joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800214b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
and qword [rdx], 0
and qword [r11 + 0x20], 0
lea rax, [r11 + 0x20]
mov qword [r11 - 0x38], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlLeapSecondInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800214ff
xor eax, eax
jmp 0x1800215d8
and dword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LeapSeconds
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [rsp + 0x70], eax
mov eax, 0xaaaaaaab
mul dword [rsp + 0x68]
shr edx, 3
mov ecx, edx
mov qword [r14], rcx
xor esi, esi
mov qword [rsp + 0x30], rsi
test edi, edi
je 0x180021556
cmp edi, 0xea
jne 0x1800215be
cmp rcx, r15
jbe 0x1800215be
mov eax, 0xc
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180022bf8
mov rsi, rax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LeapSeconds
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [rsp + 0x70], eax
test eax, eax
je 0x1800215b3
and qword [r14], 0
jmp 0x1800215be
mov rcx, qword [rsp + 0x78]

Function at 0x18002a158
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x18002a18f
call fcn.180030360
mov dword [rax], 0x16
call fcn.180029540
xor eax, eax
jmp 0x18002a21d
mov rdx, r9
mov rcx, r8
call fcn.18002a0f4
mov rbx, rax
test rax, rax
je 0x18002a21a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x18002a020]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x18002a207
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800302d4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18002a1ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18002a1fd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.180037634
jmp 0x18002a21a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18002a217
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18003bf6c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18003bf82
mov al, 1
jmp 0x18003bfe2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18003bf93
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18003bfe0
mov ecx, dword [rcx + 0x18]
nop
call fcn.180045088
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18003bfe0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18003bfe0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18003bfe0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18003bfe2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x18003c30c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xd0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180066090]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov qword [rbp - 0x41], r8
movsxd r14, edx
mov rbx, rcx
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x59], rax
mov rax, r14
mov r13, r14
sar r13, 6
mov qword [rbp - 0x39], r13
lea rcx, [0x180000000]
and eax, 0x3f
lea r15, [rax + rax*8]
mov rax, qword [rcx + r13*8 + 0x69440]
mov rax, qword [rax + r15*8 + 0x28]
mov qword [rbp - 0x19], rax
mov r12d, r9d
add r12, r8
mov qword [rbp - 0x61], r12
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [rbp - 0x49], eax
xor edi, edi
mov r10, qword [rbp - 0x59]
cmp byte [r10 + 0x28], dil
jne 0x18003c3ac
mov rcx, r10
call fcn.18002cc60
mov r10, qword [rbp - 0x59]
mov rcx, qword [r10 + 0x18]
mov ecx, dword [rcx + 0xc]
mov dword [rbp - 0x45], ecx
xor eax, eax
mov qword [rbx], rax
mov dword [rbx + 8], eax
cmp qword [rbp - 0x41], r12
jae 0x18003c757
mov r9, r14
sar r9, 6
mov qword [rbp - 0x11], r9
mov edx, edi
Function at 0x18003cccc
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor edi, edi
mov r14d, r8d
movsxd r15, ecx
mov rbx, r9
mov rsi, rdx
test r8d, r8d
je 0x18003cfbf
test rdx, rdx
jne 0x18003cd33
mov byte [r9 + 0x38], 1
xor r8d, r8d
mov dword [r9 + 0x34], edi
xor edx, edx
mov byte [r9 + 0x30], 1
xor ecx, ecx
mov dword [r9 + 0x2c], 0x16
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
call fcn.180029474
mov rax, r15
lea rcx, [0x180069440]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov qword [rbp - 0x18], r12
lea r13, [rax + rax*8]
mov rcx, qword [rcx + r12*8]
mov al, byte [rcx + r13*8 + 0x39]
mov byte [rbp - 0x48], al
dec al
cmp al, 1
ja 0x18003cd6a
mov eax, r14d
not eax
test al, 1
je 0x18003ccfc
test byte [rcx + r13*8 + 0x38], 0x20
je 0x18003cd80
xor edx, edx
mov ecx, r15d
lea r8d, [rdx + 2]
call fcn.18003d2e0
mov ecx, r15d
mov qword [rbp - 0x30], rdi
call fcn.1800467fc
lea rdx, [0x180069440]
test eax, eax
je 0x18003ceaf
mov rax, qword [rdx + r12*8]
cmp byte [rax + r13*8 + 0x38], dil
jge 0x18003ceaf
