joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4b0610
jb 0x4b066f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004b0420
aeskeygenassist xmm1, xmm0, 1
call fcn.004b0440
aeskeygenassist xmm1, xmm2, 2
call fcn.004b0420
aeskeygenassist xmm1, xmm0, 2
call fcn.004b0440
aeskeygenassist xmm1, xmm2, 4
call fcn.004b0420
aeskeygenassist xmm1, xmm0, 4
call fcn.004b0440
aeskeygenassist xmm1, xmm2, 8
call fcn.004b0420
aeskeygenassist xmm1, xmm0, 8
call fcn.004b0440
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b0420
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b0440
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b0420
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b0440
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b0420
jmp 0x4b06dd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004b0380
aeskeygenassist xmm1, xmm2, 2
call fcn.004b03e0
aeskeygenassist xmm1, xmm2, 4
call fcn.004b0380
aeskeygenassist xmm1, xmm2, 8
call fcn.004b03e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b0380
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b03e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b0380
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004b03e0
jmp 0x4b06dd
aeskeygenassist xmm1, xmm0, 1
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 2
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 4
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 8
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004b0340
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004b0340
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4b06ea
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret

Function at 0x4b5e20
Capabilities:
Execute syscall

Disassembly:
xor rax, rax
mov ax, word [rsp + 8]
push rcx
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rdi, qword gs:[0x30]
mov dword [rdi + 0x68], 0
sub rsp, 0x80
cmp ecx, 4
jle 0x4b5e60
cmp ecx, 0x10
jle 0x4b5e56
int 3
mov rdi, rsp
cld
rep movsq qword [rdi], qword [rsi]
mov rsi, rsp
sub rsp, 8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r9, qword [rsi + 0x18]
movq xmm0, rcx
movq xmm1, rdx
movq xmm2, r8
movq xmm3, r9
mov r10, rcx
syscall
add rsp, 0x88
pop rcx
mov dword [rsp + 0x28], eax
ret
Function at 0x4c9a00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4c9ca6
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
lea rax, [0x004e3fc0]
nop dword [rax]
call fcn.0040c920
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x004eee21]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004e3fc0]
call fcn.0040c920
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x004eeabc]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004e4080]
call fcn.0040c920
cmp dword [0x0068cbe0], 0
jne 0x4c9aa9
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
jmp 0x4c9ab7
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x70]
call fcn.0045fa60
mov qword [rsp + 0x60], rax
mov qword [rax + 8], 0xd
lea rcx, [0x004efd3a]
mov qword [rax], rcx
nop
lea rax, [0x004e4080]
call fcn.0040c920
cmp dword [0x0068cbe0], 0
jne 0x4c9aef
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x18], rcx
jmp 0x4c9afd
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x68]
call fcn.0045fa60
mov qword [rsp + 0x58], rax
mov qword [rax + 8], 0xc
lea rcx, [0x004ef92e]
mov qword [rax], rcx
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rcx
lea rax, [0x004d63e0]
call fcn.0040c920
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.004ba000
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x4c9c96
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x004d6320]
call fcn.0040c920
