joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400180b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400f2254]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140018260
mov rax, qword [0x1400f2258]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400180fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140018187
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400180e0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x1400182bd
mov rax, qword [0x1400f2258]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400f2258]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400182a2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140018180
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140018210
add dword [0x1400f2254], 1
cmp ebx, 8
jae 0x1400181b8
test bl, 4
jne 0x140018270
test ebx, ebx
je 0x1400181a9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140018290
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400181a9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1400181ea
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400f2258]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140018180
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
xor edi, edi
jmp 0x140018107
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400181a9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400181a9
mov rax, qword [0x1400f2258]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop dword [rax]
Function at 0x1400187d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400f22c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400f22a0]
test rbx, rbx
je 0x140018824
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14001881b
test r12, r12
je 0x14001881b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140018800
lea rcx, [0x1400f22c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140018a50
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140018a60
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x140018a70
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140018ab5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x140018aac
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140018ab7
add rax, 0x28
cmp rax, r9
jne 0x140018a98
xor eax, eax
ret

Function at 0x140018b60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400cc580]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140018bd9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140018bd9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140018bd6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x140018bcd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140018bd9
add r8, 0x28
cmp r8, r9
jne 0x140018bb8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140018cc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400cc580]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140018d2f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140018d2f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x140018d2d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140018d24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140018d38
add rax, 0x28
cmp rax, r9
jne 0x140018d10
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x140018d50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400cc580]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140018dc8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140018dc8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140018dc8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140018dc8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x140018dbc
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140018dd0
add rdx, 0x28
cmp rdx, r10
jne 0x140018da8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x140018de0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x140018dee
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140018dc5
test r8d, r8d
jg 0x140018dd8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret

Function at 0x140018ed0
Capabilities:
Allocate thread local storage

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x140018f00
mov rdx, r12
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop r12
jmp dbg.__mingwthr_key_dtor
add rsp, 0x28
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140018f40
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x140018f80
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140018f98
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140024e10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rbx
test rax, rax
je 0x140024e58
mov rcx, r12
mov qword [dbg.init_rand_s], rax
add rsp, 0x28
pop rbx
pop r12
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rbx
mov qword [0x1400f2d40], rax
lea rax, [dbg.mingw_rand_s]
jmp 0x140024e3f

Function at 0x140026ed0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x140026efc
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140027b80
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x1400c5fe0], 0
jne 0x140027c8a
mov byte [0x1400c5fe0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x140027c60
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x140027c51
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x1400c6f61]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x140027c4c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x140027c1b
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x140027d1f
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x140027c85
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x140027c85

Function at 0x140081b00
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140081b27
call rbp
cmp dword [rax], 4
jne 0x140081b44
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140081b20
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140095fb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140095fd8
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140096020
cdqe
add rsi, rax
sub rbx, rax
jne 0x140095ff0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14009602c
call rbp
cmp dword [rax], 4
je 0x140095ff0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edx, 0x9108
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400010ca
lea rcx, str.____Failed_to_allocate_shellcode_buffer_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400011c0
add rsp, 0x40
pop rbx
ret
mov r8d, 0x9108
lea rdx, [0x140005080]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea r9, [rsp + 0x30]
mov edx, 0x9108
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001120
lea rcx, str.____Failed_to_change_memory_protection._n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400011c0
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000115b
lea rcx, str.____Failed_to_create_shellcode_thread._n
call fcn.140001010
mov eax, 1
jmp 0x140001194
mov edx, 0x9108
lea rcx, str.___Shellcode_size:__d_n
call fcn.140001010
mov rdx, rbx
lea rcx, str.___Allocated_shellcode_in:_0x_p_n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400011c0
add rsp, 0x40
pop rbx
ret

Function at 0x140001a80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001aca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001aca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001aca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001aca
cmp dword [rcx + 0x84], 0xe
jbe 0x140001aca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001acc
xor al, al
add rsp, 0x28
ret
Function at 0x1800036d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1800a5080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], rdi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x180003720
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.180002710
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rdi
mov r14d, 0xf
mov qword [rbp + 0x37], r14
mov byte [rbp + 0x1f], 0
lea rdx, [rbp - 1]
mov rsi, qword [rbp - 1]
mov r15, qword [rbp + 0x17]
cmp r15, r14
cmova rdx, rsi
mov r9, qword [rbp + 0xf]
test r9, r9
je 0x180003797
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
add rax, rdx
cmp byte [rax], 0x5c
je 0x180003792
cmp rax, rdx
je 0x180003797
dec rax
cmp byte [rax], 0x5c
jne 0x180003785
sub rax, rdx
jmp 0x18000379e
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x1800037fe
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea r8, [rax + 1]
cmp r9, r8
cmovb r8, r9
lea rdx, [rbp - 1]
cmp r15, 0xf
cmova rdx, rsi
lea rcx, [rbp - 0x21]
call fcn.180002710
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rbp + 0x1f], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [rbp + 0x2f], xmm1
mov r15, qword [rbp + 0x17]
mov rsi, qword [rbp - 1]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
movq rdi, xmm1
xor edx, edx
mov r8d, 0x104
lea rcx, [0x1800aadc0]
call fcn.180080580
test rdi, rdi
je 0x1800038f6
lea rax, [rbp + 0x1f]
mov rbx, qword [rbp + 0x1f]
cmp r14, 0xf
cmova rax, rbx
lea rdx, [rbp + 0x1f]
mov r8, rdi
lea rcx, [0x1800aadc0]
cmp byte [rax], 0x22
jne 0x18000384b
cmp r14, 0xf
cmova rdx, rbx
inc rdx
jmp 0x180003853
cmp r14, 0xf
cmova rdx, rbx
call fcn.18007fee0
nop
cmp r14, 0xf
jbe 0x180003894
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180003884
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800038fc
mov rcx, rbx
call fcn.180039aec
mov r15, qword [rbp + 0x17]
mov rsi, qword [rbp - 1]
cmp r15, 0xf
jbe 0x1800038c7
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800038bf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800038f0
mov rcx, rsi
call fcn.180039aec
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180039a90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18005c2e4
nop
call fcn.180006010
nop
call fcn.18005c2e4
int3
Function at 0x180004210
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x180004234
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x1800042c2
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180004290
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x180004290
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.18007fee0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1800042ad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1800042b5
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x180004251
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x1800043a0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x1800042d9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800042db
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000430d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.18007fee0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000439d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180004348
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18000437e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18005dc18
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18000439d
cmp rsi, rax
ja 0x180004351
test rsi, rsi
je 0x18000439d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18005dc18
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x18000e1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18000f030
push r13
push r15
sub rsp, 0x38
mov rax, qword [0x1800a5080]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x70], 0
mov rax, r8
mov qword [rsp], rax
mov r13, r9
mov qword [rsp + 8], rax
mov r15, rdx
mov rcx, r8
jbe 0x18000f2cf
mov qword [rsp + 0x50], rbx
mov r11d, 1
mov qword [rsp + 0x60], rbp
mov r9d, 0x3ff
mov qword [rsp + 0x68], rsi
mov r10d, 0xdc00
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
nop dword [rax + rax]
cmp rax, r13
je 0x18000f2ac
mov rbp, rax
lea rsi, [rsp + 0x10]
lea r12, [rsp + 0x10]
nop word [rax + rax]
movzx r14d, word [r15]
movzx edx, byte [rax]
cmp r14w, 1
jbe 0x18000f0ea
lea ecx, [rdx - 0x80]
cmp ecx, 0x3f
ja 0x18000f2a8
inc rax
and dx, 0x3f
or dx, r14w
jmp 0x18000f242
cmp edx, 0x80
jae 0x18000f104
mov rbp, rax
xor ebx, ebx
inc rax
mov r8d, edx
xor edi, edi
jmp 0x18000f1db
cmp edx, 0xc0
jb 0x18000f2a8
mov r8d, edx
cmp edx, 0xe0
jae 0x18000f12f
and r8d, 0x1f
xor r10d, r10d
xor edi, edi
mov r9d, r11d
mov ebx, r11d
xor r11d, r11d
jmp 0x18000f17b
cmp edx, 0xf0
jae 0x18000f14a
and r8d, 0xf
xor r10d, r10d
xor edi, edi
mov ebx, 2
xor r11d, r11d
jmp 0x18000f178
mov edi, r11d
cmp edx, 0xf8
jae 0x18000f163
and r8d, 7
mov ebx, 3
mov r10d, r11d
jmp 0x18000f178
and r8d, 3
mov r10d, 1
cmp edx, 0xfc
sbb ebx, ebx
add ebx, 5
mov r9d, ebx
mov ecx, r9d
mov rbp, rax
sub ecx, r11d
inc ecx
movsxd rdx, ecx
mov rcx, r13
sub rcx, rax
cmp rcx, rdx
jl 0x18000f26b
inc rax
cmp r10d, r9d
jae 0x18000f1c9
movzx edx, byte [rax]
lea ecx, [rdx - 0x80]
cmp ecx, 0x3f
ja 0x18000f2a8
mov ecx, r8d
and edx, 0x3f
shl ecx, 6
mov r8d, edx
or r8d, ecx
dec r9d
inc rax
cmp r11d, r9d
jl 0x18000f1a0
mov r10d, 0xdc00
mov r9d, 0x3ff
mov r11d, 1
mov edx, r8d
shl edx, 6
test edi, edi
cmove edx, r8d
cmp edx, 0x10ffff
ja 0x18000f2a8
cmp edx, 0xffff
jbe 0x18000f21b
movzx ecx, dx
shr edx, 0xa
and cx, r9w
sub dx, 0x40
or cx, r10w
mov word [r15], cx
mov ecx, 0xd800
or dx, cx
jmp 0x18000f246
cmp ebx, 3
jb 0x18000f23c
cmp rax, r13
je 0x18000f268
movzx r8d, byte [rax]
inc rax
lea ecx, [r8 - 0x80]
cmp ecx, 0x3f
ja 0x18000f2a8
and r8d, 0x3f
or edx, r8d
test r14w, r14w
jne 0x18000f246
mov word [r15], r11w
mov word [r12], dx
lea rsi, [r12 + 2]
cmp rax, r13
je 0x18000f26b
lea rcx, [rsp + 0x12]
mov r12, rsi
cmp rsi, rcx
jne 0x18000f0c0
jmp 0x18000f26b
mov rax, rbp
cmp rbp, rax
je 0x18000f2a8
lea rcx, [rsp + 0x12]
cmp rsi, rcx
mov rcx, qword [rsp + 0x70]
jne 0x18000f287
dec rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov r11d, 1
mov r9d, 0x3ff
mov r10d, 0xdc00
test rcx, rcx
jne 0x18000f0a0
jmp 0x18000f2ac
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
sub rax, rcx
mov ecx, 0x7fffffff
cmp rax, rcx
cmovg eax, ecx
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.180039a90
add rsp, 0x38
pop r15
pop r13
ret
Function at 0x18000e1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x18000e345
cmp rcx, rbp
je 0x18000e345
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x18000e24c
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18000e36c
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18000e263
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x18000e263
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18000e276
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x18000e2c3
mov r8d, eax
cmp eax, 0x800
jae 0x18000e290
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x18000e2c3
cmp eax, 0x10000
jae 0x18000e2aa
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x18000e2c3
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x18000e345
add qword [rsi], 2
test dil, dil
jne 0x18000e2e4
cmp r10d, 3
jae 0x18000e2f0
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x18000e31e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x18000e300
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x18000e345
cmp qword [rbx], rbp
jne 0x18000e20d
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x18000e34f