joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f36c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r10, qword [0x18002a250]
xor r8d, r8d
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x40]
lea edx, [r8 + 8]
mov r9d, edx
mov rax, r8
inc r8
and eax, 7
mov al, byte [rax + r10 + 0x1880]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x18000f38e
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.180014404
add rsp, 0x28
ret

Function at 0x180010214
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
xor r13d, r13d
mov r12, rcx
mov dword [rax + 0x10], r13d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x278]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rsp + 0x278]
mov ebp, r13d
mov r14, rax
test edx, edx
jle 0x180010358
lea r15, [rsp + 0x20]
mov rsi, qword [r14]
cmp word [rsi], 0x2f
ja 0x180010287
movzx eax, word [rsi]
movabs rcx, 0xa00000002401
bt rcx, rax
jb 0x1800102c3
cmp ebx, 0x20
jae 0x1800102c3
mov rcx, rsi
mov qword [r15], rsi
mov rdi, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x1800102b6
cmp word [rsi + rdi*2], 0x2c
jne 0x1800102ae
mov word [rsi + rdi*2], r13w
inc rdi
cmp rdi, rcx
jl 0x1800102a2
mov edx, dword [rsp + 0x278]
inc ebx
add r15, 8
inc ebp
add r14, 8
cmp ebp, edx
jl 0x18001026b
cmp ebx, 1
jne 0x1800102d9
mov rbx, qword [rsp + 0x20]
jmp 0x1800102e0
jle 0x180010358
mov rbx, qword [rsp + 0x28]
cmp word [rbx], 0x5c
je 0x180010343
cmp word [rbx + 2], 0x3a
je 0x180010343
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
lea rdx, [0x180024194]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.18000d5c0
mov r8d, 0x104
mov qword [rsp + 0x280], rax
mov rdx, rax
mov rcx, r12
call fcn.180010d00
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x280]
call fcn.18000c798
jmp 0x180010354
mov r8d, 0x104
mov rdx, rbx
mov rcx, r12
call fcn.180010d00
xor eax, eax
jmp 0x18001035b
or eax, 0xffffffff
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001279c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov qword [rsp + 0x70], rdi
xor edx, edx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rsp + 0x70]
xor edx, edx
lea r9, [0x180023db0]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
lea rcx, [0x180023dc0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800128b7
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rax
mov r10, qword [rcx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [r10 + SafeArrayPutElement]
test eax, eax
js 0x1800128b7
mov rcx, qword [rsp + 0x68]
lea edx, [rdi + 0xa]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1800128b7
mov rcx, qword [0x18002ad68]
test rcx, rcx
je 0x1800128b7
lea edx, [rdi + 8]
lea r8d, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1800128b7
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
jmp 0x1800128d9
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800128c7
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800128d7
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180014404
Capabilities:
Encode data using xor

Disassembly:
not r8d
test edx, edx
jne 0x18001440e
xor eax, eax
ret
mov r9d, edx
lea rdx, [0x180024290]
movzx eax, byte [rcx]
inc rcx
xor r8d, eax
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
sub r9, 1
jne 0x180014418
not r8d
mov eax, r8d
ret
Function at 0x180016594
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, edx
mov eax, 0xaaaaaaab
mul edx
mov rbp, rcx
mov rcx, qword [0x18002ad68]
shr edx, 1
lea edi, [rdx*4 + 5]
test rcx, rcx
je 0x1800166df
lea r8d, [rdi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, rax
test rax, rax
je 0x1800166df
xor r11d, r11d
xor edx, edx
test ebx, ebx
je 0x1800166d1
lea esi, [rdi - 4]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp edx, esi
jae 0x1800166d1
xor r10d, r10d
xor r8d, r8d
mov cl, byte [r11 + rbp]
mov byte [rsp + r8 + 0x48], cl
cmp r11d, ebx
jae 0x18001661e
inc r10d
jmp 0x180016624
mov byte [rsp + r8 + 0x48], 0
inc r11d
inc r8
cmp r8, 3
jl 0x18001660b
test r10d, r10d
je 0x1800166c8
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rsp + 0x48]
and ecx, 3
movzx r8d, byte [rsp + 0x49]
shr rax, 2
shl ecx, 4
mov al, byte [rax + r14]
mov byte [rsp + 0x50], al
mov eax, r8d
shr rax, 4
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x51], al
cmp r10d, 1
jle 0x1800166a6
movzx eax, byte [rsp + 0x4a]
and r8d, 0xf
shr rax, 6
shl r8d, 2
mov ecx, r8d
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x52], al
cmp r10d, 2
jle 0x1800166ab
movzx eax, byte [rsp + 0x4a]
and eax, 0x3f
mov cl, byte [rax + r14]
jmp 0x1800166ad
mov byte [rsp + 0x52], 0x3d
mov cl, 0x3d
mov byte [rsp + 0x53], cl
xor r8d, r8d
mov al, byte [rsp + r8 + 0x50]
inc r8
mov byte [rdx + r9], al
inc edx
cmp r8, 4
jl 0x1800166b4
cmp r11d, ebx
jb 0x1800165fd
cmp edx, edi
jae 0x1800166da
mov byte [rdx + r9], 0
mov rax, r9
jmp 0x1800166e1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180016f58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
movsxd rsi, edx
mov rdi, rcx
lea rax, str.advocate
xor r9d, r9d
inc rax
inc r9d
cmp byte [rax], 0
jne 0x180016f7a
mov eax, SafeArrayGetDim
mov byte [rsp + 0x2f], 0
cmp r9d, eax
cmova r9d, eax
xor ecx, ecx
test r9d, r9d
je 0x180016fb1
lea rdx, [rsp + 0x20]
lea eax, [rcx + 0x56]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, r9d
jb 0x180016fa2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9b, byte [rbx + 0x100]
mov r11, rsi
mov r10b, byte [rbx + 0x101]
test esi, esi
jle 0x180017002
inc r9b
movzx r8d, r9b
mov dl, byte [r8 + rbx]
add r10b, dl
movzx ecx, r10b
mov al, byte [rcx + rbx]
mov byte [r8 + rbx], al
mov byte [rcx + rbx], dl
add dl, byte [r8 + rbx]
movzx eax, dl
mov cl, byte [rax + rbx]
xor byte [rdi], cl
inc rdi
sub r11, 1
jne 0x180016fd1
mov rsi, qword [rsp + 0x48]
mov byte [rbx + 0x100], r9b
mov byte [rbx + 0x101], r10b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180017134
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
lea r9, [rsp]
add rcx, 0x1d
mov r10d, reloc.OLEAUT32.dll_SafeArrayGetDim
sub r9, r8
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
lea rcx, [rcx + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r9 + rcx - 0x21], edx
sub r10, 1
jne 0x180017167
lea rcx, [rsp + 8]
lea edx, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
ror eax, 0x1f
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x18001719d
mov r15d, dword [r8]
lea esi, [rdx + 0x14]
mov r12d, dword [r8 + 4]
mov r14d, r15d
mov r13d, dword [r8 + 8]
mov r10d, r12d
mov ebx, dword [r8 + 0xc]
mov r9d, r13d
mov edi, dword [r8 + 0x10]
xor ebp, ebp
mov eax, r9d
lea r11d, [rdi + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, r14d
and ecx, ebx
ror edx, 0x1b
or ecx, eax
mov edi, ebx
mov ebx, r9d
add edx, ecx
add edx, dword [rsp + rbp*4]
mov r9d, r10d
shr r10d, 2
add r11d, edx
shl r9d, 0x1e
inc rbp
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rsi
jl 0x1800171d9
mov ebp, 0x28
ror r11d, 0x1b
add edi, 0x6ed9eba1
add r11d, dword [rsp + rsi*4]
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add r11d, ecx
mov r9d, r10d
inc rsi
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rsi, rbp
jl 0x180017223
mov edx, 0x3c
mov ecx, r9d
ror r11d, 0x1b
or ecx, r10d
mov eax, r9d
and ecx, ebx
and eax, r10d
add edi, 0x8f1bbcdc
or ecx, eax
add ecx, dword [rsp + rbp*4]
add r11d, edi
add r11d, ecx
mov edi, ebx
mov ebx, r9d
inc rbp
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rdx
jl 0x180017265
mov eax, dword [rsp + rdx*4]
add edi, 0xca62c1d6
ror r11d, 0x1b
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add eax, ecx
mov r9d, r10d
add r11d, eax
shr r10d, 2
inc rdx
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rdx, 0x50
jl 0x1800172a9
add dword [r8 + 0xc], ebx
lea eax, [r15 + r11]
add dword [r8 + 0x10], edi
lea r11, [rsp + 0x140]
and dword [r8 + 0x5c], 0
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r8], eax
lea eax, [r12 + r10]
mov dword [r8 + 4], eax
lea eax, [r9 + r13]
mov dword [r8 + 8], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180017330
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x29], 0x67452301
mov r14, r8
mov qword [rbp - 0x15], rbx
mov rsi, rcx
mov qword [rbp + 0x33], rbx
mov edx, ebx
mov dword [rbp - 0x25], 0xefcdab89
lea edi, [rbx + 0xe]
mov dword [rbp - 0x21], 0x98badcfe
lea r15d, [rbx + 1]
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov eax, ebx
mov dword [rbp + 0x3b], ebx
dec edi
test eax, eax
jne 0x180017498
mov al, byte [rsi]
movsxd rcx, edx
mov byte [rbp + rcx - 0xd], al
mov edx, dword [rbp + 0x33]
mov eax, dword [rbp + 0x3b]
inc edx
add dword [rbp - 0x15], 8
mov dword [rbp + 0x33], edx
jne 0x1800173bf
add dword [rbp - 0x11], r15d
cmove eax, r15d
mov dword [rbp + 0x3b], eax
cmp edx, 0x40
jne 0x1800173d3
lea rcx, [rbp - 0x29]
call fcn.180017134
mov eax, dword [rbp + 0x3b]
mov edx, dword [rbp + 0x33]
add rsi, r15
test edi, edi
jne 0x180017390
test eax, eax
jne 0x180017498
cmp dword [rbp + 0x37], ebx
jne 0x180017498
movsxd rax, edx
mov byte [rbp + rax - 0xd], 0x80
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp edx, 0x37
jle 0x18001744a
jmp 0x180017412
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x40
jl 0x180017403
lea rcx, [rbp - 0x29]
call fcn.180017134
mov eax, dword [rbp + 0x33]
jmp 0x180017434
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x180017425
jmp 0x18001744f
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x18001743b
mov ecx, dword [rbp - 0x11]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2b], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x2d], al
mov byte [rbp + 0x2e], cl
mov ecx, dword [rbp - 0x15]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2f], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x32], cl
lea rcx, [rbp - 0x29]
mov byte [rbp + 0x31], al
call fcn.180017134
mov dword [rbp + 0x37], r15d
lea r8, [rbp - 0x27]
mov al, byte [r8 + 1]
lea edx, [rbx*4]
lea ecx, [rdx + 1]
mov byte [rdx + r14], al
mov al, byte [r8]
add ebx, r15d
mov byte [rcx + r14], al
lea ecx, [rdx + 2]
mov al, byte [r8 - 1]
lea r8, [r8 + 4]
mov byte [rcx + r14], al
lea ecx, [rdx + 3]
mov al, byte [r8 - 6]
mov byte [rcx + r14], al
cmp ebx, 5
jb 0x18001749c
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800199c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea r9d, [r8 - 0x21524111]
mov r10, rdx
add r9d, edx
mov rbx, rcx
mov r11d, r9d
mov edi, r9d
cmp rdx, 0xc
jbe 0x180019ada
lea r8, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add r10, rax
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
movzx r8d, byte [rbx + 4]
movzx edx, byte [rbx + 8]
add r8d, r11d
shl ecx, 8
add edx, r9d
add ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
add r8d, ecx
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [rbx + 3]
shl ecx, 8
mov r9d, edx
add ecx, eax
ror r9d, 0x1c
movzx eax, byte [rbx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
add rbx, 0xc
add ecx, eax
sub ecx, edx
add edx, r8d
add ecx, edi
xor r9d, ecx
sub r8d, r9d
mov eax, r9d
add r9d, edx
ror eax, 0x1a
xor eax, r8d
sub edx, eax
mov ecx, eax
add eax, r9d
ror ecx, 0x18
xor ecx, edx
sub r9d, ecx
mov edi, ecx
add ecx, eax
ror edi, 0x10
xor edi, r9d
sub eax, edi
mov r11d, edi
ror r11d, 0xd
add edi, ecx
xor r11d, eax
sub ecx, r11d
mov r9d, r11d
ror r9d, 0x1c
add r11d, edi
xor r9d, ecx
sub rsi, 1
jne 0x180019a11
cmp r10, 6
ja 0x180019b1e
je 0x180019b7b
test r10, r10
je 0x180019c00
sub r10, 1
je 0x180019ba7
sub r10, 1
je 0x180019b9e
sub r10, 1
je 0x180019b95
sub r10, 1
je 0x180019b8c
cmp r10, 1
je 0x180019b85
jmp 0x180019bac
sub r10, 7
je 0x180019b71
sub r10, 1
je 0x180019b67
sub r10, 1
je 0x180019b60
sub r10, 1
je 0x180019b56
sub r10, 1
je 0x180019b4c
cmp r10, 1
jne 0x180019bac
movzx eax, byte [rbx + 0xb]
shl eax, 0x18
add r9d, eax
movzx eax, byte [rbx + 0xa]
shl eax, 0x10
add r9d, eax
movzx eax, byte [rbx + 9]
shl eax, 8
add r9d, eax
movzx eax, byte [rbx + 8]
add r9d, eax
movzx eax, byte [rbx + 7]
shl eax, 0x18
add r11d, eax
movzx eax, byte [rbx + 6]
shl eax, 0x10
add r11d, eax
movzx eax, byte [rbx + 5]
shl eax, 8
add r11d, eax
movzx eax, byte [rbx + 4]
add r11d, eax
movzx eax, byte [rbx + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [rbx + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [rbx + 1]
shl eax, 8
add edi, eax
movzx eax, byte [rbx]
add edi, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x12
sub r9d, eax
mov eax, r9d
mov edx, r9d
ror eax, 0x15
xor edx, edi
sub edx, eax
xor r11d, edx
mov eax, edx
ror eax, 7
sub r11d, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x10
sub r9d, eax
mov eax, r9d
mov ecx, r9d
ror eax, 0x1c
xor ecx, edx
sub ecx, eax
xor r11d, ecx
mov eax, ecx
ror eax, 0x12
sub r11d, eax
mov eax, r11d
xor r9d, r11d
ror eax, 8
sub r9d, eax
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x18001af78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
je 0x18001af89
jmp 0x18001af81
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0xc], 0
je 0x18001aff7
xor eax, eax
test eax, eax
je 0x18001afe7
jmp 0x18001afdf
mov rax, qword [rsp + 0x30]
add rax, 0x14
mov qword [rsp + 0x30], rax
jmp 0x18001afd4
xor eax, eax
test eax, eax
je 0x18001afff
jmp 0x18001aff7
mov eax, dword [0x18002a1d8]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [0x18002a1d0]
call fcn.18000ca18
test eax, eax
je 0x18001b0cc
xor eax, eax
test eax, eax
je 0x18001b029
jmp 0x18001b021
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [0x18002a1d8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x18002a1e8]
call qword [rax + 0x1f8]
test eax, eax
jne 0x18001b071
xor eax, eax
test eax, eax
je 0x18001b06a
jmp 0x18001b062
mov eax, 0xffffffff
jmp 0x18001b0d6
mov eax, dword [0x18002a1d8]
mov r8d, eax
mov rdx, qword [0x18002a1d0]
mov rcx, qword [rsp + 0x28]
call fcn.18000c910
mov eax, dword [0x18002a1d8]
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x18002a1e8]
call qword [rax + 0x1f8]
test eax, eax
jne 0x18001b0c2
xor eax, eax
test eax, eax
je 0x18001b0bb
jmp 0x18001b0b3
mov eax, 0xffffffff
jmp 0x18001b0d6
xor eax, eax
test eax, eax
je 0x18001b0ca
jmp 0x18001b0c2
jmp 0x18001b0d4
xor eax, eax
test eax, eax
je 0x18001b0d4
jmp 0x18001b0cc
xor eax, eax
add rsp, 0x58
ret
Function at 0x18001bc10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [rdx], ecx
mov dword [rdx + 0x9c0], r8d
movsxd rcx, r8d
mov eax, dword [rdx + rcx*4 - 4]
shr eax, 0x1e
xor eax, dword [rdx + rcx*4 - 4]
imul eax, eax, 0x6c078965
add eax, r8d
mov dword [rdx + rcx*4], eax
mov r8d, dword [rdx + 0x9c0]
inc r8d
mov dword [rdx + 0x9c0], r8d
cmp r8d, 0x270
jl 0x18001bc1f
ret

Function at 0x18001bc54
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, dword [rcx + 0x9c0]
mov r8, rcx
cmp r9d, 0x270
jl 0x18001bd1a
xor r9d, r9d
lea rbx, [0x180027040]
mov r10d, r9d
mov r11d, 0x7fffffff
mov edx, 0xe3
mov ecx, dword [r8 + r10*4]
xor ecx, dword [r8 + r10*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + r10*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + r10*4 + 0x634]
mov dword [r8 + r10*4], ecx
inc r10
cmp r10, rdx
jl 0x18001bc88
mov ecx, dword [r8 + rdx*4]
xor ecx, dword [r8 + rdx*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + rdx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + rdx*4 - 0x38c]
mov dword [r8 + rdx*4], ecx
inc rdx
cmp rdx, 0x26f
jl 0x18001bcb6
mov eax, dword [r8 + 0x9bc]
mov edx, eax
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
mov ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + 0x630]
xor ecx, edx
mov dword [r8 + 0x9bc], ecx
mov dword [r8 + 0x9c0], r9d
mov rbx, qword [rsp + 8]
movsxd rax, r9d
mov ecx, dword [r8 + rax*4]
lea eax, [r9 + 1]
mov dword [r8 + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x18001ed20
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x180021cc0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x140005078
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14013b000
add rsp, 0x28
jmp 0x140005078
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000a5f8], rbx
je 0x1400050c2
cmp rax, rbx
jne 0x1400050d7
mov edi, 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x1400050e4
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140005151
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400050ab
mov eax, dword [0x14000a600]
test eax, eax
jne 0x140005147
mov dword [0x14000a600], 1
lea r14, [0x1400063e0]
lea rbx, [0x1400063c8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140005139
test eax, eax
jne 0x14000513d
cmp qword [rbx], 0
je 0x14000512e
mov rax, qword [rbx]
mov rcx, qword [0x1400063a8]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000510f
test eax, eax
je 0x140005151
mov eax, 0xff
jmp 0x1400052a4
mov dword [0x140009fc4], 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x140005179
lea rdx, [0x1400063c0]
lea rcx, [0x1400063b0]
call sub.msvcrt.dll__initterm
mov dword [0x14000a600], 2
test edi, edi
jne 0x140005186
xor eax, eax
xchg qword [0x14000a5f8], rax
cmp qword [0x14000a608], 0
je 0x1400051ba
lea rcx, [0x14000a608]
call fcn.1400055a0
test eax, eax
je 0x1400051ba
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000a608]
mov r9, qword [0x1400063a8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140005246
test cl, cl
je 0x1400051dd
test edi, edi
jne 0x140005246
dec cl
cmp cl, 0x1f
ja 0x1400051f0
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400051dd
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004c84
mov dword [0x140009fc0], eax
cmp dword [0x140009fe0], 0
jne 0x14000522f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140009fc4], 0
jne 0x140005244
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140009fc0]
jmp 0x1400052a4
cmp cl, 0x22
jne 0x140005258
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14000526a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400051cd
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14106d9e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14106d9ee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14106da17
pop rbp
sub rbp, 0x33
sub rbp, 0x106d9e4
sub rsp, 0x20
jmp 0x14106da36
mov rax, 0x106d9e4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
call 0xc5c75b8c
add byte [rax], al
add byte [rax - 0x39], cl
ror dword [rbx], 6
add byte [rax], al
mov rdx, 0x5baae520
xor byte [rax], dl
inc rax
dec rcx
jne 0x14106da55
jmp 0x14106da6c
push 0xffffffffa9abc9a9
sbb al, 0x20
and byte [rax], ah
push 0x2128e1a1
and byte [rax], ah
push 0xffffffffe768c921
loopne 0x14106daae
and byte [rax], ah
and byte [rax - 0x19], ch
loop 0x14106da92
and byte [rax], ah
and byte [rax - 0x29], ch
ret 0x2168
loope 0x14106da3f
movabs eax, dword [0x70c821682020202c]
jo 0x14106db07
cwde
mov byte [rbp + 9], al
and byte [rax], ah
and byte [rax], ah
and byte [rax - 0x67], ch
sbb edx, dword [rbp + rdi*8 + 0x20]
and byte [rax], ah
and byte [rax], ah
push 0xffffffff9a68c921
invalid
and byte [rax], ah
and byte [rdx + 0x77], bh
push 0x1168f7a9
jmp 0xe4f8ec7e