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
call fcn.004ba000
movzx ecx, word [0x0068c95a]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x78], rdx
lea rax, [0x004d64a0]
call fcn.0040c920
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.004b5e20
xorps xmm15, xmm15
mov r14, qword [0x0068cb48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
call fcn.0045c160
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
xor eax, eax
mov rcx, rax
nop dword [rax + rax]
call fcn.0045fe00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045d7a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004c9a00
Function at 0x180001258
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
lea r10d, [rdx + 2]
mov r11d, edx
mov edi, 0xaaaaaaab
mov eax, edi
mov rsi, r8
mov rbx, rcx
mul r10d
shr edx, 1
shl edx, 2
inc edx
cmp dword [r9], edx
jae 0x18000129b
mov dword [r9], edx
mov eax, 6
jmp 0x18000138d
mov eax, edi
xor r10d, r10d
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mul r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
test ecx, ecx
je 0x180001320
dec ecx
mov eax, edi
mul ecx
shr edx, 1
inc edx
mov edi, edx
lea r10d, [rdx + rdx*2]
movzx eax, byte [rbx]
shr rax, 2
mov al, byte [rax + r14]
mov byte [r8], al
movzx edx, byte [rbx]
movzx ecx, byte [rbx + 1]
shl edx, 4
shr ecx, 4
add r8, 4
add edx, ecx
add rbx, 3
and edx, 0x3f
mov al, byte [rdx + r14]
mov byte [r8 - 3], al
movzx eax, byte [rbx - 2]
movzx ecx, byte [rbx - 1]
shr ecx, 6
lea edx, [rcx + rax*4]
and edx, 0x3f
mov al, byte [rdx + r14]
mov byte [r8 - 2], al
movzx eax, byte [rbx - 1]
and eax, 0x3f
mov al, byte [rax + r14]
mov byte [r8 - 1], al
dec rdi
jne 0x1800012c3
cmp r10d, r11d
jae 0x180001381
movzx edi, byte [rbx]
inc r10d
cmp r10d, r11d
jae 0x180001336
movzx edx, byte [rbx + 1]
jmp 0x180001338
xor edx, edx
mov eax, edi
mov ecx, edx
shl edi, 4
shr rax, 2
shr ecx, 4
and eax, 0x3f
add ecx, edi
mov al, byte [rax + r14]
and ecx, 0x3f
mov byte [r8], al
mov al, byte [rcx + r14]
mov byte [r8 + 1], al
cmp r10d, r11d
jae 0x18000136f
and edx, 0xf
shl edx, 2
movsx ecx, byte [rdx + r14]
jmp 0x180001374
mov ecx, 0x3d
mov byte [r8 + 2], cl
mov byte [r8 + 3], 0x3d
add r8, 4
mov byte [r8], 0
sub r8d, esi
xor eax, eax
mov dword [r9], r8d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x180001448
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov ecx, dword [r9]
mov rbx, r9
mov esi, r8d
mov rdi, rdx
call fcn.1800040f4
test eax, eax
jne 0x180001569
mov ecx, dword [r9 + 4]
lea eax, [rcx - 1]
cmp eax, 0x7f
ja 0x180001564
xor edx, edx
mov eax, r8d
div ecx
mov r8d, eax
test edx, edx
jne 0x180001564
test cl, 3
jne 0x180001564
movsxd rax, dword [r9]
lea r12, [0x18004cf90]
imul rax, rax, 0xb0
mov r10, qword [rax + r12 + 0x60]
test r10, r10
je 0x1800014e5
lea rax, [r9 + 0x88]
mov rdx, rdi
mov rcx, rbp
add r9, 8
mov qword [rsp + 0x20], rax
call r10
jmp 0x180001569
test esi, esi
je 0x180001560
lea r14, [r9 + 8]
xor edx, edx
test ecx, ecx
jle 0x18000150f
mov r8, rbp
mov rcx, r14
sub r8, rbx
mov eax, dword [r8 + rcx - 8]
add edx, 4
xor dword [rcx], eax
lea rcx, [rcx + 4]
cmp edx, dword [rbx + 4]
jl 0x1800014fc
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
mov rdx, rdi
mov rcx, r14
imul rax, rax, 0xb0
call qword [rax + r12 + 0x28]
test eax, eax
jne 0x180001569
xor edx, edx
cmp dword [rbx + 4], edx
jle 0x180001552
mov r8, rdi
mov rcx, r14
sub r8, rbx
mov eax, dword [r8 + rcx - 8]
add edx, 4
mov dword [rcx], eax
lea rcx, [rcx + 4]
cmp edx, dword [rbx + 4]
jl 0x18000153f
movsxd rcx, dword [rbx + 4]
add rdi, rcx
add rbp, rcx
sub esi, ecx
jne 0x1800014ed
xor eax, eax
jmp 0x180001569
mov eax, 0x10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180001588
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1800466c8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov ecx, dword [r9]
mov rbx, r9
mov esi, r8d
mov rbp, rdx
call fcn.1800040f4
test eax, eax
jne 0x1800016a6
mov ecx, dword [r9 + 4]
lea eax, [rcx - 1]
cmp eax, 0x7f
ja 0x1800016a1
xor edx, edx
mov eax, r8d
div ecx
mov r8d, eax
test edx, edx
jne 0x1800016a1
test cl, 3
jne 0x1800016a1
movsxd rax, dword [r9]
lea r15, [0x18004cf90]
imul rax, rax, 0xb0
mov r10, qword [rax + r15 + 0x68]
test r10, r10
je 0x180001624
lea rax, [r9 + 0x88]
mov rdx, rbp
mov rcx, rdi
add r9, 8
mov qword [rsp + 0x20], rax
call r10
jmp 0x1800016a6
test esi, esi
je 0x18000169d
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, rdi
imul rax, rax, 0xb0
call qword [rax + r15 + 0x30]
test eax, eax
jne 0x1800016a6
xor r8d, r8d
cmp dword [rbx + 4], r8d
jle 0x18000168e
lea r9, [rsp + 0x30]
mov r10, rdi
mov r11, rbp
sub r9, rdi
sub r10, rbx
sub r11, rbx
lea rdx, [rbx + 8]
lea rax, [r10 + rdx]
add r8d, 4
mov ecx, dword [r9 + rax - 8]
mov eax, dword [rax - 8]
xor ecx, dword [rdx]
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov dword [r11 + rdx - 0xc], ecx
cmp r8d, dword [rbx + 4]
jl 0x18000166b
movsxd rax, dword [rbx + 4]
add rdi, rax
add rbp, rax
sub esi, dword [rbx + 4]
jne 0x180001628
xor eax, eax
jmp 0x1800016a6
mov eax, 0x10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180025ce0
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800039f4
Capabilities:
Hash data using sha256

Disassembly:
and dword [rcx + 0x28], 0
and qword [rcx], 0
xor eax, eax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret

Function at 0x180004170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x70]
mov r13, r8
mov r15, rdx
call fcn.18000411c
test eax, eax
jne 0x1800042e2
movsxd rdi, dword [rsi + 0x70]
lea rbx, [0x18004e590]
shl rdi, 7
mov ecx, dword [rdi + rbx + 0x10]
mov r12d, dword [rdi + rbx + 0xc]
call fcn.18001d1c8
mov ecx, r12d
mov r14, rax
call fcn.18001d1c8
mov rbp, rax
test r14, r14
je 0x1800042d0
test rax, rax
je 0x1800042c8
mov rdx, rax
mov rcx, rsi
call qword [rdi + rbx + 0x68]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea r9, [0x18004e590]
xor r8d, r8d
cmp dword [rdi + r9 + 0x10], r8d
jbe 0x180004223
mov rax, qword [rsi + 0xe8]
mov cl, byte [rax + r8]
xor cl, 0x5c
mov byte [r8 + r14], cl
inc r8d
cmp r8d, dword [rdi + r9 + 0x10]
jb 0x180004207
mov rcx, rsi
call qword [rdi + r9 + 0x58]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea rax, [0x18004e590]
mov rdx, r14
mov rcx, rsi
mov r8d, dword [rdi + rax + 0x10]
call qword [rdi + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea rax, [0x18004e590]
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call qword [rdi + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea rax, [0x18004e590]
mov rdx, r14
mov rcx, rsi
call qword [rdi + rax + 0x68]
mov ebx, eax
test eax, eax
jne 0x1800042a8
xor ecx, ecx
test r12d, r12d
je 0x1800042a2
mov rdx, r14
sub rdx, r15
cmp ecx, dword [r13]
jae 0x1800042a2
mov al, byte [rdx + r15]
inc ecx
mov byte [r15], al
inc r15
cmp ecx, r12d
jb 0x18000428b
mov dword [r13], ecx
xor ebx, ebx
mov rcx, qword [rsi + 0xe8]
call fcn.18001d188
mov rcx, rbp
call fcn.18001d188
mov rcx, r14
call fcn.18001d188
mov eax, ebx
jmp 0x1800042e2
mov rcx, r14
call fcn.18001d188
test rbp, rbp
je 0x1800042dd
mov rcx, rbp
call fcn.18001d188
mov eax, 0xd
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000ebf4
Capabilities:
Check http status code

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x130
xor ebx, ebx
lea r9, [rax + 0x10]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x13]
mov dword [rax + 0x10], 0x100
mov qword [rsp + 0x20], rbx
call qword [0x180030588]
test eax, eax
je 0x18000ec37
lea rcx, [rsp + 0x30]
call fcn.18001dd44
cmp eax, 0xc8
sete bl
mov eax, ebx
add rsp, 0x130
pop rbx
ret
Function at 0x180010170
Capabilities:
Encode data using xor

Disassembly:
movsxd r10, edx
movsxd rax, r9d
sub r10, 4
cmp r10, rax
jbe 0x180010182
xor eax, eax
ret
mov r11, rcx
add rcx, 4
sub edx, 4
je 0x1800101b3
xor r9d, r9d
mov r10d, edx
sub rcx, r8
mov rax, r9
inc r9
and eax, 3
mov al, byte [rax + r11]
xor al, byte [rcx + r8]
mov byte [r8], al
inc r8
dec r10
jne 0x180010197
mov eax, edx
ret

Function at 0x1800101b8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, edx
movsxd rax, r9d
mov rbx, r8
add rsi, 4
mov edi, edx
mov rbp, rcx
mov r14, r8
cmp rsi, rax
jbe 0x1800101ef
xor eax, eax
jmp 0x180010222
call fcn.18000efd8
xor edx, edx
mov dword [rbx], eax
add rbx, 4
test edi, edi
je 0x180010220
sub rbp, rbx
mov rax, rdi
mov rcx, rdx
inc rdx
and ecx, 3
mov cl, byte [rcx + r14]
xor cl, byte [rbx + rbp]
mov byte [rbx], cl
inc rbx
dec rax
jne 0x180010206
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180010ca0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 4], 0
mov rdi, rdx
mov rbx, rcx
ja 0x180010c92
mov ecx, dword [rcx]
call fcn.18002a22e
mov edx, 4
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 5]
mov dword [rsp + 0x30], eax
call rdi
mov rcx, qword [rbx + 8]
call fcn.18001e420
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov r14d, r8d
mov rbp, rdx
cmp qword [0x180046cd8], rsi
mov rbx, rcx
jne 0x180010cde
mov ecx, 0x80004
call fcn.18001d1c8
mov qword [0x180046cd8], rax
mov ecx, dword [rbx]
call fcn.18002a22e
mov rcx, qword [0x180046cd8]
mov dword [rcx], eax
mov edi, dword [rbx + 4]
cmp edi, r14d
cmova edi, r14d
test edi, edi
je 0x180010d30
mov rax, qword [0x180046cd8]
mov r9, qword [rbx + 8]
mov ecx, esi
add rax, 4
mov r8d, edi
mov edx, 1
add rcx, rax
call fcn.18001ec70
test eax, eax
je 0x180010d2c
sub dword [rbx + 4], eax
add esi, eax
sub edi, eax
jne 0x180010cfc
jmp 0x180010d30
and dword [rbx + 4], 0
mov rcx, qword [0x180046cd8]
lea edx, [rsi + 4]
mov r8d, 8
call rbp
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x180010c58
Function at 0x180017ed4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
call fcn.180017d24
mov qword [rsp + 0x20], rax
xor eax, eax
cmp eax, 1
je 0x180017f4c
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180017f3d
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x40
jb 0x180017f3d
cmp qword [rsp + 0x28], 0x400
jae 0x180017f3d
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
jne 0x180017f3d
jmp 0x180017f4c
mov rax, qword [rsp + 0x20]
dec rax
mov qword [rsp + 0x20], rax
jmp 0x180017ee2
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x180018354
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov byte [rsp + 0x28], 0x6b
mov byte [rsp + 0x29], 0x65
mov byte [rsp + 0x2a], 0x72
mov byte [rsp + 0x2b], 0x6e
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x2d], 0x6c
mov byte [rsp + 0x2e], 0x33
mov byte [rsp + 0x2f], 0x32
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x38], 0x4c
mov byte [rsp + 0x39], 0x6f
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x3c], 0x4c
mov byte [rsp + 0x3d], 0x69
mov byte [rsp + 0x3e], 0x62
mov byte [rsp + 0x3f], 0x72
mov byte [rsp + 0x40], 0x61
mov byte [rsp + 0x41], 0x72
mov byte [rsp + 0x42], 0x79
mov byte [rsp + 0x43], 0x41
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x58], 0x4c
mov byte [rsp + 0x59], 0x6f
mov byte [rsp + 0x5a], 0x61
mov byte [rsp + 0x5b], 0x64
mov byte [rsp + 0x5c], 0x4c
mov byte [rsp + 0x5d], 0x69
mov byte [rsp + 0x5e], 0x62
mov byte [rsp + 0x5f], 0x72
mov byte [rsp + 0x60], 0x61
mov byte [rsp + 0x61], 0x72
mov byte [rsp + 0x62], 0x79
mov byte [rsp + 0x63], 0x45
mov byte [rsp + 0x64], 0x78
mov byte [rsp + 0x65], 0x41
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x48], 0x56
mov byte [rsp + 0x49], 0x69
mov byte [rsp + 0x4a], 0x72
mov byte [rsp + 0x4b], 0x74
mov byte [rsp + 0x4c], 0x75
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0x6c
mov byte [rsp + 0x4f], 0x41
mov byte [rsp + 0x50], 0x6c
mov byte [rsp + 0x51], 0x6c
mov byte [rsp + 0x52], 0x6f
mov byte [rsp + 0x53], 0x63
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x68], 0x56
mov byte [rsp + 0x69], 0x69
mov byte [rsp + 0x6a], 0x72
mov byte [rsp + 0x6b], 0x74
mov byte [rsp + 0x6c], 0x75
mov byte [rsp + 0x6d], 0x61
mov byte [rsp + 0x6e], 0x6c
mov byte [rsp + 0x6f], 0x50
mov byte [rsp + 0x70], 0x72
mov byte [rsp + 0x71], 0x6f
mov byte [rsp + 0x72], 0x74
mov byte [rsp + 0x73], 0x65
mov byte [rsp + 0x74], 0x63
mov byte [rsp + 0x75], 0x74
mov byte [rsp + 0x76], 0
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
call qword [rax]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x10], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x18], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x20], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x28], rax
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 9
rep stosb byte [rdi], al
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0xd
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0xf
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0xd
rep stosb byte [rdi], al
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xf
rep stosb byte [rdi], al
add rsp, 0x80
pop rdi
ret
Function at 0x180019858
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
lea rsi, [0x180045030]
mov ebp, 0x800
lea r8, str.._._._.._._.__
mov rcx, rsi
mov r9d, 0x1000
mov edx, ebp
call fcn.180019988
xor r14d, r14d
mov eax, r14d
xor byte [rax + rsi], 0x8a
inc rax
cmp rax, rbp
jl 0x18001989a
lea rcx, [rsp + 0x20]
mov r8d, ebp
mov rdx, rsi
call fcn.180014854
jmp 0x18001994a
lea rcx, [rsp + 0x20]
call fcn.180014900
lea rcx, [rsp + 0x20]
movsx ebx, ax
call fcn.180014900
mov rcx, qword [0x180050100]
movsx rdi, di
mov edx, ebx
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x180019934
dec edx
je 0x18001991d
dec edx
jne 0x18001994a
lea rcx, [rsp + 0x20]
movsx edx, ax
movsx rbx, ax
call fcn.18001489c
mov rcx, qword [0x180050100]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001d860
jmp 0x18001994a
lea rcx, [rsp + 0x20]
call fcn.180014864
mov rcx, qword [0x180050100]
mov dword [rdi + rcx + 8], eax
jmp 0x18001994a
lea rcx, [rsp + 0x20]
call fcn.180014900
mov rdx, qword [0x180050100]
mov word [rdi + rdx + 8], ax
lea rcx, [rsp + 0x20]
call fcn.180014900
movzx edi, ax
test ax, ax
jg 0x1800198bb
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp fcn.18001d470

Function at 0x180019988
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x1800199ce
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov ebx, edx
mov r11, rcx
xor r10d, r10d
movsxd rdi, r9d
mov eax, r10d
mov rcx, rdi
inc r10d
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [rcx + r8 - 1]
xor byte [r11], al
inc r11
cmp r10d, ebx
jl 0x1800199a1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800199d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov ebx, edx
mov r11, rcx
test edx, edx
jle 0x1800199fd
mov eax, r10d
inc r10d
cdq
idiv r9d
movsxd rax, edx
mov cl, byte [rax + r8]
xor byte [r11], cl
inc r11
cmp r10d, ebx
jl 0x1800199e1
mov rbx, qword [rsp + 8]
ret