joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b18
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140004010]
xor rax, rsp
mov qword [rbp - 8], rax
movups xmm0, xmmword [rdx]
xor ebx, ebx
mov ecx, ecx
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], rbx
movdqu xmmword [rbp - 0x48], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140001b80
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140001b80
xor eax, eax
jmp 0x140001c71
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x20]
mov rcx, r14
mov rdi, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140001bf0
lea rcx, [rdi - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140001be8
mov rdx, qword [rdi + 0x50]
lea rcx, [rbp - 0x58]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140001c51
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140001bb0
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, dword [rax + 0xc]
mov r14d, dword [rcx + 0x14]
mov ecx, r14d
mov edi, r14d
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140001c5a
lea rcx, [rdi - 8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140001c48
mov edx, dword [rdi + 0x28]
lea rcx, [rbp - 0x58]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140001c57
mov edi, dword [rdi]
cmp rdi, r14
jne 0x140001c11
jmp 0x140001c5a
mov rbx, qword [rdi + 0x20]
jmp 0x140001c5a
mov ebx, dword [rdi + 0x10]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001fa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18008d78b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x1800933c0
jmp fcn.18012ccac

Function at 0x18008f354
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
test r11b, cl
cmp word [rcx], ax
jne 0x180093494
movsxd rax, dword [rcx + 0x3c]
stc
cmc
lea rax, [rax + rcx]
cmp dword [rax], 0x4550
jmp 0x180099082
xor eax, eax
jmp 0x180095857
ret
ret
jne 0x180093494
mov ecx, 0x20b
test cx, 0x48a3
clc
cmp word [rax + 0x18], cx
jne 0x180093494
mov eax, 1
jmp 0x180095caa

Function at 0x18008ffe4
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
lea edx, [r8 + 2]
jmp 0x180134560

Function at 0x180096090
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x180094af9
xor eax, eax
jmp 0x180097367
je 0x18008f7d4
mov edx, dword [rax + 0xc]
cmc
cmp rax, 0x3ad5267e
cmp r10, rdx
jmp 0x180098572
jb 0x180097367
inc r9d
clc
add rax, 0x28
cmp di, r8w
test r11b, r12b
cmp r9d, r11d
jmp 0x18008f7ce
movsxd r8, dword [rcx + 0x3c]
movzx r10, r15w
cmc
shrd r10, rsi, 0xae
sub r9d, r9d
jmp 0x18009a157
ret
jb 0x180095085
mov ecx, dword [rax + 8]
cmp r11w, r14w
test r15, 0x79df2195
add ecx, edx
test r11b, bl
cmc
cmp r10, rcx
jmp 0x18009507f
lea r8, [r8 + rcx]
lahf
mov ax, r8w
inc al
mov r10, rdx
movsx r11d, bp
bt rax, 0xbb
movsx ax, bpl
movzx eax, word [r8 + 0x14]
add r11b, 0xe6
movzx r11, r10w
movzx r11d, word [r8 + 6]
test r11b, r15b
clc
test r10b, 4
add rax, 0x18
add rax, r8
test r11d, r11d
jmp 0x180094af3

Function at 0x1800986b8
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
sub ecx, ecx
bswap r8
lea r8d, [rdx + 1]
jmp 0x180134560
mov dword [rsp + 0x18], r8d
cmp dx, sp
cmc
mov dword [rsp + 0x10], edx
clc
stc
cmp si, bx
push rbp
mov rbp, rsp
jmp 0x180134580
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
cmc
mov qword [rsp + 0x60], rbx
bts bx, ax
sub bx, 0x7e90
mov ebx, ecx
stc
test r8d, r8d
jmp 0x1801345a6
jne 0x18013462e
sub ecx, ecx
jmp 0x1801345b3
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18013462e
mov ecx, 0x5a4d
jmp 0x1801345cc
cmp word [rax], cx
jne 0x18013462e
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
test dil, bl
cmp r15b, spl
cmp dword [rcx], 0x4550
jne 0x18013462e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1801345fd
jne 0x18013462e
cmp dword [rcx + 0x84], 0xe
jmp 0x18013460f
jbe 0x18013462e
cmp dword [rcx + 0xf8], 0
je 0x18013462e
mov ecx, ebx
jmp 0x180134629
call fcn.18013476a
mov byte [rbp + 0x28], 0
setb dh
rdtsc
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
bswap r8w
mov dx, 0x43fe
xchg cx, cx
mov qword [rbp - 0x10], rax
seto al
movsxd rdx, r10d
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov dl, r10b
mov eax, 2
mov dword [rbp - 0x2c], eax
mov rdx, 0x561265ee
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
not dl
jmp 0x180134680
lea r8, [rbp - 0x18]
mov cx, 0x23a1
movzx cx, sil
lea rdx, [rbp - 0x28]
not cx
lea rcx, [rbp - 0x30]
jmp 0x18013469d
call fcn.180134375
nop
test r9d, 0x7c634573
cmc
cmp dword [rbp + 0x20], 0
jmp 0x1801346b4
je 0x1801346d6
mov rbx, qword [rsp + 0x60]
movsx bp, dl
add rsp, 0x50
movsx ebp, r12w
movzx rbp, r9w
pop rbp
jmp 0x1801346d5
ret
mov ecx, ebx
call fcn.1801346e3
int3
Function at 0x1800cf3fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
rol bh, 0xe9
push rsi
bsr bx, r9w
cwde
rol ebx, 0x3e
sub rsp, 0x20
adc ebx, eax
ror al, cl
sbb ebx, edi
mov esi, dword [rcx + 8]
mov rbx, rcx
jmp 0x1800cf428
mov eax, dword [rcx + 0xc]
test rsi, 0x35196e98
add esi, 0x7f9
clc
mov qword [rsp + 0x38], rdi
test cl, r12b
cmp ax, r12w
test bpl, 2
cmp esi, eax
jle 0x1800cf537
lea eax, [rax + rax*2]
setle ch
rol ch, cl
mov qword [rsp + 0x30], rbp
clc
inc rcx
cmp sil, r11b
cdq
mov ebp, esi
shr ecx, cl
ror ch, 0xa7
sub eax, edx
rcl cx, 1
sar eax, 1
cmp esi, eax
movsx rcx, bx
movzx cx, dl
mov rcx, r10
cmovle ebp, eax
mov cl, spl
movzx rcx, r11w
movsxd rcx, ebp
jmp 0x1800cf493
call fcn.180095b5e
movsxd rdx, dword [rbx + 8]
mov rdi, rax
movzx r8d, r12w
mov r8, qword [rbx]
jmp 0x1800cf4ab
test rdx, rdx
je 0x1800cf50e
mov rcx, rax
stc
sub r8, rax
and eax, 0x7942295d
nop dword [rax]
