joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x554d2c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe20eff5013750a45
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9e3e0610e20eff50
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9395730c6c75017b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30a0613120c1005
mov qword [rsp + 0x32], rdx
movabs rdx, 0x903080c1212030a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6070d0d0901070b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x554cca
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x554cfc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x554d1f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0x14
jb 0x554cb0
jmp 0x554d13
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00454ec0
mov eax, edi
mov ecx, 0x14
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00554c40

Function at 0x556100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5561dd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6a91697374615e6b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x8665578175656a91
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa010b060b0b0d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x305000a010b060b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30607090b0100
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x556180
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 6]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 6]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x5561ad
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x5561d0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x556162
jmp 0x5561c4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00454ec0
mov eax, edi
mov ecx, 0xe
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.00556100
Function at 0x558300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5583fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x61536eb6c27465ac
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x739c076674656153
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa785718fd688447a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11030b0c0b031512
mov qword [rsp + 0x34], rdx
movabs rdx, 0x304110a1300100e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1303070a0304110a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1107061304140515
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x558399
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3b]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5583cb
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5583ee
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3b]
cmp rsi, 0x16
jb 0x55837f
jmp 0x5583e2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00454ec0
mov eax, edi
mov ecx, 0x16
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.00558300

Function at 0x5585e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5586fd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb679e1cb8eb865e2
mov qword [rsp + 0x18], rdx
movabs rdx, 0x65a59d76b6b8c089
mov qword [rsp + 0x20], rdx
movabs rdx, 0x588c74a8869965a5
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9e73cec872c6506c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20410061808091d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x308020410061808
mov qword [rsp + 0x38], rdx
movabs rdx, 0x215040d0011050a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x111a141d120b1102
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50a1b0a11071a0e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5586a0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x5586cd
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x5586f0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1e
jb 0x55867d
jmp 0x5586e4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1e
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.005585e0
Function at 0x55ae40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55af12
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7373506c37546547
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x546361675e737350
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc0b0a030c0b080c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x209030a0c050c0b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x55aeac
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x55aede
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x55af05
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 0xd
jb 0x55ae92
jmp 0x55aef5
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00454ec0
mov eax, edi
mov ecx, 0xd
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055ae40

Function at 0x55bdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55be9d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x490977ac9dd9c9d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x65648c9c906eaa04
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30407040c050204
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0a040703040704
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb000806030b0101
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x55be40
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x1d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x1d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x55be6d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x55be90
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xf
jb 0x55be22
jmp 0x55be84
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00454ec0
mov eax, edi
mov ecx, 0xf
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.0055bdc0
Function at 0x55d640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d707
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xbe72c364419665c1
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x7b77b3d8
movabs rdx, 0x8050505070a0900
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2050b000a090805
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x55d6a8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x55d6d7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x55d6fa
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x55d68b
jmp 0x55d6ee
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055d640

Function at 0x55dd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55ddf8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb5484ce949a3c557
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x105060407020106
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4010704
xor eax, eax
jmp 0x55dd96
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7b]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x55ddc8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x55ddeb
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7b]
cmp rsi, 8
jb 0x55dd7c
jmp 0x55dddf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.0055dd40

Function at 0x55e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55ea7d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x62e377fa78747783
mov qword [rsp + 0x19], rdx
movabs rdx, 0xef6dfb807962e377
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x500000c0c030a06
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50500000c0c03
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c040601090901
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x55ea20
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x76]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x76]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x55ea4d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x55ea70
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x55ea02
jmp 0x55ea64
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00454ec0
mov eax, edi
mov ecx, 0xd
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.0055e9a0
Function at 0x55eaa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55eb67
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6eef00948e8d6567
mov qword [rsp + 0x19], rdx
movabs rdx, 0xfe9f026eef00948e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa09020903050406
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6020508
xor eax, eax
jmp 0x55eb08
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x55eb37
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x55eb5a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x55eaeb
jmp 0x55eb4e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055eaa0

