joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180015fd0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x20a
mov word [rsp + 0x20], 0
call fcn.180099ff0
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x180016168
mov rdx, qword [rbx + 0x20]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x260], rsi
mov qword [rsp + 0x268], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
mov word [rsp + 0x22a], 0
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x180016068
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x18001606f
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x1800160c0
cmp rdx, 8
jb 0x180016084
mov rcx, qword [rdi]
jmp 0x180016087
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x1800160c0
cmp rdx, 8
jb 0x1800160a2
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.1800030f0
jmp 0x180016154
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x1800160d4
call fcn.180097730
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x180016108
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.180003d30
test rsi, rsi
je 0x180016154
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x180016121
mov rcx, qword [rdi]
jmp 0x180016124
test rsi, rsi
jne 0x1800160ec
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x18001611a
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x180016154
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.180098b20
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x180016146
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x260]
mov al, 1
jmp 0x18001616a
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180099050
add rsp, 0x240
pop rbx
ret
Function at 0x180016190
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x20a
mov word [rsp + 0x20], 0
call fcn.180099ff0
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x180016328
mov rdx, qword [rbx + 0x20]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x260], rsi
mov qword [rsp + 0x268], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
mov word [rsp + 0x22a], 0
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x180016228
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x18001622f
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x180016280
cmp rdx, 8
jb 0x180016244
mov rcx, qword [rdi]
jmp 0x180016247
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x180016280
cmp rdx, 8
jb 0x180016262
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.1800030f0
jmp 0x180016314
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x180016294
call fcn.180097730
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x1800162c8
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.180003d30
test rsi, rsi
je 0x180016314
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x1800162e1
mov rcx, qword [rdi]
jmp 0x1800162e4
test rsi, rsi
jne 0x1800162ac
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x1800162da
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x180016314
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.180098b20
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x180016306
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x260]
mov al, 1
jmp 0x18001632a
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180099050
add rsp, 0x240
pop rbx
ret
Function at 0x180016350
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbp, rcx
cmp qword [rdx + 0x20], 8
jb 0x18001638e
lea rbx, [rdx + 8]
mov rdx, qword [rbx]
jmp 0x180016395
lea rbx, [rdx + 8]
mov rdx, rbx
cmp qword [rcx + 0x20], 8
jb 0x1800163a5
lea rsi, [rcx + 8]
mov rcx, qword [rsi]
jmp 0x1800163ac
lea rsi, [rcx + 8]
mov rcx, rsi
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1800163c3
mov al, 1
jmp 0x1800164cb
cmp qword [rdi + 0x20], 8
jb 0x1800163cf
mov rcx, qword [rbx]
jmp 0x1800163d2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800164c9
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800030f0
nop
lea rcx, [rsp + 0x28]
call fcn.180016e40
test al, al
je 0x1800164b7
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
cmp qword [rdi + 0x20], 8
jb 0x18001643e
mov rcx, qword [rbx]
jmp 0x180016441
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1800164b7
cmp qword [rdi + 0x20], 8
jb 0x180016457
mov rdx, qword [rbx]
jmp 0x18001645a
mov rdx, rbx
cmp qword [rbp + 0x20], 8
jb 0x180016464
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x180016492
lea rcx, [rsp + 0x28]
call fcn.180016510
nop
cmp qword [rsp + 0x48], 8
jb 0x18001648e
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov al, 1
jmp 0x1800164cb
cmp qword [rdi + 0x20], 8
jb 0x18001649c
mov rbx, qword [rbx]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop
cmp qword [rsp + 0x48], 8
jb 0x1800164c9
mov rcx, qword [rsp + 0x30]
call fcn.180098980
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099050
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x180016510
Capabilities:
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
cmp qword [rcx + 0x20], 8
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
mov rsi, rcx
jb 0x18001653d
mov r12, qword [rcx + 8]
lea rbx, [rcx + 8]
jmp 0x180016544
lea rbx, [rcx + 8]
mov r12, rbx
or rcx, 0xffffffffffffffff
xor r8d, r8d
xor eax, eax
mov edx, 7
mov rdi, r12
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov word [rsp + 0x28], r8w
repne scasw ax, word [rdi]
not rcx
movabs rax, 0x7ffffffffffffffe
sub rcx, 1
cmp rcx, rax
mov rbp, rcx
jbe 0x180016590
call fcn.180097730
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
cmp rdx, rbp
jae 0x180016643
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.180003d30
mov rdx, qword [rsp + 0x40]
test rbp, rbp
je 0x1800165f3
cmp rdx, 8
lea rcx, [rsp + 0x28]
lea rdi, [rbp + rbp]
cmovae rcx, qword [rsp + 0x28]
add rdx, rdx
mov r9, rdi
mov r8, r12
call fcn.180098b20
cmp qword [rsp + 0x40], 8
lea rax, [rsp + 0x28]
cmovae rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbp
mov word [rdi + rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
test eax, eax
sete dil
cmp qword [rsp + 0x40], 8
jb 0x18001662c
mov rcx, qword [rsp + 0x28]
call fcn.180098980
test dil, dil
mov rdi, qword [rsp + 0x68]
je 0x18001666a
xor al, al
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
test rbp, rbp
jne 0x1800165ab
cmp rdx, 8
lea rax, [rsp + 0x28]
mov qword [rsp + 0x38], rbp
cmovae rax, qword [rsp + 0x28]
mov word [rax], bp
mov rdx, qword [rsp + 0x40]
jmp 0x1800165f3
cmp qword [rsi + 0x20], 8
jb 0x180016674
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x78]
test eax, eax
setne al
add rsp, 0x50
pop rsi
ret
Function at 0x1800169e0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x20a
mov word [rsp + 0x20], 0
call fcn.180099ff0
cmp qword [rsi + 0x20], 8
jb 0x180016a2c
mov rdx, qword [rsi + 8]
jmp 0x180016a30
lea rdx, [rsi + 8]
cmp qword [rdi + 0x20], 8
jb 0x180016a3d
mov rcx, qword [rdi + 8]
jmp 0x180016a41
lea rcx, [rdi + 8]
lea r9, [rsp + 0x20]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180016b7e
mov rdx, qword [rbx + 0x20]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
mov word [rsp + 0x22a], 0
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x180016a8a
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x180016a91
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x180016ae4
cmp rdx, 8
jb 0x180016aa6
mov rcx, qword [rdi]
jmp 0x180016aa9
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x180016ae4
cmp rdx, 8
jb 0x180016ac4
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.1800030f0
mov al, 1
jmp 0x180016b80
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x180016af8
call fcn.180097730
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x180016b2c
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.180003d30
test rsi, rsi
je 0x180016b7a
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x278], rbp
cmp rdx, 8
jb 0x180016b47
mov rcx, qword [rdi]
jmp 0x180016b4a
test rsi, rsi
jne 0x180016b10
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x180016b3e
mov rdi, qword [rdi]
mov word [rdi], 0
mov al, 1
jmp 0x180016b80
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.180098b20
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x180016b6c
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x278]
mov al, 1
jmp 0x180016b80
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180099050
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x180017e40
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov edi, edx
xor ebp, ebp
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x20], ebp
mov word [rsp + 0x30], bp
call fcn.180099ff0
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x180017ebd
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], rbp
lea rdx, [0x1800c93e8]
xor r8d, r8d
mov rcx, rsi
mov word [rsi + 8], bp
call fcn.180003980
jmp 0x180017fda
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsi + 0x20], 7
mov qword [rsp + 0x280], rbx
lea rbx, [rsi + 8]
lea rdi, [rsp + 0x30]
mov qword [rsi + 0x18], rbp
mov word [rbx], bp
mov rdx, qword [rsi + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rdi, [rcx - 1]
jb 0x180017efc
mov rax, qword [rbx]
jmp 0x180017eff
mov rax, rbx
lea rcx, [rsp + 0x30]
cmp rcx, rax
jb 0x180017f50
cmp rdx, 8
jb 0x180017f14
mov rcx, qword [rbx]
jmp 0x180017f17
mov rcx, rbx
mov rax, qword [rsi + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x30]
cmp rcx, rax
jbe 0x180017f50
cmp rdx, 8
jb 0x180017f32
mov rbx, qword [rbx]
lea r8, [rsp + 0x30]
mov r9, rdi
mov rdx, rsi
sub r8, rbx
mov rcx, rsi
sar r8, 1
call fcn.1800030f0
jmp 0x180017fd2
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
jbe 0x180017f64
call fcn.180097730
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x180017f90
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.180003d30
test rdi, rdi
je 0x180017fd2
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x180017fa7
mov rcx, qword [rbx]
jmp 0x180017faa
test rdi, rdi
jne 0x180017f7c
cmp rax, 8
mov qword [rsi + 0x18], rbp
jb 0x180017fa2
mov rbx, qword [rbx]
mov word [rbx], bp
jmp 0x180017fd2
mov rcx, rbx
lea rbp, [rdi + rdi]
lea r8, [rsp + 0x30]
add rdx, rdx
mov r9, rbp
call fcn.180098b20
cmp qword [rsi + 0x20], 8
mov qword [rsi + 0x18], rdi
jb 0x180017fcc
mov rbx, qword [rbx]
mov word [rbx + rbp], 0
mov rbx, qword [rsp + 0x280]
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180099050
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x180018000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
cmp qword [rdx + 0x20], 8
jb 0x18001801a
mov rdi, qword [rdx + 8]
jmp 0x18001801e
lea rdi, [rdx + 8]
cmp qword [rcx + 0x20], 8
jb 0x18001802b
mov rbx, qword [rcx + 8]
jmp 0x18001802f
lea rbx, [rcx + 8]
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call fcn.180099ff0
mov dword [rsp + 0x20], 0x70
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x28], rax
lea rax, str.open
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x24], eax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1800180ac
cmp qword [rsp + 0x58], 0x20
seta al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x180030680
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
test rdx, rdx
mov r10, rdx
je 0x1800307ad
test r8, r8
je 0x1800307ad
test r9d, r9d
jle 0x1800307ad
cmp r9d, 3
mov qword [rsp], rbx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
jl 0x18003073e
mov eax, 0xaaaaaaab
mul r9d
shr edx, 1
mov eax, edx
mov r11d, edx
imul eax, eax, 0xfffffffd
add r9d, eax
nop
movzx eax, byte [r8]
add r10, 4
add r8, 3
shr rax, 2
movzx eax, byte [rax + rbx]
mov byte [r10 - 4], al
mov al, byte [r8 - 3]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [r8 - 2]
shr eax, 4
or rcx, rax
movzx eax, byte [rcx + rbx]
mov byte [r10 - 3], al
mov al, byte [r8 - 2]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [r8 - 1]
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + rbx]
mov byte [r10 - 2], al
mov al, byte [r8 - 1]
and eax, 0x3f
sub r11, 1
movzx eax, byte [rax + rbx]
mov byte [r10 - 1], al
jne 0x1800306d0
test r9d, r9d
jle 0x18003079e
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rbx]
mov byte [r10], al
movzx ecx, byte [r8]
and cl, 3
shl cl, 4
cmp r9d, 1
jle 0x18003076c
movzx eax, byte [r8 + 1]
shr al, 4
or cl, al
cmp r9d, 2
movzx eax, cl
movzx eax, byte [rax + rbx]
mov byte [r10 + 1], al
jge 0x180030781
mov al, 0x3d
jmp 0x180030791
mov al, byte [r8 + 1]
and eax, 0xf
shl eax, 2
cdqe
movzx eax, byte [rax + rbx]
mov byte [r10 + 2], al
mov byte [r10 + 3], 0x3d
add r10, 4
mov rbx, qword [rsp]
mov byte [r10], 0
mov al, 1
add rsp, 8
ret
xor al, al
add rsp, 8
ret
Function at 0x180031d70
Capabilities:
Hash data with md5

Disassembly:
test rcx, rcx
je 0x180031e7a
push rbx
push rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov esi, edx
mov rbp, r8
mov rbx, rcx
cmp esi, 1
jl 0x180031e60
xor eax, eax
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [r8], rax
mov qword [r8 + 8], rax
lea r8d, [rax + 0x58]
call fcn.180099ff0
xor r11d, r11d
test esi, esi
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x24], r11d
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x34], 0x10325476
lea ecx, [rsi*8]
jle 0x180031e53
mov eax, esi
mov dword [rsp + 0x20], ecx
sar eax, 0x1d
cmp esi, 0x40
mov dword [rsp + 0x24], eax
jl 0x180031e3f
mov qword [rsp + 0xc8], rdi
mov rdi, rsi
shr rdi, 6
mov eax, edi
shl eax, 6
sub esi, eax
nop
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18004e5f0
add rbx, 0x40
sub rdi, 1
jne 0x180031e20
mov rdi, qword [rsp + 0xc8]
test esi, esi
je 0x180031e53
lea rcx, [rsp + 0x38]
movsxd r8, esi
mov rdx, rbx
call fcn.1800999d0
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.18004ee90
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180099050
add rsp, 0x90
pop rsi
pop rbp
pop rbx
ret 0

Function at 0x180031d79
Capabilities:
Hash data with md5

Disassembly:
test rcx, rcx
je 0x180031e7a
push rbx
push rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov esi, edx
mov rbp, r8
mov rbx, rcx
cmp esi, 1
jl 0x180031e60
xor eax, eax
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [r8], rax
mov qword [r8 + 8], rax
lea r8d, [rax + 0x58]
call fcn.180099ff0
xor r11d, r11d
test esi, esi
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x24], r11d
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x34], 0x10325476
lea ecx, [rsi*8]
jle 0x180031e53
mov eax, esi
mov dword [rsp + 0x20], ecx
sar eax, 0x1d
cmp esi, 0x40
mov dword [rsp + 0x24], eax
jl 0x180031e3f
mov qword [rsp + 0xc8], rdi
mov rdi, rsi
shr rdi, 6
mov eax, edi
shl eax, 6
sub esi, eax
nop
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18004e5f0
add rbx, 0x40
sub rdi, 1
jne 0x180031e20
mov rdi, qword [rsp + 0xc8]
test esi, esi
je 0x180031e53
lea rcx, [rsp + 0x38]
movsxd r8, esi
mov rdx, rbx
call fcn.1800999d0
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.18004ee90
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180099050
add rsp, 0x90
pop rsi
pop rbp
pop rbx
ret 0
Function at 0x1800325a0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rsi, rdx
mov r13, rcx
mov qword [r11 - 0x48], rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov byte [r11 - 0x40], r14b
xor eax, eax
mov qword [r11 - 0x3f], rax
mov dword [r11 - 0x37], eax
mov word [r11 - 0x33], ax
mov byte [r11 - 0x31], al
mov rbp, qword [rdx + 0x18]
cmp qword [rdx + 0x20], 0x10
jb 0x180032613
lea r12, [rdx + 8]
mov rbx, qword [r12]
jmp 0x18003261a
lea r12, [rdx + 8]
mov rbx, r12
test rbx, rbx
je 0x1800326dd
cmp ebp, 1
jl 0x1800326dd
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0x30]
call fcn.180099ff0
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x38], 0x67452301
mov dword [rsp + 0x3c], 0xefcdab89
mov dword [rsp + 0x40], 0x98badcfe
mov dword [rsp + 0x44], 0x10325476
lea ecx, [rbp*8]
test ebp, ebp
jle 0x1800326cb
mov eax, ebp
sar eax, 0x1d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], ecx
cmp ebp, 0x40
jl 0x1800326b7
mov edi, ebp
shr rdi, 6
mov eax, edi
shl eax, 6
sub ebp, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18004e5f0
add rbx, 0x40
sub rdi, 1
jne 0x1800326a0
test ebp, ebp
je 0x1800326cb
movsxd r8, ebp
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800999d0
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.18004ee90
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.180032400
nop
cmp qword [rsi + 0x20], 0x10
jb 0x1800326fe
mov rcx, qword [r12]
call fcn.180098980
mov qword [rsi + 0x20], 0xf
mov qword [rsi + 0x18], r14
mov byte [r12], 0
mov rax, r13
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180099050
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180032da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
sub rsp, 0x88
cmp qword [rcx + 0x40], 0
mov rbx, rcx
mov eax, 1
je 0x180032dc2
call fcn.180032a90
mov rbp, qword [rbx + 0xe0]
test rbp, rbp
mov qword [rsp + 0x20], rbp
je 0x18003301e
mov qword [rsp + 0x80], rsi
xor esi, esi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x28], 0x454d4147
mov dword [rsp + 0x2c], 0x2d52474d
mov r8d, esi
mov rdx, rsi
mov dword [rsp + 0x30], 0x2d333231
mov dword [rsp + 0x34], 0x2d363534
mov dword [rsp + 0x38], 0x2d393837
mov dword [rsp + 0x3c], 0x2d323130
mov dword [rsp + 0x40], 0x2d353433
mov dword [rsp + 0x44], 0x2d383736
nop
nop
nop
nop
mov eax, dword [rsp + rdx*4 + 0x28]
add rdx, 1
lea ecx, [r8 + rax*2]
add r8d, 1
cmp rdx, 8
mov dword [rsp + rdx*4 + 0x24], ecx
jl 0x180032e40
lea eax, [rbp + 1]
mov edi, eax
cmp rdi, qword [rbx + 0xb0]
je 0x180032ec7
test eax, eax
mov r12, rsi
je 0x180032ea8
mov rcx, rdi
call fcn.180097720
cmp qword [rbx + 0xb0], rsi
mov r12, rax
jbe 0x180032ea8
mov rdx, qword [rbx + 0xb8]
test rdx, rdx
je 0x180032ea8
mov rcx, qword [rbx + 0xb0]
mov r8, rdi
cmp rcx, rdi
cmovb r8, rcx
mov rcx, rax
call fcn.1800999d0
mov rcx, qword [rbx + 0xb8]
test rcx, rcx
je 0x180032eb9
call fcn.180099070
mov qword [rbx + 0xb8], r12
mov qword [rbx + 0xb0], rdi
mov rcx, qword [rbx + 0xb8]
mov r8, rdi
xor edx, edx
call fcn.180099ff0
mov r12, qword [rbx + 0xb8]
mov rdi, qword [rbx + 0xd8]
test r12, r12
je 0x180033007
test rdi, rdi
je 0x180033007
cmp ebp, 4
jb 0x180033007
mov qword [rsp + 0x60], r14
call fcn.18005d7b0
mov r11d, ebp
shr r11d, 3
mov r14d, ebp
mov ecx, r11d
and r14d, 7
test r11d, r11d
mov qword [rsp + 0xb8], rcx
jle 0x180032fc2
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], r15
mov r15, rdi
lea r13, [r12 + 4]
mov rbx, rsi
mov rbp, rcx
sub r15, r12
nop
nop
mov eax, dword [rdi + rbx*8]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xb0]
mov dword [rsp + 0xa8], eax
mov eax, dword [r15 + r13]
lea rcx, [rsp + 0xa8]
mov dword [rsp + 0xac], eax
call fcn.18005e8a0
mov r11d, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xb4]
add rbx, 1
mov dword [r13 - 4], r11d
mov dword [r13], eax
add r13, 8
cmp rbx, rbp
jl 0x180032f50
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x20]
mov rcx, qword [rsp + 0xb8]
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x68]
test r14d, r14d
jle 0x180032fe2
movsxd rdx, r14d
lea rcx, [r12 + rcx*8]
sub rdi, r12
movzx eax, byte [rcx + rdi]
add rcx, 1
sub rdx, 1
mov byte [rcx - 1], al
jne 0x180032fd1
mov rdx, qword [rbx + 0xb8]
mov r8d, ebp
mov rcx, rbx
call fcn.180033030
mov r14, qword [rsp + 0x60]
mov ecx, 3
test al, al
cmove esi, ecx
mov eax, esi
jmp 0x18003300c
mov eax, 2
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x70]
add rsp, 0x88
pop rbp
pop rbx
ret
Function at 0x180037d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov r12, rcx
mov ecx, 0x400
mov rbp, r8
mov rdi, rdx
mov dword [rsp + 0x30], 1
xor sil, sil
call fcn.180098a00
xor edx, edx
mov r8d, 0x400
mov rcx, rax
mov rbx, rax
call fcn.180099ff0
mov rcx, qword [r12]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x78], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180037df2
mov rcx, rbp
mov dword [r12 + 8], eax
call fcn.180002c90
jmp 0x180037e13
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
mov sil, 1
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.180003980
mov rcx, rbx
call fcn.180098ad0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov al, sil
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x180037e40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [r8], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180037e8f
mov dword [rbx + 8], eax
xor al, al
add rsp, 0x30
pop rbx
ret
mov al, 1
add rsp, 0x30
pop rbx
ret