cmp byte [rbx + 0x28], dil
jne 0x18003cdbf
mov rcx, rbx
call fcn.18002cc60
lea rdx, [0x180069440]
mov rax, qword [rbx + 0x18]
cmp qword [rax + 0x138], rdi
jne 0x18003cddb
mov rax, qword [rdx + r12*8]
cmp byte [rax + r13*8 + 0x39], dil
je 0x18003ceaf
mov rcx, qword [rdx + r12*8]
lea rdx, [rbp - 0x20]
mov rcx, qword [rcx + r13*8 + 0x28]
Function at 0x18003d600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180023240
sub rsp, rax
mov rax, qword [0x180066090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180039e40
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18003d64f
mov rax, rbp
jmp 0x18003d757
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x69440]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18003d23c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x69440]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18003d753
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003d753
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18003d23c
test rax, rax
js 0x18003d753
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18003d753
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18003d745
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18003d745
cmp byte [rcx], 0xd
jne 0x18003d72b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18003d73a
cmp byte [rcx + 1], 0xa
jne 0x18003d73a
inc rcx
jmp 0x18003d73a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x66650]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18003d70d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18003d757
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180022480
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003d880
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x180069440]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18003d8d7
cmp word [rdx], r13w
jne 0x18003d8d7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18003d8dc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18003da01
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18003da22
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18003d915
mov rdx, r9
mov word [rbx], cx
jmp 0x18003d93c
cmp r9, r8
jae 0x18003d94c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18003d8f6
jmp 0x18003da01
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003d9f6
cmp dword [rsp + 0x80], esi
je 0x18003d9f6
lea r8, [0x180069440]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18003d9ce
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18003d99e
mov word [rbx], r13w
jmp 0x18003d9fe
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18003d9ab
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18003d9fe
cmp word [rsp + 0x70], r13w
jne 0x18003d9db
cmp rbx, r14
je 0x18003d998
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18003d244
cmp word [rsp + 0x70], r13w
je 0x18003da01
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x180069440]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18003d9fb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18003da01
Function at 0x180041834
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180041864
xor eax, eax
jmp 0x180041927
mov rbp, rbx
cmp word [rax], si
je 0x180041889
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180041870
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18004186c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180037760
movsxd r14, eax
test eax, eax
jne 0x1800418c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18004185d
mov rcx, r14
call fcn.180037670
mov rdi, rax
test rax, rax
jne 0x1800418e0
xor ecx, ecx
call fcn.180037634
jmp 0x1800418bc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180037760
test eax, eax
jne 0x180041911
mov rcx, rdi
call fcn.180037634
jmp 0x18004191b
xor ecx, ecx
call fcn.180037634
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180041944
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1800419cb
mov rsi, rbx
cmp word [rax], bp
je 0x18004198a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x180041974
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x180041970
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.180037670
mov rdi, rax
test rax, rax
je 0x1800419b8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.180024c20
mov rbp, rdi
xor ecx, ecx
call fcn.180037634
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18004459c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18003583c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]

Function at 0x180049a84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18003d244
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18003d244
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180049bd4
cmp rax, 0xffffffffffffffff
je 0x180049bd4
xor edi, edi
test rbp, rbp
jle 0x180049b7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180038800
mov rbx, rax
test rax, rax
jne 0x180049b0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180049b75
mov edx, 0x8000
mov ecx, r14d
call fcn.180049908
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18003cccc
cmp eax, 0xffffffff
je 0x180049b55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180049b1c
mov edx, r15d
mov ecx, r14d
call fcn.180049908
jmp 0x180049b75
cmp byte [rsi + 0x38], dil
je 0x180049b6c
cmp dword [rsi + 0x34], 5
jne 0x180049b6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180049b75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180037634
jmp 0x180049be8
jns 0x180049be8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18003d244
cmp rax, 0xffffffffffffffff
jne 0x180049ba0
cmp byte [rsi + 0x30], dil
je 0x180049be8
mov edi, dword [rsi + 0x2c]
jmp 0x180049be8
mov ecx, r14d
call fcn.180045088
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180049be8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180049be8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180049be1
mov eax, dword [rsi + 0x2c]
jmp 0x180049be6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18003d244
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18004a1f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18004a218
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18004a218
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180077d36
Capabilities:
Packed with generic packer

Disassembly:
lea rsi, [rsi + 0x68ca6810]
and r9w, 0x2510
push r9
or r9, qword [rsp + 0x30]
jo 0x18068df2c
jns 0x1800818c2
cmovns r11w, r9w
cmovs r13w, r9w
xchg qword [rsp + 0x50], rsi
mov r9, qword [rsp + 0x18]
cmp byte [rsp + 0x38], 0xca
jl 0x1800055a1
or r11d, dword [rsp + 0x3c]
js 0x1803783fc
movzx r13w, r11b
mov r13, qword [rsp + r13 - 0x5ea600ac]
shl r11, 0xcc
je 0x1802a82ca
call fcn.18078842a

Function at 0x1800789d1
Capabilities:
Encode data using base64

Disassembly:
call 0x18022d72f
imul ecx, dword [rdx - 0x33333334], 0xcccccccc
call fcn.180187f02

Function at 0x1800789e5
Capabilities:
Encode data using base64

Disassembly:
push rcx
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
movabs rcx, 0x504f2a1a40187c70
and sil, cl
not cx
xor rsi, 0x4e015dfc
jo 0x18059afcd
push r14
add qword [rsp + 0x18], 0xffffffffffe3e45b
movabs r13, 0x79c239b70e9b3518
mov rdi, rcx
push r9
sub dword [rsp + 0x28], 0x24f83e91
mov word [rsp + 0x28], 0x6937
and byte [rsp + 0x28], 3
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret
sub qword [rsp + 0x30], 0x5a6c2966
mov rdi, qword [rsp + 0x28]
or r9w, 0x4422
cmp rbx, r9
call fcn.1801f25dd
lea rbp, [rbp + riz + 0x6e060ba1]
and byte [rsp + 0x28], 0x46
mov rbp, qword [rsp + 0x30]
test word [rsp + 0x28], 0x7b74
jne 0x1802819c2

Function at 0x18007cada
Capabilities:
Encode data using base64

Disassembly:
lea r13, [r13 + r13*2 + 0x2331ec9]
mov r13, qword [rsp + r13*2 - 0x4663d72]
jno 0x1805d1ee8
jg fcn.1807651a8
js 0x18036ee00
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret

Function at 0x180080600
Capabilities:
Write file on windows

Disassembly:
jb 0x1807b85cb
sub r8, 0x37bd29a2
xchg qword [rsp + 0x20], rax
sub r8w, 0x30f4
push rdi
ja 0x1805b1be5

Function at 0x180086c73
Capabilities:
Packed with generic packer

Disassembly:
not byte [rsp + 0x38]
je 0x180578ce2
lea rcx, [rcx + 0x497f4325]
jno 0x180552788
rcl byte [rbx - 0x333328cc], cl
mov r15, qword [rsp + 8]
mov qword [rsp + 8], rcx
push r10
movabs r10, 0x6c6f41f830f648df
sub r10b, 0xf1
sete r10b
sub r10d, 0x6b8e40f0
call fcn.1802b0198

Function at 0x18017073d
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 8], 0x7f8f2a04
or edx, 0x2fe474b4
not r12
lea r15, [r12*8 + 0xb536c0a]
jns 0x18073b876
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
push rbx

Function at 0x180187e9d
Capabilities:
Packed with generic packer

Disassembly:
jno 0x1801a4eec
movabs rbx, 0x36062ce2005734ce
call fcn.180233838
Function at 0x1801930e8
Capabilities:
Packed with generic packer

Disassembly:
js 0x1803aa36b
mov r15, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
call fcn.1806f6885
jo 0x1806a37e0
jae 0x180750adf
add dword [rcx + rax], eax
add byte [rdx + riz*2], al
add byte [rax], al
push rdx
push r12
pushfq
movabs r12, 0x2a2316fc0cc8150d
bswap r12
lea r12, [r12 + r12*8 + 0x7d9054dd]
push r13
test r12, r12
jbe 0x1807acf35
call fcn.18069f103
jbe 0x1801deb98
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.18094f6c6
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rdi
push rcx
push r14
call fcn.1801e1a72
ror dword [rcx], 0x56
cmp edi, eax
enter 0x56da, 0x45
sub al, 0xa9
stosd dword [rdi], eax
stosb byte [rdi], al
invalid

Function at 0x18019f448
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + rsi - 0x75df56c1], rcx
mov rsi, qword [rsp + rdx + 0x240141ee]
lea rdx, [rdx + riz + 0x781505ba]
cmp dx, 0x75f0
je 0x18007db63
shr edx, 0x5d
and dx, dx
sub dx, 0x6d36
sub edx, 0x79c628fc
mov rdx, qword [rsp + 0x20]
call fcn.180187dab

Function at 0x1801b0d69
Capabilities:
Authenticate hmac

Disassembly:
pushfq
neg r13w
push 0x535c3de7
ja 0x18051a522
shl r13b, 0x6f
call fcn.18051a510
popfq
lea rsp, [rsp + 0x20]
call fcn.180974918

Function at 0x1801b0da3
Capabilities:
Authenticate hmac

Disassembly:
push 0xb5a57fa
push r11
pushfq
sub dword [rsp + 0x10], 0x159b6cb8
mov r11, qword [rsp + 0x10]
jg 0x18028d1ca
mov rsi, qword [rsp + 0x20]
shl word [rsp + 0x10], 0x4c
jne 0x1801b6ad3
lea rax, [rax + r9*2 - 0x4346d63b]
sub qword [rsp + r9*2 - 0x4346d634], r9
call fcn.18066e145
pop rdx
jnp 0x1801b0d3d
invalid
shl r11w, 0x58
jns 0x1805125e2
mov r9, r11
xor byte [rsp + 0x18], r11b
test word [rsp + 0x18], 0x4a5b
mov byte [rsp + 0x18], r9b
not byte [rsp + 0x18]
lea r11, [r9 + r11*2 + 0xc5a0977]
call fcn.180609fbb
add qword [rsp + 0x20], 0x7fa568af
neg r10b
call fcn.180223935
lea rsi, [rsi + 1]
not r11b
push r9
xor r11b, 0x78
xor word [rsp + 0x18], 0x1736
sub dword [rsp + 0x18], 0x4ccb0627
cmp r11d, dword [rsp + 0x1a]
mov qword [rsp + 0x28], rsi
jne 0x1801ee9fe
add eax, esi
nop
cmp byte [rsp + rbp*8], 0xd8
adc al, 0x7f
nop
invalid
Function at 0x1801b6b33
Capabilities:
Encode data using base64

Disassembly:
mov byte [rsp + 0x20], dil
je 0x180002999
mov rdi, qword [rsp + 8]
call fcn.1806b1126
invalid
lea r9, [r13 + r9*8 + 0x74d4770d]
mov r9b, r13b
mov r13, qword [rsp + 0x20]
jns 0x1806bbb3d
mov rax, qword [rsp + r8 - 0x6e6366ec]
mov rax, qword [rax]
jo fcn.18047a588
or r9d, dword [rsp + r15*8 - 0xd8015d]
mov qword [rsp + r9 - 0x6046715d], r15
test qword [rsp + r15*2 - 0x360050], r9
not byte [rsp + r9 - 0x60467145]
push r9
lea rax, [rax + r15 + 0x5d794365]
jb 0x180252b1c
cmp word [rsp + r8 - 0x6e6366fc], 0x4723
call fcn.180571cd6
mov r9, qword [rsp + 0x30]
ja 0x1805835eb
cmp r9, 0x64dc3fec
jle 0x180191597
xor r12b, r9b
or r9, 0xf145b53
jns 0x18076270a
mov bh, byte [rcx + 0x227f722c]
sub al, 0x72
jg 0x1806bbb82
and al, 0x2a
jb 0x1806bbb5c
adc dword [rbp - 0x34], edi
lea edx, [rdi + 0x725d1866]
retf 0x7167
mov bl, 0xc9
fisttp qword [rbp + 0x58c9b085]
jb 0x1806bbbfc
jo 0x1806bbb8c
inc dword [rbp - 0x5b]
movsd dword [rdi], dword [rsi]
lea esi, [rax]
cmp eax, 0x7b8ddaa0
add cl, cl
fimul dword [rbp + 0x3c9029b4]
jb 0x1806bbb8b
invalid
nop
invalid
lea r9, [r12 + r9 + 0x7173083f]
jne 0x180571d07

Function at 0x1801cdcc0
Capabilities:
Packed with generic packer

Disassembly:
test rbx, 0x38bf2133
jns 0x180700a76
pushfq
call fcn.180735e8a
push r10
mov qword [rsp + 0x58], rcx
js 0x18016bf0a
movabs r8, 0x3acf51461f534643
movabs r14, 0x233804136d522995

Function at 0x1801d04b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
movabs rdi, 0x6d9504b458c379c3
pushfq
xor edi, edi
mov rbp, qword [rsp + rdi*4 + 0x20]
jl 0x1804d83cf
shl edi, 0x46
jns 0x18080b088

Function at 0x1801d747a
Capabilities:
Encode data using xor

Disassembly:
bswap r12d
mov qword [rsp + 0x20], 0xffffffffa778d8a4
mov r12, qword [rsp + 0x18]
xor byte [rsp + 8], 9
or qword [rsp + 8], 0x49173c3f
mov qword [rsp + 8], 0x4e002952
test byte [rsp + 8], 0x6c
jo 0x1801d747d
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1808e79a2
test al, 0x19
add byte [rax + 0x35c30678], 0x9d
and eax, 0x673fe8fd
invalid

Function at 0x18020a7e6
Capabilities:
Packed with generic packer

Disassembly:
shr r8b, 0xa9
test r9d, 0x790c700f
push rcx
movabs rcx, 0x5e3915a321a23f61
lea r9, [r8*4 + 0x2f4639c5]
add qword [rsp + 8], 0xfffffffffff7db13
and r8b, 0x40
shr r11w, 0x44
and r9w, r8w
setno r11b
jae 0x1802e99a0
jno 0x18070b450
call 0x1802bf39b
cmp r8b, 0x51
call fcn.18070b7a2

Function at 0x18020a824
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov qword [rsp], 0xffffffffa0059acc
call fcn.180974918

Function at 0x18025bc25
Capabilities:
Encode data using base64

Disassembly:
ja fcn.1806bbb38
or word [rsp + 0x38], r12w
jns 0x1807120b3

Function at 0x18025d4c9
Capabilities:
Packed with generic packer

Disassembly:
jne 0x18066f68e
jle 0x1802bcdaa
call fcn.180018544
mov qword [rsp + 0x10], 0x642344e8
neg dword [rsp + 0x10]
push rbx
mov rbx, qword [rsp + 0x18]
lea rdi, [rdi + rbx - 0x5b91701f]
push r14
jno 0x1801d541a