Function at 0x573700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5737e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1137445144385627
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1e3a373421562f11
mov qword [rsp + 0x24], rdx
movabs rdx, 0x107000e0a0b0604
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0e0a080107000e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0c00010405020d
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x573780
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x12]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x5737b2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5737d7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x12]
cmp rsi, 0xf
jb 0x573762
jmp 0x5737cb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00454ec0
mov eax, edi
mov ecx, 0xf
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00573700
Function at 0x573800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5738cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x561e752dd6f06552
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf737e7172a561e75
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc030b020608030b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x90c0b04030a0c0a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x57386f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x53]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x53]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x57389c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x5738bf
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x573852
jmp 0x5738b3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00454ec0
mov eax, edi
mov ecx, 0xd
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00573800
Function at 0x575300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5753ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd96b45dff774d4fb
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6565e6d96b45dff7
mov qword [rsp + 0x22], rdx
movabs rdx, 0x57c3e9afd45c0353
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0c0304070e0007
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd110d0111030c0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0111080f100510
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x57538a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x5753bc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5753df
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
cmp rsi, 0x13
jb 0x575370
jmp 0x5753d3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00454ec0
mov eax, edi
mov ecx, 0x13
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00575300
Function at 0x180004520
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x180039010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
movsxd r10, edx
mov r8, rcx
mov r9d, edx
mov ecx, 0x40
lea rdi, [rsp]
rep stosb byte [rdi], al
mov rdi, r10
lea rax, [rsp]
shr rdi, 3
test rdi, rdi
je 0x180004574
nop dword [rax + rax]
mov rcx, qword [r8]
add r8, 8
mov qword [rax], rcx
add rax, 8
sub rdi, 1
jne 0x180004560
mov rdx, r10
and edx, 7
je 0x180004594
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180004580
xor r8d, r8d
test r9d, r9d
jle 0x1800045b9
mov edx, r8d
nop
movzx ecx, byte [rsp + rdx]
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x1800045b1
add cl, 0x20
mov byte [rsp + rdx], cl
inc rdx
cmp rdx, r10
jl 0x1800045a0
lea rdx, [rsp]
mov r11d, r9d
mov r10d, 0xb801fcda
cmp r9d, 4
jl 0x180004607
mov rdi, r9
shr rdi, 2
mov eax, edi
neg eax
lea r9d, [r9 + rax*4]
nop dword [rax + rax]
imul eax, dword [rdx], 0x5bd1e995
add rdx, 4
imul r10d, r10d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r10d, ecx
sub rdi, 1
jne 0x1800045e0
sub r9d, 1
je 0x18000462c
sub r9d, 1
je 0x180004622
cmp r9d, 1
jne 0x180004632
movzx r8d, byte [rdx + 2]
shl r8d, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [rdx]
xor r8d, eax
imul ecx, r8d, 0x5bd1e995
imul edi, r11d, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, r10d, 0x5bd1e995
xor ecx, eax
mov eax, edi
shr eax, 0x18
xor eax, edi
imul edx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor edx, eax
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18001f3a0
add rsp, 0x50
pop rdi
ret
Function at 0x18001bf90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbp, rcx
cmp edx, 1
jne 0x18001c021
test r8, r8
je 0x18001c002
mov qword [rsp + 0x40], rbx
mov rcx, r8
mov qword [rsp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
lea rbx, [rdx*2 + 2]
mov rcx, rbx
call fcn.180023428
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1800207a0
mov rbx, qword [rsp + 0x40]
mov qword [0x18003c580], rsi
test rsi, rsi
je 0x18001bffd
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rsi, qword [rsp + 0x48]
xor eax, eax
lea r8, [0x18001b2e0]
mov qword [rsp + 0x28], rax
mov r9, rbp
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18001e430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x180039010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov edx, 0xf
mov r8d, 0xa86f8bb2
mov rbx, rcx
lea r9d, [rdx - 1]
call fcn.180004350
xor edx, edx
lea ecx, [rdx + 2]
call rax
mov rdi, rax
test rax, rax
je 0x18001e62d
mov dword [rsp + 0x40], 0x238
mov r9d, 0xd
mov r8d, 0x5e57b014
jmp 0x18001e5f7
mov byte [rsp + 0x20], 0
mov byte [rsp + 0x21], 0x21
mov byte [rsp + 0x22], 8
mov byte [rsp + 0x23], 0x58
mov byte [rsp + 0x24], 8
mov byte [rsp + 0x25], 0x7d
mov byte [rsp + 0x26], 8
mov byte [rsp + 0x27], 0x50
mov byte [rsp + 0x28], 8
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 8
mov byte [rsp + 0x2b], 0x54
mov byte [rsp + 0x2c], 8
mov byte [rsp + 0x2d], 0x21
mov byte [rsp + 0x2e], 8
mov byte [rsp + 0x2f], 0x54
mov byte [rsp + 0x30], 8
mov byte [rsp + 0x31], 0x51
mov byte [rsp + 0x32], 8
mov byte [rsp + 0x33], 0x21
mov byte [rsp + 0x34], 8
mov byte [rsp + 0x35], 0x58
mov byte [rsp + 0x36], 8
mov byte [rsp + 0x37], 0x21
mov byte [rsp + 0x38], 8
mov byte [rsp + 0x39], 8
mov byte [rsp + 0x3a], 8
movzx eax, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
test al, al
jne 0x18001e591
xor r8d, r8d
nop dword [rax + rax]
movzx ecx, byte [rsp + r8 + 0x21]
mov eax, 8
sub eax, ecx
imul ecx, eax, 0x3e
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x21], cl
inc r8
cmp r8, 0x1a
jb 0x18001e540
mov edx, 0xf
mov r8d, 0xcd7328ca
lea r9d, [rdx + 0x42]
call fcn.180004350
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x6c]
call rax
test eax, eax
jne 0x18001e5eb
lea ecx, [rax + 0x18]
call fcn.180023428
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
test rax, rax
je 0x18001e613
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov rcx, qword [rbx + 8]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
add rax, 8
mov qword [rbx + 8], rax
mov r9d, 0xc
mov r8d, 0xc9a81ce0
mov edx, 0xf
call fcn.180004350
lea rdx, [rsp + 0x40]
mov rcx, rdi
call rax
test eax, eax
jne 0x18001e4a0
mov r9d, 0x5b
mov r8d, 0xca528872
lea edx, [r9 - 0x4c]
call fcn.180004350
mov rcx, rdi
call rax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18001f3a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180027164
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180027194
xor eax, eax
jmp 0x180027257
mov rbp, rbx
cmp word [rax], si
je 0x1800271b9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800271a0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18002719c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180027084
movsxd r14, eax
test eax, eax
jne 0x1800271f7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18002718d
mov rcx, r14
call fcn.180024c0c
mov rdi, rax
test rax, rax
jne 0x180027210
xor ecx, ecx
call fcn.180024c6c
jmp 0x1800271ec
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180027084
test eax, eax
jne 0x180027241
mov rcx, rdi
call fcn.180024c6c
jmp 0x18002724b
xor ecx, ecx
call fcn.180024c6c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18002c810
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002c838
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18002c838
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.180004030
mov r10, rax
test rax, rax
jne 0x18000101b
add rsp, 0x20
pop rbx
ret
mov eax, dword [rax + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov edi, dword [rax + r10 + 0x88]
add rdi, r10
mov r9d, dword [rdi + 0x20]
mov r11d, dword [rdi + 0x18]
add r9, r10
test r11d, r11d
je 0x180001073
mov edx, dword [r9]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x180001063
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180001050
cmp eax, ebx
je 0x180001080
add r9, 4
inc r8d
cmp r8d, r11d
jb 0x180001041
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, dword [rdi + 0x24]
add rax, r10
movsxd rcx, r8d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x30]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
add rsp, 0x20
pop rbx
ret

Function at 0x1800010b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.180004052
mov r10, rax
test rax, rax
jne 0x1800010c6
add rsp, 0x28
ret
mov eax, dword [rax + 0x3c]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, r10
test r11d, r11d
je 0x180001126
nop dword [rax]
mov edx, dword [r8]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x18000111a
nop
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180001100
cmp eax, 0x278e4f75
je 0x180001132
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x1800010f0
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x20]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
add rsp, 0x28
ret