joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453c6f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005727e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45c700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005725e8], 0
je 0x45c70e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45c720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005725e8], 0
je 0x45c735
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45c740
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005725e8], 0
je 0x45c775
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00572b80]
aesenc xmm0, xmmword [0x00572b90]
aesenc xmm0, xmmword [0x00572ba0]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback
Function at 0x45ddc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x005727e0]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x45de5b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x45e080
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x005727e0]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x45e117
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x45e4e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45e514
mov rcx, 0x28
jmp 0x45e51f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005727e0], rcx
pop rbp
ret

Function at 0x465560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46562a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005727e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46560f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0046c500]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4655fe
mov edi, 1
lea rsi, [0x0046c500]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004951c8]
lea rsi, [0x00494f08]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x1800382e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rsp + 0x90], rax
movss xmm6, dword [0x180287788]
movss dword [rsp + 0x24], xmm6
mov rdx, qword [rcx]
cmp rdx, 2
jb 0x1800384ca
mov ecx, 0x68
mov dword [rsp + 0x20], ecx
mov eax, dword [0x1802d88e4]
cmp eax, 0x9f3
jl 0x180038352
mov ecx, 0x70
jmp 0x180038364
add eax, 0xfffff766
mov r8d, 0x40
cmp eax, 0x45
cmovbe ecx, r8d
mov dword [rsp + 0x20], ecx
movsxd rax, ecx
mov rcx, qword [rax + rdx]
test rcx, rcx
jne 0x18003837c
movaps xmm0, xmm6
jmp 0x1800384cd
mov r14d, dword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
test rsi, rsi
jne 0x180038391
movaps xmm0, xmm6
jmp 0x1800384cd
xor ebx, ebx
movabs r15, 0xf777541f7831b2e
mov dword [rsp + 0x28], ebx
cmp ebx, r14d
jge 0x1800384c2
lea eax, [rbx*8]
movsxd rcx, eax
mov rdi, qword [rcx + rsi + 0x20]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x30], rdi
test rdi, rdi
jne 0x1800383ce
jmp 0x1800384bb
lea rcx, [rsp + 0x30]
call fcn.1800380b8
movsd xmm0, qword [rax]
movsd qword [rsp + 0x38], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
mov rax, qword [rdi]
cmp byte [rsp + 0x38], 0
je 0x1800384bb
movabs rcx, 0x74c72cd70464fc0f
mov qword [rsp + 0x50], rcx
movabs rcx, 0xccfab3428c6747a0
mov qword [rsp + 0x58], rcx
movabs rcx, 0xbfa037b06d216de4
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r15
movabs rcx, 0x1db34fb26e0b8e5f
mov qword [rsp + 0x70], rcx
movabs rcx, 0xa295c323e93022cc
mov qword [rsp + 0x78], rcx
movabs rcx, 0xbfa037b06d4502a9
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], r15
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.1801932d0
test rax, rax
je 0x1800384bb
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [0x18028774c]
jb 0x1800384c2
comiss xmm6, xmm0
jb 0x1800384c2
mulss xmm6, xmm0
movss dword [rsp + 0x24], xmm6
jmp 0x1800384c2
inc ebx
jmp 0x18003839d
jmp 0x1800384ca
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180190e30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
ret
Function at 0x18005f8a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 0x5a4d
mov r14, r9
mov rbp, r8
cmp word [rdx], ax
jne 0x18005f945
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x18005f945
movzx esi, word [rcx + 0x14]
xor r11d, r11d
movzx ebx, word [rcx + 6]
add rsi, rcx
test rbx, rbx
je 0x18005f945
xor r8d, r8d
lea rcx, [rsi + 0x18]
test dword [rcx + 0x24], 0x20000
jne 0x18005f936
mov rax, qword [rcx]
mov rdi, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
sub rdi, rax
mov byte [rsp + 0x38], 0
movzx r9d, byte [rax]
movzx r10d, byte [rax + rdi]
sub r9d, r10d
jne 0x18005f931
inc rax
test r10d, r10d
jne 0x18005f91b
test r9d, r9d
je 0x18005f969
inc r11d
inc r8
add rcx, 0x28
cmp r8, rbx
jl 0x18005f8fa
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180190e30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
movsxd rax, r11d
mov r9, r14
lea rcx, [rax + rax*4]
mov ebx, dword [rsi + rcx*8 + 0x24]
mov r8d, dword [rsi + rcx*8 + 0x20]
add rbx, rdx
mov rdx, rbx
call fcn.18005f7a8
cmp rax, 0xffffffffffffffff
je 0x18005f945
add rax, rbx
jmp 0x18005f947
Function at 0x1800771f8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rax, rax
je 0x180077236
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
add eax, 0xffffff80
test eax, 0xffffff7f
je 0x180077236
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800772ac
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1800772ac
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0xabc53217
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x1800772a8
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x180077288
cmp r11d, 0xd964636b
je 0x1800772b1
test edx, edx
jne 0x18007726b
mov rax, qword [rax]
jmp 0x180077247
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbx
add rax, r8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x180077764
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x1800777b7
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, rbx
call fcn.1800757a0
call fcn.1800771f8
call fcn.1800772e0
and qword [rsp + 0x28], 0
lea r8, [0x18007699c]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800777b7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180077b64
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180077b89
xor eax, eax
jmp 0x180077c86
cmp qword [rcx + 0x68], 0
je 0x180077b9a
