joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rsi, rdx
mov ecx, dword [rax + rcx + 0x88]
mov edx, dword [rax + r11 + 0x8c]
xor ebx, ebx
mov dword [rsp + 0x120], edx
mov qword [rsp + 0x130], rcx
add rcx, r11
mov eax, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x1c]
mov r10d, dword [rcx + 0x20]
mov edi, dword [rcx + 0x18]
mov r8d, dword [rcx + 0x10]
add rax, r11
add rbp, r11
add r10, r11
mov qword [rsp + 0x128], rax
test esi, 0xffff0000
jne 0x1800026fc
mov edx, esi
cmp rdx, r8
jb 0x1800026f5
mov eax, dword [rcx + 0x14]
lea rcx, [r8 - 1]
add rcx, rax
cmp rdx, rcx
ja 0x1800026f5
sub rdx, r8
mov ebx, dword [rbp + rdx*4]
jmp 0x180002758
xor eax, eax
jmp 0x18000283a
mov r9d, ebx
test edi, edi
jle 0x180002762
nop word [rax + rax]
mov eax, dword [r10]
mov r8, rsi
add rax, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002733
inc rax
test ecx, ecx
jne 0x180002720
test edx, edx
je 0x180002745
inc r9d
add r10, 4
cmp r9d, edi
jl 0x180002710
jmp 0x18000275b
mov rcx, qword [rsp + 0x128]
movsxd rax, r9d
movzx ecx, word [rcx + rax*2]
mov ebx, dword [rbp + rcx*4]
add rbx, r11
mov edx, dword [rsp + 0x120]
mov ecx, dword [rsp + 0x130]
lea rax, [rcx + r11]
cmp rbx, rax
jb 0x180002837
mov eax, edx
add rax, rcx
add rax, r11
cmp rbx, rax
ja 0x180002837
xor edx, edx
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x20], 0
lea r8d, [rdx + 0x63]
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x91]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x90], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x20]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x180002837
lea rdx, [rax + 1]
lea rcx, [rsp + 0x90]
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x120], 0x6c6c642e
mov byte [rsp + 0x124], 0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002837
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.180002670
jmp 0x18000283a
mov rax, rbx
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x180002e30
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x1800061b8]
mov r14, rdx
test rbx, rbx
jne 0x180003011
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x6c64746e
mov dword [rbp - 0x25], 0x6c642e6c
mov word [rbp - 0x21], 0x6c
mov dword [rbp - 9], 0x6e55744e
mov dword [rbp - 5], 0x5670616d
mov dword [rbp - 1], 0x4f776569
mov dword [rbp + 3], 0x63655366
mov dword [rbp + 7], 0x6e6f6974
mov byte [rbp + 0xb], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x29]
mov dword [rbp + 0x67], ebx
mov rsi, rax
call fcn.180002850
mov rdi, rax
test rax, rax
je 0x180002ef5
mov r8d, dword [rbp + 0x67]
mov rdx, rsi
mov rcx, rax
call fcn.1800024c0
test eax, eax
jne 0x180002f0d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1800061b8]
test rbx, rbx
jne 0x180003011
or eax, 0xffffffff
jmp 0x18000301a
movsxd rcx, dword [rdi + 0x3c]
mov r8d, r15d
add rcx, rdi
sub r8d, esi
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
cmp r8d, dword [rax + 0xc]
jb 0x180002f5c
movzx r10d, word [rcx + 6]
mov r9d, ebx
test r10d, r10d
je 0x180002f58
mov edx, dword [rax + 0xc]
cmp r8d, edx
jb 0x180002f4c
add edx, dword [rax + 8]
cmp r8d, edx
jb 0x180003003
inc r9d
add rax, 0x28
cmp r9d, r10d
jb 0x180002f38
or r8d, 0xffffffff
mov rax, qword [r8 + rdi]
mov rcx, rdi
mov qword [rbp + 0xf], rax
mov rax, qword [r8 + rdi + 8]
mov qword [rbp + 0x17], rax
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x65696253
mov dword [rbp - 0x15], 0x2e6c6c44
mov dword [rbp - 0x11], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x77]
test rax, rax
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], rbx
cmovne r8d, ebx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r15]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp + r8 + 0x15], rax
mov qword [rbp + 0x77], rdi
call fcn.1800036c0
test eax, eax
cmovns rbx, qword [rbp + 0x67]
mov qword [0x1800061b8], rbx
test rbx, rbx
je 0x180002f05
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
jmp 0x180002efc
mov ecx, dword [rax + 0x14]
sub ecx, dword [rax + 0xc]
add r8d, ecx
jmp 0x180002f5c
mov rdx, r14
or rcx, 0xffffffffffffffff
call rbx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003040
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x1800061e8]
mov r12, r8
mov r13d, edx
mov r14, rcx
test rbx, rbx
jne 0x180003229
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x21], 0x6c64746e
mov dword [rbp - 0x1d], 0x6c642e6c
mov word [rbp - 0x19], 0x6c
mov dword [rbp - 1], 0x704f744e
mov dword [rbp + 3], 0x65536e65
mov dword [rbp + 7], 0x6f697463
mov word [rbp + 0xb], 0x6e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x21]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x21]
mov dword [rbp + 0x7f], ebx
mov rsi, rax
call fcn.180002850
mov rdi, rax
test rax, rax
je 0x180003107
mov r8d, dword [rbp + 0x7f]
mov rdx, rsi
mov rcx, rax
call fcn.1800024c0
test eax, eax
jne 0x18000311f
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1800061e8]
test rbx, rbx
jne 0x180003229
or eax, 0xffffffff
jmp 0x18000323d
movsxd rcx, dword [rdi + 0x3c]
mov r8d, r15d
add rcx, rdi
sub r8d, esi
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
cmp r8d, dword [rax + 0xc]
jb 0x180003174
movzx r10d, word [rcx + 6]
mov r9d, ebx
test r10d, r10d
je 0x180003170
nop word [rax + rax]
mov edx, dword [rax + 0xc]
cmp r8d, edx
jb 0x180003164
add edx, dword [rax + 8]
cmp r8d, edx
jb 0x18000321b
inc r9d
add rax, 0x28
cmp r9d, r10d
jb 0x180003150
or r8d, 0xffffffff
mov rax, qword [r8 + rdi]
mov rcx, rdi
mov qword [rbp + 0xf], rax
mov rax, qword [r8 + rdi + 8]
mov qword [rbp + 0x17], rax
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x65696253
mov dword [rbp - 0xd], 0x2e6c6c44
mov dword [rbp - 9], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp - 0x29]
test rax, rax
lea rdx, [rbp + 0x7f]
mov qword [rbp + 0x7f], rbx
cmovne r8d, ebx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r15]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp + r8 + 0x15], rax
mov qword [rbp - 0x29], rdi
call fcn.1800036c0
test eax, eax
cmovns rbx, qword [rbp + 0x7f]
mov qword [0x1800061e8], rbx
test rbx, rbx
je 0x180003117
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
jmp 0x18000310e
mov ecx, dword [rax + 0x14]
sub ecx, dword [rax + 0xc]
add r8d, ecx
jmp 0x180003174
test r14, r14
je 0x180003117
mov r8, r12
mov edx, r13d
mov rcx, r14
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180003260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800061d0]
mov ebx, ecx
test rax, rax
jne 0x1800032d6
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6e72656b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], al
mov dword [rbp - 0x20], 0x65736142
mov dword [rbp - 0x1c], 0x4c746553
mov dword [rbp - 0x18], 0x4e747361
mov dword [rbp - 0x14], 0x72724554
mov word [rbp - 0x10], 0x726f
mov byte [rbp - 0xe], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800061d0], rax
mov ecx, ebx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1800032f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800061b0]
mov rbx, rcx
test rax, rax
jne 0x18000336e
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
mov dword [rbp - 0x2c], 0x6c642e6c
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x20], 0x466c7452
mov dword [rbp - 0x1c], 0x6873756c
mov dword [rbp - 0x18], 0x75636553
mov dword [rbp - 0x14], 0x654d6572
mov dword [rbp - 0x10], 0x79726f6d
mov dword [rbp - 0xc], 0x68636143
mov word [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800061b0], rax
xor edx, edx
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x180003380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r14, rcx
lea rcx, [rbp - 0x50]
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov dword [rbp - 0x50], 0x6e72656b
mov dword [rbp - 0x4c], 0x61626c65
mov dword [rbp - 0x48], 0x642e6573
mov word [rbp - 0x44], 0x6c6c
mov byte [rbp - 0x42], 0
mov dword [rbp - 0x28], 0x65736142
mov dword [rbp - 0x24], 0x6d726f46
mov dword [rbp - 0x20], 0x624f7461
mov dword [rbp - 0x1c], 0x7463656a
mov dword [rbp - 0x18], 0x72747441
mov dword [rbp - 0x14], 0x74756269
mov word [rbp - 0x10], 0x7365
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800061c8], rax
test rax, rax
jne 0x18000347f
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x40], 0x6e65704f
mov dword [rbp - 0x3c], 0x656c6946
mov dword [rbp - 0x38], 0x7070614d
mov dword [rbp - 0x34], 0x57676e69
mov byte [rbp - 0x30], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov rdx, rax
mov eax, r8d
mov ecx, r8d
cmp byte [rcx + rdx], 0xff
jne 0x18000346d
cmp byte [rcx + rdx + 1], 0x15
je 0x1800034a7
inc rcx
inc eax
cmp rcx, 0x70
jl 0x180003460
mov rax, qword [0x1800061c8]
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
cdqe
add rdx, rax
mov rax, r8
nop
cmp byte [rax + rdx], 0xe8
je 0x1800034c4
inc rax
inc r8d
cmp rax, 0x70
jl 0x1800034b0
jmp 0x180003478
movsxd rax, r8d
movsxd rcx, dword [rax + rdx + 1]
add rcx, rax
lea rax, [rdx + 5]
add rax, rcx
mov qword [0x1800061c8], rax
jmp 0x18000347f
Function at 0x1800035a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, rdx
mov r8, rcx
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor ecx, ecx
xor edx, edx
mov qword [rbp + 0x77], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x1800061e0]
test rax, rax
jne 0x18000363f
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x6c64746e
mov dword [rbp - 0x15], 0x6c642e6c
mov word [rbp - 0x11], 0x6c
mov dword [rbp + 7], 0x496c7452
mov dword [rbp + 0xb], 0x5574696e
mov dword [rbp + 0xf], 0x6f63696e
mov dword [rbp + 0x13], 0x74536564
mov dword [rbp + 0x17], 0x676e6972
mov byte [rbp + 0x1b], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800061e0], rax
lea rcx, [rbp - 9]
mov rdx, rbx
call rax
mov rax, qword [0x1800061c8]
xor edx, edx
lea r9, [rbp + 0x77]
lea r8, [rbp - 9]
lea rcx, [rbp + 0x1f]
test rax, rax
jne 0x180003669
call fcn.180003380
jmp 0x18000366b
call rax
test eax, eax
jns 0x180003689
mov ecx, eax
call fcn.180003260
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
mov r8, qword [rbp + 0x77]
lea rcx, [rbp + 0x7f]
mov edx, 0xf001f
call fcn.180003040
test eax, eax
js 0x18000366f
mov rax, qword [rbp + 0x7f]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x1800036c0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x90
mov rbx, qword [0x1800060a8]
mov r14, r9
mov r15, rdx
test rbx, rbx
jne 0x1800037b5
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
lea rcx, [rbp - 0x29]
mov qword [rax + 0x18], r12
mov dword [rbp - 9], 0x6c41775a
mov dword [rbp - 5], 0x61636f6c
mov dword [rbp - 1], 0x69566574
mov dword [rbp + 3], 0x61757472
mov dword [rbp + 7], 0x6d654d6c
mov dword [rbp + 0xb], 0x79726f
mov dword [rbp - 0x29], 0x6c64746e
mov dword [rbp - 0x25], 0x6c642e6c
mov word [rbp - 0x21], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x29]
xor r12d, r12d
mov rdi, rax
mov dword [rbp + 0x77], r12d
call fcn.180002850
mov rbx, rax
test rax, rax
je 0x180003796
mov r8d, dword [rbp + 0x77]
mov rdx, rdi
mov rcx, rax
call fcn.1800024c0
test eax, eax
jne 0x1800037e9
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1800060a8]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xc0]
mov r9, r14
xor r8d, r8d
mov rdx, r15
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
call rbx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rbp
ret
movsxd rcx, dword [rbx + 0x3c]
lea rdx, [rbx + 0x18]
mov r8d, esi
movzx eax, word [rcx + rbx + 0x14]
add rdx, rcx
sub r8d, edi
add rdx, rax
cmp r8d, dword [rdx + 0xc]
jb 0x18000383a
movzx r10d, word [rcx + rbx + 6]
mov r9d, r12d
test r10d, r10d
je 0x180003836
mov ecx, dword [rdx + 0xc]
cmp r8d, ecx
jb 0x18000382a
add ecx, dword [rdx + 8]
cmp r8d, ecx
jb 0x1800038d1
inc r9d
add rdx, 0x28
cmp r9d, r10d
jb 0x180003816
or r8d, 0xffffffff
mov rax, qword [r8 + rbx]
mov rcx, rbx
mov qword [rbp + 0xf], rax
mov rax, qword [r8 + rbx + 8]
mov qword [rbp + 0x17], rax
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x65696253
mov dword [rbp - 0x15], 0x2e6c6c44
mov dword [rbp - 0x11], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
test rax, rax
cmovne r8d, r12d
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + rsi]
mov dword [rbp + r8 + 0x11], r12d
mov qword [rbp + r8 + 0x15], rax
lea eax, [r8 + 0xe]
mov edx, eax
mov edi, eax
call fcn.1800038e0
mov rbx, rax
mov qword [0x1800060a8], rax
test rax, rax
je 0x18000379d
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x18000379d
mov eax, dword [rdx + 0x14]
sub eax, dword [rdx + 0xc]
add r8d, eax
jmp 0x18000383a
Function at 0x1800038e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800061c0]
xor ebx, ebx
mov qword [rbp - 0x30], rdx
mov qword [rbp + 0x10], rbx
test rax, rax
jne 0x180003964
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x18], 0x6c41775a
mov dword [rbp - 0x14], 0x61636f6c
mov dword [rbp - 0x10], 0x69566574
mov dword [rbp - 0xc], 0x61757472
mov dword [rbp - 8], 0x6d654d6c
mov dword [rbp - 4], 0x79726f
mov dword [rbp - 0x28], 0x6c64746e
mov dword [rbp - 0x24], 0x6c642e6c
mov word [rbp - 0x20], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800061c0], rax
lea r9, [rbp - 0x30]
lea rdx, [rbp + 0x10]
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
call rax
test eax, eax
cmovns rbx, qword [rbp + 0x10]
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x180004340
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rdi, rdx
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180004384
mov rdx, rcx
lea rcx, [rsp + 0x44]
mov r8d, eax
mov dword [rsp + 0x40], eax
call sub.msvcrt.dll_memcpy
mov r14d, dword [rsp + 0x40]
xor ebx, ebx
lea esi, [rbx + 0x78]
cmp r14d, 0x38
ja 0x1800043b6
mov esi, 0x38
lea rcx, [rbp - 0x28]
xor edx, edx
mov r8d, 0xf8
sub esi, r14d
mov qword [rbp - 0x30], 0x80
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x44]
lea rdx, [rbp - 0x30]
mov r8d, esi
add rcx, r14
call sub.msvcrt.dll_memcpy
mov edx, dword [rsp + 0x40]
mov ecx, ebx
lea eax, [rdx*8]
mov r8d, 1
cmp eax, edx
mov dword [rbp + 0xf8], eax
cmovb ecx, r8d
mov dword [rbp + 0xfc], ecx
mov rax, qword [rbp + 0xf8]
lea ecx, [rsi + r14]
mov qword [rsp + rcx + 0x44], rax
lea rcx, [rsp + 0x30]
call fcn.180003a00
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x2c], eax
movzx r9d, byte [rsp + rbx + 0x20]
lea r8, [rbp + 0xf8]
mov edx, 0x100
mov rcx, rdi
mov dword [rbp + 0xf8], 0x78323025
mov byte [rbp + 0xfc], 0
call qword [sym.imp.msvcrt.dll_sprintf_s]
inc rbx
add rdi, 2
cmp rbx, 0x10
jl 0x180004451
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800044b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
movsxd rax, dword [rcx + 0x3c]
mov rdi, rcx
mov r11, rdx
mov ecx, dword [rax + rcx + 0x88]
mov eax, dword [rax + rdi + 0x8c]
mov qword [rsp + 0x128], rcx
add rcx, rdi
mov dword [rsp + 0x120], eax
mov esi, dword [rcx + 0x1c]
mov r10d, dword [rcx + 0x20]
mov ebp, dword [rcx + 0x24]
mov ebx, dword [rcx + 0x18]
mov edx, dword [rcx + 0x10]
add rsi, rdi
add r10, rdi
add rbp, rdi
test r11, 0xffffffffffff0000
jne 0x18000452b
cmp r11, rdx
jb 0x180004573
mov eax, dword [rcx + 0x14]
lea rcx, [rdx - 1]
add rcx, rax
cmp r11, rcx
ja 0x180004573
sub r11, rdx
mov eax, dword [rsi + r11*4]
add rax, rdi
jmp 0x180004575
xor r9d, r9d
test ebx, ebx
jle 0x180004573
nop word [rax + rax]
mov eax, dword [r10]
mov r8, r11
add rax, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180004563
inc rax
test ecx, ecx
jne 0x180004550
test edx, edx
je 0x180004588
inc r9d
add r10, 4
cmp r9d, ebx
jl 0x180004540
xor eax, eax
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
movsxd rax, r9d
movzx ecx, word [rbp + rax*2]
mov ebx, dword [rsi + rcx*4]
mov ecx, dword [rsp + 0x128]
lea rax, [rcx + rdi]
add rbx, rdi
cmp rbx, rax
jb 0x180004673
mov eax, dword [rsp + 0x120]
add rax, rcx
add rax, rdi
cmp rbx, rax
ja 0x180004673
xor edx, edx
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x20], 0
lea r8d, [rdx + 0x63]
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x91]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x90], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x20]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x180004673
lea rdx, [rax + 1]
lea rcx, [rsp + 0x90]
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x120], 0x6c6c642e
mov byte [rsp + 0x124], 0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180004673
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.1800044b0
jmp 0x180004575
mov rax, rbx
jmp 0x180004575
Function at 0x1800049d0
Capabilities:
Enumerate pe sections

Disassembly:
push r14
push r15
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
mov r15, rdx
mov r14, rcx
cmp dword [rdx + 0x94], esi
jbe 0x180004ad3
mov ebx, dword [rdx + 0x90]
lea edx, [rsi + 0x14]
add rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x180004abb
lea rdi, [rbx + 0xc]
movabs rbp, 0x8000000000000000
nop dword [rax + rax]
mov eax, dword [rdi]
test eax, eax
je 0x180004abb
lea rcx, [r14 + rax]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], sil
jne 0x180004a42
xor edx, edx
call sub.msvcrt.dll_memset
mov eax, dword [rdi - 0xc]
test eax, eax
je 0x180004a5f
lea rbx, [r14 + rax]
jmp 0x180004a65
mov ebx, dword [rdi + 4]
add rbx, r14
cmp qword [rbx], rsi
je 0x180004aa0
nop word [rax + rax]
mov rax, qword [rbx]
mov qword [rbx], rsi
test rbp, rax
jne 0x180004a97
lea rcx, [rax + r14]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8 + 2], sil
jne 0x180004a83
inc r8
xor edx, edx
call sub.msvcrt.dll_memset
add rbx, 8
cmp qword [rbx], rsi
jne 0x180004a70
add rdi, 0x14
mov edx, 0x14
lea rcx, [rdi - 0xc]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x180004a30
mov ecx, dword [r15 + 0x90]
mov r8d, dword [r15 + 0x94]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
cmp dword [r15 + 0x8c], esi
jbe 0x180004b5f
mov edi, dword [r15 + 0x88]
add rdi, r14
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x180004b2b
mov ebx, dword [rdi + 0x20]
mov ebp, esi
add rbx, r14
test eax, eax
je 0x180004b2b
nop dword [rax]
mov ecx, dword [rbx]
add rcx, r14
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], sil
jne 0x180004b10
xor edx, edx
call sub.msvcrt.dll_memset
inc ebp
add rbx, 4
cmp ebp, dword [rdi + 0x18]
jb 0x180004b00
mov eax, dword [rdi + 0x14]
test eax, eax
je 0x180004b47
mov ecx, dword [rdi + 0x1c]
lea r8d, [rax*8]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
mov ecx, dword [r15 + 0x88]
mov r8d, dword [r15 + 0x8c]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
mov eax, dword [r15 + 0xb4]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x180004b8d
mov ecx, dword [r15 + 0xb0]
mov r8d, eax
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
movzx eax, word [r15 + 0x14]
movzx r10d, word [r15 + 6]
lea r9, [r15 + 0x18]
add r9, rax
test r10d, r10d
je 0x180004c06
nop word [rax + rax]
lea rax, [rsp + 0x20]
mov r8, r9
mov dword [rsp + 0x20], 0x6c65722e
mov word [rsp + 0x24], 0x636f
mov byte [rsp + 0x26], 0
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180004be3
inc rax
test ecx, ecx
jne 0x180004bd0
test edx, edx
je 0x180004bf4
inc esi
add r9, 0x28
cmp esi, r10d
jb 0x180004bb0
jmp 0x180004c06
mov ecx, dword [r9 + 0xc]
mov r8d, dword [r9 + 0x10]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
mov eax, dword [r15 + 0x9c]
mov rsi, qword [rsp + 0x70]
test eax, eax
je 0x180004c2a
mov ecx, dword [r15 + 0x98]
mov r8d, eax
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
add rsp, 0x48
pop r15
pop r14
ret