c60
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180117eb0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180117d7a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180117cc4
mov rax, qword [0x1802dd008]
cmp qword [rsp + 0x20], rax
ja 0x180117cc4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180117c86
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180117cf5
jmp 0x180117d7a
cmp dword [rsp + 0x50], 0x10000
jne 0x180117d5d
cmp qword [rsp + 0x48], 0x10000
jb 0x180117d5d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180117d3b
mov rax, qword [rsp + 0x28]
jmp 0x180117d7c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180117d4b
xor eax, eax
jmp 0x180117d7c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180117d75
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180117eb0
mov qword [rsp + 0x20], rax
jmp 0x180117c86
xor eax, eax
add rsp, 0x68
ret

Function at 0x180117d90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180117ef0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180117ea6
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180117deb
mov rax, qword [0x1802dd008]
cmp qword [rsp + 0x20], rax
ja 0x180117deb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180117dad
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180117e1c
jmp 0x180117ea6
cmp dword [rsp + 0x50], 0x10000
jne 0x180117e84
cmp qword [rsp + 0x48], 0x10000
jb 0x180117e84
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180117e62
mov rax, qword [rsp + 0x28]
jmp 0x180117ea8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180117e72
xor eax, eax
jmp 0x180117ea8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180117ea1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180117ef0
mov qword [rsp + 0x20], rax
jmp 0x180117dad
xor eax, eax
add rsp, 0x68
ret
Function at 0x180117f40
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1801184d0
mov qword [rsp + 0x28], 0
cmp qword [0x1802e0b58], 0
jne 0x180117f88
cmp qword [0x1802e0b50], 0
je 0x180117f88
mov rax, qword [0x1802e0b50]
mov qword [0x1802e0b58], rax
cmp qword [0x1802e0b58], 0
je 0x18011802e
mov rax, qword [0x1802e0b58]
cmp qword [rax + 0x10], 0
je 0x18011802e
mov rax, qword [0x1802e0b58]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18011802e
mov rax, qword [0x1802e0b58]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18011802e
mov rax, qword [0x1802e0b58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180117ff4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180117ffb
xor eax, eax
jmp 0x1801181a9
mov rax, qword [0x1802e0b58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1801181a9
mov rax, qword [0x1802e0b50]
mov qword [0x1802e0b58], rax
jmp 0x180118050
mov rax, qword [0x1802e0b58]
mov rax, qword [rax + 8]
mov qword [0x1802e0b58], rax
cmp qword [0x1802e0b58], 0
je 0x18011809d
cmp qword [0x1802e0b58], 0
je 0x18011809b
mov rax, qword [0x1802e0b58]
cmp qword [rax + 0x10], 0
je 0x18011809b
mov rax, qword [0x1802e0b58]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18011809b
mov rax, qword [0x1802e0b58]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18011809b
jmp 0x180117fcc
jmp 0x18011803e
mov rcx, qword [rsp + 0x60]
call fcn.18011a370
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1801181b0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1801181a7
mov rax, qword [rsp + 0x48]
mov qword [0x1802e0b58], rax
mov rax, qword [0x1802e0b58]
mov dword [rax], 0x52727464
mov rax, qword [0x1802e0b58]
mov qword [rax + 0x10], 0
mov rax, qword [0x1802e0b58]
mov rcx, qword [0x1802e0b50]
mov qword [rax + 8], rcx
mov rax, qword [0x1802e0b58]
mov qword [0x1802e0b50], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1802e0b58]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180118158
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180118192
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18011814e
mov rax, qword [0x1802e0b58]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180117fcc
xor eax, eax
add rsp, 0x58
ret
Function at 0x180118ec0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180118f07
xor al, al
jmp 0x180118fa9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180118f31
xor al, al
jmp 0x180118fa9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180118fa1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180118fa1
mov al, 1
jmp 0x180118fa9
jmp 0x180118fa7
xor al, al
add rsp, 0x78
ret