or ax, dx
shld rax, r9, 0xe3
nop word [rax + rax]
rcl ax, cl
adc al, 0xbd
xor al, 0x7d
movzx eax, byte [r8 + rcx]
cmp r15b, 0xb4
clc
cmp ax, r13w
mov byte [rcx], al
lea rcx, [rcx + 1]
cmp bl, r13b
jmp 0x1800cf4f8
sub rdx, 1
jmp 0x1800cf501
jne 0x1800cf4dc
mov r8, qword [rbx]
movzx rcx, r14w
mov rcx, r8
jmp 0x1800cf516
call fcn.1800918c0
mov dword [rbx + 0xc], ebp
mov bpl, 0xbf
movsx bp, r9b
movzx ebp, r14w
mov rbp, qword [rsp + 0x30]
mov qword [rbx], rdi
jmp 0x1800cf53a
mov rdi, qword [rcx]
movsxd rcx, dword [rbx + 8]
add dx, r13w
mov edx, esi
lea r8, [0x180086208]
lea rcx, [rcx + rdi]
lea rdx, [0x180085a10]
shld ax, sp, 0xd6
ror di, cl
mov rdi, qword [rsp + 0x38]
lea rax, [rcx + 0x7f8]
clc
cmp sil, 0x9c
cmp rcx, r8
ja 0x1800cf5d2
cmp rax, rdx
jmp 0x1800cf580
jb 0x1800cf5d2
sub rdx, rcx
mov r8d, 0x7f9
xchg ah, ah
rcr rax, cl
movzx eax, byte [rdx + rcx]
mov byte [rcx], al
test bpl, 0x71
stc
lea rcx, [rcx + 1]
sub r8, 1
jmp 0x1800cf5ac
jne 0x1800cf594
mov dword [rbx + 8], esi
bsr ebx, esp
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
movzx si, r10b
jmp 0x1800cf5cb
pop rsi
jmp 0x1800cf5d1
ret
mov r8d, 0x7f9
jmp 0x1800cf5dd
call fcn.180132c20
mov dword [rbx + 8], esi
ror sil, 0x90
sub bl, 0
add bl, 0xae
mov rbx, qword [rsp + 0x40]
test sp, r8w
btc si, 0x19
add rsp, 0x20
jmp 0x1800cf606
pop rsi
jmp 0x1800cf60c
ret
Function at 0x1800cf932
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
shr ax, 0x7c
rol bx, 0x1c
push rbp
movzx bx, r8b
xor bx, r11w
push rsi
not al
adc ax, bp
push rdi
push r14
lahf
shld ax, r14w, 0x50
sub al, r8b
push r15
sub rsp, 0x20
cmovg r15d, r11d
btr bx, 0x43
movzx rax, r11w
mov r15, rdx
rcl al, cl
mov rbx, rcx
cmp si, sp
mov eax, esi
mov eax, dword [rcx + 0xc]
cmp r11w, 0x119b
mov ecx, dword [rcx + 8]
cmc
cmp ecx, eax
jmp 0x1800cf990
jne 0x1800cfaba
test eax, eax
lea r14d, [rax + rax]
jg 0x1800cf9a8
mov r14d, 4
movsxd rdi, r14d
mov qword [rsp + 0x50], rdi
mov eax, 0x18
xchg dx, cx
bswap dx
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
movzx rcx, r13w
movzx cx, r10b
mov rcx, rax
call fcn.180095b5e
mov rbp, rax
clc
neg sil
shl sil, cl
mov qword [rsp + 0x58], rax
shl sil, cl
shr si, 0xd3
shld esi, ebp, 0x5b
mov rsi, rax
clc
test r14d, r14d
jmp 0x1800cfa00
je 0x1800cfa22
mov rcx, rsi
jmp 0x1800cfa0e
call fcn.180099da6
add rsi, 0x18
cmc
sub rdi, 1
jne 0x1800cfa06
xor edx, edx
jmp 0x1800cfa29
cmp dword [rbx + 8], edx
jle 0x1800cfa8d
mov ecx, edx
movsx ax, spl
movsx rax, r11w
inc ax
mov rax, qword [rbx]
jmp 0x1800cfa48
movups xmm0, xmmword [rcx + rax]
jmp 0x1800cfa51
movups xmmword [rcx + rbp], xmm0
jmp 0x1800cfa5a
movsd xmm1, qword [rcx + rax + 0x10]
jmp 0x1800cfa65
movsd qword [rcx + rbp + 0x10], xmm1
jmp 0x1800cfa70
inc edx
cmp r15w, bx
jmp 0x1800cfa7b
lea rcx, [rcx + 0x18]
cmp edx, dword [rbx + 8]
jmp 0x1800cfa87
jl 0x1800cfa40
mov rcx, qword [rbx]
jmp 0x1800cfa95
call fcn.1800918c0
mov qword [rbx], rbp
movsxd rcx, eax
mov dword [rbx + 0xc], r14d
mov rcx, 0x23a20c8d
movzx rbp, si
cwde
mov ecx, dword [rbx + 8]
movsx r14d, r13w
not rax
movsxd rax, ecx
inc r14b
setns sil
mov dil, 0x5f
lea rcx, [rax + rax*2]
mov rax, qword [rbx]
movups xmm0, xmmword [r15]
setle dil
inc bpl
movups xmmword [rax + rcx*8], xmm0
movzx rsi, r14w
movzx si, bpl
setno r14b
movsd xmm1, qword [r15 + 0x10]
dec r15w
movsd qword [rax + rcx*8 + 0x10], xmm1
jmp 0x1800cfb04
inc dword [rbx + 8]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
movzx edi, r10w
movsxd rdi, ebx
pop r15
pop r14
movzx esi, r15w
not dil
pop rdi
movsx si, al
pop rsi
mov bpl, 0x8f
jmp 0x1800cfb33
pop rbp
jmp 0x1800cfb39
ret
Function at 0x180127a25
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x180127a33
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmc
jmp 0x180127a44
add rsp, 0x28
jmp 0x180127a4d
ret

Function at 0x180128c77
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
sal r8, cl
dec r8w
mov r8, rcx
neg ah
rcl ax, cl
mov eax, 0x5a4d
jmp 0x180128c94
cmp word [0x180000000], ax
jmp 0x180128ca0
jne 0x180128db2
movsxd rcx, dword [0x18000003c]
shl dx, 0x52
dec dl
lea rdx, [0x180000000]
add rcx, rdx
clc
cmp dword [rcx], 0x4550
jmp 0x180128cc9
jne 0x180128db2
mov eax, 0x20b
test spl, 0xdd
stc
cmp r12b, 0x36
cmp word [rcx + 0x18], ax
jne 0x180128db2
sub r8, rdx
rol ah, 0xa0
movzx eax, word [rcx + 0x14]
mov dh, cl
lea rdx, [rcx + 0x18]
add rdx, rax
bt ax, 0xd8
movzx eax, word [rcx + 6]
btc rcx, r9
and cx, sp
add ch, 0xd4
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rcx, 0x283313b
stc
test bpl, sil
mov qword [rsp], rdx
cmp r11b, 0x28
clc
cmp rdx, r9
jmp 0x180128d31
je 0x180128d70
mov ecx, dword [rdx + 0xc]
jmp 0x180128d3f
cmp r8, rcx
jmp 0x180128d47
jb 0x180128d67
mov eax, dword [rdx + 8]
add eax, ecx
clc
test r8w, 0x49b4
cmp r8, rax
jmp 0x180128d61
jb 0x180128d7b
add rdx, 0x28
jmp 0x180128d20
sub edx, edx
jmp 0x180128d7b
test rdx, rdx
jmp 0x180128d83
jne 0x180128d95
xor al, al
jmp 0x180128d90
jmp 0x180128dc0
cmp dword [rdx + 0x24], 0
jge 0x180128da6
sub al, al
jmp 0x180128dc0
mov al, 1
jmp 0x180128dad
jmp 0x180128dc0
xor al, al
jmp 0x180128db9
jmp 0x180128dc0
add rsp, 0x18
jmp 0x180128dc9
ret

Function at 0x1801296e2
Capabilities:
Terminate process

Disassembly:
push rbx
rol ebx, cl
mov bl, r11b
sub rsp, 0x20
ror bx, cl
sar rbx, 0xe1
xor bh, 0x4c
mov rbx, rcx
test r15w, 0x73fa
cmc
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsxd rbx, r13d
ror ebx, cl
rcr ebx, cl
mov edx, 0xc0000409
sal bl, 0x15
add bl, bl
add rsp, 0x20
not bx
xchg bl, bh
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x18012a180
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
shl rbx, 0x2c
cmc
push rbp
movzx rax, r12w
mov rbp, rsp
movsxd rax, r9d
and bh, ch
dec ebx
sub rsp, 0x20
mov rax, qword [0x180085010]
sub bl, bpl
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x18012a1b9
jne 0x18012a287
and qword [rbp + 0x18], 0
movzx ecx, ax
lea rcx, [rbp + 0x18]
jmp 0x18012a1d0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
jmp 0x18012a1e3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x18012a1f4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
movsx rcx, di
lea rcx, [rbp + 0x20]
cmp bpl, r11b
clc
xor qword [rbp + 0x10], rax
jmp 0x18012a211
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
ror cx, 4
lea rcx, [rbp + 0x10]
cmc
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
test r12b, 0xbf
movsxd rbp, r15d
rcl bpl, 0x4d
xor rax, rcx
shld rbp, rax, 0x6b
sbb bpl, 2
movabs rcx, 0xffffffffffff
ror ebp, 8
bsf ebp, r13d
xchg bpl, bpl
and rax, rcx
cmc
movabs rcx, 0x2b992ddfa233
xadd bpl, bpl
bsf bp, dx
setne bpl
cmp rax, rbx
cmove rax, rcx
mov qword [0x180085010], rax
shrd rbp, r8, 0xef
mov rbx, qword [rsp + 0x48]
not rax
sal bpl, 0xdc
ror bp, 0xa3
mov qword [0x180085008], rax
add rsp, 0x20
movzx bp, r9b
movsxd rbp, r8d
pop rbp
jmp 0x18012a2b0
ret
Function at 0x18012a9d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test cl, r15b
test r11d, 0x26a55d10
mov qword [rsp + 0x18], rbp
cmp cl, sil
push rsi
xchg sil, sil
bt rsi, r13
shr si, cl
push rdi
btc esi, esp
push r12
sbb r12b, 0x97
push r14
xadd r14, rdi
bt esi, r12d
sbb r12b, 0x59
push r15
sub rsp, 0x20
movsx r12, bx
mov edi, dword [r8 + 0xc]
xchg r15w, si
movsx r15w, cl
movsxd r12, edx
mov r12, rcx
movzx rcx, sp
mov rcx, r8
movsx r15, r10w
not r14
mov rsi, r9
mov r14, r8
movsx r15, ax
setno r15b
mov r15b, 0x71
mov r15, rdx
jmp 0x18012aa54
call fcn.18008efe8
mov r10, qword [r12]
mov ebp, eax
mov qword [rsi], r10
clc
test edi, edi
jmp 0x18012aa6a
je 0x18012ab68
movsxd rax, dword [r14 + 0x10]
dec edi
lea rdx, [rdi + rdi*4]
lea rbx, [rax + rdx*4]
stc
clc
test r11b, 3
add rbx, qword [r15 + 8]
cmc
cmp di, di
cmp ebp, dword [rbx + 4]
jle 0x18012aa63
cmp ebp, dword [rbx + 8]
jmp 0x18012aa9d
jg 0x18012aa63
mov rcx, qword [r15]
xchg dh, dh
lea rdx, [rsp + 0x50]
test r10d, ebp
sub r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
cmovg r9w, r8w
xor ecx, ecx
not r9b
adc r10, r10
add r8, qword [rsp + 0x50]
inc r9
xor r10w, dx
movzx r10, r11w
mov r9d, dword [rbx + 0xc]
movzx r10, r14w
ror r10b, cl
mov r10d, dword [rax]
test r9d, r9d
je 0x18012ab1a
lea rdx, [r8 + 0xc]
movsxd rax, dword [rdx]
cmp rax, r10
je 0x18012ab28
inc ecx
cmp r11b, 0xe3
cmc
add rdx, 0x14
cmp ecx, r9d
jmp 0x18012ab14
jb 0x18012aaf5
cmp ecx, r9d
jmp 0x18012ab22
jae 0x18012aa63
mov rax, qword [r12]
ror r15b, 0x66
rol dil, 0xad
movzx rbx, r13w
lea rcx, [rcx + rcx*4]
btr rdi, 0x20
rcl r15, 0x9c
movsxd rcx, dword [r8 + rcx*4 + 0x10]
test r13w, 0x34d6
mov rcx, qword [rcx + rax]
bsr rdi, r14
bts r15, r13
sal r14b, cl
mov qword [rsi], rcx
and r12d, edi
rcr bl, 0x1f
mov rbx, qword [rsp + 0x58]
not r12
and r15b, 0x60
mov rax, rsi
mov rbp, qword [rsp + 0x60]
shl di, cl
clc
add rsp, 0x20
bswap rsi
pop r15
pop r14
not di
pop r12
setge dil
movsxd rsi, esp
movzx edi, si
pop rdi
cmovno si, r9w
bswap rsi
setns sil
pop rsi
ret
Function at 0x18012ccac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
ror r10d, cl
mov r10b, 0x6c
jmp 0x18012ccbf
mov qword [rax + 8], rbx
rcl r10d, 0x1c
movsx r10w, bpl
mov qword [rax + 0x10], rsi
stc
test dl, r15b
mov qword [rax + 0x18], rdi
mov r10d, eax
not bl
mov qword [rax + 0x20], r14
sal bh, cl
dec r10b
cmp dword [rcx + 0x10], 0
movzx r10, di
movsx rbx, ax
movsx r10w, al
mov rbx, r8
setb r10b
mov r10, rdx
je 0x18012ce8a
movsxd r9, dword [rcx + 0x10]
rcr r11w, cl
rcr dil, 0x1a
rcl ax, 0x19
lea r14, [0x180000000]
mov rdi, qword [rdx + 8]
cmove eax, r8d
sub esi, esi
movsx rcx, r15w
add r9, rdi
or edx, 0xffffffff
cmc
xor r8d, r8d
sar r11b, cl
movzx ecx, byte [r9]
neg r11d
cwde
not eax
and ecx, 0xf
sal ah, 0x20
xor r11d, r8d
movsx rax, byte [rcx + r14 + 0x708a0]
and r11, 0x26984850
dec r11w
mov cl, byte [rcx + r14 + 0x708b0]
cmovp r11d, ecx
sal r11w, 0xdd
sub r9, rax
ror r11w, 0x50
test r15b, bpl
mov r11d, dword [r9 - 4]
jmp 0x18012cd8c
shr r11d, cl
cmp esp, r15d
test r11d, r11d
jmp 0x18012cd9a
je 0x18012ce8a
mov rax, qword [r10 + 0x10]
or cl, 0x28
rol cx, 0xf5
mov r10d, dword [rax]
sal ecx, cl
cmc
clc
movzx ecx, byte [r9]
btc rax, rsi
and ecx, 0xf
cmp spl, r9b
sub rax, r10
btr eax, 0x7a
movsx rax, byte [rcx + r14 + 0x708a0]
cmp r12b, 0xe6
cmp di, r8w
clc
mov cl, byte [rcx + r14 + 0x708b0]
cmc
test dil, r9b
sub r9, rax
btr rax, 0xd9
mov eax, dword [r9 - 4]
stc
cmc
shr eax, cl
jmp 0x18012cdfa
add esi, eax
cbw
shrd ax, r10w, 0x37
movsx rax, cx
mov eax, esi
add rax, r10
lea rax, [rax + rdi]
cmp rbx, rax
jmp 0x18012ce19
jb 0x18012ce75
movzx ecx, byte [r9]
inc r8d
sar dh, 0xc0
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x708a0]
movzx dx, r14b
bswap dx
cwd
mov cl, byte [rcx + r14 + 0x708b0]
sbb dl, r9b
btc edx, 0x5c
sub r9, rax
mov edx, dword [r9 - 4]
cmc
shr edx, cl
jmp 0x18012ce5d
dec edx
test r13, 0x79aa2e7f
jmp 0x18012ce6c
cmp r8d, r11d
jb 0x18012cdb2
test r8d, r8d
je 0x18012ce8a
mov eax, edx
jmp 0x18012ce85
jmp 0x18012ce99
or eax, 0xffffffff
xchg bx, bx
movzx ebx, r15w
jmp 0x18012ce99
mov rbx, qword [rsp + 8]
mov di, 0x1dae
movsxd r14, esi
cmovno rsi, r8
mov rsi, qword [rsp + 0x10]
not di
movsx r14d, r8w
movzx r14d, dx
mov rdi, qword [rsp + 0x18]
setne r14b
mov r14, qword [rsp + 0x20]
jmp 0x18012cecc
ret
Function at 0x180132769
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
sub r8b, 0x8f
bswap bx
cwd
mov rbx, rcx
clc
lea r9, [0x1800718b0]
sub ecx, ecx
movzx rdx, r13w
bswap r8w
mov r8b, 0xcd
lea r8, [0x1800718a8]
not dx
cmove dx, r9w
mov dl, r15b
lea rdx, [0x180070420]
call fcn.180132504
test rax, rax
je 0x1801327d9
mov rcx, rbx
movsx ebx, dx
movsxd rbx, r11d
add rsp, 0x20
setno bh
movsx bx, r13b
pop rbx
jmp 0x1801327d2
jmp qword [0x180070288]
add rsp, 0x20
movzx ebx, r11w
cmovae bx, si
mov bl, r9b
pop rbx
jmp 0x1801327ee
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x180132911
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
rol r9d, cl
rcl r9b, cl
push rdi
rol di, cl
jmp 0x180132928
sub rsp, 0x20
bswap bx
movzx r8, bx
movsx r8w, r14b
mov rbx, rdx
lea r9, [0x1800718c8]
cwd
mov edi, ecx
lea rdx, [0x180070448]
movzx cx, bl
mov ecx, 3
lea r8, [0x1800718c0]
jmp 0x180132962
call fcn.180132504
mov rdx, rbx
mov ecx, edi
jmp 0x180132974
test rax, rax
je 0x180132988
call qword [0x180070288]
jmp 0x18013298e
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx di, sil
add rsp, 0x20
movsx edi, bp
pop rdi
jmp 0x1801329a5
ret
Function at 0x18013ab93
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
clc
test r15b, r14b
mov qword [rax + 0x18], rsi
test r8, 0x585d3b93
mov qword [rax + 0x20], rdi
push r14
jmp 0x18013abb8
sub rsp, 0x40
jmp 0x18013abc1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
ror bl, cl
movsxd rbx, ecx
mov rbx, rax
test rax, rax
jmp 0x18013abd9
jne 0x18013abe6
xor eax, eax
jmp 0x18013ad62
mov rbp, rbx
jmp 0x18013abee
cmp word [rax], si
jmp 0x18013abf6
je 0x18013ac3a
or rax, 0xffffffffffffffff
jmp 0x18013ac05
inc rax
jmp 0x18013ac0e
cmp word [rbp + rax*2], si
jne 0x18013ac05
lea rbp, [rbp + rax*2]
add rbp, 2
cmc
cmp r12w, bx
test r9w, di
cmp word [rbp], si
jmp 0x18013ac34
jne 0x18013abfc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
rcl r9b, cl
shld r9d, ebx, 0xe2
btr r8, r9
sar rbp, 1
mov r8w, r12w
mov r8, rbx
mov r9d, ebp
stc
mov dword [rsp + 0x28], esi
jmp 0x18013ac71
sub edx, edx
cmc
stc
mov qword [rsp + 0x20], rsi
sub ecx, ecx
jmp 0x18013ac81
call fcn.18013a97f
movsxd r14, eax
stc
cmc
test eax, eax
jne 0x18013aca1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18013abdf
mov rcx, r14
jmp 0x18013aca9
call fcn.1801374d8
mov rdi, rax
test rax, rax
jmp 0x18013acb9
jne 0x18013acd0
sub ecx, ecx
jmp 0x18013acc6
call fcn.18013785e
jmp 0x18013ac93
mov qword [rsp + 0x38], rsi
mov r9d, ebp
rol r8b, 0xf2
and r8d, 0x4ff55537
mov qword [rsp + 0x30], rsi
mov r8, rbx
test r13d, edi
cmp cl, 0xc0
mov dword [rsp + 0x28], r14d
test r14w, 0x7718
xor edx, edx
test dl, r13b
cmp ecx, eax
cmp bp, 0x7afb
sub ecx, ecx
mov qword [rsp + 0x20], rdi
jmp 0x18013ad14
call fcn.18013a97f
test eax, eax
jmp 0x18013ad20
jne 0x18013ad38
mov rcx, rdi
jmp 0x18013ad2e
call fcn.18013785e
jmp 0x18013ad53
sub ecx, ecx
jmp 0x18013ad3f
call fcn.18013785e
mov rsi, rdi
mov cx, r10w
cmovge cx, r9w
xchg rcx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
sar esi, 5
mov rbx, qword [rsp + 0x50]
mov bpl, 0x3e
mov rbp, qword [rsp + 0x58]
add r14w, 0x3df6
sal sil, 0x59
test r15b, 0xc6
mov rsi, qword [rsp + 0x60]
cmp r12b, sil
clc
inc dil
mov rdi, qword [rsp + 0x68]
shr r14b, 0xe0
movsx r14d, bx
bts r14w, r11w
add rsp, 0x40
movsx r14w, sil
movsx r14d, di
setnp r14b
pop r14
jmp 0x18013adb3
ret
Function at 0x18013b838
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
rol cx, cl
movzx ecx, sp
mov qword [rax + 8], rbx
movsxd rcx, esp
mov qword [rax + 0x10], rbp
sal cx, cl
mov qword [rax + 0x18], rsi
shld ecx, r14d, 0x96
or rcx, 0x51d93a98
rol ch, cl
mov qword [rax + 0x20], rdi
sub ecx, edi
jmp 0x18013b86c
push r14
sub rsp, 0x90
movsx cx, ch
not cx
movsx rcx, r14w
lea rcx, [rax - 0x78]
jmp 0x18013b889
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor r14d, r14d
cmp r14b, 0x70
cmp word [rsp + 0x62], r14w
jmp 0x18013b8a1
je 0x18013b9e4
mov rax, qword [rsp + 0x68]
cmp r8b, 0xe1
jmp 0x18013b8b5
test rax, rax
jmp 0x18013b8bd
je 0x18013b9e4
movsxd rbx, dword [rax]
rcl ecx, cl
lea rsi, [rax + 4]
mov edi, 0x2000
jmp 0x18013b8da
lea rbx, [rbx + rsi]
rcl rcx, 0x3f
bt cx, 0
cmp dword [rax], edi
movzx rcx, r11w
setns ch
jmp 0x18013b8f5
cmovl edi, dword [rax]
xchg rcx, rcx
mov ecx, edi
call fcn.180140166
cmp edi, dword [0x180087e10]
cmovg edi, dword [0x180087e10]
test r15w, bp
cmc
test edi, edi
jmp 0x18013b91b
je 0x18013b9e4
mov ebp, r14d
clc
cmp qword [rbx], 0xffffffffffffffff
jmp 0x18013b92e
je 0x18013b9c5
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x18013b93d
je 0x18013b9c5
test byte [rsi], 1
je 0x18013b9c5
test byte [rsi], 8
jmp 0x18013b954
jne 0x18013b970
mov rcx, qword [rbx]
jmp 0x18013b962
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x18013b9c5
mov rax, rbp
lea r8, [0x180087a10]
sete ch
mov rcx, rbp
btr edx, 0xd5
sar dl, 0x59
dec edx
sar rcx, 6
xor rdx, 0x61590483
and eax, 0x3f
mov rcx, qword [r8 + rcx*8]
mov dl, r13b
movsxd rdx, esi
cwd
lea rdx, [rax + rax*8]
movsxd rax, r10d
mov rax, qword [rbx]
jmp 0x18013b9b2
mov qword [rcx + rdx*8 + 0x28], rax
setne al
mov al, byte [rsi]
jmp 0x18013b9c1
mov byte [rcx + rdx*8 + 0x38], al
inc rbp
jmp 0x18013b9cd
inc rsi
add rbx, 8
stc
sub rdi, 1
jmp 0x18013b9de
jne 0x18013b925
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
movzx r14d, sp
movzx r14, r12w
mov esi, r15d
mov rsi, qword [r11 + 0x20]
mov dil, 0x6c
mov rdi, qword [r11 + 0x28]
setae r14b
not r14
movsx r14w, r10b
mov rsp, r11
movzx r14w, spl
pop r14
jmp 0x18013ba25
ret