joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005d300
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, qword [rsp + 0x88]
xor r15d, r15d
mov rbx, qword [rsp + 0x80]
mov rbp, r9
mov rsi, qword [rsp + 0x90]
mov r14, r8
mov rcx, qword [rcx]
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], rbx
mov qword [rax - 0x30], rsi
mov qword [rax - 0x38], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
mov edx, eax
test eax, eax
je 0x1800c4d10
mov eax, edx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, dword [rbp]
cmp word [r14 + rcx*2], r15w
jne 0x1800c4d6d
cmp dword [rsi], r15d
jbe 0x1800c4d6d
cmp dword [rsi], 2
jbe 0x1800c4d4d
cmp dword [rsi], 7
jne 0x1800c4d6d
test byte [rdi], 1
jne 0x1800c4d6d
mov eax, dword [rdi]
and eax, 0xfffffffe
cmp eax, 4
jb 0x1800c4d6d
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], r15w
jne 0x1800c4d6d
cmp word [rbx + rax*2 - 4], r15w
jmp 0x1800c4d67
test byte [rdi], 1
jne 0x1800c4d6d
mov eax, dword [rdi]
and eax, 0xfffffffe
cmp eax, 2
jb 0x1800c4d6d
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], r15w
je 0x18005d35c
mov eax, 0xd
jmp 0x18005d35e
Function at 0x18005d380
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdx, qword [rdx]
lea r8, str.Formats
mov r13, rcx
xor esi, esi
lea rcx, [rbp - 0x61]
mov qword [rbp - 0x61], rsi
call fcn.18005f30c
mov ebx, eax
test eax, eax
jg 0x1800c4d78
test ebx, ebx
js 0x1800c4d86
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x30], rsi
lea r8, [rbp - 0x39]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
mov r12d, esi
mov dword [rbp - 0x69], 0x28
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
jne 0x18005d4ce
mov r15d, dword [rbp - 0x69]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_IIDFromString]
mov edi, eax
test eax, eax
js 0x1800c4da2
mov ebx, edi
test edi, edi
js 0x18005d4db
lea rdi, [r13 + 0xb0]
mov esi, dword [rdi + 0x18]
lea r14d, [rsi + 1]
cmp r14d, esi
sbb ebx, ebx
and ebx, 0x80070216
cmp r14d, esi
cmovae r15d, r14d
jb 0x1800c4dbb
cmp r15d, dword [rdi + 0x14]
ja 0x18005d50d
mov eax, dword [rdi + 0x18]
movups xmm0, xmmword [rbp - 0x51]
shl rax, 4
add rax, qword [rdi]
movups xmmword [rax], xmm0
mov dword [rdi + 0x18], r15d
xor esi, esi
test ebx, ebx
js 0x1800c4df3
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x69]
mov qword [rsp + 0x30], rsi
lea r8, [rbp - 0x39]
inc r12d
mov qword [rsp + 0x28], rsi
mov edx, r12d
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x69], 0x28
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
je 0x18005d41c
test ebx, ebx
jle 0x18005d4db
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rbp - 0x61]
call fcn.18005f368
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18008b970
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, 0x10
lea r9, [rbp - 0x51]
mov rcx, rdi
lea r8d, [rdx - 0xf]
call fcn.18003376c
mov ebx, eax
test eax, eax
jns 0x18005d483
jmp 0x1800c4dd9
movzx ebx, ax
or ebx, 0x80070000
jmp 0x18005d3d0
cmp dword [0x18019cca4], esi
je 0x1800c4d95
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18005d4db
jmp 0x18005d3d8
cmp dword [0x18019cca4], esi
je 0x18005d434
mov ecx, edi
call fcn.180096ba4
nop
jmp 0x18005d434
cmp dword [0x18019cca4], 0
je 0x1800c4dcb
mov ecx, ebx
call fcn.180096ba4
cmp r14d, esi
jb 0x18005d483
jmp 0x18005d464
cmp dword [0x18019cca4], 0
je 0x18005d483
mov ecx, eax
call fcn.180096ba4
nop
jmp 0x18005d483
cmp dword [0x18019cca4], esi
je 0x1800c4e02
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18005d4db
jmp 0x18005d48d
Function at 0x18005d980
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
lea rax, [r11 + 0x20]
