joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180034070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rbp - 8], rax
cmp dword [rdx + 0x10], 0
mov rbx, rdx
mov rdi, rcx
je 0x18003418e
movsd xmm1, qword [0x1800ba7b8]
lea rcx, [0x1800a7d98]
movq rdx, xmm1
call fcn.18000ba10
mov r8d, dword [rbx + 0x14]
bt r8d, 0x19
jae 0x1800341b4
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x18003418e
cmp dword [rbx + 0x18], 0
jne 0x1800340f8
mov rax, qword [rdi]
mov ecx, dword [rdi + 0x50]
cmp dword [rax + 0x38], ecx
je 0x1800340f8
mov eax, dword [rbx + 0x10]
xor edx, edx
div ecx
test edx, edx
jne 0x18003418e
movdqa xmm0, xmmword [0x1800bbba0]
xor ecx, ecx
movdqa xmm1, xmmword [str.M69M_L_8_M6KJ_]
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
movzx eax, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5e], al
add rcx, 2
cmp rcx, 0x1e
jb 0x180034120
mov byte [rbp - 0x41], 0
lea rax, [rbp - 0x5f]
mov qword [rbp - 0x28], 0
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180034160
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x38]
call fcn.18000b0f0
lea rdx, [rbp - 0x38]
call fcn.18000a540
mov edx, dword [rbx + 0x10]
mov r8d, 0x4000
mov rcx, qword [rbx]
call rax
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800555d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
movsd xmm1, qword [0x1800ba7b8]
mov rcx, r8
shr rcx, 0x1d
mov rax, r8
shr rax, 0x1e
and ecx, 1
and eax, 1
lea rdx, [rax + rcx*2]
mov rax, r8
shr rax, 0x1f
lea rcx, [0x1800a7d98]
lea rdx, [rax + rdx*2]
lea rax, [0x180098018]
mov eax, dword [rax + rdx*4]
mov edi, eax
bts edi, 9
movq rdx, xmm1
and r8d, 0x4000000
cmove edi, eax
call fcn.18000ba10
movdqa xmm0, xmmword [0x1800baf30]
xor ecx, ecx
movdqa xmm1, xmmword [0x1800bb170]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x40], 0x4337485f
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x3c], 0x40
movzx eax, cl
add al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x24
jb 0x180034233
mov byte [rbp - 0x3b], 0
lea rax, [rbp - 0x5f]
mov qword [rbp - 0x28], 0
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180034270
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x38]
call fcn.18000b0f0
lea rdx, [rbp - 0x38]
call fcn.18000a540
mov edx, dword [rbx + 0x10]
lea r9, [rbp - 0x10]
mov rcx, qword [rbx]
mov r8d, edi
call rax
test eax, eax
jne 0x18003418e
jmp 0x180034193
Function at 0x1800369c0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x180036c34
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
cmp dword [rcx + 0x1c], 0
mov rbx, rcx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
je 0x180036a1c
movsd xmm1, qword [0x1800ba7b8]
lea rcx, [0x1800a7d98]
movq rdx, xmm1
call fcn.18000ba10
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, qword [rbx + 8]
xor edx, edx
mov r9d, dword [rax + 0x28]
add r9, rcx
call r9
cmp qword [rbx + 0x10], 0
je 0x180036a71
xor edi, edi
cmp dword [rbx + 0x18], edi
jle 0x180036a4f
xor esi, esi
nop dword [rax]
mov rax, qword [rbx + 0x10]
mov rcx, qword [rsi + rax]
test rcx, rcx
je 0x180036a44
mov rdx, qword [rbx + 0x40]
call qword [rbx + 0x38]
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x18]
jl 0x180036a30
movsd xmm1, qword [0x1800ba7b8]
lea rcx, [0x1800a7d98]
movq rdx, xmm1
call fcn.18000ba10
mov rcx, qword [rbx + 0x10]
call fcn.180061acc
cmp qword [rbx + 8], 0
mov rdi, 0xffffffffffffffff
je 0x180036b00
movdqa xmm0, xmmword [0x1800bc120]
xor ecx, ecx
movdqa xmm1, xmmword [0x1800ba850]
movdqu xmmword [rbp - 0x19], xmm0
movdqu xmmword [rbp - 9], xmm1
nop
movzx eax, byte [rbp - 0x19]
add al, cl
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x1e
jb 0x180036aa0
mov byte [rbp + 6], 0
lea rax, [rbp - 0x18]
mov qword [rbp + 0x1f], 0
mov r8, rdi
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], 0
inc r8
cmp byte [rax + r8], 0
jne 0x180036ad2
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xf]
call fcn.18000b0f0
lea rdx, [rbp + 0xf]
call fcn.18000a540
mov rcx, qword [rbx + 8]
xor edx, edx
mov r8d, 0x8000
call rax
movdqa xmm0, xmmword [0x1800bb140]
xor ecx, ecx
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x5b2e5a2a
mov dword [rbp - 5], 0x1210122a
mov word [rbp - 1], 0x1b
movzx eax, cl
add al, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x18
jb 0x180036b23
mov byte [rbp], 0
lea rax, [rbp - 0x18]
mov qword [rbp + 0x1f], 0
mov r8, rdi
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], 0
inc r8
cmp byte [rax + r8], 0
jne 0x180036b55
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xf]
call fcn.18000b0f0
lea rdx, [rbp + 0xf]
call fcn.18000a540
movdqa xmm0, xmmword [0x1800bbdc0]
mov rsi, rax
movdqa xmm1, xmmword [0x1800bb3d0]
xor ecx, ecx
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp + 7], 0x3d38353c
movdqu xmmword [rbp - 9], xmm1
mov word [rbp + 0xb], 0x3e
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x17], al
add rcx, 2
cmp rcx, 0x24
jb 0x180036bb0
mov byte [rbp + 0xc], 0
lea rax, [rbp - 0x18]
mov qword [rbp + 0x3f], 0
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], 0
inc rdi
cmp byte [rax + rdi], 0
jne 0x180036be6
mov r8, rdi
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x2f]
call fcn.18000b0f0
lea rdx, [rbp + 0x2f]
call fcn.18000a540
call rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call rsi
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
Function at 0x18003d5a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18003d5c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18003d63c
mov rdi, r14
mov rcx, rbx
call fcn.180025940
test rax, rax
jle 0x18003d614
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180059790
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18003d62c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18003d634
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18003d5d6
sub r14, rdi
jmp 0x18003d729
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18003d653
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18003d655
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18003d68a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180059790
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18003d726
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x18003d6c5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x18003d701
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180068e28
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x18003d73f
cmp rbp, rax
ja 0x18003d6d1
mov r8, rdi
test rdi, rdi
je 0x18003d726
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180068e28
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x18003d729
Function at 0x18003db90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18003dbbd
xor eax, eax
jmp 0x18003dd03
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18003dbf7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18003dbf7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18003dd03
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18003dcf6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18003dc3a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18003dc49
movsx ecx, dil
jmp 0x18003dc9d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x18003dcf6
cmp eax, 1
jle 0x18003dcb7
cmp eax, 3
jne 0x18003dcf6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1800677b8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003dcfb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18003dce4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1800683d0
cmp rsi, rax