Function at 0x1801192b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1802e0b50]
mov qword [rsp + 0x28], rax
jmp 0x1801192d0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1801192ff
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1801192fd
call sub.KERNEL32.dll_GetLastError
jmp 0x180119301
jmp 0x1801192c2
xor eax, eax
add rsp, 0x38
ret
Function at 0x1801199c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1802e0b68], eax
je 0x1801199ed
mov eax, 0x10dd
jmp 0x180119c06
cmp dword [0x1802e0b6c], 0
je 0x180119a01
mov eax, dword [0x1802e0b6c]
jmp 0x180119c06
cmp qword [rsp + 0x78], 0
jne 0x180119a13
mov eax, 0x57
jmp 0x180119c06
cmp qword [rsp + 0x70], 0
jne 0x180119a25
mov eax, 6
jmp 0x180119c06
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180119a57
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x1802e0b6c], eax
mov rax, qword [rsp + 0x70]
mov qword [0x1802e0b70], rax
mov eax, dword [rsp + 0x20]
jmp 0x180119c06
mov ecx, 0x30
call fcn.18011b7e4
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180119ac9
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x1802e0b6c], eax
cmp qword [rsp + 0x30], 0
je 0x180119ab4
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call fcn.18011b7b0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x1802e0b70], rax
mov eax, dword [rsp + 0x20]
jmp 0x180119c06
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.180119990
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.180119990
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x180119b26
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x180119b43
mov dword [rsp + 0x20], 9
cmp dword [0x1802e0b60], 0
je 0x180119b3e
jmp 0x180119a8a
jmp 0x180119a80
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x180119b70
mov dword [rsp + 0x20], 9
cmp dword [0x1802e0b60], 0
je 0x180119b6b
jmp 0x180119a8a
jmp 0x180119a80
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x180119ba7
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x180119a80
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x1802e0b80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x1802e0b80], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x180119c10
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1802e0b68], eax
je 0x180119c2b
mov eax, 0x10dd
jmp 0x180119d50
mov rax, qword [0x1802e0b80]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180119cd5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180119ca0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180119ca0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.180118610
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18011b7b0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x180119c37
mov qword [0x1802e0b80], 0
call fcn.180119070
mov rax, qword [0x1802e0b78]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180119d39
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.18011b7b0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x180119cf1
mov qword [0x1802e0b78], 0
mov dword [0x1802e0b68], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x18011a280
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1802e0b6c], 0
je 0x18011a29d
mov eax, dword [0x1802e0b6c]
jmp 0x18011a363
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x18011a2b0
xor eax, eax
jmp 0x18011a363
mov ecx, 0x10
call fcn.18011b7e4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18011a31e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18011a303
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.18011b7b0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1802e0b6c], eax
mov qword [0x1802e0b70], 0
mov eax, dword [rsp + 0x20]
jmp 0x18011a363
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x18011a338
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x18011a2d9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1802e0b78]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1802e0b78], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x18011c8e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18011c964
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18012fc70]
cmp byte [rcx + rax], 0
je 0x18011c964
dec r8
sub rdx, 1
jne 0x18011c94a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140003960
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140008790]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400039cf
mov rcx, r9
call fcn.140003830
test eax, eax
je 0x1400039cf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400039cd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400039c4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400039cf
add rdx, 0x28
cmp rdx, r9
jne 0x1400039b0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14002438c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400243d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400243d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400243d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400243d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400243d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400243d8
xor al, al
add rsp, 0x28
ret

Function at 0x14002c9e0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002c744

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x14001af18
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001ad44
Function at 0x14001125d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112f8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014db0
xor al, al
jmp 0x140014e31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014dc3
xor al, al
jmp 0x140014e31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ded
xor al, al
jmp 0x140014e31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014e01
xor al, al
jmp 0x140014e31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014e13
xor al, al
jmp 0x140014e31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014e2f
xor al, al
jmp 0x140014e31
mov al, 1
add rsp, 0x38
ret
Function at 0x140002180
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400021a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400021b1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400021d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400021d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002212
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400022ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000224d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000228e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400022ae
cmp rbx, rax
ja 0x140002260
test rbx, rbx
je 0x1400022ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret