joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4090b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rcx, rcx
mov qword [r11 - 0x20], r12
mov rsi, r9
mov r12d, r8d
mov rbp, rdx
je 0x40919f
test rdx, rdx
je 0x40919f
test r9, r9
je 0x40919f
mov qword [r11 - 8], rbx
xor ebx, ebx
mov qword [r11 - 0x38], rcx
cmp qword [rsp + 0xb8], rbx
je 0x409160
mov rdx, qword [rsp + 0xb8]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x38]
xor r8d, r8d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40915b
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0xb0]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp qword [rsp + 0xb8], rbx
mov esi, eax
je 0x409196
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x40913c
xor eax, eax
jmp 0x409144

Function at 0x409750
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x218
mov qword [rsp + 0x20], 0xfffffffffffffffe
invalid
dec dword [rcx - 0x77]
pop rbx
sbb byte [rcx - 0x77], cl
imul esp, dword [rax], 0x49
mov dword [rbx - 8], esi

Function at 0x40c1a0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40c1c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40c1c9
mov ecx, eax
call fcn.0040d6e0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x40c1d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov edi, edx
mov rbx, rcx
jne 0x40c220
call fcn.0040d6b0
mov dword [rax], ebx
call fcn.0040d680
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbx
call fcn.0040cbe0
lea eax, [rbx - 1]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40c24c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040d6e0
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
test dil, dil
jns 0x40c256
and eax, 0xfffffffe
jmp 0x40c259
or eax, 1
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40c22b
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x38
ret
Function at 0x40e1a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004242f8]
jne 0x40a60a
rol rcx, 0x10
test cx, 0xffff
jne 0x40a606
repz ret
ror rcx, 0x10
jmp 0x40e100
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00425a80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00425b78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x40e185
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00425a80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x40e1a7
mov rax, qword [rsp + 0x88]
mov qword [0x00425b78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00425b18], rax
mov rax, qword [0x00425b78]
mov qword [0x004259f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00425b00], rax
mov dword [0x004259e0], 0xc0000409
mov dword [0x004259e4], 1
or al, 0x78
add dword [rax], eax
add dword [rax], eax
add byte [rax], al
Function at 0x418730
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0040faa0
xor ebx, ebx
cmp qword [0x00426700], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x418861
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x418793
xor eax, eax
jmp 0x418941
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41878c
mov rcx, rax
call fcn.0040fa30
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x00426700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040fa30
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x00426708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040fa30
lea rcx, [rsp + 0x30]
mov qword [0x00426710], rax
call fcn.0040a9e0
test eax, eax
je 0x418817
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040cb40
cmp dword [rsp + 0x30], 2
jne 0x418861
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040fa30
test rax, rax
mov qword [0x00426720], rax
je 0x418861
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040fa30
mov qword [0x00426718], rax
mov rcx, qword [0x00426718]
cmp rcx, rsi
je 0x4188f3
cmp qword [0x00426720], rsi
je 0x4188f3
call fcn.0040fb00
call rax
test rax, rax
mov rbp, rax
je 0x4188be
mov rcx, qword [0x00426720]
call fcn.0040fb00
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4188be
test byte [rsp + 0x48], 1
jne 0x4188f3
lea rcx, [rsp + 0x34]
call fcn.0040aa30
test eax, eax
je 0x4188e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040cb40
cmp dword [rsp + 0x34], 4
jb 0x4188ed
bts edi, 0x15
jmp 0x418927
bts edi, 0x12
jmp 0x418927
mov rcx, qword [0x00426708]
cmp rcx, rsi
je 0x418927
call fcn.0040fb00
call rax
test rax, rax
mov rbx, rax
je 0x418927
mov rcx, qword [0x00426710]
cmp rcx, rsi
je 0x418927
call fcn.0040fb00
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00426700]
call fcn.0040fb00
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x14001675c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400167da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400167d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400167d1
mov rax, qword [rbp - 8]
jmp 0x1400167ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400167a4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001988
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019d4
xor al, al
add rsp, 0x28
ret
Function at 0x140001e38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e82
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e84
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rbp + 0x128], rax
movdqa xmm0, xmmword [str.C:WindowsSyste]
lea rcx, [rbp + 0x108]
movdqu xmmword [rbp + 0x108], xmm0
mov dword [rbp + 0x118], 0x5c32336d
mov dword [rbp + 0x11c], 0x5f327377
mov dword [rbp + 0x120], 0x642e3233
mov word [rbp + 0x124], 0x6c6c
mov byte [rbp + 0x126], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x140003248]
lea rdx, [rbp + 0xd8]
movups xmm0, xmmword [str.]
mov r15, rax
mov dword [rbp + 0x120], ecx
movsd xmm1, qword [0x140003240]
movzx ecx, word [0x14000324c]
mov word [rbp + 0x124], cx
movzx ecx, byte [0x14000324e]
mov byte [rbp + 0x126], cl
mov rcx, rax
movups xmmword [rbp + 0x108], xmm0
mov dword [rbp + 0xd8], 0x6b636f73
movsd qword [rbp + 0x118], xmm1
mov word [rbp + 0xdc], 0x7465
mov byte [rbp + 0xde], 0
mov dword [rbp + 0xf8], 0x53415357
mov dword [rbp + 0xfc], 0x74726174
mov word [rbp + 0x100], 0x7075
mov byte [rbp + 0x102], 0
mov dword [rbp + 0xe8], 0x74656e69
mov dword [rbp + 0xec], 0x6464615f
mov word [rbp + 0xf0], 0x72
mov dword [rbp + 0xd0], 0x6e6f7468
mov word [rbp + 0xd4], 0x73
mov dword [rbp + 0xe0], 0x6e6e6f63
mov dword [rbp + 0xe4], 0x746365
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xf8]
mov rcx, r15
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xe8]
mov rcx, r15
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xd0]
mov rcx, r15
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xe0]
mov rcx, r15
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x202
lea rdx, [rsp + 0x30]
mov r15, rax
call rbx
mov edx, 1
mov r12d, 2
mov ecx, r12d
lea r8d, [rdx + 5]
call r14
lea rcx, str.127.0.0.1
mov ebx, eax
mov word [rsp + 0x20], r12w
call rsi
mov ecx, 0x7e7
mov dword [rsp + 0x24], eax
call rdi
mov word [rsp + 0x22], ax
nop
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rbx
call r15
cmp eax, 0xffffffff
je 0x1400011f0
mov rax, rbx
mov rcx, qword [rbp + 0x128]
xor rcx, rsp
call fcn.140001370
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lahf
fisub dword [rax + riz]
jl 0x14003f67f
movabs eax, dword [0x7763a13e8c07c028]
fidiv word [rsi]
invalid
sub byte [rsi], bh
sub ah, byte [rax]
xchg esi, eax
invalid
invalid
je 0x14003f654
push rsi
push rdx
jp case.0x14000727a.7
je 0x14003f5fb
cmp esp, dword [rdi]
loope 0x14003f64a
invalid
and edx, dword [rbx + 0x59]
int 0x51
jle 0x14003f62b
ret 0x280a
invalid
add al, 0xf7
invalid
add ah, 0x30
int 0x47
mov esi, 0xb629666
test eax, 0xbf8c14
mov dh, 0x36
imul ebx, dword [rcx], 0xbb579355
sbb dword [rbp - 0x6d], edx
push rdi
invalid
mov cl, 6
invalid
sbb dword [rbp - 0x6d], edx
push rdi
mov ebx, 0x48206b1
adc al, 0x85
adc al, 0x85
jl 0x14003f67e
invalid
std
loope 0x14003f6cd
xchg edi, eax
loopne 0x14003f60d
movsb byte [rdi], byte [rsi]
mov ebp, dword [rax - 0x15]
xchg edi, eax
sub eax, 0xbf462ed8
sbb ecx, ebx
sub r13, rsp
mov dl, 0x49
add ah, byte [rbx + 0x69]
invalid
imul esi, dword [rbx], 0xf9319db9
invalid
fistp dword [rax + 0x7e]
invalid
invalid
mov eax, 0x9d7cc483
sal esi, 0xd0
clc
invalid
fdivr qword [rax]
jl 0x14003f69c
mov cl, 0x2d
mov cl, 0x2d
lahf
std
fldcw word [r8 + 0x2f5f281a]
test al, 0x1a
sub byte [rdi + 0x2f], bl
sub byte [rdi + 0x2f], bl
sbb spl, byte [rdi - 0x795519a1]
in al, 0xa6
mov ebx, 0x86801f3
loopne 0x14003f670
and bh, byte [rcx + 0x61]
xor al, 0xd9
cmp dword [rdi - 0x30fb6179], ebp
sahf
add al, 0xcf
mov ah, 0xb
xchg edx, eax
or esp, dword [rdi - 0x6e]
jg 0x14003f6d1
sub bl, byte [rdx - 0x14ee096]
fst dword [rsi + rsi*2 - 0x2c]
mov bh, 0x96
js 0x14003f6a9
wait
invalid
Function at 0x180004000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13b0
call fcn.18004d5e0
sub rsp, rax
mov rdi, rcx
movsxd rsi, r8d
xor ecx, ecx
movsxd rbp, edx
call fcn.18005ce08
mov rcx, rax
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop word [rax + rax]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, r9d
mov dword [rsp + r9*4 + 0x24], ecx
inc r9
cmp r9, 0x270
jb 0x180004050
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.180014f80
mov ecx, eax
lea rbx, [rcx + rcx*2]
test ebx, ebx
jne 0x1800040a5
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.180014f80
mov ecx, eax
lea rbx, [rcx + rcx*2]
cmp ebx, 1
jb 0x180004090
shr rbx, 0x20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
inc ebx
sub ebx, 1
je 0x1800040e7
sub ebx, 1
je 0x1800040d1
cmp ebx, 1
jne 0x18000410f
mov rcx, rsi
call fcn.18004d184
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
jmp 0x180004103
mov rdi, qword [rdi]
mov r8, rsi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1800040ff
mov rdi, qword [rdi]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rdi + 0x10]
mov rbx, rax
call fcn.180002550
mov qword [rax + rbp*8], rbx
lea r11, [rsp + 0x13b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800096e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rdi, rcx
xor esi, esi
mov dword [rbp + 0x1e8], 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
add rax, 0x19f
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x19f
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
xor eax, eax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea ecx, [rsi + 0x10]
call fcn.18004cdc8
mov qword [rax + 8], rsi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rax], rcx
mov word [rsp + 0x70], si
mov qword [rsp + 0x76], rsi
mov qword [rsp + 0x7e], rsi
xor eax, eax
mov word [rsp + 0x73], ax
mov byte [rsp + 0x75], al
mov word [rsp + 0x76], ax
mov byte [rsp + 0x78], al
mov word [rsp + 0x79], ax
mov byte [rsp + 0x7b], al
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x7e], al
mov word [rsp + 0x7f], ax
mov byte [rbp - 0x7f], al
mov word [rbp - 0x7e], ax
mov byte [rbp - 0x7c], al
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x6c], esi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r9, [rbp + 0xb0]
lea r8, [rbp + 0x1e8]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000ed20
mov ebx, dword [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.180011d40
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
lea edx, [rsi + 0x10]
call fcn.18004ccdc
lea eax, [rbx - 1]
cmp eax, 0x102
ja 0x18000984e
lea r9, [rbp - 0x60]
xor r8d, r8d
lea rdx, [0x1800e6b58]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x18000984e
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180009836
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.18000d5c0
jmp 0x180009863
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rax, rdi
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180014f80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180014fe1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180014fa0
mov ecx, dword [r9]
jmp 0x1800150c8
cmp ecx, 0x4e0
jb 0x1800150c8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180015000
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180015050
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180065474
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1800654a6
call fcn.180058ac4
mov dword [rax], 0x16
call fcn.18005da70
jmp 0x1800655c5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800655c5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1800655c5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1800654d5
lock or dword [rcx + 0x14], 0x10
jmp 0x1800655c5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1800654e9
call fcn.180066784
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.18006098c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.180066c9c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1800655b3
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x18006557e
mov rcx, rsi
call fcn.18006098c
cmp eax, edi
je 0x180065569
mov rcx, rsi
call fcn.18006098c
cmp eax, 0xfffffffe
je 0x180065569
mov rcx, rsi
call fcn.18006098c
movsxd rbx, eax
lea r14, [0x1800cff00]
mov rcx, rsi
sar rbx, 6
call fcn.18006098c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x180065570
lea rdx, [0x180076410]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18006557e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1800655a2
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1800655a2
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1800655a2
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1800655c8
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x180066504
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18004d5e0
sub rsp, rax
mov rax, qword [0x180076078]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18006098c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180066553
mov rax, rbp
jmp 0x18006665b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xcff00]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180067474
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0xcff00]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180066657
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180066657
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180067474
test rax, rax
js 0x180066657
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180066657
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180066649
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180066649
cmp byte [rcx], 0xd
jne 0x18006662f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18006663e
cmp byte [rcx + 1], 0xa
jne 0x18006663e
inc rcx
jmp 0x18006663e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x76460]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180066611
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18006665b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18004d5b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret