joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000de84
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [str.P_t9F]
xor r8d, r8d
mov rbp, rdx
mov rsi, rcx
xor edi, edi
call qword [rax + 0x240]
test eax, eax
jne 0x18000df6c
xor edx, edx
mov word [rsp + 0x30], di
mov r8d, 0x206
lea rcx, [rsp + 0x32]
call sub.msvcrt.dll_memset
mov ecx, 0x6de
call fcn.18000dae4
mov rcx, qword [0x180029fc0]
lea edx, [rdi + 1]
add rcx, 0x668
mov qword [rsp + 0x260], rax
mov r8d, 0xf4240
mov rbx, rax
call fcn.18001b9b4
mov r9, rbp
mov dword [rsp + 0x20], eax
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0x103
call fcn.180010954
lea rcx, [rsp + 0x260]
call fcn.18000da80
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x18000df55
mov rax, qword [str.P_t9F]
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [rax + 0x240]
test eax, eax
jne 0x18000df5a
or edi, 0xffffffff
jmp 0x18000df7c
mov rax, qword [str.P_t9F]
mov rcx, rsi
call qword [rax + 0x238]
jmp 0x18000df7c
mov rdx, qword [str.P_t9F]
mov rcx, rsi
call qword [rdx + 0x238]
lea r11, [rsp + 0x240]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18000df98
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x260
mov edx, 0x80
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call sub.msvcrt.dll_memset
mov r8d, 0x200
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18001422c
mov rax, qword [str.P_t9F]
mov rcx, rbx
call qword [rax + 0x238]
test eax, eax
je 0x18000dff2
mov eax, 1
jmp 0x18000e076
mov rcx, qword [0x180029fc0]
or r8d, 0xffffffff
add rcx, 0x668
mov edx, 0xf0000000
call fcn.18001b9b4
mov r9d, eax
lea r8, [0x180024398]
mov edx, 0x20
lea rcx, [rsp + 0x20]
call fcn.180010954
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [0x18002436c]
mov rcx, rbx
call fcn.18000d2dc
mov qword [rsp + 0x278], rax
test rax, rax
je 0x18000e074
mov rdx, rax
mov rcx, rbx
call fcn.18000de84
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x278]
mov ebx, eax
call fcn.18000c7c0
test ebx, ebx
jns 0x18000dfe8
xor eax, eax
add rsp, 0x260
pop rbx
ret

Function at 0x18000ebec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [0x18002aad8]
test rcx, rcx
jne 0x18000ec0b
mov eax, ebx
jmp 0x18000ec40
mov r8d, dword [rdi]
mov edx, 8
inc r8d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18000ec40
cmp dword [rdi], ebx
jbe 0x18000ec40
mov ecx, ebx
and ecx, 3
mov edx, ebx
inc ebx
mov cl, byte [rcx + rdi + 0x108]
xor cl, byte [rdx + rdi + 4]
mov byte [rdx + rax], cl
cmp ebx, dword [rdi]
jb 0x18000ec25
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f070
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r10, qword [0x180029fc0]
xor r8d, r8d
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x40]
lea edx, [r8 + 8]
mov r9d, edx
mov rax, r8
inc r8
and eax, 7
mov al, byte [rax + r10 + 0x1880]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x18000f092
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.180013f88
add rsp, 0x28
ret

Function at 0x18000ff1c
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
xor r13d, r13d
mov r12, rcx
mov dword [rax + 0x10], r13d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x278]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rsp + 0x278]
mov ebp, r13d
mov r14, rax
test edx, edx
jle 0x180010060
lea r15, [rsp + 0x20]
mov rsi, qword [r14]
cmp word [rsi], 0x2f
ja 0x18000ff8f
movzx eax, word [rsi]
movabs rcx, 0xa00000002401
bt rcx, rax
jb 0x18000ffcb
cmp ebx, 0x20
jae 0x18000ffcb
mov rcx, rsi
mov qword [r15], rsi
mov rdi, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x18000ffbe
cmp word [rsi + rdi*2], 0x2c
jne 0x18000ffb6
mov word [rsi + rdi*2], r13w
inc rdi
cmp rdi, rcx
jl 0x18000ffaa
mov edx, dword [rsp + 0x278]
inc ebx
add r15, 8
inc ebp
add r14, 8
cmp ebp, edx
jl 0x18000ff73
cmp ebx, 1
jne 0x18000ffe1
mov rbx, qword [rsp + 0x20]
jmp 0x18000ffe8
jle 0x180010060
mov rbx, qword [rsp + 0x28]
cmp word [rbx], 0x5c
je 0x18001004b
cmp word [rbx + 2], 0x3a
je 0x18001004b
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
lea rdx, [0x180024184]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.18000d2dc
mov r8d, 0x104
mov qword [rsp + 0x280], rax
mov rdx, rax
mov rcx, r12
call fcn.180010a08
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x280]
call fcn.18000c7c0
jmp 0x18001005c
mov r8d, 0x104
mov rdx, rbx
mov rcx, r12
call fcn.180010a08
xor eax, eax
jmp 0x180010063
or eax, 0xffffffff
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001236c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov qword [rsp + 0x70], rdi
xor edx, edx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rsp + 0x70]
xor edx, edx
lea r9, [0x180023db0]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
lea rcx, [0x180023dc0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180012487
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rax
mov r10, qword [rcx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x18]
test eax, eax
js 0x180012487
mov rcx, qword [rsp + 0x68]
lea edx, [rdi + 0xa]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x180012487
mov rcx, qword [0x18002aad8]
test rcx, rcx
je 0x180012487
lea edx, [rdi + 8]
lea r8d, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180012487
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
jmp 0x1800124a9
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180012497
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800124a7
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800137b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
call fcn.18000dae4
mov ecx, 0xcaf
mov qword [rsp + 0x38], rax
mov rsi, rax
call fcn.18000dae4
mov ecx, 0x6b4
mov rdi, rax
call fcn.18000dae4
mov rcx, qword [0x180029fc0]
mov rbx, rax
add rcx, 0x668
mov qword [rbp + 0x1a8], rax
call fcn.18001b8b0
mov r9, qword [0x180029fc0]
lea rcx, [rsp + 0x50]
add r9, 0x124a
mov dword [rsp + 0x20], eax
mov r8, rbx
mov edx, 0x104
call fcn.180010954
lea rcx, [rbp + 0x1a8]
call fcn.18000da80
mov rcx, qword [0x180029fc0]
lea rdx, [0x180024184]
and qword [rsp + 0x28], 0
add rcx, 0x1040
mov r9, rdx
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.18000d2dc
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rax, qword [str.P_t9F]
xor r8d, r8d
call qword [rax + 0x240]
mov rax, qword [str.P_t9F]
mov rcx, rsi
call qword [rax + 0x28]
mov rbx, rax
test rax, rax
jne 0x1800138c3
mov rax, qword [str.P_t9F]
mov rcx, rsi
call qword [rax + 8]
mov rbx, rax
test rax, rax
jne 0x1800138c3
lea rcx, [rsp + 0x38]
call fcn.18000da80
or eax, 0xffffffff
jmp 0x180013a54
mov rax, qword [str.P_t9F]
lea rcx, [rsp + 0x50]
call qword [rax + 8]
mov r12, rax
test rax, rax
je 0x180013a24
mov r15d, dword [rbx + 0x3c]
mov eax, dword [r15 + rbx + 0x88]
test eax, eax
je 0x180013a24
lea rsi, [rbx + rax]
xor r13d, r13d
mov r8d, dword [rsi + 0x20]
mov eax, dword [rsi + 0x24]
add r8, rbx
mov edx, dword [rsi + 0x1c]
add rax, rbx
add rdx, rbx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x1b8], rdx
cmp dword [rsi + 0x18], r13d
jbe 0x180013a24
movzx eax, word [rax + r13*2]
mov edi, dword [rdx + rax*4]
add rdi, rbx
cmp rdi, rsi
jb 0x18001394b
mov eax, dword [r15 + rbx + 0x8c]
add rax, rsi
cmp rdi, rax
jb 0x180013a12
mov edx, dword [r8 + r13*4]
mov rcx, r12
mov rax, qword [str.P_t9F]
add rdx, rbx
call qword [rax + 0x18]
mov r14, rax
test rax, rax
je 0x180013a06
mov rdx, rdi
mov r8d, 7
mov cl, byte [rax]
cmp byte [rdx], cl
jne 0x180013986
inc rdx
inc rax
sub r8, 1
jne 0x180013974
movzx ecx, byte [rdx]
movzx eax, byte [rax]
cmp ecx, eax
je 0x180013a06
cmp byte [rdi], 0xe9
jne 0x180013a06
mov rax, qword [str.P_t9F]
lea r9, [rbp + 0x1a8]
and dword [rbp + 0x1a8], 0
mov edx, 8
mov rcx, rdi
lea r8d, [rdx + 0x38]
call qword [rax + 0x1f8]
test eax, eax
je 0x180013a06
mov r10d, 8
mov rdx, rdi
mov ecx, r10d
sub rdx, r14
mov al, byte [r14]
mov byte [rdx + r14], al
inc r14
sub rcx, 1
jne 0x1800139cf
and dword [rbp + 0x1b0], ecx
lea r9, [rbp + 0x1b0]
mov rax, qword [str.P_t9F]
mov rdx, r10
mov r8d, dword [rbp + 0x1a8]
mov rcx, rdi
call qword [rax + 0x1f8]
mov rdx, qword [rbp + 0x1b8]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
inc r13d
cmp r13d, dword [rsi + 0x18]
jb 0x180013927
lea rcx, [rsp + 0x38]
call fcn.18000da80
test r12, r12
je 0x180013a40
mov rax, qword [str.P_t9F]
mov rcx, r12
call qword [rax + 0x10]
mov rax, qword [str.P_t9F]
lea rcx, [rsp + 0x50]
call qword [rax + 0x238]
xor eax, eax
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013f88
Capabilities:
Encode data using xor

Disassembly:
not r8d
test edx, edx
jne 0x180013f92
xor eax, eax
ret
mov r9d, edx
lea rdx, [0x180024280]
movzx eax, byte [rcx]
inc rcx
xor r8d, eax
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
sub r9, 1
jne 0x180013f9c
not r8d
mov eax, r8d
ret
Function at 0x1800161f4
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, edx
mov eax, 0xaaaaaaab
mul edx
mov rbp, rcx
mov rcx, qword [0x18002aad8]
shr edx, 1
lea edi, [rdx*4 + 5]
test rcx, rcx
je 0x18001633f
lea r8d, [rdi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, rax
test rax, rax
je 0x18001633f
xor r11d, r11d
xor edx, edx
test ebx, ebx
je 0x180016331
lea esi, [rdi - 4]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp edx, esi
jae 0x180016331
xor r10d, r10d
xor r8d, r8d
mov cl, byte [r11 + rbp]
mov byte [rsp + r8 + 0x48], cl
cmp r11d, ebx
jae 0x18001627e
inc r10d
jmp 0x180016284
mov byte [rsp + r8 + 0x48], 0
inc r11d
inc r8
cmp r8, 3
jl 0x18001626b
test r10d, r10d
je 0x180016328
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rsp + 0x48]
and ecx, 3
movzx r8d, byte [rsp + 0x49]
shr rax, 2
shl ecx, 4
mov al, byte [rax + r14]
mov byte [rsp + 0x50], al
mov eax, r8d
shr rax, 4
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x51], al
cmp r10d, 1
jle 0x180016306
movzx eax, byte [rsp + 0x4a]
and r8d, 0xf
shr rax, 6
shl r8d, 2
mov ecx, r8d
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x52], al
cmp r10d, 2
jle 0x18001630b
movzx eax, byte [rsp + 0x4a]
and eax, 0x3f
mov cl, byte [rax + r14]
jmp 0x18001630d
mov byte [rsp + 0x52], 0x3d
mov cl, 0x3d
mov byte [rsp + 0x53], cl
xor r8d, r8d
mov al, byte [rsp + r8 + 0x50]
inc r8
mov byte [rdx + r9], al
inc edx
cmp r8, 4
jl 0x180016314
cmp r11d, ebx
jb 0x18001625d
cmp edx, edi
jae 0x18001633a
mov byte [rdx + r9], 0
mov rax, r9
jmp 0x180016341
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180016bb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
movsxd rsi, edx
mov rdi, rcx
lea rax, str.business.doc
xor r9d, r9d
inc rax
inc r9d
cmp byte [rax], 0
jne 0x180016bda
mov eax, 0xf
mov byte [rsp + 0x2f], 0
cmp r9d, eax
cmova r9d, eax
xor ecx, ecx
test r9d, r9d
je 0x180016c11
lea rdx, [rsp + 0x20]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, r9d
jb 0x180016c02
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9b, byte [rbx + 0x100]
mov r11, rsi
mov r10b, byte [rbx + 0x101]
test esi, esi
jle 0x180016c62
inc r9b
movzx r8d, r9b
mov dl, byte [r8 + rbx]
add r10b, dl
movzx ecx, r10b
mov al, byte [rcx + rbx]
mov byte [r8 + rbx], al
mov byte [rcx + rbx], dl
add dl, byte [r8 + rbx]
movzx eax, dl
mov cl, byte [rax + rbx]
xor byte [rdi], cl
inc rdi
sub r11, 1
jne 0x180016c31
mov rsi, qword [rsp + 0x48]
mov byte [rbx + 0x100], r9b
mov byte [rbx + 0x101], r10b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180016d94
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
lea r9, [rsp]
add rcx, 0x1d
mov r10d, 0x10
sub r9, r8
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
lea rcx, [rcx + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r9 + rcx - 0x21], edx
sub r10, 1
jne 0x180016dc7
lea rcx, [rsp + 8]
lea edx, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
ror eax, 0x1f
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x180016dfd
mov r15d, dword [r8]
lea esi, [rdx + 0x14]
mov r12d, dword [r8 + 4]
mov r14d, r15d
mov r13d, dword [r8 + 8]
mov r10d, r12d
mov ebx, dword [r8 + 0xc]
mov r9d, r13d
mov edi, dword [r8 + 0x10]
xor ebp, ebp
mov eax, r9d
lea r11d, [rdi + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, r14d
and ecx, ebx
ror edx, 0x1b
or ecx, eax
mov edi, ebx
mov ebx, r9d
add edx, ecx
add edx, dword [rsp + rbp*4]
mov r9d, r10d
shr r10d, 2
add r11d, edx
shl r9d, 0x1e
inc rbp
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rsi
jl 0x180016e39
mov ebp, 0x28
ror r11d, 0x1b
add edi, 0x6ed9eba1
add r11d, dword [rsp + rsi*4]
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add r11d, ecx
mov r9d, r10d
inc rsi
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rsi, rbp
jl 0x180016e83
mov edx, 0x3c
mov ecx, r9d
ror r11d, 0x1b
or ecx, r10d
mov eax, r9d
and ecx, ebx
and eax, r10d
add edi, 0x8f1bbcdc
or ecx, eax
add ecx, dword [rsp + rbp*4]
add r11d, edi
add r11d, ecx
mov edi, ebx
mov ebx, r9d
inc rbp
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rdx
jl 0x180016ec5
mov eax, dword [rsp + rdx*4]
add edi, 0xca62c1d6
ror r11d, 0x1b
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add eax, ecx
mov r9d, r10d
add r11d, eax
shr r10d, 2
inc rdx
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rdx, 0x50
jl 0x180016f09
add dword [r8 + 0xc], ebx
lea eax, [r15 + r11]
add dword [r8 + 0x10], edi
lea r11, [rsp + 0x140]
and dword [r8 + 0x5c], 0
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r8], eax
lea eax, [r12 + r10]
mov dword [r8 + 4], eax
lea eax, [r9 + r13]
mov dword [r8 + 8], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180016f90
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x29], 0x67452301
mov r14, r8
mov qword [rbp - 0x15], rbx
mov rsi, rcx
mov qword [rbp + 0x33], rbx
mov edx, ebx
mov dword [rbp - 0x25], 0xefcdab89
lea edi, [rbx + 0xe]
mov dword [rbp - 0x21], 0x98badcfe
lea r15d, [rbx + 1]
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov eax, ebx
mov dword [rbp + 0x3b], ebx
dec edi
test eax, eax
jne 0x1800170f8
mov al, byte [rsi]
movsxd rcx, edx
mov byte [rbp + rcx - 0xd], al
mov edx, dword [rbp + 0x33]
mov eax, dword [rbp + 0x3b]
inc edx
add dword [rbp - 0x15], 8
mov dword [rbp + 0x33], edx
jne 0x18001701f
add dword [rbp - 0x11], r15d
cmove eax, r15d
mov dword [rbp + 0x3b], eax
cmp edx, 0x40
jne 0x180017033
lea rcx, [rbp - 0x29]
call fcn.180016d94
mov eax, dword [rbp + 0x3b]
mov edx, dword [rbp + 0x33]
add rsi, r15
test edi, edi
jne 0x180016ff0
test eax, eax
jne 0x1800170f8
cmp dword [rbp + 0x37], ebx
jne 0x1800170f8
movsxd rax, edx
mov byte [rbp + rax - 0xd], 0x80
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp edx, 0x37
jle 0x1800170aa
jmp 0x180017072
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x40
jl 0x180017063
lea rcx, [rbp - 0x29]
call fcn.180016d94
mov eax, dword [rbp + 0x33]
jmp 0x180017094
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x180017085
jmp 0x1800170af
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x18001709b
mov ecx, dword [rbp - 0x11]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2b], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x2d], al
mov byte [rbp + 0x2e], cl
mov ecx, dword [rbp - 0x15]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2f], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x32], cl
lea rcx, [rbp - 0x29]
mov byte [rbp + 0x31], al
call fcn.180016d94
mov dword [rbp + 0x37], r15d
lea r8, [rbp - 0x27]
mov al, byte [r8 + 1]
lea edx, [rbx*4]
lea ecx, [rdx + 1]
mov byte [rdx + r14], al
mov al, byte [r8]
add ebx, r15d
mov byte [rcx + r14], al
lea ecx, [rdx + 2]
mov al, byte [r8 - 1]
lea r8, [r8 + 4]
mov byte [rcx + r14], al
lea ecx, [rdx + 3]
mov al, byte [r8 - 6]
mov byte [rcx + r14], al
cmp ebx, 5
jb 0x1800170fc
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18001961c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea r9d, [r8 - 0x21524111]
mov r10, rdx
add r9d, edx
mov rbx, rcx
mov r11d, r9d
mov edi, r9d
cmp rdx, 0xc
jbe 0x180019736
lea r8, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add r10, rax
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
movzx r8d, byte [rbx + 4]
movzx edx, byte [rbx + 8]
add r8d, r11d
shl ecx, 8
add edx, r9d
add ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
add r8d, ecx
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [rbx + 3]
shl ecx, 8
mov r9d, edx
add ecx, eax
ror r9d, 0x1c
movzx eax, byte [rbx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
add rbx, 0xc
add ecx, eax
sub ecx, edx
add edx, r8d
add ecx, edi
xor r9d, ecx
sub r8d, r9d
mov eax, r9d
add r9d, edx
ror eax, 0x1a
xor eax, r8d
sub edx, eax
mov ecx, eax
add eax, r9d
ror ecx, 0x18
xor ecx, edx
sub r9d, ecx
mov edi, ecx
add ecx, eax
ror edi, 0x10
xor edi, r9d
sub eax, edi
mov r11d, edi
ror r11d, 0xd
add edi, ecx
xor r11d, eax
sub ecx, r11d
mov r9d, r11d
ror r9d, 0x1c
add r11d, edi
xor r9d, ecx
sub rsi, 1
jne 0x18001966d
cmp r10, 6
ja 0x18001977a
je 0x1800197d7
test r10, r10
je 0x18001985c
sub r10, 1
je 0x180019803
sub r10, 1
je 0x1800197fa
sub r10, 1
je 0x1800197f1
sub r10, 1
je 0x1800197e8
cmp r10, 1
je 0x1800197e1
jmp 0x180019808
sub r10, 7
je 0x1800197cd
sub r10, 1
je 0x1800197c3
sub r10, 1
je 0x1800197bc
sub r10, 1
je 0x1800197b2
sub r10, 1
je 0x1800197a8
cmp r10, 1
jne 0x180019808
movzx eax, byte [rbx + 0xb]
shl eax, 0x18
add r9d, eax
movzx eax, byte [rbx + 0xa]
shl eax, 0x10
add r9d, eax
movzx eax, byte [rbx + 9]
shl eax, 8
add r9d, eax
movzx eax, byte [rbx + 8]
add r9d, eax
movzx eax, byte [rbx + 7]
shl eax, 0x18
add r11d, eax
movzx eax, byte [rbx + 6]
shl eax, 0x10
add r11d, eax
movzx eax, byte [rbx + 5]
shl eax, 8
add r11d, eax
movzx eax, byte [rbx + 4]
add r11d, eax
movzx eax, byte [rbx + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [rbx + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [rbx + 1]
shl eax, 8
add edi, eax
movzx eax, byte [rbx]
add edi, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x12
sub r9d, eax
mov eax, r9d
mov edx, r9d
ror eax, 0x15
xor edx, edi
sub edx, eax
xor r11d, edx
mov eax, edx
ror eax, 7
sub r11d, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x10
sub r9d, eax
mov eax, r9d
mov ecx, r9d
ror eax, 0x1c
xor ecx, edx
sub ecx, eax
xor r11d, ecx
mov eax, ecx
ror eax, 0x12
sub r11d, eax
mov eax, r11d
xor r9d, r11d
ror eax, 8
sub r9d, eax
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x18001abd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
je 0x18001abe5
jmp 0x18001abdd
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0xc], 0
je 0x18001ac53
xor eax, eax
test eax, eax
je 0x18001ac43
jmp 0x18001ac3b
mov rax, qword [rsp + 0x30]
add rax, 0x14
mov qword [rsp + 0x30], rax
jmp 0x18001ac30
xor eax, eax
test eax, eax
je 0x18001ac5b
jmp 0x18001ac53
mov eax, dword [0x180029f48]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [0x180029f40]
call fcn.18000ca40
test eax, eax
je 0x18001ad28
xor eax, eax
test eax, eax
je 0x18001ac85
jmp 0x18001ac7d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [0x180029f48]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [str.P_t9F]
call qword [rax + 0x1f8]
test eax, eax
jne 0x18001accd
xor eax, eax
test eax, eax
je 0x18001acc6
jmp 0x18001acbe
mov eax, 0xffffffff
jmp 0x18001ad32
mov eax, dword [0x180029f48]
mov r8d, eax
mov rdx, qword [0x180029f40]
mov rcx, qword [rsp + 0x28]
call fcn.18000c938
mov eax, dword [0x180029f48]
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [str.P_t9F]
call qword [rax + 0x1f8]
test eax, eax
jne 0x18001ad1e
xor eax, eax
test eax, eax
je 0x18001ad17
jmp 0x18001ad0f
mov eax, 0xffffffff
jmp 0x18001ad32
xor eax, eax
test eax, eax
je 0x18001ad26
jmp 0x18001ad1e
jmp 0x18001ad30
xor eax, eax
test eax, eax
je 0x18001ad30
jmp 0x18001ad28
xor eax, eax
add rsp, 0x58
ret