jne 0x18003dcf6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18003dcfb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800555d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180041c70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rdi, rcx
xor r15d, r15d
mov qword [rcx + 0x40], r15
mov qword [rcx + 0x48], 0xf
mov byte [rcx + 0x30], r15b
mov qword [rcx + 0x60], r15
mov qword [rcx + 0x68], 7
mov word [rcx + 0x50], r15w
lea rax, [rcx + 0x11a0]
lea ecx, [r15 + 6]
nop
mov dword [rax], r15d
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
lea rax, [rax + 0x120]
sub rcx, 1
jne 0x180041cc0
mov dword [rdi + 0x28], r15d
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], cl
lea rax, [rbp - 0x39]
mov qword [rbp + 0x6f], rax
movdqa xmm0, xmmword [0x1800bad60]
movdqu xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [str._t_vxsz]
movdqu xmmword [rbp + 0x17], xmm1
mov word [rbp + 0x27], 0x7a
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 8], al
movzx eax, byte [rbp + 7]
xor byte [rbp + rcx + 9], al
add rcx, 2
cmp rcx, 0x20
jb 0x180041d30
mov byte [rbp + 0x28], 0
mov qword [rbp - 9], r15
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], 0
lea rax, [rbp + 8]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180041d70
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x19]
call fcn.18000b0f0
lea rdx, [rbp - 0x19]
call fcn.18000a540
lea r9, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae r9, qword [rbp - 0x39]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, rax
lea rcx, [rbp - 0x39]
call fcn.18000b090
mov qword [rdi + 0x20], rbx
xor r8d, r8d
xor edx, edx
lea rcx, [rdi + 0x30]
call fcn.18000b0f0
mov qword [rdi + 0x70], r15
xor edx, edx
mov r8d, 0x17e0
lea rcx, [rdi + 0x80]
call fcn.180059570
lea rcx, [rdi + 0x11a0]
xor edx, edx
mov r8d, 0x6c0
call fcn.180059570
lea rdx, [rdi + 0x80]
mov rcx, rdi
call fcn.18004d750
lea rdx, [rdi + 0x80]
mov rcx, rdi
call fcn.18004df00
nop
mov rax, rdi
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800420e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
xor edi, edi
mov rbx, rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
cmp qword [rcx + 8], rax
jne 0x1800421b3
cmp qword [rcx + 0x18], rax
jne 0x1800421b3
cmp qword [rcx + 0x20], rax
je 0x1800421b3
lea ecx, [rdi + 0xa]
call fcn.18000ce90
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180042e60]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
mov r9, rbx
mov qword [rsp + 0x40], rax
lea r8, [0x180043230]
lea rax, [rsp + 0x34]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov r9, rbx
mov qword [rsp + 0x48], rax
lea r8, [0x180042ff0]
lea rax, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
lea eax, [rdi + 1]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800555d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180044190
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r14, rcx
lea rbx, [rcx + 0x11a8]
lea rdi, [rcx + 0x11b8]
mov esi, 6
xor r15d, r15d
nop word [rax + rax]
cmp qword [rbx + 8], r15
je 0x180044397
cmp dword [rbx - 8], r15d
jne 0x180044359
cmp qword [rbx], r15
je 0x180044397
movdqa xmm1, xmmword [0x1800bbb30]
mov rax, r15
movdqa xmm0, xmmword [0x1800bb4f0]
movdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x49404c3c
movdqa xmm1, xmmword [0x1800baca0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0xc], 0x3a49
mov byte [rbp - 0xa], r15b
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x30]
psubb xmm0, xmm1
movdqu xmmword [rbp + rax - 0x30], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x180044230
cmp rax, 0x26
jae 0x18004425e
add byte [rbp + rax - 0x30], 0xf9
inc rax
cmp rax, 0x26
jb 0x180044250
mov qword [rbp - 0x40], r15
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbp - 0x50], r15b
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x180044280
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.18000b0f0
lea rdx, [rbp - 0x50]
call fcn.18000a540
mov rcx, qword [rbx]
xor edx, edx
call rax
mov rax, qword [rbx]
test rax, rax
je 0x180044397
cmp rax, 0xffffffffffffffff
je 0x180044397
movdqa xmm0, xmmword [0x1800bb860]
mov eax, 0x10
psubb xmm0, xmmword [0x1800bacf0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x4e434e43
mov dword [rbp - 0x3c], 0x3b3b3c4f
mov dword [rbp - 0x38], 0x4f424b4b
mov word [rbp - 0x34], 0x3f50
mov byte [rbp - 0x32], r15b
nop word [rax + rax]
add byte [rbp + rax - 0x50], 0xf6
inc rax
cmp rax, 0x1e
jb 0x180044300
mov qword [rbp - 0x20], r15
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbp - 0x30], r15b
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x180044330
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.18000b0f0
lea rdx, [rbp - 0x30]
call fcn.18000a540
mov rcx, qword [rbx]
call rax
mov qword [rbx], r15
jmp 0x180044397
mov rcx, qword [rbx]
xor edx, edx
call fcn.18000d0b0
cmp eax, 0x102
je 0x180044397
mov r8, qword [rbx + 8]
mov r9, r14
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rdi
lea rcx, str._ut_mcmd_base::runModule_____s_run
mov qword [rbx], rax
call fcn.18000cd30
add rdi, 0x120
add rbx, 0x120
sub rsi, 1
jne 0x1800441d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
lea eax, [rsi + 1]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180045a30
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x78], r14d
lea ecx, [r14 + 0x10]
call fcn.18000cf30
mov rdi, rax
lea ecx, [r14 + 0x30]
call fcn.180055898
mov rbx, rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x20], r14
mov qword [rax], r14
xor eax, eax
movups xmmword [rbx + 8], xmm0
mov dword [rbx + 0x18], eax
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180045ab2
call fcn.18000cfe0
mov qword [rbx + 0x20], r14
mov dword [rbx + 0x28], r14d
test rdi, rdi
je 0x180045b9f
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
mov rdx, rbp
mov rcx, rbx
call fcn.180033bc0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x180045c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x180045b9f
cmp rax, 0xffffffffffffffff
je 0x180045b98
movdqa xmm0, xmmword [0x1800bad90]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1800ba8e0]
movdqu xmmword [rsp + 0x40], xmm1
mov rax, r14
nop dword [rax]
movzx ecx, byte [rsp + 0x30]
xor byte [rsp + rax + 0x31], cl
movzx ecx, byte [rsp + 0x30]
xor byte [rsp + rax + 0x32], cl
add rax, 2
cmp rax, 0x1e
jb 0x180045b30
mov byte [rsp + 0x4f], 0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180045b70
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x58]
call fcn.18000b0f0
lea rdx, [rsp + 0x58]
call fcn.18000a540
mov rcx, rsi
call rax
mov eax, 1
jmp 0x180045be1
mov qword [rbx], r14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 8], xmm0
mov dword [rbx + 0x18], eax
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180045bc0
call fcn.18000cfe0
mov qword [rbx + 0x20], r14
mov dword [rbx + 0x28], r14d
mov edx, 0x30
mov rcx, rbx
call fcn.180055890
test rdi, rdi
je 0x180045bde
mov rcx, rdi
call fcn.18000cfe0
mov eax, r14d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800555d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180045d80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp dword [rdx], 6
mov rdi, rcx
mov ebx, 1
jne case.0x180045dd1.1001
mov eax, dword [rdx + 8]
add eax, 0xfffffc17
cmp eax, 0xc7
ja case.0x180045dd1.1001
lea r8, [0x180000000]
movzx eax, byte [r8 + rax + 0x46018]
mov ecx, dword [r8 + rax*4 + 0x45fd0]
add rcx, r8
jmp rcx
movdqa xmm0, xmmword [0x1800bb880]
xor eax, eax
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rdi + 0x28], ebx
mov dword [rbp - 0x30], 0x33324842
mov dword [rbp - 0x2c], 0x41494137
mov word [rbp - 0x28], 0x34
nop dword [rax]
movzx ecx, byte [rbp - 0x40]
xor byte [rbp + rax - 0x3f], cl
inc rax
cmp rax, 0x18
jb 0x180045e00
lea rdx, [rbp - 0x3f]
mov byte [rbp - 0x27], 0
lea rcx, [rbp - 0x20]
call fcn.18000a950
mov rdx, rax
call fcn.18000a540
mov rcx, qword [rdi + 0x20]
call rax
jmp case.0x180045dd1.1001
mov dword [rdi + 0x28], 2
mov r8, 0xffffffffffffffff
mov rdx, qword [rdx + 0x20]
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180045e50
lea rcx, [rdi + 0x30]
call fcn.18000b0f0
movdqa xmm0, xmmword [0x1800bace0]
xor eax, eax
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x7f7f0209
mov dword [rbp - 0x2c], 0x71780f78
mov word [rbp - 0x28], 7
nop word [rax + rax]
movzx ecx, al
add cl, byte [rbp - 0x40]
xor byte [rbp + rax - 0x3f], cl
inc rax
cmp rax, 0x18
jb 0x180045e90
lea rdx, [rbp - 0x3f]
mov byte [rbp - 0x27], 0
lea rcx, [rbp - 0x20]
call fcn.18000a950
mov rdx, rax
call fcn.18000a540
mov rcx, qword [rdi + 0x20]
call rax
jmp case.0x180045dd1.1001
movdqa xmm0, xmmword [0x1800bc4c0]
xor eax, eax
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rdi + 0x28], 3
mov dword [rbp - 0x30], 0x80a7174
mov dword [rbp - 0x2c], 0x7e757c0d
mov word [rbp - 0x28], 0xa
movzx ecx, al
add cl, byte [rbp - 0x40]
xor byte [rbp + rax - 0x3f], cl
inc rax
cmp rax, 0x18
jb 0x180045ef1
lea rdx, [rbp - 0x3f]
mov byte [rbp - 0x27], 0
lea rcx, [rbp - 0x20]
call fcn.18000a950
mov rdx, rax
call fcn.18000a540
mov rcx, qword [rdi + 0x20]
call rax
jmp case.0x180045dd1.1001
mov rcx, rdi
call fcn.1800460e0
jmp 0x180045fb8
mov rcx, rdi
call fcn.1800463f0
jmp 0x180045fb8
mov rcx, rdi
call fcn.180047210
jmp 0x180045fb8
mov rcx, rdi
call fcn.180047b20
jmp 0x180045fb8
mov rcx, rdi
call fcn.180048320
jmp 0x180045fb8
mov rcx, rdi
call fcn.1800485b0
jmp 0x180045fb8
mov rcx, rdi
call fcn.18004bb00
jmp 0x180045fb8
mov rdx, qword [rdx + 0x20]
lea rcx, [rbp - 0x20]
call fcn.18000a950
mov rdx, rax
mov rcx, rdi
call fcn.18004c7e0
jmp 0x180045fb8
mov rcx, rdi
call fcn.180049530
jmp 0x180045fb8
mov rcx, rdi
call fcn.1800488b0
jmp 0x180045fb8
mov rcx, rdi
call fcn.180049970
jmp 0x180045fb8
call fcn.180049f60
jmp 0x180045fb8
mov rcx, rdi
call fcn.18004a380
mov ebx, eax
mov rdi, qword [rsp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x100016e3c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], di
call sub.msvcrt.dll_memset
lea ebp, [rdi + 0x5c]
cmp rbx, rdi
je 0x100016eb4
cmp word [rbx], di
je 0x100016eb4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x100016eb4
cmp word [rbx], 0x7f
jae 0x100016ea9
cmp word [rbx + 2], 0x3a
je 0x100016f1e
cmp word [rbx], bp
jne 0x100016eb4
cmp word [rbx + 2], bp
je 0x100016f1e
mov esi, 0x105
lea rcx, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x100016f1e
lea ecx, [rax + 2]
cmp ecx, esi
ja 0x100016f1e
mov ecx, eax
inc eax
mov r8, rbx
mov word [rsp + rcx*2 + 0x20], bp
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov word [rsp + rax*2 + 0x20], di
call fcn.100004e58
cmp eax, edi
jl 0x100016f1e
lea r8, [0x100004d10]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.100004e58
cmp eax, edi
setge al
cmp al, dil
je 0x100016f1e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100016f20
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.100017460
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x100017044
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rdx], 0
lea rcx, [rsp + 0x20]
mov r8d, MsiBeginTransactionA
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], MsiBeginTransactionA
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x1000170ab
cmp dword [rsp + 0x24], 5
ja 0x10001709c
jne 0x1000170ab
cmp dword [rsp + 0x28], 1
jb 0x1000170ab
lea rcx, [0x100003c38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1000170b7
lea rcx, [0x100003c38]
call fcn.100016e3c
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.100017460
add rsp, 0x158
ret