and dword [rsp + 0x40], 0
lea r9, [r11 + 8]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x58], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 4
mov ebx, eax
jne 0x18005d9ca
test eax, eax
jg 0x18005d9cf
test ebx, ebx
js 0x18005d9da
mov eax, ebx
add rsp, 0x30
pop rbx
ret
mov ebx, 0xd
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18005d9be
cmp dword [0x18019cca4], 0
je 0x18005d9c2
jmp 0x1800c4f60
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005d9c2

Function at 0x18005dbf8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
mov rax, r8
mov qword [r11 - 0x10], r9
mov rdi, r9
mov qword [r11 - 0x18], rdx
lea r9, [r11 + 8]
mov rbx, rdx
xor esi, esi
mov rdx, rax
mov dword [rsp + 0x40], esi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x40]
mov edx, eax
test ecx, ecx
je 0x18005dc77
cmp ecx, 2
ja 0x1800c4fee
test byte [rdi], 1
jne 0x18005dc77
mov eax, dword [rdi]
and eax, 0xfffffffe
cmp eax, 2
jb 0x18005dc77
test rbx, rbx
je 0x18005dc65
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x18005dc77
mov eax, edx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, 0xd
jmp 0x18005dc67
cmp ecx, 7
jne 0x18005dc77
test byte [rdi], 1
jne 0x18005dc77
mov eax, dword [rdi]
and eax, 0xfffffffe
cmp eax, 4
jb 0x18005dc77
test rbx, rbx
je 0x18005dc65
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x18005dc77
cmp word [rbx + rax*2 - 4], si
je 0x18005dc65
jmp 0x18005dc77
Function at 0x18005e8b4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdx, qword [rdx]
lea r8, str.Containers
and qword [rbp - 0x59], 0
mov r14, rcx
lea rcx, [rbp - 0x59]
call fcn.18005f30c
mov edi, eax
test eax, eax
jg 0x1800c5634
test edi, edi
js 0x1800c5642
xor esi, esi
lea rax, [rbp - 0x51]
and qword [rbp - 0x61], rsi
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rsi
and qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rsi
xor edx, edx
mov rcx, qword [rbp - 0x59]
lea r9, [rbp - 0x69]
lea r8, [rbp - 0x49]
mov dword [rbp - 0x69], 0x40
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov edi, eax
cmp eax, 0x103
jne 0x1800c565f
xor edi, edi
lea rcx, [rbp - 0x61]
call fcn.18005f368
lea rcx, [rbp - 0x59]
call fcn.18005f368
mov eax, edi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.18008b970
mov rsi, qword [rsp + 0x120]
add rsp, 0xf0
pop r14
pop rdi
pop rbp
ret
movzx edi, ax
or edi, 0x80070000
jmp 0x18005e8fc
cmp dword [0x18019cca4], 0
je 0x1800c5652
mov ecx, edi
call fcn.180096ba4
test edi, edi
js 0x18005e955
jmp 0x18005e904
test edi, edi
jne 0x1800c56c6
mov rdx, qword [rbp - 0x59]
lea r8, [rbp - 0x49]
lea rcx, [rbp - 0x61]
call fcn.18005f30c
test eax, eax
jle 0x1800c5682
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1800c5694
lea r8, [rbp - 0x49]
mov rcx, r14
lea rdx, [rbp - 0x61]
call fcn.1800d9b98
lea rcx, [rbp - 0x61]
inc esi
call fcn.18005f368
and qword [rbp - 0x61], 0
lea rax, [rbp - 0x51]
mov qword [rsp + 0x38], rax
mov edx, esi
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
jmp 0x18005e924
jle 0x18005e94c
movzx edi, di
or edi, 0x80070000
jmp 0x18005e94c
Function at 0x18005f20c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
and dword [rax + 8], 0
mov rsi, r9
mov r14, r8
mov r15, rdx
test r9, r9
je 0x18005f23e
and qword [r9], 0
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x18005f24b
and dword [rdi], 0
mov rcx, qword [r15]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
and qword [rsp + 0x20], 0
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jg 0x1800c5932
mov ebp, dword [0x18019cca4]
test ebx, ebx
js 0x1800c5940
cmp dword [rsp + 0x50], 3
jne 0x1800c5981
test rsi, rsi
je 0x18005f2fb
test rdi, rdi
je 0x18005f2fb
cmp dword [rdi], 0
je 0x18005f2fb
mov ecx, dword [rdi]
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsi], rax
test rax, rax
je 0x1800c5988
mov rcx, qword [r15]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jg 0x1800c599a
test ebx, ebx
js 0x1800c59a8
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
test ebx, ebx
jns 0x18005f2e0
jmp 0x1800c5959
movzx ebx, ax
or ebx, 0x80070000
jmp 0x18005f274
test ebp, ebp
je 0x1800c5951
mov ecx, ebx
call fcn.180096ba4
mov ebp, dword [0x18019cca4]
test ebx, ebx
jns 0x18005f282
test rsi, rsi
je 0x1800c5970
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800c5970
call qword [sym.imp.msvcrt.dll_free]
and qword [rsi], 0
test rdi, rdi
je 0x18005f2e0
and dword [rdi], 0
jmp 0x18005f2e0
mov ebx, 0x80070057
jmp 0x1800c598d
mov ebx, 0x8007000e
test ebp, ebp
je 0x1800c5959
mov ecx, ebx
call fcn.180096ba4
jmp 0x1800c5959
movzx ebx, ax
or ebx, 0x80070000
jmp 0x18005f2d8
cmp dword [0x18019cca4], 0
je 0x18005f2fb
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005f2fb

Function at 0x18005f394
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov r10, r8
mov rcx, qword [rdx]
xor r8d, r8d
and dword [rsp + 0x40], 0
mov rdx, r10
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r9
lea r9, [r11 + 8]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jg 0x1800c59c2
test ebx, ebx
js 0x1800c59d0
mov eax, ebx
add rsp, 0x30
pop rbx
ret
movzx ebx, ax
or ebx, 0x80070000
jmp 0x18005f3d2
cmp dword [0x18019cca4], 0
je 0x18005f3da
mov ecx, ebx
call fcn.180096ba4
nop
jmp 0x18005f3da
Function at 0x18005fb64
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x188
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
call fcn.18005fbc0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18008b970
add rsp, 0x188
ret

Function at 0x18005fbc0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [0x18019d513], 0
jne 0x18005fc29
mov ecx, 6
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_IsProcessorFeaturePresent]
test eax, eax
mov ecx, 0xa
setne byte [0x18019d512]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_IsProcessorFeaturePresent]
test eax, eax
mov ecx, 0xd
setne byte [0x18019d511]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_IsProcessorFeaturePresent]
xor ecx, ecx
mov eax, 1
cpuid
shr ecx, 9
and cl, 1
mov byte [0x18019d510], cl
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov byte [0x18019d513], 1
add rsp, 0x60
pop rbx
ret

Function at 0x180060590
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, 0x811c9dc5
mov r8d, 0x10
movzx ecx, byte [rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, ecx
sub r8, 1
jne 0x18006059b
xor edx, edx
div dword [0x18019da08]
mov eax, edx
ret

Function at 0x18006a874
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
xor ebx, ebx
and dword [rax + 0x18], ebx
lea rdx, [rax + 0x18]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800c8d42
mov ecx, dword [rsp + 0x40]
mov dword [rdi + 4], ecx
mov dword [rdi], esi
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
je 0x18006a8a1
jg 0x1800c8d56
mov ebx, eax
jmp 0x1800c8d5f
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x18006a8a1
cmp dword [0x18019cca4], 0
je 0x1800c8d77
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18006a8aa
jmp 0x18006a8a1
Function at 0x18007d810
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov r14, r9
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov ebx, r13d
test rdx, rdx
je 0x18007d87c
cmp dword [rdx], r13d
jge 0x18007d866
mov ebx, 0x8007007a
cmp dword [0x18019cca4], r13d
je 0x18007d9ca
mov ecx, ebx
call fcn.180096ba4
jmp 0x18007d9ca
jne 0x18007d87c
mov ecx, 0xfde9
mov dword [r9], 1
mov dword [r8], ecx
jmp 0x18007d9ca
mov ecx, 0xfde9
mov dword [r9], r13d
or ebp, 0xffffffff
mov dword [r8], ecx
mov dword [rsp + 0x68], ecx
test rsi, rsi
je 0x18007d898
mov r9d, dword [rdx]
jmp 0x18007d89b
mov r9d, ebp
mov dword [rsp + 0x28], r13d
mov r8, r12
mov edx, 8
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov edi, eax
mov eax, 0x80000000
test edi, edi
jne 0x18007d9a5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov edi, 0x80070000
test eax, eax
jle 0x18007d8d8
movzx ebx, ax
or ebx, edi
mov ecx, 0x80000000
lea eax, [rbx + rcx]
test ecx, eax
jne 0x18007d8f0
cmp ebx, 0x80070459
jne 0x18007d84d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov r9d, 2
lea r8, [rsp + 0x68]
mov edx, 0x20001004
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18007d942
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18007d928
movzx ebx, ax
or ebx, edi
test ebx, ebx
mov eax, 0x88982f94
cmovns ebx, eax
cmp dword [0x18019cca4], r13d
je 0x18007d942
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18007d9ca
test rsi, rsi
je 0x18007d951
mov ebp, dword [rsi]
mov ecx, dword [rsp + 0x68]
mov r9d, ebp
mov dword [rsp + 0x28], r13d
mov r8, r12
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
jne 0x18007d9a0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18007d988
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x18007d9a0
cmp dword [0x18019cca4], r13d
je 0x18007d99c
mov ecx, ebx
call fcn.180096ba4
test ebx, ebx
js 0x18007d9ca
mov eax, 0x80000000
test rsi, rsi
je 0x18007d9c0
movsxd rdi, edi
mov ecx, 0xffffffff
inc rdi
add rax, rdi
cmp rax, rcx
ja 0x18007d9e9
mov ebx, r13d
mov ecx, dword [rsp + 0x68]
mov dword [r15], ecx
mov dword [r14], edi
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 0x80070216
jmp 0x18007d84d
Function at 0x18007e740
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18019bca8]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
mov rbx, r8
and qword [rsp + 0x20], 0
mov esi, edx
mov rdi, rcx
lea rdx, [rsp + 0x40]
lea ecx, [r9 + 0x21]
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov ebp, 7
test eax, eax
js 0x18007e7f5
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
js 0x18007e7fc
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
js 0x18007e803
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
movups xmm0, xmmword [rsp + 0x48]
movdqu xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18008b970
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbp
int 0x29
jmp 0x18007e791
mov rcx, rbp
int 0x29
jmp 0x18007e7a9
mov rcx, rbp
int 0x29
jmp 0x18007e7c4
Function at 0x18008ec40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov r13, rsi
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov qword [rsp], r8
mov r8d, dword [rsp + 0x98]
mov r14, rdx
mov r15, rcx
xor eax, eax
mov esi, dword [rsi]
mov ebx, dword [rbx]
mov qword [rsp + 8], rax
jmp 0x18008eca8
add eax, 1
add esi, 1
mov dword [rsp + 8], eax
cmp esi, dword [rsp + 0xa0]
jge 0x18008edd9
cmp eax, dword [rsp + 0xa8]
jge 0x18008edd9
movzx eax, byte [rsi + rdi + 2]
shl ebx, 5
xor ebx, eax
mov r11, rsi
and ebx, r8d
movsxd rbp, dword [r9 + rbx*4]
mov dword [r9 + rbx*4], esi
mov r12, rdi
sub r11, rbp
cmp r11d, dword [rsp + 0x90]
jge 0x18008eda9
cmp ebp, dword [rsp + 0xb0]
jge 0x18008ecfb
mov r12, qword [rsp]
movzx eax, word [rsi + rdi]
lea r10, [rsi + rdi]
movzx ecx, word [rbp + r12]
lea r12, [rbp + r12]
cmp eax, ecx
jne 0x18008eda9
xor ecx, ecx
mov rax, qword [rcx + r10]
mov rdx, qword [rcx + r12]
xor rax, rdx
jne 0x18008ed43
add ecx, 8
cmp ecx, 0x100
jl 0x18008ed18
movzx eax, word [rcx + r10]
movzx edx, word [rcx + r12]
xor eax, edx
jne 0x18008ed43
add ecx, 2
jmp 0x18008ed4d
bsf rax, rax
shr rax, 3
add ecx, eax
cmp ecx, 3
jl 0x18008eda9
lea rbp, [rsi + 1]
lea rsi, [rcx + rsi - 1]
lea rdx, [rcx - 3]
movzx ecx, byte [rbp + rdi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, r8d
mov dword [r9 + rbx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x18008ed5f
lea rcx, [r11 - 1]
cmp r11, 0x101
jl 0x18008ed8d
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [rcx + r13 + 0x100]
add word [r15 + rcx*4], 1
movzx ebp, byte [rdx + r13]
add ebp, 0x101
jmp 0x18008edb2
xor r11, r11
movzx edx, byte [rsi + rdi]
mov ebp, edx
add word [r14 + rbp*4], 1
mov eax, dword [rsp + 8]
mov rcx, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov word [rcx + rax*2], r11w
mov byte [rax + rbp], dl
jmp 0x18008ec9e
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov dword [rdi], esi
mov dword [rcx], ebx
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800df3b4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r14d, r14d
mov r15d, r8d
mov rdi, rcx
test edx, edx
je 0x1800df5e1
test r8d, r8d
je 0x1800df5e1
cmp qword [rcx + 0xb0], r14
je 0x1800df3fd
mov ebx, 0x88982f04
jmp 0x1800df5e6
mov r13, qword [rsp + 0xb0]
cmp r13, 0xffffffffffffffff
je 0x1800df5e1
mov eax, dword [rsp + 0xb8]
mov dword [rcx + 0x78], edx
lea rdx, [rcx + 0xa8]
mov dword [rcx + 0x7c], r15d
movups xmm0, xmmword [r9]
mov dword [rcx + 0xac], eax
mov dword [rcx + 0xc0], 2
movdqu xmmword [rcx + 0x90], xmm0
mov rcx, r9
call fcn.1800317f8
mov esi, eax
test eax, eax
jns 0x1800df45e
cmp dword [0x18019cca4], r14d
je 0x1800df45e
mov ecx, eax
call fcn.180096ba4
mov ebx, esi
test esi, esi
js 0x1800df5f6
mov ebp, dword [rsp + 0xc8]
mov ecx, ebp
sub ecx, 1
je 0x1800df4a1
cmp ecx, 2
je 0x1800df499
cmp dword [0x18019cca4], r14d
mov ebx, 0x80070057
je 0x1800df5f6
mov ecx, ebx
call fcn.180096ba4
jmp 0x1800df5e6
mov r12d, 6
jmp 0x1800df4a7
mov r12d, 4
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov ecx, dword [rsp + 0xc0]
lea r8, [rsp + 0xc0]
mov r14d, dword [rsp + 0x58]
dec r14d
not r14d
and r14d, ecx
mov edx, r14d
call fcn.180020d88
mov esi, eax
test eax, eax
jns 0x1800df4ed
cmp dword [0x18019cca4], 0
je 0x1800df4ed
mov ecx, eax
call fcn.180096ba4
mov ebx, esi
test esi, esi
js 0x1800df5f6
mov eax, dword [rsp + 0xb8]
mov ecx, 0xffffffff
mov rsi, r15
mov r15d, 0x80070216
imul rsi, rax
mov eax, ecx
cmp rsi, rcx
cmovbe eax, esi
cmp rcx, rsi
mov dword [rdi + 0xb8], eax
sbb ebx, ebx
and ebx, r15d
cmp rsi, rcx
jbe 0x1800df549
cmp dword [0x18019cca4], 0
je 0x1800df540
mov ecx, ebx
call fcn.180096ba4
mov ecx, 0xffffffff
cmp rsi, rcx
ja 0x1800df5f6
mov ebx, dword [rsp + 0xc0]
mov esi, dword [rdi + 0xb8]
add esi, ebx
cmp esi, ebx
jb 0x1800df5cb
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
and qword [rsp + 0x28], 0
mov r9d, r14d
mov eax, esi
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFileEx]
mov qword [rdi + 0xc8], rax
test rax, rax
jne 0x1800df5b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1800df5a4
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
mov eax, 0x88982f94
cmovns ebx, eax
cmp dword [0x18019cca4], 0
jmp 0x1800df5ed
add rax, rbx
mov dword [rdi + 0xd0], ebp
mov qword [rdi + 0xb0], rax
xor ebx, ebx
jmp 0x1800df5f6
cmp dword [0x18019cca4], 0
je 0x1800df5dc
mov ecx, r15d
call fcn.180096ba4
mov ebx, r15d
jmp 0x1800df5f6
mov ebx, 0x80070057
cmp dword [0x18019cca4], r14d
je 0x1800df5f6
mov ecx, ebx
call fcn.180096ba4
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret