joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003df0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x690
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov r8d, edx
mov rdi, rcx
test rcx, rcx
je 0x18000404a
cmp r8d, 0x40
jbe 0x18000404a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000404a
movsxd rdx, dword [rcx + 0x3c]
lea rcx, [rdx + 0x108]
cmp r8, rcx
jbe 0x18000404a
cmp dword [rdx + rdi], 0x4550
lea rbx, [rdx + rdi]
jne 0x18000404a
mov eax, 0x2002
test word [rbx + 0x16], ax
je 0x18000404a
mov eax, 0x8664
cmp word [rbx + 4], ax
jne 0x18000404a
mov eax, 0xf0
cmp word [rbx + 0x14], ax
jne 0x18000404a
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x18000404a
movzx ecx, word [rbx + 0x14]
xor ebp, ebp
movzx r9d, word [rbx + 6]
add rcx, 0x28
test r9, r9
je 0x180003eda
mov edx, ebp
add rcx, rbx
nop word [rax + rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, r8d
ja 0x18000404a
inc rdx
add rcx, 0x28
cmp rdx, r9
jl 0x180003ec0
xor edx, edx
mov qword [rsp + 0x6a8], rsi
mov r8d, 0x208
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x260]
call fcn.18000a5a0
xor edx, edx
lea rcx, [rsp + 0x470]
mov r8d, 0x208
call fcn.18000a5a0
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.18000a5a0
mov rcx, rdi
call fcn.180002200
test eax, eax
je 0x18000402e
movzx eax, word [rbx + 0x14]
lea rdx, [rsp + 0x470]
mov r9d, dword [rbx + 0x50]
lea rcx, [rsp + 0x260]
mov r8d, dword [rax + rbx + 0x4c]
sub r9d, r8d
call fcn.180002260
test eax, eax
je 0x18000402e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.180002ae0
test eax, eax
je 0x18000402e
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x470]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000402e
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x50]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
mov rcx, rsi
cmp rax, 0xffffffffffffffff
je 0x180004028
lea rax, [rsp + 0x40]
mov rdx, rbp
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x260]
mov qword [rsp + 0x20], rdi
call fcn.180003540
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x18000403b
jmp 0x18000402e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.180003b70
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x6a8]
jmp 0x18000404c
xor eax, eax
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.180009470
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180004080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x18000420d
movzx edi, word [rcx]
mov ecx, 0xfe
lea eax, [rdi - 1]
cmp ax, cx
ja 0x18000420d
lea r8d, [rcx + 2]
mov qword [rsp + 0x158], rsi
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.18000a5a0
mov r8d, edi
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18000aa00
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x20], 0xd3f505f9
mov rbx, rsi
lea rax, [rsp + 0x30]
nop
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x180004100
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rdx, rsi
lea rax, [rsp + 0x30]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180004136
inc rdx
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.18000b574
xor r8d, r8d
mov edx, r8d
test rbx, rbx
je 0x1800041a0
mov rax, rsi
nop
inc rax
cmp word [rbx + rax*2], r8w
jne 0x180004160
cmp rdx, rax
jae 0x180004194
movzx ecx, word [rbx + rdx*2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x180004184
add cx, 0x20
mov word [rbx + rdx*2], cx
cmp cx, 0x2e
je 0x18000418f
inc rdx
jmp 0x180004156
mov word [rbx + rdx*2], r8w
inc rsi
cmp word [rbx + rsi*2], r8w
jne 0x180004194
jmp 0x1800041a3
mov rsi, r8
lea edx, [rsi + rsi]
mov edi, 0x811c9dc5
mov rsi, qword [rsp + 0x158]
add rdx, rbx
mov rcx, rbx
cmp rbx, rdx
jae 0x1800041d3
nop
movzx eax, byte [rcx]
inc rcx
xor eax, edi
imul edi, eax, 0x1000193
cmp rcx, rdx
jb 0x1800041c0
test rbx, rbx
je 0x1800041ec
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [rsp + 0x20]
movzx ecx, byte [rdx]
lea rax, [rsp + 0x24]
xor ecx, edi
inc rdx
imul edi, ecx, 0x1000193
cmp rdx, rax
jb 0x1800041f1
mov eax, edi
jmp 0x18000420f
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180009470
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x180004230
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x180027f18]
mov ebp, edx
mov esi, ecx
test rdi, rdi
jne 0x180004264
mov rdi, qword gs:[0x60]
mov qword [0x180027f18], rdi
mov rdi, qword [rdi + 0x18]
add rdi, 0x30
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18000429f
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rbx + 0x38]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.180004080
cmp esi, eax
je 0x1800042b6
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180004280
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rbx + 0x10]
xor edi, edi
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx + 0x8c], edi
je 0x1800043af
mov eax, dword [rax + rbx + 0x88]
test eax, eax
je 0x1800043af
add rax, rbx
cmp dword [rax + 0x18], edi
je 0x1800043af
mov ecx, dword [rax + 0x20]
test ecx, ecx
je 0x1800043af
cmp dword [rax + 0x24], edi
je 0x1800043af
cmp dword [rax + 0x1c], edi
je 0x1800043af
mov esi, dword [rax + 0x14]
lea r10, [rbx + rcx]
mov r11d, edi
test esi, esi
je 0x1800043af
mov dword [rsp + 0x50], 0xd3f505f9
nop
mov r9d, dword [r10]
add r9, rbx
jne 0x18000432d
mov rax, rdi
jmp 0x18000433d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], dil
jne 0x180004334
mov r8d, eax
mov edx, 0x811c9dc5
add r8, r9
mov rcx, r9
cmp r9, r8
jae 0x180004363
movzx eax, byte [rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jb 0x180004350
lea rcx, [rsp + 0x50]
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
lea rax, [rsp + 0x54]
cmp rcx, rax
jb 0x180004370
cmp edx, ebp
je 0x1800043a0
inc r11d
add r10, 4
cmp r11d, esi
jb 0x180004320
mov rax, rdi
jmp 0x1800042a1
mov rdx, r9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rax, rdi
jmp 0x1800042a1
Function at 0x1800053e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12d, edx
mov rsi, rcx
test rcx, rcx
je 0x180005488
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
test ecx, ecx
je 0x180005488
mov ebp, dword [rsi + rcx + 0x20]
lea r15, [rsi + rcx]
mov r14d, dword [r15 + 0x18]
add rbp, rsi
xor edi, edi
test r14d, r14d
je 0x180005488
nop
mov ebx, dword [rbp]
lea rbp, [rbp + 4]
add rbx, rsi
mov rcx, rbx
call fcn.180005070
mov r9d, 0x57da3548
test eax, eax
jle 0x18000547c
mov r10d, eax
nop
movzx r8d, byte [rbx]
lea rbx, [rbx + 1]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add r9d, eax
rol r9d, 5
sub r10, 1
jne 0x180005450
cmp r9d, r12d
je 0x1800054a9
inc edi
cmp edi, r14d
jb 0x180005430
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov edx, dword [r15 + 0x24]
lea eax, [rdi + rdi]
mov ecx, dword [r15 + 0x1c]
add rax, rsi
add rcx, rsi
movzx r8d, word [rdx + rax]
mov eax, dword [rcx + r8*4]
add rax, rsi
jmp 0x18000548a

Function at 0x1800054d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rdi
mov rax, qword gs:[0x60]
mov edi, ecx
mov rdx, qword [rax + 0x18]
mov r10, qword [rdx + 0x10]
cmp qword [r10 + 0x30], 0
je 0x18000557e
mov qword [rsp + 0x10], rbx
nop word [rax + rax]
movups xmm1, xmmword [r10 + 0x58]
mov eax, 0x57da3548
movd ecx, xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r11, xmm0
movzx edx, cx
test edx, edx
je 0x18000555c
mov ebx, edx
nop word [rax + rax]
movzx r9d, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
movsx ecx, dl
add eax, ecx
rol eax, 5
sub rbx, 1
jne 0x180005530
cmp eax, edi
je 0x180005573
mov r10, qword [r10]
cmp qword [r10 + 0x30], 0
jne 0x180005500
mov rbx, qword [rsp + 0x10]
xor eax, eax
pop rdi
ret
mov rax, qword [r10 + 0x30]
mov rbx, qword [rsp + 0x10]
pop rdi
ret
xor eax, eax
pop rdi
ret
Function at 0x180006040
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x67452301
mov r14, r8
mov dword [rbp - 0x54], 0xefcdab89
mov rbx, rdx
mov dword [rbp - 0x50], 0x98badcfe
mov rdi, rcx
mov dword [rbp - 0x4c], 0x10325476
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rdx, rdx
je 0x1800060e8
mov dword [rbp - 0x60], edx
cmp rdx, 0x40
jb 0x1800060d4
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.180005590
mov esi, eax
test eax, eax
jne 0x180006230
add rdi, 0x40
sub rbx, 0x40
cmp rbx, 0x40
jae 0x1800060b0
test rbx, rbx
je 0x1800060e8
mov r8, rbx
lea rcx, [rbp - 0x48]
mov rdx, rdi
call fcn.18000aa00
mov edx, dword [rbp - 0x60]
lea rcx, [rbp - 0x48]
and edx, 0x3f
mov byte [rbp + rdx - 0x48], 0x80
inc edx
mov eax, edx
add rcx, rax
cmp edx, 0x38
ja 0x180006115
mov r8d, 0x38
sub r8d, edx
xor edx, edx
call fcn.18000a5a0
jmp 0x180006151
mov r8d, 0x40
sub r8d, edx
xor edx, edx
call fcn.18000a5a0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x60]
call fcn.180005590
mov esi, eax
test eax, eax
jne 0x180006230
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x18], rax
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
mov ecx, dword [rbp - 0x60]
mov eax, dword [rbp - 0x5c]
lea edx, [rax*8]
mov eax, ecx
shr eax, 0x1d
lea ecx, [rcx*8]
or edx, eax
mov byte [rbp - 0x10], cl
mov eax, ecx
mov byte [rbp - 0xc], dl
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr edx, 0x18
shr ecx, 0x18
mov byte [rbp - 9], dl
lea rdx, [rbp - 0x48]
mov byte [rbp - 0xd], cl
lea rcx, [rbp - 0x60]
shr eax, 0x10
mov byte [rbp - 0xa], al
call fcn.180005590
mov esi, eax
test eax, eax
jne 0x180006230
movzx eax, byte [rbp - 0x58]
mov byte [r14], al
movzx eax, byte [rbp - 0x57]
mov byte [r14 + 1], al
movzx eax, byte [rbp - 0x56]
mov byte [r14 + 2], al
movzx eax, byte [rbp - 0x55]
mov byte [r14 + 3], al
movzx eax, byte [rbp - 0x54]
mov byte [r14 + 4], al
movzx eax, byte [rbp - 0x53]
mov byte [r14 + 5], al
movzx eax, byte [rbp - 0x52]
mov byte [r14 + 6], al
movzx eax, byte [rbp - 0x51]
mov byte [r14 + 7], al
movzx eax, byte [rbp - 0x50]
mov byte [r14 + 8], al
movzx eax, byte [rbp - 0x4f]
mov byte [r14 + 9], al
movzx eax, byte [rbp - 0x4e]
mov byte [r14 + 0xa], al
movzx eax, byte [rbp - 0x4d]
mov byte [r14 + 0xb], al
movzx eax, byte [rbp - 0x4c]
mov byte [r14 + 0xc], al
movzx eax, byte [rbp - 0x4b]
mov byte [r14 + 0xd], al
movzx eax, byte [rbp - 0x4a]
mov byte [r14 + 0xe], al
movzx eax, byte [rbp - 0x49]
mov byte [r14 + 0xf], al
mov r9, qword [fcn.18000a5a0]
lea rcx, [rbp - 0x60]
xor edx, edx
lea r8d, [rdx + 0x58]
call r9
lea r11, [rsp + 0x80]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800074e0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, r9
mov rbp, r8
movzx r14d, dl
mov rsi, rcx
cmp r9, 0x40
jbe 0x180007520
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rbp
call fcn.180009150
mov edi, eax
test eax, eax
jne 0x180007766
lea rbp, [rsp + 0x20]
lea ebx, [rax + 0x40]
cmp dword [rsi], 0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa8], r15
mov byte [rsp + 0xa0], r14b
mov byte [rsp + 0xa1], bl
jne 0x1800075da
mov qword [rsi + 8], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsi + 0x20], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsi + 0x28], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsi + 0x30], rax
movabs rax, 0x510e527fade682d1
mov qword [rsi + 0x38], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsi + 0x40], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsi + 0x48], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsi + 0x50], rax
mov dword [rsi + 0xd8], 0
mov dword [rsi], 1
lea r15, [rsp + 0xa0]
mov r12d, dword [rsi + 8]
add rsi, 8
and r12d, 0x7f
mov r14d, 2
mov r13d, 0x80
sub r13d, r12d
add qword [rsi], r14
cmp qword [rsi], r14
jae 0x18000760f
inc qword [rsi + 8]
test r12d, r12d
je 0x18000768e
cmp r13, r14
ja 0x18000768e
mov eax, r12d
lea rcx, [rsi + 0x50]
add rcx, rax
lea rdx, [rsp + 0xa0]
mov r8, r13
call fcn.18000aa00
lea rdx, [rsi + 0x50]
mov rcx, rsi
call fcn.1800083d0
mov edi, eax
test eax, eax
jne 0x18000774e
lea r15, [rsp + 0xa0]
sub r14, r13
add r15, r13
xor r12d, r12d
cmp r14, 0x80
jb 0x180007689
mov rdx, r15
mov rcx, rsi
call fcn.1800083d0
mov edi, eax
test eax, eax
jne 0x18000774e
sub r15, 0xffffffffffffff80
add r14, 0xffffffffffffff80
cmp r14, 0x80
jae 0x180007663
test r14, r14
je 0x1800076a3
mov eax, r12d
lea rcx, [rsi + 0x50]
add rcx, rax
mov r8, r14
mov rdx, r15
call fcn.18000aa00
test rbx, rbx
je 0x18000774c
mov r14d, dword [rsi]
mov r15d, 0x80
add qword [rsi], rbx
and r14d, 0x7f
sub r15d, r14d
cmp qword [rsi], rbx
jae 0x1800076c8
inc qword [rsi + 8]
test r14d, r14d
je 0x180007702
cmp rbx, r15
jb 0x180007702
mov eax, r14d
lea rcx, [rsi + 0x50]
add rcx, rax
mov r8, r15
mov rdx, rbp
call fcn.18000aa00
lea rdx, [rsi + 0x50]
mov rcx, rsi
call fcn.1800083d0
mov edi, eax
test eax, eax
jne 0x18000774e
add rbp, r15
sub rbx, r15
xor r14d, r14d
cmp rbx, 0x80
jb 0x180007732
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rsi
call fcn.1800083d0
mov edi, eax
test eax, eax
jne 0x18000774e
sub rbp, 0xffffffffffffff80
add rbx, 0xffffffffffffff80
cmp rbx, 0x80
jae 0x180007710
test rbx, rbx
je 0x18000774c
mov eax, r14d
lea rcx, [rsi + 0x50]
add rcx, rax
mov r8, rbx
mov rdx, rbp
call fcn.18000aa00
xor edi, edi
mov r13, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r15, qword [rsp + 0xa8]
mov rax, qword [fcn.18000a5a0]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
mov eax, edi
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180007cb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x248]
sub rsp, 0x348
mov rbx, r8
mov rdi, rdx
mov r13, rcx
cmp r8, 0x180
jbe 0x180007ce9
mov eax, 0xffffffc8
add rsp, 0x348
pop r13
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 0x370], rsi
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x378], r12
xor edx, edx
mov r8d, 0x1a0
mov qword [rsp + 0x340], r15
call fcn.18000a5a0
xor edx, edx
lea rcx, [rbp + 0x120]
mov r8d, 0x120
call fcn.18000a5a0
mov rax, rbx
mov byte [rbp - 0x6d], bl
shr rax, 0x18
lea rcx, [rbp - 0x68]
mov byte [rbp - 0x70], al
mov r8, rbx
mov rax, rbx
mov byte [rbp - 0x69], 0x30
shr rax, 0x10
mov rdx, rdi
mov byte [rbp - 0x6f], al
mov rax, rbx
shr rax, 8
mov byte [rbp - 0x6e], al
call fcn.18000aa00
xor r15d, r15d
mov byte [rbp + rbx - 0x68], 0x80
mov eax, r15d
lea r12, [rbx + 0x19]
lea rcx, [rsp + 0x60]
nop
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x20
jl 0x180007d70
mov r8d, 0x100
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x120]
call fcn.180006570
mov esi, eax
mov r8d, 0x10
test eax, eax
jne 0x180007e9d
mov qword [rsp + 0x380], r14
mov r14, r15
nop
xorps xmm0, xmm0
mov rdi, r12
movups xmmword [rsp + 0x20], xmm0
test r12, r12
je 0x180007e2c
lea rbx, [rbp - 0x80]
lea rax, [rsp + 0x20]
sub rbx, rax
nop dword [rax]
lea rax, [rsp + 0x20]
mov rdx, r8
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180007de0
mov rax, rdi
lea rdx, [rsp + 0x20]
add rbx, 0x10
lea rcx, [rbp + 0x120]
cmp rdi, 0x10
cmovae rax, r8
lea r8, [rsp + 0x20]
sub rdi, rax
call fcn.180006dc0
mov esi, eax
test eax, eax
jne 0x180007e95
lea r8d, [rax + 0x10]
test rdi, rdi
jne 0x180007dd0
movups xmm0, xmmword [rsp + 0x20]
inc byte [rbp - 0x7d]
movups xmmword [rsp + r14 + 0x30], xmm0
add r14, 0x10
cmp r14, 0x30
jl 0x180007db0
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x120]
call fcn.180006570
mov esi, eax
test eax, eax
jne 0x180007e95
mov rbx, r13
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x120]
call fcn.180006dc0
mov esi, eax
test eax, eax
jne 0x180007e95
movups xmm0, xmmword [rsp + 0x50]
add r15d, 0x10
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp r15d, 0x30
jl 0x180007e63
mov r14, qword [rsp + 0x380]
mov rax, qword [fcn.18000a5a0]
lea rcx, [rbp + 0x120]
xor edx, edx
mov r8d, 0x120
call rax
mov rax, qword [fcn.18000a5a0]
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x1a0
call rax
mov rax, qword [fcn.18000a5a0]
lea rcx, [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 0x30]
call rax
mov rax, qword [fcn.18000a5a0]
lea rcx, [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 0x20]
call rax
mov rax, qword [fcn.18000a5a0]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x10]
call rax
mov r15, qword [rsp + 0x340]
mov r12, qword [rsp + 0x378]
test esi, esi
je 0x180007f2c
mov rax, qword [fcn.18000a5a0]
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x30]
call rax
mov eax, esi
mov rsi, qword [rsp + 0x370]
add rsp, 0x348
pop r13
pop rdi
pop rbx
pop rbp
ret
Function at 0x180007f50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xorps xmm0, xmm0
lea rbp, [rax - 0x58]
xor r14d, r14d
lea r9, [rcx + 0x28]
mov ebx, 1
mov esi, r14d
movups xmmword [rax - 0x58], xmm0
sub rbx, rcx
mov r12, rdx
movups xmmword [rax - 0x48], xmm0
mov r15, rcx
movups xmmword [rax - 0x38], xmm0
lea rax, [r15 + 0xf]
nop dword [rax + rax]
add byte [rax], 1
jne 0x180007fb1
dec rax
lea rcx, [rbx + rax]
test rcx, rcx
jg 0x180007fa0
mov r8, rbp
mov rdx, r15
mov rcx, r9
call fcn.180006dc0
mov edi, eax
test eax, eax
jne 0x180008027
add rbp, 0x10
lea r9, [r15 + 0x28]
add esi, 0x10
cmp esi, 0x30
jl 0x180007f97
lea rax, [rsp + 0x20]
sub r12, rax
nop dword [rax]
lea rax, [rsp + 0x20]
add rax, r14
add r14, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r12 + rax]
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp r14, 0x30
jl 0x180007fe0
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [r15 + 0x28]
call fcn.180006570
mov edi, eax
test eax, eax
jne 0x180008027
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r15], xmm0
mov rax, qword [fcn.18000a5a0]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x30]
call rax
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180009150
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x47], rax
mov rdi, rcx
xor ecx, ecx
movabs rax, 0x6a09e667f3bcc908
mov qword [rbp - 0x79], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbp - 0x71], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbp - 0x69], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbp - 0x61], rax
movabs rax, 0x510e527fade682d1
mov qword [rbp - 0x59], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp - 0x51], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbp - 0x49], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp - 0x41], rax
mov r14, r8
mov qword [rsp + 0x20], rcx
mov rbx, rdx
mov qword [rsp + 0x28], rcx
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
test rdx, rdx
je 0x18000926a
mov qword [rsp + 0x20], rdx
cmp rdx, 0x80
jb 0x180009256
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1800083d0
mov esi, eax
test eax, eax
jne 0x180009279
sub rdi, 0xffffffffffffff80
add rbx, 0xffffffffffffff80
cmp rbx, 0x80
jae 0x180009232
test rbx, rbx
je 0x18000926a
mov r8, rbx
lea rcx, [rbp - 0x39]
mov rdx, rdi
call fcn.18000aa00
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.180008df0
mov esi, eax
mov r9, qword [fcn.18000a5a0]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0xd8
call r9
lea r11, [rsp + 0x100]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403a485f

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403a647c