joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ee6f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov rdx, qword [rcx]
mov r9, qword [rcx + 8]
mov r8, r9
sub r8, rdx
je 0x140093767
mov rax, r8
shr rax, 2
neg r9
xor r9, rdx
cmp r9, 0xffffffffffffffff
je 0x140093762
mov r10, r8
and r10, 0xfffffffffffffffe
xor r9d, r9d
lea r11, [0x14011efa0]
nop dword [rax]
movzx esi, al
movzx edi, byte [rdx + r9]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [rdx + r9 + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add r9, 2
cmp r10, r9
jne 0x140093710
test r8b, 1
je 0x14009375c
movzx r8d, al
movzx edx, byte [rdx + r9]
xor edx, r8d
lea r8, [0x14011efa0]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor r9d, r9d
jmp 0x14009373c
xor eax, eax
jmp 0x14009375c
sub rsp, 0x28
movapd xmmword [rsp + 0x10], xmm7
movapd xmmword [rsp], xmm6
mov r11, qword [r8]
mov r10, qword [r8 + 8]
mov rax, r10
sub rax, r11
sar rax, 2
lea r9, [rax - 1]
cmp r9, 2
jb 0x1400ee7c8
cvtsi2sd xmm0, ecx
cvtsi2sd xmm1, edx
add rax, 0xfffffffffffffffd
movq xmm2, rax
punpckldq xmm2, xmmword [0x140115370]
subpd xmm2, xmmword [0x140115380]
haddpd xmm2, xmm2
mov ecx, 1
movdqa xmm3, xmmword [0x140115370]
movapd xmm4, xmmword [0x140115380]
movsd xmm5, qword [0x14011a870]
mov rdx, qword [r8]
mov r10, qword [r8 + 8]
sub r10, rdx
sar r10, 2
cmp r10, rcx
jbe 0x1400ee7ea
movq xmm6, rax
punpckldq xmm6, xmm3
subpd xmm6, xmm4
haddpd xmm6, xmm6
lea r10, [rcx - 1]
movq xmm7, r10
punpckldq xmm7, xmm3
subpd xmm7, xmm4
haddpd xmm7, xmm7
mulsd xmm6, xmm0
mulsd xmm7, xmm1
addsd xmm7, xmm6
divsd xmm7, xmm2
addsd xmm7, xmm5
cvttsd2si r10d, xmm7
mov dword [rdx + rcx*4], r10d
dec rax
inc rcx
cmp rcx, r9
jne 0x1400ee760
mov r11, qword [r8]
mov r10, qword [r8 + 8]
cmp r10, r11
je 0x1400ee7ed
mov dword [r10 - 4], 0x7fffffff
mov rcx, r8
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
jmp 0x1400936d0
int3
int3
Function at 0x140001164
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x6c]
add edx, dword [rsp + 0x6c]
mov r8d, dword [rcx + 0xc]
mov dword [rsp + 0x6c], edx
mov edx, dword [rcx + 0x14]
mov r9d, edx
mov r10, qword [rsp + 0x48]
add r10, r9
mov edx, r8d
mov r9d, edx
mov r11, qword [rsp + 0x50]
add r11, r9
mov edx, dword [rcx + 0x10]
mov r8d, edx
mov qword [rsp + 0x30], rcx
mov rcx, r11
mov rdx, r10
mov qword [rsp + 0x28], rax
call sym.TAPI32.dll_lineConfigDialog
fcomp dword [rax]
add byte [rax], al
mov si, word [rsp + 0x5c]
xor si, word [rsp + 0x5c]
and al, 0x5c
and al, 0x5c
mov word [rsp + 0x5c], si
mov rax, qword [rsp + 0x28]
add rax, 1
mov rcx, qword [rsp + 0x30]
xor byte [rax - 0x7d], cl
shr dword [rax], 0x48
cmp eax, 5
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
jne 0x1400010f7
mov rcx, qword [rsp + 0x48]
call fcn.140001c00
mov edx, dword [rax + 0x54]
mov r8d, edx
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
call sym.TAPI32.dll_lineConfigDialog
nop
add rsp, 0x70
pop rsi
ret
Function at 0x1400014c4
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rsp + 0x98]
call rax
mov edx, 0xe6f5dc
mov ecx, edx
lea r8, [rsp + 0xb0]
mov r9b, byte [rsp + 0x77]
and r9b, 0x51
mov byte [rsp + 0xd3], r9b
mov byte [rsp + 0xd3], 0xf5
mov r11, qword [sym.imp.USER32.dll_ScreenToClient]
mov edx, 0xe6f5dc
mov esi, edx
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x68], rcx
mov rcx, rsi
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], r8
call r11
lea rcx, [rsp + 0x7c]
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x7c], 0xafa
cli
or al, byte [rax]
add byte [rbx + rcx*4 - 0x7c], cl
and al, 0xc8
add byte [rax], al
add byte [rsi - 0x75], ah
mov esp, 0xbe24
add byte [rsi - 0x7d], ah
idiv edi
mov word [rsp + 0xbe], di
xor r8, 0x3bb432f0
mov qword [rsp + 0x88], r8
mov r8, qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
lea r11, [rsp + 0x7c]
lea rsi, [rsp + 0x88]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x50], ecx
mov rcx, r11
mov qword [rsp + 0x48], rdx
mov rdx, rsi
mov dword [rsp + 0x44], eax
call r8
mov dword [rsp + 0x40], eax
call sym.TAPI32.dll_lineRedirectA
cmp eax, 0
je 0x14000156e
jmp 0x140001609
lea rax, [0x140004144]
mov rcx, qword [rsp + 0x80]
lea rdx, [0x140004144]
mov r8, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
call r8
cmp rax, 0
jne 0x140001609
call fcn.1400017f0
mov dword [rsp + 0x34], eax
jmp 0x140001609
call fcn.140001050
cmp eax, 0
jne 0x140001609
lea rax, str.shell32
lea rcx, str.shell32
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
call rdx
mov rcx, qword [rsp + 0xc8]
xor rcx, 0x475face7
mov qword [rsp + 0x80], rax
mov r8b, byte [rsp + 0x77]
and r8b, 0xdc
mov byte [rsp + 0xd3], r8b
mov qword [rsp + 0x90], rcx
add byte [rax], al
add dh, al
test byte [rbx + rdx*8], ah
add byte [rax], al
add byte [rdi + 0x48], bh
mov eax, dword [rsp + 0x90]
mov r8b, 0x1d
mov r9b, byte [rsp + 0x77]
mov qword [rsp + 0x20], rax
mov al, r9b
mul r8b
mov byte [rsp + 0xd3], al
mov rcx, qword [rsp + 0x20]
cmp rcx, 0x4d7e66d
jbe 0x14000157c
jmp 0x140001531
mov qword [rsp + 0xc0], 0x33d0983c
mov eax, dword [rsp + 0xb8]
invalid
cli
in al, dx
invalid

Function at 0x140001c30
Capabilities:
Get disk information

Disassembly:
call rcx
lodsd eax, dword [rsi]
popfq
add edi, dword [rcx + 0x73239c30]
invalid

Function at 0x140002544
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x28]
mov dx, word [rsp + 0x3e]
mov cx, dx
xor ecx, 0x3b02
mov r8w, cx
mov word [rsp + 0xae], r8w
mov dword [rsp + 0xae], r8d

Function at 0x140003760
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x58], edx
cmp cx, 0
je 0x1400037f9
add byte [rax], al
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb8], 0
cmp rax, rcx
je sym.TAPI32.dll_lineGetCallInfo
jmp 0x14000367f
Function at 0x1800011a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800011e2
xor al, al
jmp 0x180001260
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18000120c
xor al, al
jmp 0x180001260
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x180001258
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0xec]
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x180001258
mov al, 1
jmp 0x180001260
xor al, al
jmp 0x180001260
add rsp, 0x68
ret

Function at 0x1800012f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1804e5460]
mov qword [rsp + 0x20], rax
jmp 0x180001310
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001335
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180001302
add rsp, 0x38
ret
Function at 0x180001340
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1804e5478], eax
je 0x18000135c
mov eax, 0x10dd
jmp 0x180001479
mov rax, qword [0x1804e5490]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001402
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x1800013d2
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x1800013d2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.1800014f0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1800575f8
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x180001368
mov qword [0x1804e5490], 0
call fcn.180001480
mov rax, qword [0x1804e5488]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180001462
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1800575f8
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18000141e
mov qword [0x1804e5488], 0
mov dword [0x1804e5478], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180001bf0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x180001c0d
xor eax, eax
jmp 0x180001ca5
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180001c47
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x180001ca0
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x180001c9e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9e
xor eax, eax
jmp 0x180001ca5
jmp 0x180001c3d
mov eax, 1
add rsp, 0x28
ret

Function at 0x180001d90
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1804e547c], 0
je 0x180001dad
mov eax, dword [0x1804e547c]
jmp 0x180001e71
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180001dc1
xor eax, eax
jmp 0x180001e71
mov ecx, 0x10
call fcn.180056b34
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180001e2a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180001e0f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1800575f8
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1804e547c], eax
mov qword [0x1804e5480], 0
mov eax, dword [rsp + 0x20]
jmp 0x180001e71
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180001e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180001dea
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1804e5488]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1804e5488], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x180004d10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1804e4010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, vtable.CEncrypt_unsigned_long_long_unsigned___int64__.0
mov r14, rdx
mov qword [rcx], rax
mov rsi, rcx
lea rax, vtable.ccddaabb.0
mov qword [rcx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov word [rsi + 0xa], 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea ecx, [rax + 0x66]
movzx eax, word [rsi + 0xa]
add ecx, ebp
movzx edx, cx
mov ecx, 0xc
sub ecx, eax
mov eax, edx
cdq
idiv ecx
mov word [rsi + 8], dx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add al, 0x66
add al, bpl
movsx ecx, al
and ecx, 0x800000ff
jge 0x180004d9c
dec ecx
or ecx, 0xffffff00
inc ecx
xor edi, edi
mov byte [rsi + 0xc], cl
mov ebx, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add al, 0x66
add al, bpl
movsx eax, al
and eax, 0x800000ff
jge 0x180004dc1
dec eax
or eax, 0xffffff00
inc eax
mov byte [rsi + rbx + 0x28], al
inc rbx
cmp rbx, 0xc
jl 0x180004da3
mov dword [rsi + 0x1c], 0x66
mov dword [rsi + 0x20], ebp
mov dword [rsi + 0x18], 0x330
mov rax, qword [r14]
mov qword [rsp + 0x20], rax
movzx eax, word [rsi + 0xa]
cmp eax, 4
jbe 0x180004dfe
mov r8d, eax
test al, 3
jne 0x180004e3a
test rax, rax
jne 0x180004e04
jmp 0x180004e3a
mov r8d, 4
lea rcx, [rsp + 0x20]
mov r9, rsi
sub r9, rcx
nop
lea rdx, [rsp + 0x20]
add rdx, rdi
add rdi, 4
mov ecx, dword [rdx]
add ecx, dword [rsi + 0x18]
mov eax, ecx
shr ecx, 0x19
xor eax, 0xfac6d9
shl eax, 7
or eax, ecx
mov dword [r9 + rdx + 0x28], eax
cmp rdi, r8
jl 0x180004e10
mov rax, rsi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180056ae0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180005970
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r14, rcx
call fcn.180056a90
mov r11, rax
cmp qword [rax + 0x60], 0
je 0x180005aab
xor esi, esi
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r11 + 0x30]
xor bl, bl
mov r8, qword [r11 + 0x60]
mov r11, qword [r11]
test rbp, rbp
je 0x180005aa1
movzx edi, word [r11 + 0x58]
mov edx, esi
test edi, edi
je 0x180005aa1
mov r9, r14
nop dword [rax + rax]
movzx eax, word [r8]
test ax, ax
je 0x180005a99
movsx r10d, byte [r9]
test r10b, r10b
je 0x180005a99
cmp eax, r10d
jne 0x180005aa1
inc edx
add r8, 2
inc r9
mov bl, 1
cmp edx, edi
jl 0x1800059e0
mov eax, 0x5a4d
cmp word [rbp], ax
jne 0x180005aab
movsxd rax, dword [rbp + 0x3c]
cmp dword [rax + rbp], 0x4550
jne 0x180005aab
mov ecx, dword [rax + rbp + 0x88]
test ecx, ecx
je 0x180005aab
mov r11d, dword [rcx + rbp + 0x1c]
lea rax, [rcx + rbp]
mov r9d, dword [rax + 0x20]
add r11, rbp
mov ebx, dword [rax + 0x24]
add r9, rbp
mov r10d, dword [rax + 0x18]
add rbx, rbp
test r10d, r10d
je 0x180005aab
nop
mov eax, dword [r9]
xor dl, dl
add rax, rbp
cmp byte [rax], dl
je 0x180005aca
mov r8, r15
sub r8, rax
movzx ecx, byte [rax + r8]
test cl, cl
je 0x180005ac6
cmp byte [rax], cl
jne 0x180005aca
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x180005a72
movsxd rax, esi
movzx ecx, word [rbx + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, rbp
jmp 0x180005aad
test bl, bl
jne 0x180005a12
cmp qword [r11 + 0x60], rsi
jne 0x1800059b0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
test dl, dl
jne 0x180005a89
inc esi
add r9, 4
cmp esi, r10d
jb 0x180005a60
jmp 0x180005aab
Function at 0x18000c190
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1804e4010]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [rcx + 0x1d], 0
lea rbx, [rcx + 0x1d]
mov rax, rbx
je 0x18000c1be
mov byte [rax], 0
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x18000c1b2
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 5]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
movzx eax, word [0x18005cc80]
movsd xmm0, qword [str.muryp]
mov word [rsp + 0x38], ax
shr ax, 8
movsd qword [rsp + 0x30], xmm0
test al, al
je 0x18000c229
xor byte [rsp + 0x30], 0x31
xor byte [rsp + 0x31], 0x32
xor byte [rsp + 0x32], 0x33
xor byte [rsp + 0x33], 0x34
xor byte [rsp + 0x34], 0x35
xor byte [rsp + 0x35], 0x36
xor byte [rsp + 0x36], 0x37
xor byte [rsp + 0x37], 0x38
xor byte [rsp + 0x38], 0x39
xor byte [rsp + 0x39], 0x3a
lea rdx, [rbx - 1]
nop dword [rax]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x18000c230
lea rax, [rsp + 0x30]
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + r8]
mov byte [rdx + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x18000c250
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180056ae0
add rsp, 0x50
pop rbx
ret
Function at 0x1800157c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1804e4010]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 0x1d], 0
lea rbx, [rcx + 0x1d]
mov qword [rsp + 0x58], rbp
mov rax, rbx
mov qword [rsp + 0x30], r14
mov rbp, rcx
je 0x1800157fc
nop
mov byte [rax], 0
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1800157f0
mov word [rcx + 0x121], 0
mov byte [rcx + 0x1c], 0
mov rax, qword [0x1804e5c70]
cmp rax, qword [0x1804e5c78]
je 0x180015820
mov qword [0x1804e5c78], rax
mov r8, qword [rcx + 8]
mov eax, 0xaaaaaaab
movsxd rcx, dword [r8 + 0x3c]
mul dword [rcx + r8 + 0xa4]
mov ecx, dword [rcx + r8 + 0xa0]
shr edx, 3
add rcx, r8
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov r14, qword [rbp + 8]
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1800158b0
movzx eax, word [rax + r14 + 0x14]
test ax, ax
je 0x1800158b0
mov qword [rsp + 0x60], rsi
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov qword [rsp + 0x38], rdi
mov edx, eax
mov rcx, r14
mov esi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
xor eax, eax
mov ecx, esi
mov rdi, r14
mov edx, esi
rep stosb byte [rdi], al
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rcx, rbp
call fcn.18000c190
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
cmp byte [rbx], 0
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x58]
je 0x1800158de
mov byte [rbx], 0
lea rbx, [rbx + 1]
cmp byte [rbx], 0
jne 0x1800158d2
lea rcx, [0x180014e80]
call fcn.180009030
lea rcx, [0x1800131e0]
call fcn.180009030
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180056ae0
add rsp, 0x40
pop rbx
ret

Function at 0x180019ca0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1804e60c8]
add rcx, 0x3841340
call fcn.180004ea0
mov rsi, rax
test rax, rax
je 0x180019d6a
mov rcx, qword [0x1804e60c8]
add rcx, 0x38255b3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call fcn.180004ea0
xor edi, edi
mov rbp, rax
mov edx, edi
lea rax, [0x1804e5f34]
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rdx + rax - 0xc]
ror ecx, 7
xor ecx, 0xfac6d9
sub ecx, dword [0x1804e5f18]
mov dword [rdx + rax], ecx
add rdx, 4
cmp rdx, 8
jl 0x180019d00
mov rbx, qword [0x1804e5f34]
lea rcx, [rsi + 0x160]
call fcn.180004ea0
sub rbx, rbp
mov rbp, qword [rsp + 0x38]
xor rax, rbx
mov rbx, qword [rsp + 0x30]
je 0x180019d6a
lea rcx, [rax + 0x30]
call fcn.180004ea0
test rax, rax
lea rcx, [rax + 0x2044]
cmovne rdi, rcx
mov rax, rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1800210f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002114d
lea rbx, [0x1804d2b70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180021134
cmp r10, 2
jb 0x180021134
cmp byte [r9], r8b
jne 0x180021134
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180021110
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18002118f
lea rbx, [0x1804d2b70]
cmp r8b, 0x23
jne 0x180021173
cmp byte [r9], r8b
jne 0x180021173
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180021160
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800212d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800212ea
mov qword [r8], 0
lea rdx, [0x1804d841c]
call fcn.1800211a0
mov rbx, rax
test rax, rax
jne 0x18002130a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800213e1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800213e1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800213e1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800213e1
cmp rdi, 0xffffffffffffffff
je 0x1800213e1
mov rax, qword [0x1804e5ad0]
test rax, rax
je 0x18002137e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1800213e1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800213ce
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1804e5ad0]
test rax, rax
je 0x1800213c3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800213ea
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1800213dc
mov qword [r14], rdi
mov rax, rsi
jmp 0x1800213ec
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180023ea0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1804d2b70]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1804e5ad0]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x180023f36
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.180036450
mov eax, ebx
add rsp, 0x20
pop rbx
ret