joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c4e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x66
mov dword [rbp - 0x20], 0x30001a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2d003b
mov dword [rbp - 0x18], 0x22002e
mov dword [rbp - 0x14], 0x360027
mov dword [rbp - 0x10], 0x4c0020
call fcn.140004fd0
mov rcx, rax
call 0x14000c4e0
mov qword [0x1400151b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x73
mov dword [rbp - 0x20], 0x30001a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2d003b
mov dword [rbp - 0x18], 0x22002e
mov dword [rbp - 0x14], 0x450056
call fcn.1400022a0
mov rcx, rax
call 0x14000c4e0
lea rcx, [rbp - 0x20]
mov qword [0x1400151a8], rax
mov dword [rbp - 0x20], 0x1003f
mov dword [rbp - 0x1c], 0xf000d
mov dword [rbp - 0x18], 0x6e0007
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c4e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c542
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000ccc0
test al, al
jne 0x14000c554
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c510
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400151c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1d0002
mov dword [rbp - 0x1c], 0xf000c
mov dword [rbp - 0x18], 0x5d0007
mov dword [rbp - 0x14], 0x590057
mov dword [rbp - 0x10], 0x650017
mov dword [rbp - 0xc], 0x6f000a
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400151c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400151a0], rax
mov dword [rbp - 0x20], 0x1c0006
mov dword [rbp - 0x1c], 0xa0007
mov dword [rbp - 0x18], 0xb0005
mov dword [rbp - 0x14], 0x590011
mov dword [rbp - 0x10], 0x650017
mov dword [rbp - 0xc], 0x6f000a
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x1400136b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400151b0], rax
mov word [rbp - 0x10], 0x3613
mov byte [rbp - 0xe], 0x73
call fcn.140004620
mov rcx, qword [0x1400151a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140015130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xf0c1d02
mov dword [rbp - 0x1c], 0x121d2b07
mov dword [rbp - 0x18], 0xa127c10
mov word [rbp - 0x14], 0x7525
call fcn.140001180
mov rcx, qword [0x1400151a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140015130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x61d1b18
mov dword [rbp - 0x1c], 0x3000019
mov dword [rbp - 0x18], 0x103793c
mov word [rbp - 0x14], 0x7533
call fcn.140001180
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013770]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150e8], rax
mov byte [rbp - 0x10], 0x65
call fcn.140004330
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013700]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150f0], rax
mov dword [rbp - 0x10], 0x65160d01
call fcn.140002660
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013690]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150e0], rax
mov byte [rbp - 0x10], 0x65
call fcn.140004330
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013640]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150d8], rax
mov dword [rbp - 0x10], 0x241d0e0c
mov byte [rbp - 0xc], 0x72
call fcn.140003130
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013710]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x200b
mov byte [rbp - 0xe], 0x73
call fcn.140004620
mov rcx, qword [0x1400151b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000e380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000e5ae
mov word [rbp + 0x50], 0x7551
mov word [rbp + 0x58], 0x7551
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e434
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000e420
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000e465
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000e450
cmp rdi, rbx
jne 0x14000e582
mov r13, rsi
mov word [rbp - 0x50], 0x7551
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e4a6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000e492
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000e5a8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x750030
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000e518
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x75002b
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000e518
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x750030
mov dword [rbp - 0x42], 0x750010
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x750030
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000e575
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x75002b
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000e575
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x750030
mov dword [rbp - 0x32], 0x750010
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000e582
inc r14
jmp 0x14000e480
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000e5ae
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000e3f0
mov rax, qword [rbp - 8]
jmp 0x14000e5b0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180004050
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800371c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1800041ba
cmp byte [rcx + 0x71], 0
je 0x1800041ba
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1800040a4
xor al, al
jmp 0x1800041bc
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180003950
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.180003ae0
nop
mov r10, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
nop dword [rax + rax]
lea rdx, [rsp + 0x40]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rsp + 0x40]
cmovae r8, r10
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x180004122
sub eax, 1
jne 0x18000419b
jmp 0x180004126
mov byte [rdi + 0x71], 0
lea rax, [rsp + 0x40]
mov r10, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rsp + 0x30]
sub rbx, rax
je 0x180004177
lea rcx, [rsp + 0x40]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
call fcn.18000d050
cmp rbx, rax
jne 0x1800041a0
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x40]
cmp byte [rdi + 0x71], 0
je 0x1800041a4
test rbx, rbx
jne 0x1800040e0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.180003c70
jmp 0x1800040d1
sub eax, 2
je 0x1800041a4
xor bl, bl
jmp 0x1800041a6
mov bl, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x40]
call fcn.180003950
movzx eax, bl
jmp 0x1800041bc
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180007b00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180004f80
Capabilities:
Hash data using crc32b

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
xor r10d, r10d
mov ebx, 0x80
xor edx, edx
movzx eax, r10b
and al, 1
mov eax, r10d
cmovne edx, ebx
shr eax, 1
test al, 1
je 0x180004fa7
or edx, 0x40
shr eax, 1
test al, 1
je 0x180004fb0
or edx, 0x20
shr eax, 1
test al, 1
je 0x180004fb9
or edx, 0x10
shr eax, 1
test al, 1
je 0x180004fc2
or edx, 8
shr eax, 1
test al, 1
je 0x180004fcb
or edx, 4
shr eax, 1
test al, 1
je 0x180004fd4
or edx, 2
test al, 2
je 0x180004fdb
or edx, 1
shl edx, 0x18
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
lea eax, [rcx + rcx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
lea eax, [rcx + rcx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
lea eax, [rcx + rcx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
xor r9d, r9d
mov dword [r11], eax
lea r8d, [r9 + 0x1e]
test al, 1
je 0x1800050a8
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x1800050bb
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x180005096
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jle 0x180004f90
mov rbx, qword [rsp + 8]
ret

Function at 0x1800050f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, r8
mov dword [r8], 0xffffffff
mov rsi, rcx
mov qword [rsp + 0x40], 0
lea r8, [0x180031a20]
lea rcx, [rsp + 0x40]
call fcn.18000d96c
test eax, eax
je 0x180005132
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov ecx, 0x400
mov qword [rsp + 0x30], rdi
call fcn.18000d88c
mov rdi, rax
test rax, rax
jne 0x180005165
mov rcx, qword [rsp + 0x40]
call fcn.18000c7c0
mov rdi, qword [rsp + 0x30]
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov r9, qword [rsp + 0x40]
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call fcn.18000f638
test eax, eax
je 0x1800051cf
mov r9, rdi
test eax, eax
je 0x1800051b3
nop dword [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
mov r8d, dword [rbx]
movzx edx, r8b
xor rdx, rcx
shr r8d, 8
mov ecx, dword [rsi + rdx*4]
xor ecx, r8d
mov dword [rbx], ecx
add eax, 0xffffffff
jne 0x180005190
mov r9, qword [rsp + 0x40]
mov edx, 1
mov r8d, 0x400
mov rcx, rdi
call fcn.18000f638
test eax, eax
jne 0x180005181
mov rcx, rdi
call fcn.18000d458
mov rcx, qword [rsp + 0x40]
call fcn.18000c7c0
mov eax, dword [rbx]
mov rdi, qword [rsp + 0x30]
not eax
mov dword [rbx], eax
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x180006290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
sub rdx, rcx
movabs r11, 0xffffffff0ba6512b
add r11, rdx
movabs rbx, 0xffffffff0ba6512c
add rbx, rdx
mov r10, rcx
mov r8d, 0xc3
mov rax, rcx
mov r9d, 0xf
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r11 + rax]
lea rax, [rax + 2]
xor cl, r8b
mov byte [rax - 2], cl
lea rcx, [r8 + 1]
movzx edx, cl
movzx ecx, byte [rbx + rax - 2]
xor cl, dl
mov byte [rax - 1], cl
lea rcx, [rdx + 1]
movzx r8d, cl
sub r9, 1
jne 0x1800062d0
mov rbx, qword [rsp + 8]
mov rax, r10
mov byte [r10 + 0x1e], r9b
ret

Function at 0x180006310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
sub rdx, rcx
mov r8d, 0x38
movabs r11, 0xffffffff175a1d6a
movabs rbx, 0xffffffff175a1d6b
add r11, rdx
mov r10, rcx
mov rax, rcx
add rbx, rdx
lea r9d, [r8 - 0x22]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r11 + rax]
lea rax, [rax + 2]
xor cl, r8b
mov byte [rax - 2], cl
lea rcx, [r8 + 1]
movzx edx, cl
movzx ecx, byte [rbx + rax - 2]
xor cl, dl
mov byte [rax - 1], cl
lea rcx, [rdx + 1]
movzx r8d, cl
sub r9, 1
jne 0x180006350
mov rbx, qword [rsp + 8]
mov rax, r10
mov byte [r10 + 0x2c], r9b
ret

Function at 0x1800080e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x180008171
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x180008171
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180008171
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x180008155
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x18000814f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x180008157
add rdx, 0x28
jmp 0x180008134
xor edx, edx
test rdx, rdx
jne 0x180008160
xor al, al
jmp 0x180008177
test dword [rdx + 0x24], 0x80000000
je 0x18000816d
xor al, al
jmp 0x180008177
mov al, 1
jmp 0x180008177
xor al, al
jmp 0x180008177
add rsp, 0x18
ret
Function at 0x180013848
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1800136e8
call fcn.18000d18c
mov dword [rax], 0x16
call fcn.18000cb88
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800136d0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1800136d0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x18001371a
lock or dword [rax + 0x14], 0x10
jmp 0x1800136d0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180013737
mov rcx, qword [rbp + 0x10]
call fcn.18001625c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800123f8
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180018be4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x18001378e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1800136d0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1800137fa
mov rcx, qword [rbp + 0x10]
call fcn.1800123f8
cmp eax, 0xffffffff
je 0x1800137e1
mov rcx, qword [rbp + 0x10]
call fcn.1800123f8
cmp eax, 0xfffffffe
je 0x1800137e1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800123f8
movsxd rdi, eax
lea rsi, [0x1800522c0]
mov rcx, rbx
sar rdi, 6
call fcn.1800123f8
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1800137e8
lea rax, [0x180037430]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800137fa
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180013830
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x18001382c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x18001382c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1800136d3
jmp 0x1800136a0

Function at 0x18001688c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800168ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18000d11c
or eax, 0xffffffff
jmp 0x1800168ae
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400029c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Master_tpublicar_tuni_twpadmin_twsmleads_tfunstuff_tgibson_tcustomize_tcloseouts_tnucleo_tprp_tlifecare_tcontactos_tbasil_tscheduledtasks_tdownloadrev_tewebeditpro_tzhidao_tscripting_twoodworking_tnancy_tit_thomme_tprihlaseni_twenzhang_tcosmetics_tuploadimages_tcustomavatars_tinfobox_tpagos_tlaredo_ttemporary_tco_tforsale_tflakes_torderinfo_tcalbellibenl_tcouples_tprogramfiles_tarbeitgeber_tlastdetail_tcorreu_tquicklinks_tfj_tforumas
mov r10, rax
sub rbx, rax
movabs rdi, 0x14cab88725af6e75
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xc
lea r9, [r9 + 0x18]
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xc
jb 0x140002a10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Master_tpublicar_tuni_twpadmin_twsmleads_tfunstuff_tgibson_tcustomize_tcloseouts_tnucleo_tprp_tlifecare_tcontactos_tbasil_tscheduledtasks_tdownloadrev_tewebeditpro_tzhidao_tscripting_twoodworking_tnancy_tit_thomme_tprihlaseni_twenzhang_tcosmetics_tuploadimages_tcustomavatars_tinfobox_tpagos_tlaredo_ttemporary_tco_tforsale_tflakes_torderinfo_tcalbellibenl_tcouples_tprogramfiles_tarbeitgeber_tlastdetail_tcorreu_tquicklinks_tfj_tforumas
mov r10, rax
sub rbx, rax
movabs rdi, 0x14cab88725af6e75
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xa]
mul rcx
add r11d, 0xa
shr rdx, 5
imul rax, rdx, 0x18a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140002f90
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret