joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180066914
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x1800669ad
cmp esi, edi
jne 0x180066965
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.180065014
test rax, rax
je 0x1800669c0
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x1800669e9
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x180066942
cmp esi, edi
jne 0x180066a27
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.180065014
test rax, rax
jne 0x180066a24
lea r8, str.out_of_memory
mov edx, 0xc8
mov rcx, rbp
call fcn.18003f3ec
test rbx, rbx
je 0x1800669e5
mov rax, qword [fcn.180095704]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x180066a50
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x180066a04
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x180066a0b
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1800cf744]
mov edx, 0xc8
mov rcx, rbp
call fcn.18003f3ec
jmp 0x1800669d4
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.180066258
mov rdi, rax
test rbx, rbx
je 0x180066a4d
mov rdx, qword [fcn.180095704]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180067c64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800c1640]
mov r9d, ecx
not r9d
cmp r8, 4
jb 0x180067cb6
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
xor r11d, r11d
movzx ecx, byte [r11 + rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rbx + rax*4]
cmp r11, 4
jl 0x180067c8d
add rdx, 4
sub r10, 1
jne 0x180067c8a
test r8, r8
je 0x180067cd8
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r8, 1
jne 0x180067cbb
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x180071c80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, rdx
mov ecx, 0xfffffffd
sub rax, r8
mov rdi, r8
add rax, 0x7ffffffa
mov rsi, rdx
cmp rax, rcx
ja 0x180071d24
mov byte [rbp - 0x20], WSACleanup
mov byte [rbp - 0x1f], 0x75
mov byte [rbp - 0x1e], 0x78
mov byte [rbp - 0x1d], 0x28
mov byte [rbp - 0x1c], 0x38
mov byte [rbp - 0x1b], 0x80
mov byte [rbp - 0x1a], 0x2d
mov byte [rbp - 0x19], 0x38
mov byte [rbp - 0x18], 0x39
mov byte [rbp - 0x17], 0x3e
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x14], 0x80
mov byte [rbp - 0x13], 0
movzx eax, byte [rbp - 0x20]
xor eax, eax
nop dword [rax]
movzx ecx, byte [rbp + rax - 0x20]
sub cl, 8
mov byte [rbp + rax - 0x20], cl
inc rax
cmp rax, 0xd
jb 0x180071cf0
mov r8, rsi
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.18007a9e0
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
mov dword [rbp - 0x10], 0x10
mov eax, dword [rbp - 0x10]
xor al, 0x6a
mov qword [rsp + 0x50], rbx
mov byte [rbp - 0xc], al
mov eax, dword [rbp - 0x10]
inc al
xor al, 0x6d
mov byte [rbp - 0xb], al
mov eax, dword [rbp - 0x10]
add al, 2
xor al, 0x70
mov byte [rbp - 0xa], al
mov eax, dword [rbp - 0x10]
add al, 3
xor al, 0x20
mov byte [rbp - 9], al
mov eax, dword [rbp - 0x10]
add al, 4
xor al, 0x5b
mov byte [rbp - 8], al
mov eax, dword [rbp - 0x10]
add al, 5
xor al, 0x72
mov byte [rbp - 7], al
mov eax, dword [rbp - 0x10]
add al, 6
xor al, 0x69
mov byte [rbp - 6], al
mov eax, dword [rbp - 0x10]
add al, 7
xor al, 0x70
mov byte [rbp - 5], al
mov eax, dword [rbp - 0x10]
add al, 8
xor al, 0x5d
mov byte [rbp - 4], al
xor eax, eax
mov byte [rbp - 3], al
movzx eax, byte [rbp - 0xc]
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax - 0xc]
mov edx, dword [rbp - 0x10]
add dl, al
xor dl, cl
mov byte [rbp + rax - 0xc], dl
inc rax
cmp rax, 9
jb 0x180071da0
lea rdx, [rbp - 0xc]
mov byte [rbp - 3], 0
mov rcx, rdi
call fcn.18007a9e0
mov r8d, 8
mov qword [rbp + 0x18], rsi
lea rdx, [rbp + 0x18]
mov rbx, rax
lea rcx, [rax + rdi]
call fcn.18007b660
mov rsi, qword [rsp + 0x60]
add rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x180071e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x48], rbp
mov rbp, r8
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov qword [rsp + 0x20], r14
mov r14, rcx
mov ecx, 0x10
call fcn.180091200
mov qword [rsp + 0x40], rax
mov rbx, rax
test rax, rax
je 0x180071e8f
mov qword [rsp + 0x28], rdi
lea rax, vtable.MemoryAllocator.0
mov rdi, rbp
mov qword [rbx], rax
and rdi, 0xfffffffffffff000
mov qword [rbx + 8], 0
test rbp, rbp
cmove rdi, rbp
nop dword [rax]
add rdi, 0x1000
mov r9d, 0x40
mov rcx, rdi
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 8], rax
test rax, rax
je 0x180071e60
mov rdi, qword [rsp + 0x28]
jmp 0x180071e91
xor ebx, ebx
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 8]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x40], rbx
cmp rdx, qword [rcx + 0x10]
je 0x180071ec5
mov qword [rdx], rbx
add qword [rcx + 8], 8
mov rax, qword [rbx + 8]
add rsp, 0x30
pop rbx
ret
lea r8, [rsp + 0x40]
call fcn.18006e580
mov rax, qword [rbx + 8]
add rsp, 0x30
pop rbx
ret
Function at 0x180074a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rax, r8
sub rax, rdx
mov rbp, rcx
add rax, 0x7ffffffa
mov ecx, 0xfffffffd
cmp rax, rcx
mov r15, r8
mov r8d, 0xe
mov edx, 5
cmova edx, r8d
mov rcx, rdi
call fcn.18007b040
lea rcx, [rbp + 8]
mov r8, rdi
mov r14, rax
lea rdx, [rax + 0x100]
call fcn.180071e00
mov r9, r14
mov r8, rdi
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call fcn.18007ba90
add rsi, rax
mov rcx, rsi
call fcn.180073210
mov byte [rsp + 0x20], 0x75
mov byte [rsp + 0x21], 0x77
mov byte [rsp + 0x22], 0x7e
mov byte [rsp + 0x23], 0x28
lea rbx, [rsi + rax]
mov byte [rsp + 0x24], 0x7a
mov byte [rsp + 0x25], 0x6b
mov byte [rsp + 0x26], 0x80
mov byte [rsp + 0x27], 0x34
mov byte [rsp + 0x28], 0x28
mov byte [rsp + 0x29], 0x7a
mov byte [rsp + 0x2a], 0x7b
mov byte [rsp + 0x2b], 0x78
mov byte [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x20]
xor eax, eax
nop dword [rax]
movzx ecx, byte [rsp + rax + 0x20]
sub cl, 8
mov byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xc
jb 0x180074b50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18007a9e0
add rbx, rax
mov rdx, r15
mov r8, rbx
mov rcx, rbp
call fcn.180070c80
add rbx, rax
mov rcx, rbx
call fcn.180071ee0
add rbx, rax
mov r9, r14
mov rdx, rbx
mov r8, rdi
mov rcx, rbp
call fcn.1800713a0
lea rdx, [r14 + rdi]
mov rcx, rbp
lea r8, [rax + rbx]
call fcn.180071c80
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.180071c80
sub r14, rax
mov rdx, r14
lea rcx, [rax + rdi]
call fcn.18007b700
mov rbx, qword [rsp + 0x50]
mov al, 1
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1800769e0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x180076aac
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x180076aac
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180076ac5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x180076a9c
cmp byte [rax], 0x5c
jne 0x180076a96
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x180076a96
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180076a82
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x180076a93
test r8b, 0x10
jne 0x180076a96
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x180076a96
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.180078e50
test edi, edi
jne 0x180076a00
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.1800779b0
int3

Function at 0x180079400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180079434
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180079420
ret
Function at 0x18007b4b0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x230
mov r12, r9
mov r14, r8
mov rbx, rdx
xor sil, sil
call fcn.18007adc0
mov r15, rax
test rax, rax
je 0x18007b63a
mov qword [rsp + 0x250], rbp
mov qword [rsp + 0x258], rdi
test rbx, rbx
jne 0x18007b4fd
xor ecx, ecx
jmp 0x18007b509
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x1800a7e60]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__wfopen
xor edx, edx
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 2]
call sub.msvcrt.dll_fseek
mov rcx, rdi
call sub.msvcrt.dll_ftell
xor r8d, r8d
movsxd rbx, eax
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_fseek
mov rcx, rbx
call fcn.1800917a4
mov r9, rdi
mov r8d, 1
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_fread
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rdi, qword [rsp + 0x258]
mov eax, 0x5a4d
cmp word [rbp], ax
jne 0x18007b62a
movsxd rcx, dword [rbp + 0x3c]
add rcx, rbp
cmp dword [rcx], 0x4550
jne 0x18007b62a
movzx ebx, word [rcx + 0x14]
xor r9d, r9d
movzx r11d, word [rcx + 6]
add rbx, rcx
test r11d, r11d
je 0x18007b62a
nop dword [rax]
movsxd rax, r9d
lea r8, [rbx + 0x18]
lea rcx, [rax + rax*4]
mov rax, r14
lea r10, [rcx*8]
add r8, r10
sub r8, r14
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18007b5f3
inc rax
test ecx, ecx
jne 0x18007b5e0
test edx, edx
je 0x18007b601
inc r9d
cmp r9d, r11d
jl 0x18007b5c0
jmp 0x18007b62a
mov eax, dword [r10 + rbx + 0x24]
mov sil, 1
add rax, r15
mov qword [r12], rax
mov ecx, dword [r10 + rbx + 0x28]
cmp ecx, dword [r10 + rbx + 0x20]
mov rax, qword [rsp + 0x270]
cmovbe ecx, dword [r10 + rbx + 0x20]
mov dword [rax], ecx
mov rcx, rbp
call fcn.18009168c
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
movzx eax, sil
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x18007b660
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov dword [rsp + 0x50], 0
mov rbx, rdx
lea r9, [rsp + 0x50]
mov rdx, rsi
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rsi
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18007b760
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push r14
push r15
sub rsp, 0x20
movzx r15d, r8b
mov r14, rdx
mov rsi, rcx
call fcn.18007bd70
mov rbp, rax
test rax, rax
jne 0x18007b799
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rax, qword [rax + 8]
cmp qword [rbp], rax
je 0x18007b828
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rdi, qword [rax - 8]
mov rcx, r14
mov r8, qword [rdi]
lea rdx, [rdi + 8]
call fcn.18007b660
mov rax, qword [rsi + 0x18]
mov rbx, qword [rsi + 0x10]
cmp rbx, rax
je 0x18007b80c
mov rcx, qword [rbx]
cmp qword [rcx + 8], rdi
je 0x18007b7e5
add rbx, 8
cmp rbx, rax
jne 0x18007b7d1
jmp 0x18007b80c
test rcx, rcx
je 0x18007b7f4
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov r8, qword [rsi + 0x18]
lea rdx, [rbx + 8]
sub r8, rdx
mov rcx, rbx
call sub.msvcrt.dll_memmove
add qword [rsi + 0x18], 0xfffffffffffffff8
mov rax, qword [rbp + 8]
add rax, 0xfffffffffffffff8
mov qword [rbp + 8], rax
cmp qword [rbp], rax
jne 0x18007b7b1
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test r15b, r15b
je 0x18007b934
mov r8, qword [rsi + 0x98]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, r14b
xor rdx, rax
movzx eax, byte [rsp + 0x49]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x4a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x4b]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x4c]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x4d]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x4e]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x4f]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rsi + 0x70]
and r8, rdx
shl r8, 4
add r8, qword [rsi + 0x80]
mov r9, qword [r8 + 8]
mov rdx, r9
cmp r9, rcx
je 0x18007b8e3
mov rax, qword [r8]
cmp r14, qword [r9 + 0x10]
je 0x18007b8e5
cmp rdx, rax
je 0x18007b8e3
mov rdx, qword [rdx + 8]
cmp r14, qword [rdx + 0x10]
jne 0x18007b8d2
jmp 0x18007b8e5
xor edx, edx
test rdx, rdx
je 0x18007b934
mov rax, qword [r8]
cmp r9, rdx
jne 0x18007b90a
cmp rax, rdx
jne 0x18007b900
mov qword [r8], rcx
mov qword [r8 + 8], rcx
jmp 0x18007b915
mov rcx, qword [rdx + 8]
mov qword [r8 + 8], rcx
jmp 0x18007b915
cmp rax, rdx
jne 0x18007b915
mov rax, qword [rdx]
mov qword [r8], rax
mov r8, qword [rdx]
lea rcx, [rsi + 0x70]
dec qword [rsi + 0x78]
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
call fcn.18007a000
mov rbp, qword [rsp + 0x58]
mov al, 1
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x18007bd70
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
movzx r8d, dl
mov r9, rcx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
mov r10, qword [r9 + 0x70]
mov qword [r11 + 0x10], rdx
movzx eax, byte [r11 + 0x11]
xor r8, rax
movzx eax, byte [r11 + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x13]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x14]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x15]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x16]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x17]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r9 + 0x98]
and rcx, r8
xor r8d, r8d
shl rcx, 4
add rcx, qword [r9 + 0x80]
mov rax, qword [rcx + 8]
cmp rax, r10
je 0x18007be31
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x18007be34
nop dword [rax + rax]
cmp rax, rcx
je 0x18007be31
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x18007be20
jmp 0x18007be34
mov rax, r8
test rax, rax
cmove rax, r10
cmp rax, r10
lea rcx, [rax + 0x18]
cmovne r8, rcx
mov rax, r8
ret
Function at 0x18007c2e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rbx, rdx
mov rdi, rcx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x18007c300
cmp rax, 0x100
jae 0x18007c3d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x230
call sub.msvcrt.dll_memset
mov r8, rbx
mov qword [rsp + 0x38], rdi
mov edx, 0x100
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_strcpy_s
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], 1
call fcn.18007c5b0
test eax, eax
je 0x18007c3d0
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x280]
mov r8d, 0x40
mov dword [rsp + 0x280], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x280]
mov r8d, dword [rsp + 0x280]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov rbx, qword [rsp + 0x270]
xor eax, eax
add rsp, 0x260
pop rdi
ret
Function at 0x18007c530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, qword [rdx]
mov r10, r9
mov r9d, dword [rsp + 0x28]
movsxd r8, r8d
inc r9d
mov byte [rsp + 0x28], 1
mov rdx, qword [rax + r8*8]
mov r8, r10
jmp fcn.1800747a0

Function at 0x18007c8d0
Capabilities:
Encode data using xor

Disassembly:
cmp ecx, 0x38c
jl 0x180087560
xor eax, eax
ret
xor eax, eax
lea r10, [0x18010ebc0]
mov byte [0x18010ebd0], al
xorps xmm0, xmm0
imul eax, ecx, 0x11
movups xmmword [0x18010ebc0], xmm0
movsxd rdx, eax
add rdx, qword [section..data]
movzx eax, cl
imul r11d, eax, 0xd
movzx r9d, r11b
xor r9b, 0x6e
xor r8d, r8d
nop dword [rax + rax]
movzx ecx, r9b
lea r10, [r10 + 1]
xor cl, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r10 - 1], cl
movzx ecx, r11b
add cl, byte [rdx - 1]
add cl, r8b
inc r8d
add r9b, cl
cmp r8d, 0x11
jl 0x1800875a0
lea rax, [0x18010ebc0]
ret

Function at 0x18007de50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, r9d
xor ecx, ecx
mov rdi, r8
mov rsi, rdx
cmp r8, 0xffffffffffffffff
jne 0x18007dea3
movzx eax, byte [rdx]
mov edi, ecx
test al, al
je 0x18007de97
imul ecx, ecx, 0x1003f
inc rdi
movzx eax, al
add ecx, eax
movzx eax, byte [rdi + rdx]
test al, al
jne 0x18007de81
test rdi, rdi
jne 0x18007decf
xor eax, eax
jmp 0x18007df52
mov rdx, rcx
test r8, r8
je 0x18007de97
nop dword [rax + rax]
movzx eax, byte [rdx + rsi]
test al, al
je 0x18007deca
imul ecx, ecx, 0x1003f
inc rdx
add ecx, eax
cmp rdx, r8
jb 0x18007deb0
jmp 0x18007de97
mov ecx, 0x11
mov eax, dword [rbx + 0x108]
mov edx, ecx
xor edx, ebp
mov qword [rsp + 0x30], r14
mov r14d, 0xffffffff
cmp ebp, r14d
cmove edx, ecx
movzx ecx, byte [rbx + 0x10c]
imul rax, rdx
shr rax, cl
imul eax, dword [rbx + 0x100]
mov rbx, qword [rbx + 0xf0]
sub edx, eax
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x18007df4a
mov eax, dword [rbx + 0x30]
cmp eax, edi
jne 0x18007df39
cmp dword [rbx + 0x14], ebp
jne 0x18007df39
lea rcx, [rbx + 0x34]
cmp eax, 0xb
jbe 0x18007df2a
mov rcx, qword [rbx + 0x38]
mov r8d, edi
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x18007df41
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18007df11
test rbx, rbx
je 0x18007df4a
mov r14d, dword [rbx + 0xc]
mov eax, r14d
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800866c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, qword [r9 + 0x10]
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
cmp rbx, 0x20
ja 0x1800867b7
xor r12d, r12d
nop dword [rax + rax]
mov r10, qword [rdi + 8]
mov r9, r12
test rbx, rbx
je 0x180086748
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov ecx, 0x20
add r8, r9
movzx edx, byte [r10 + r8]
lea eax, [rdx - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r9
xor cl, dl
mov byte [r8], cl
cmp r9, rbx
jb 0x180086720
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180085f40
mov dword [r14], eax
test eax, eax
jne 0x1800867e2
mov rcx, qword [r15]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx ecx, byte [rcx + 0x48]
call fcn.18008c6c0
mov dword [r14], eax
test eax, eax
jne 0x1800867e2
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180086400
test eax, eax
je 0x1800867b7
mov ecx, dword [rsi]
test eax, ecx
jne 0x1800867db
or ecx, eax
xor r8d, r8d
mov dword [rsi], ecx
mov rdx, rdi
lea rcx, [r15 + 8]
call fcn.18008c740
cmp al, 2
jne 0x1800867b7
mov rbx, qword [rdi + 0x10]
cmp rbx, 0x20
jbe 0x180086700
mov eax, 0x1a
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov eax, 0x37
jmp 0x1800867bc
xor r8d, r8d
lea rcx, [r15 + 8]
mov rdx, rdi
call fcn.18008c740
cmp al, 2
jne 0x180086855
mov rdx, qword [rdi + 0x10]
cmp rdx, 0x20
ja 0x180086855
mov r11, qword [rdi + 8]
mov r10, r12
test rdx, rdx
je 0x18008683d
lea rax, [rsp + 0x20]
sub r11, rax
lea r9, [rsp + 0x20]
mov ecx, 0x20
add r9, r10
movzx r8d, byte [r11 + r9]
lea eax, [r8 - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r10
xor cl, r8b
mov byte [r9], cl
cmp r10, rdx
jb 0x180086813
lea rcx, [rsp + 0x20]
call fcn.180086400
cmp eax, 0x10
jne 0x180086855
or dword [rsi], eax
xor eax, eax
jmp 0x1800867bc
mov rax, qword [rdi + 8]
mov qword [r15 + 0x18], rax
xor eax, eax
jmp 0x1800867bc

Function at 0x1800875d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea r10, [0x18010ebd4]
mov dword [0x18010ebd4], eax
mov word [0x18010ebd8], ax
lea eax, [rcx + rcx*2]
add eax, eax
movsxd rdx, eax
add rdx, qword [0x1800f4008]
movzx eax, cl
imul r11d, eax, 0xd
movzx r9d, r11b
xor r9b, 0x6e
xor r8d, r8d
nop word [rax + rax]
movzx ecx, r9b
lea r10, [r10 + 1]
xor cl, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r10 - 1], cl
movzx ecx, r11b
add cl, byte [rdx - 1]
add cl, r8b
inc r8d
add r9b, cl
cmp r8d, 6
jl 0x180087610
lea rax, [0x18010ebd4]
ret