call fcn.180079f04
jmp 0x180077c86
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x180077bb1
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180077bb3
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180077be8
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1801937c0
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180077c80
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x180077c23
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x180077c5b
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.18019d31c
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x180077c97
cmp rbp, r15
ja 0x180077c31
mov r8, rbx
test rbx, rbx
je 0x180077c80
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.18019d31c
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x180077c83
Function at 0x180078064
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x18007809d
xor eax, eax
jmp 0x1800781bf
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1800780d7
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1800780d7
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1800781bf
cmp qword [rbx + 0x80], 0
je 0x1800781bd
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180078112
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180078135
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.18019d6b0
cmp eax, edi
cmovne edi, esi
jmp 0x1800781bd
lea r8, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
je 0x180078183
sub eax, 1
je 0x180078183
cmp eax, 2
jne 0x1800781bd
movsx ecx, byte [rbp - 0x30]
jmp 0x18007811f
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1800781ad
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.18019d038
cmp r14, rax
jne 0x1800781bd
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x1800781bf
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180190e30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180078914
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180078983
cmp byte [rcx + 0x71], 0
je 0x180078983
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800789d7
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x18007899d
sub eax, 1
je 0x1800789a1
cmp eax, 2
jne 0x1800789d7
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180190e30
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800789ce
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.18019d038
cmp rdi, rax
jne 0x1800789d7
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180078985
xor al, al
jmp 0x180078985

Function at 0x18007a170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x64616f4c
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], 0x7262694c
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x41797261
mov byte [rbp - 0x24], 0
mov dword [rbp - 0x20], 0x4e52454b
mov dword [rbp - 0x1c], 0x41424c45
mov dword [rbp - 0x18], 0x642e4553
mov word [rbp - 0x14], 0x6c6c
mov byte [rbp - 0x12], 0
call fcn.18007a1f0
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180190e30
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x18007a1f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rsp + 0x100], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x64
mov rdi, rdx
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov r8, rcx
xor ecx, ecx
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
jmp 0x18007a276
mov rcx, qword [rax + 0x60]
lea r8, [rsp + 0x30]
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x18007a26f
add rcx, 2
test r9d, r9d
jne 0x18007a259
test edx, edx
je 0x18007a27f
mov rax, qword [rax]
cmp qword [rax + 0x30], 0
jne 0x18007a24d
jmp 0x18007a288
mov rax, qword [rax + 0x30]
test rax, rax
jne 0x18007a295
mov rcx, rbx
call fcn.18007a170
test rax, rax
je 0x18007a2a5
mov rdx, rdi
mov rcx, rax
call fcn.18007a2c8
test rax, rax
jne 0x18007a2a7
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180190e30
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop rdi
ret
Function at 0x18007a2c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1802a6070]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x18007a440
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
mov r11d, dword [rax + rcx + 0x8c]
lea r8, [rcx + r9]
test r11d, r11d
je 0x18007a440
lea r13d, [r12 + 1]
cmp rdx, 0xffff
ja 0x18007a3ef
mov ecx, dword [r8 + 0x1c]
movzx eax, bp
sub ax, word [r8 + 0x10]
add rcx, rbx
add ax, r13w
movzx edx, ax
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x18007a3ef
lea eax, [r9 + r11]
cmp edi, eax
jae 0x18007a3ef
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180193e70
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x18007a37e
test r8, r8
je 0x18007a440
lea rcx, [rsp + 0x20]
call fcn.1801937c0
mov edx, 0x2e
lea rcx, [rsp + 0x20]
call fcn.18019370c
lea rdi, [rax + r13]
mov byte [rax], r12b
cmp byte [rdi], 0x23
jne 0x18007a3c1
lea rcx, [rdi + 1]
call fcn.18019dbf8
movzx edi, ax
lea rcx, [rsp + 0x20]
call fcn.18007a170
mov rsi, rax
cmp rax, rbx
jne 0x18007a3e2
mov rdx, rbp
mov rcx, rdi
call fcn.18019dafc
test eax, eax
je 0x18007a440
mov rdx, rdi
mov rcx, rsi
call fcn.18007a2c8
jmp 0x18007a442
mov ecx, dword [r8 + 0x18]
mov edi, r12d
mov r15d, dword [r8 + 0x20]
sub ecx, r13d
lea r10d, [rdi + rcx]
mov rsi, rbp
shr r10d, 1
lea rax, [r15 + r10*4]
mov edx, dword [rax + rbx]
add rdx, rbx
sub rsi, rdx
mov al, byte [rdx]
cmp al, byte [rdx + rsi]
jne 0x18007a427
add rdx, r13
test al, al
jne 0x18007a414
mov eax, r12d
jmp 0x18007a42c
sbb eax, eax
or eax, r13d
test eax, eax
jns 0x18007a436
lea edi, [r10 + 1]
jmp 0x18007a43c
jle 0x18007a46d
lea ecx, [r10 - 1]
cmp edi, ecx
jbe 0x18007a3fd
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180190e30
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r8 + 0x24]
add rcx, rbx
cmp word [rcx + r10*2], r12w
je 0x18007a440
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rbx
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x18007a4bf
lea eax, [r9 + r11]
cmp edi, eax
jae 0x18007a4bf
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180193e70
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x18007a4b1
jmp 0x18007a387
lea rax, [rbx + rdi]
jmp 0x18007a442