joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800611d8
Capabilities:
Encrypt data using chaskey

Disassembly:
push rax
pushf
mov eax, 0x9ebb7327
pushf
not eax
add eax, 0x8e544485
xor eax, 0xb0a133b9
rol eax, 0x22
popf
pushf
not eax
add eax, 0xe7b83c84
xor eax, 0x863df260
rol eax, 0xee
popf
pushf
not eax
add eax, 0xebe2bf41
xor eax, 0x9b3e0405
rol eax, 0xe9
popf
cmp eax, 4
jne 0x180061228
popf
pop rax
jmp 0x180061493
cmp eax, 0
jne 0x180061237
popf
pop rax
jmp 0x180061264
cmp eax, 3
jne 0x180061246
popf
pop rax
jmp 0x180061452
cmp eax, 1
jne 0x180061255
popf
pop rax
jmp 0x180061316
cmp eax, 2
jne 0x180061264
popf
pop rax
jmp 0x1800613bd
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.180074fd4
lea rdi, [rax + 0x90]
mov ecx, dword [rax + 0x3a8]
mov eax, dword [0x1800406a8]
test eax, ecx
je 0x1800612bd
push rax
pushf
mov eax, 0xf4b8bb13
pushf
not eax
add eax, 0xde02b9bc
xor eax, 0xe880e003
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xeed43e37
xor eax, 0x98d1abf9
rol eax, 0xf0
popf
jmp 0x180061219
push rax
pushf
mov eax, 0x523f18b
pushf
not eax
add eax, 0xc48ea28d
xor eax, 0xce135edc
rol eax, 0x23
popf
pushf
not eax
add eax, 0xa395d6ba
xor eax, 0xf4aa9b00
rol eax, 0x52
popf
pushf
not eax
add eax, 0xa890a4c5
xor eax, 0xfc4e3784
rol eax, 0x65
popf
pushf
not eax
add eax, 0xaac4dfcc
xor eax, 0x8720cd1a
rol eax, 0xeb
popf
jmp 0x180061219
mov rbx, qword [rdi]
test rbx, rbx
jne 0x180061364
push rax
pushf
mov eax, 0xe15276be
pushf
not eax
add eax, 0xb3582789
xor eax, 0x952e2c0f
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x82866d23
xor eax, 0xb959e08d
rol eax, 0x60
popf
pushf
not eax
add eax, 0xa62db7e4
xor eax, 0xee699333
rol eax, 0xcd
popf
jmp 0x180061219
push rax
pushf
mov eax, 0x33ec10bb
pushf
not eax
add eax, 0xc5f3b688
xor eax, 0xf080e42c
rol eax, 0x25
popf
pushf
not eax
add eax, 0x92a6a988
xor eax, 0xa5770da1
rol eax, 0xed
popf
pushf
not eax
add eax, 0xe7a809cd
xor eax, 0xa760281f
rol eax, 0x91
popf
pushf
not eax
add eax, 0xfde4a3ec
xor eax, 0xf3ec6a12
rol eax, 0x2b
popf
jmp 0x180061219
mov ecx, 0x2f0e42b5
pushf
not ecx
add ecx, 0xc6f96ae3
xor ecx, 0xc37f7d0d
rol ecx, 0x2f
popf
pushf
not ecx
add ecx, 0xb2eb1a58
xor ecx, 0x805af00d
rol ecx, 0xe7
popf
call fcn.180059647
nop
mov rdx, qword [0x1800426b0]
mov rcx, rdi
call fcn.1800bd705
mov rbx, rax
mov ecx, 0x24898398
pushf
not ecx
add ecx, 0x946d4741
xor ecx, 0x84bfe157
rol ecx, 0x79
popf
pushf
not ecx
add ecx, 0xaf00c94e
xor ecx, 0xfd4de689
rol ecx, 0xbf
popf
pushf
not ecx
add ecx, 0x9019b13f
xor ecx, 0xe6e5b77e
rol ecx, 0x79
popf
call fcn.180141f50
test rbx, rbx
je 0x180061493
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1801590a0
nop
Function at 0x18006de27
Capabilities:
Encrypt data using chaskey

Disassembly:
push rax
pushf
mov eax, 0xb8b3360
pushf
not eax
add eax, 0xa412850a
xor eax, 0x8098e1a4
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xaa0df428
xor eax, 0xfce950ef
rol eax, 0x64
popf
pushf
not eax
add eax, 0xb7603da5
xor eax, 0xe4449099
rol eax, 0xd7
popf
pushf
not eax
add eax, 0x97439a23
xor eax, 0xd45fed68
rol eax, 0x85
popf
Function at 0x1800766c2
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x16fd1981
pushf
not eax
add eax, 0xd37d8fcc
xor eax, 0x9e0c4a43
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x8cb7496a
xor eax, 0xdf45f2a2
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xcf7c95d8
xor eax, 0xaf989ae2
rol eax, 0x9b
popf
cmp eax, 2
jne 0x180076712
popf
pop rax
jmp 0x180076843
cmp eax, 0
jne 0x180076721
popf
pop rax
jmp 0x180076730
cmp eax, 1
jne 0x180076730
popf
pop rax
jmp 0x180076837
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1d68606be]
pushf
sub r9, 0x5682e91e
popf
mov ecx, 0x8e57377a
pushf
not ecx
add ecx, 0x9a16b88d
xor ecx, 0xb2e867ac
rol ecx, 0xc3
popf
pushf
not ecx
add ecx, 0x8b4f0c0c
xor ecx, 0xb275765f
rol ecx, 0xb5
popf
pushf
not ecx
add ecx, 0xc2efadc5
xor ecx, 0xb9c14e71
rol ecx, 0xc1
popf
lea r8, [0x1f56b14b4]
pushf
sub r8, 0x7567f71c
popf
lea rdx, [0x1d2db7fc5]
pushf
sub rdx, 0x52d86225
popf
call fcn.1800132bc
mov ecx, ebx
test rax, rax
je 0x180076804
push rax
pushf
mov eax, 0xd1a8023c
pushf
not eax
add eax, 0xf07dc6ce
xor eax, 0xb0c70396
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xe9ffdb8e
xor eax, 0xd3095258
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xf919ff22
xor eax, 0xc623662a
rol eax, 0xbf
popf
jmp 0x180076703
push rax
pushf
mov eax, 0x1a47eb3c
pushf
not eax
add eax, 0xc89aef8a
xor eax, 0xfc0b23d9
rol eax, 0x59
popf
pushf
not eax
add eax, 0xd6eba66e
xor eax, 0xae4ef61e
rol eax, 0x4e
popf
jmp 0x180076703
add rsp, 0x20
pop rbx
jmp qword [0x18002f408]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x18007d726
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xd671f485
pushf
not eax
add eax, 0x86786bfd
xor eax, 0xdbd8d91b
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xb471b8f7
xor eax, 0x8c16a999
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xdcd571bc
xor eax, 0xcc2a0c95
rol eax, 0xa4
popf
cmp eax, 2
jne 0x18007d776
popf
pop rax
jmp 0x18007d867
cmp eax, 0
jne 0x18007d785
popf
pop rax
jmp 0x18007d794
cmp eax, 1
jne 0x18007d794
popf
pop rax
jmp 0x18007d858
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1c3c4f762]
pushf
sub r9, 0x43c1d9ea
popf
xor ecx, ecx
lea r8, [0x1eb5dfe55]
pushf
sub r8, 0x6b5ae0e5
popf
lea rdx, [0x1efb1d748]
pushf
sub rdx, 0x6faeb9d0
popf
call fcn.1800132bc
test rax, rax
je 0x18007d825
push rax
pushf
mov eax, 0x46348bd9
pushf
not eax
add eax, 0xb40a326e
xor eax, 0xab86023e
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x93766364
xor eax, 0xede644ae
rol eax, 0x33
popf
pushf
not eax
add eax, 0xd32f8d33
xor eax, 0x876f7ed8
rol eax, 0x8d
popf
jmp 0x18007d767
push rax
pushf
mov eax, 0x448190c7
pushf
not eax
add eax, 0x99972d6a
xor eax, 0xfd8d2900
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xde6faa65
xor eax, 0x8a234f13
rol eax, 0x3a
popf
jmp 0x18007d767
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x18002f408]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x180082353
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x9d0a565e
pushf
not eax
add eax, 0xb3cb6c3b
xor eax, 0x87f2cf85
rol eax, 0x28
popf
pushf
not eax
add eax, 0xd738f617
xor eax, 0x92233530
rol eax, 0x10
popf
pushf
not eax
add eax, 0xdccfa394
xor eax, 0xca66b192
rol eax, 3
popf
pushf
not eax
add eax, 0xb73e50c6
xor eax, 0xeb58349e
rol eax, 0x22
popf
cmp eax, 0
jne 0x1800823b6
popf
pop rax
jmp 0x1800823b6
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1800b6faa
Function at 0x1800a10d5
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x146fdf51
pushf
not eax
add eax, 0xc54f2468
xor eax, 0xcc3aa121
rol eax, 0x39
popf
pushf
not eax
add eax, 0xc41d655e
xor eax, 0x887c468d
rol eax, 0x90
popf
pushf
not eax
add eax, 0xea91884b
xor eax, 0xc2a34dcc
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x8289d49d
xor eax, 0x9d9be109
rol eax, 0x2f
popf
cmp eax, 2
jne 0x1800a1138
popf
pop rax
jmp 0x1800a1206
cmp eax, 0
jne 0x1800a1147
popf
pop rax
jmp 0x1800a1156
cmp eax, 1
jne 0x1800a1156
popf
pop rax
jmp 0x1800a11f4
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1800e49c9
test al, al
je 0x1800a119a
push rax
pushf
mov eax, 0xc790069b
pushf
not eax
add eax, 0xf87f73cb
xor eax, 0xfbf7ba4b
rol eax, 0x60
popf
pushf
not eax
add eax, 0xab788926
xor eax, 0xe15fb1c1
rol eax, 0xc8
popf
jmp 0x1800a1129
push rax
pushf
mov eax, 0x360455b
pushf
not eax
add eax, 0xd5149f36
xor eax, 0xbaf7401a
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xc3e8cf62
xor eax, 0xd8c31a4f
rol eax, 5
popf
pushf
not eax
add eax, 0x8f29ba60
xor eax, 0xa776053b
rol eax, 0xad
popf
pushf
not eax
add eax, 0xd379e802
xor eax, 0xa684896f
rol eax, 0xbf
popf
jmp 0x1800a1129
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1800a1200
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.180097081
mov ecx, ebx
jmp 0x1800a1210
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1800a1dd4
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x5b7d302d
pushf
not eax
add eax, 0x94428132
xor eax, 0xeede9e7f
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x8f22892d
xor eax, 0xae9121b0
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x8521933e
xor eax, 0xdfdb918e
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x87fb9c75
xor eax, 0xc110c1bb
rol eax, 0xd3
popf
cmp eax, 0
jne 0x1800a1e37
popf
pop rax
jmp 0x1800a1e37
jmp fcn.180089c3f
Function at 0x1800b6a36
Capabilities:
Get geographical location

Disassembly:
push rax
pushf
mov eax, 0x96db8def
pushf
not eax
add eax, 0xb1862c5e
xor eax, 0x9f4d082f
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xfdc62d44
xor eax, 0x9c4c47b3
rol eax, 0x62
popf
cmp eax, 2
jne 0x1800b6a73
popf
pop rax
jmp 0x1800b6c4d
cmp eax, 0
jne 0x1800b6a82
popf
pop rax
jmp 0x1800b6aa0
cmp eax, 3
jne 0x1800b6a91
popf
pop rax
jmp 0x1800b6cc1
cmp eax, 1
jne 0x1800b6aa0
popf
pop rax
jmp 0x1800b6be4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x1ce67568c]
pushf
sub r9, 0x4e641304
popf
mov rbp, rcx
lea r8, [0x1ff05868f]
pushf
sub r8, 0x7f02430f
popf
lea rdx, [0x1daa2a325]
pushf
sub rdx, 0x5a9f5f9d
popf
mov ecx, 0x5a0f31a0
pushf
not ecx
add ecx, 0xe9d61993
xor ecx, 0xe793d363
rol ecx, 0xd5
popf
pushf
not ecx
add ecx, 0xa0895abd
xor ecx, 0xb470c335
rol ecx, 0xe7
popf
pushf
not ecx
add ecx, 0xaf0a8b56
xor ecx, 0xab0bfcb7
rol ecx, 2
popf
pushf
not ecx
add ecx, 0xa0a06db9
xor ecx, 0xf174567c
rol ecx, 0x26
popf
call fcn.18001f3d0
test rax, rax
je 0x1800b6bb1
push rax
pushf
mov eax, 0x2fcfa91
pushf
not eax
add eax, 0xa4f14174
xor eax, 0xfb2e6b0e
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xbfdf98ce
xor eax, 0xc125f158
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xca9196de
xor eax, 0xf11b828a
rol eax, 0x57
popf
pushf
not eax
add eax, 0xb1c0bf19
xor eax, 0xc87ba98e
rol eax, 0xae
popf
jmp 0x1800b6a64
push rax
pushf
mov eax, 0xe04bdad0
pushf
not eax
add eax, 0xdf2afbb2
xor eax, 0x86fa6b06
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x8170fe2a
xor eax, 0xfc416049
rol eax, 0xa5
popf
jmp 0x1800b6a64
movabs r10, 0xc6594f4b2f8538bf
pushf
not r10
add r10, 0x604fd818
xor r10, 0x70faf8e7
rol r10, 0x5d
popf
pushf
not r10
add r10, 0x573920bd
xor r10, 0x65b7efa0
rol r10, 0x24
popf
pushf
not r10
add r10, 0x581c096f
xor r10, 0x5032c483
rol r10, 0xb3
popf
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
jmp 0x1800b6c45
call qword [0x18002f410]
jmp 0x1800b6cc1
xor edx, edx
mov rcx, rbp
call fcn.1800c7cc0
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x1800b6c62
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push rax
pushf
mov eax, 0x30de2554
pushf
not eax
add eax, 0xa235fbb8
xor eax, 0x8276b9c6
rol eax, 0x23
popf
pushf
not eax
add eax, 0xbb4d0284
xor eax, 0xe185fa87
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x8e192814
xor eax, 0x9c615393
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xaa71b00a
xor eax, 0x932e809b
rol eax, 0xa9
popf
jmp 0x1800b6a64
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1801365e7
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x1cef931d
pushf
not eax
add eax, 0x89a72173
xor eax, 0xa084ffa2
rol eax, 0xc
popf
pushf
not eax
add eax, 0xcb3303f1
xor eax, 0x9cc0acfa
rol eax, 0x77
popf
pushf
not eax
add eax, 0x857ef130
xor eax, 0x96bbe7ab
rol eax, 0xf
popf
pushf
not eax
add eax, 0xacd49e6c
xor eax, 0xfcbc16cb
rol eax, 0x1b
popf
cmp eax, 4
jne 0x18013664a
popf
pop rax
jmp 0x1801368d2
cmp eax, 0
jne 0x180136659
popf
pop rax
jmp 0x1801366a4
cmp eax, 3
jne 0x180136668
popf
pop rax
jmp 0x18013683e
cmp eax, 1
jne 0x180136677
popf
pop rax
jmp 0x180136722
cmp eax, 5
jne 0x180136686
popf
pop rax
jmp 0x18013691d
cmp eax, 2
jne 0x180136695
popf
pop rax
jmp 0x1801367a9
cmp eax, 6
jne 0x1801366a4
popf
pop rax
jmp 0x180136964
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.180052e99
cmp rdi, qword [rax + 0x58]
jne 0x1801366ef
push rax
pushf
mov eax, 0xaaeb15e0
pushf
not eax
add eax, 0xc6bf740a
xor eax, 0xd220f21d
rol eax, 0x29
popf
pushf
not eax
add eax, 0x9d9ad233
xor eax, 0xb4c2689f
rol eax, 0xe9
popf
jmp 0x18013663b
push rax
pushf
mov eax, 0x1a6d8810
pushf
not eax
add eax, 0x8766adbb
xor eax, 0xa2b59846
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xbee72178
xor eax, 0x98f7bb05
rol eax, 0xc3
popf
jmp 0x18013663b
call fcn.180052e99
mov rdx, qword [rax + 0x58]
test rdx, rdx
je 0x180136763
push rax
pushf
mov eax, 0xf9f17b0a
pushf
not eax
add eax, 0xd51be6c7
xor eax, 0x8e678373
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xdaa40c86
xor eax, 0x876c6948
rol eax, 8
popf
jmp 0x18013663b
push rax
pushf
mov eax, 0x7f29ad6a
pushf
not eax
add eax, 0xc0633e7a
xor eax, 0xc4298cfa
rol eax, 0x99
popf
pushf
not eax
add eax, 0x80899f1c
xor eax, 0x9fe0bee4
rol eax, 0xb
popf
pushf
not eax
add eax, 0xd44ada2e
xor eax, 0xd64ab9df
rol eax, 0x60
popf
jmp 0x18013663b
mov rbx, qword [rdx + 8]
cmp rdi, rdx
je 0x1801367e5
push rax
pushf
mov eax, 0x739d69b4
pushf
not eax
add eax, 0xecfff521
xor eax, 0x8e46d8e9
rol eax, 0xd
popf
pushf
not eax
add eax, 0x8828ca61
xor eax, 0xfdb8137c
rol eax, 0x95
popf
jmp 0x18013663b
push rax
pushf
mov eax, 0x86004e0
pushf
not eax
add eax, 0x912be229
xor eax, 0xf709be15
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x8c128eb1
xor eax, 0x97bf5fe1
rol eax, 0xad
popf
pushf
not eax
add eax, 0xb857c4ea
xor eax, 0xf26658a2
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xd00fb6da
xor eax, 0xd9ad04ee
rol eax, 0x68
popf
jmp 0x18013663b
mov rdx, rbx
test rbx, rbx
je 0x18013688c
push rax
pushf
mov eax, 0x9726e177
pushf
not eax
add eax, 0xf9a9bea0
xor eax, 0xec664eff
rol eax, 0x54
popf
pushf
not eax
add eax, 0x877abb5f
xor eax, 0x86ae1f14
rol eax, 0x79
popf
pushf
not eax
add eax, 0xfda154b1
xor eax, 0xfa07750c
rol eax, 0x73
popf
jmp 0x18013663b
push rax
pushf
mov eax, 0x6027a6c9
pushf
not eax
add eax, 0xab70ca7d
xor eax, 0xd86d2cf3
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x8cc1ef01
xor eax, 0xd4cb6971
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xd1e18189
xor eax, 0xd75b04e6
rol eax, 0x9f
popf
jmp 0x18013663b
jmp 0x1801367a9
call fcn.180052e99
mov qword [rax + 0x58], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1801590a0
int3
Function at 0x180163aba
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x954da8bd
pushf
not eax
add eax, 0xca8f92d7
xor eax, 0xac3359b6
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xaa86664d
xor eax, 0x9babcd8f
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xa4ab885c
xor eax, 0x8dfda56c
rol eax, 0x84
popf
cmp eax, 4
jne 0x180163b0a
popf
pop rax
jmp 0x180163d10
cmp eax, 0
jne 0x180163b19
popf
pop rax
jmp 0x180163b64
cmp eax, 3
jne 0x180163b28
popf
pop rax
jmp 0x180163cd6
cmp eax, 1
jne 0x180163b37
popf
pop rax
jmp 0x180163bd7
cmp eax, 5
jne 0x180163b46
popf
pop rax
jmp 0x180163d48
cmp eax, 2
jne 0x180163b55
popf
pop rax
jmp 0x180163c3a
cmp eax, 6
jne 0x180163b64
popf
pop rax
jmp 0x180163d97
sub rsp, 0x28
call fcn.18006432d
test eax, eax
je 0x180163ba4
push rax
pushf
mov eax, 0xf320d4b8
pushf
not eax
add eax, 0x92b37525
xor eax, 0xf27ae92b
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xf2cfd558
xor eax, 0xe9a6e39a
rol eax, 0x36
popf
jmp 0x180163afb
push rax
pushf
mov eax, 0x83fb54dc
pushf
not eax
add eax, 0xfdfd2477
xor eax, 0xce17e66e
rol eax, 0xac
popf
pushf
not eax
add eax, 0xef06768d
xor eax, 0x88672b4b
rol eax, 0xc7
popf
jmp 0x180163afb
call fcn.1800e5b9f
jmp 0x180163d48
call fcn.1800980b4
mov ecx, eax
call fcn.180058b95
test eax, eax
je 0x180163c7d
push rax
pushf
mov eax, 0xdc9cfa28
pushf
not eax
add eax, 0xc3fc4f5a
xor eax, 0xaecf63a1
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xfcc2db9c
xor eax, 0xf390d4f9
rol eax, 0x5c
popf
jmp 0x180163afb
push rax
pushf
mov eax, 0x8fe681e
pushf
not eax
add eax, 0xb3353480
xor eax, 0xc31e9416
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xa0e1a461
xor eax, 0x8e4b0d14
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xa6899ebb
xor eax, 0xd3ac31cf
rol eax, 0x43
popf
pushf
not eax
add eax, 0xb65b582c
xor eax, 0xc0495b30
rol eax, 0x83
popf
jmp 0x180163afb
xor al, al
jmp 0x180163d97
call fcn.1800b4055
push rax
pushf
mov eax, 0xaeb0e029
pushf
not eax
add eax, 0xaba1e2a6
xor eax, 0x9e13c4f8
rol eax, 0x25
popf
pushf
not eax
add eax, 0xe6e9c670
xor eax, 0x8a9275e3
rol eax, 0xd1
popf
jmp 0x180163afb
mov al, 0x81
pushf
not al
add al, 0xae
xor al, 0xc6
rol al, 0x7c
popf
pushf
not al
add al, 0x25
xor al, 0x36
rol al, 0x62
popf
push rax
pushf
mov eax, 0xdfdd8b86
pushf
not eax
add eax, 0xca576dc2
xor eax, 0xc54a4fc1
rol eax, 0x22
popf
pushf
not eax
add eax, 0x8c97952d
xor eax, 0xcfc81d44
rol eax, 0x33
popf
jmp 0x180163afb
add rsp, 0x28
ret
Function at 0x18017be90
Capabilities:
Encode data using base64

Disassembly:
push rax
pushf
mov eax, 0x95395db3
pushf
not eax
add eax, 0x9c0b84dc
xor eax, 0xd205f91e
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xdb3b923f
xor eax, 0xa07902eb
rol eax, 0x65
popf
pushf
not eax
add eax, 0xdc48bbfd
xor eax, 0xea22b651
rol eax, 2
popf
cmp eax, 4
jne 0x18017bee0
popf
pop rax
jmp 0x18017c076
cmp eax, 0
jne 0x18017beef
popf
pop rax
jmp 0x18017bf2b
cmp eax, 3
jne 0x18017befe
popf
pop rax
jmp 0x18017c03a
cmp eax, 1
jne 0x18017bf0d
popf
pop rax
jmp 0x18017bfd6
cmp eax, 5
jne 0x18017bf1c
popf
pop rax
jmp 0x18017c0dd
cmp eax, 2
jne 0x18017bf2b
popf
pop rax
jmp 0x18017c034
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x18017bf90
push rax
pushf
mov eax, 0x4f4e3425
pushf
not eax
add eax, 0xed4e4a13
xor eax, 0xd9fbda23
rol eax, 0x18
popf
pushf
not eax
add eax, 0x8e9330ac
xor eax, 0xf469d53a
rol eax, 0x58
popf
pushf
not eax
add eax, 0xa8d0004d
xor eax, 0xc43f1c8a
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xf8699f97
xor eax, 0x8e1d8106
rol eax, 0x59
popf
jmp 0x18017bed1
push rax
pushf
mov eax, 0x679502a8
pushf
not eax
add eax, 0x93fb54cb
xor eax, 0xca8f3158
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xac6db52c
xor eax, 0x8da923bb
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xec4ea9ea
xor eax, 0x963f2d76
rol eax, 0x76
popf
jmp 0x18017bed1
call fcn.1800b03e0
mov dword [rax], 0x16
call fcn.1800e5b31
or eax, 0xffffffff
jmp 0x18017c0dd
sub dword [rcx + 0x10], 1
jns 0x18017c076
add rsp, 0x28
jmp fcn.18009743b
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
push rax
pushf
mov eax, 0x6398b9ed
pushf
not eax
add eax, 0xe55e586a
xor eax, 0x85301bc4
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xb7c81aa5
xor eax, 0xb3141bdb
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x930d0991
xor eax, 0xdcd77e2d
rol eax, 0x61
popf
pushf
not eax
add eax, 0xe6fe92c2
xor eax, 0x9d033579
rol eax, 0x3f
popf
jmp 0x18017bed1
add rsp, 0x28
ret
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014da0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014dc0
xor al, al
jmp 0x140014e41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014dd3
xor al, al
jmp 0x140014e41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014dfd
xor al, al
jmp 0x140014e41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014e11
xor al, al
jmp 0x140014e41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014e23
xor al, al
jmp 0x140014e41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014e3f
xor al, al
jmp 0x140014e41
mov al, 1
add rsp, 0x38
ret
Function at 0x140004ab0
Capabilities:
Manipulate console buffer

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x14008f080]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov ecx, 0xfffffff5
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [rsp + 0x38]
lea rax, [rsp + 0x34]
movsx r8d, word [rsp + 0x3a]
mov dl, reloc.WLDAP32.dll_Ordinal_32
mov r9d, dword [rsp + 0x30]
imul r8d, ecx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx eax, word [rsp + 0x38]
mov edx, 7
movsx r8d, word [rsp + 0x3a]
mov rcx, rdi
mov r9d, dword [rsp + 0x30]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, dword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14006ed40
add rsp, 0x60
pop rdi
ret
Function at 0x140009bc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140009be8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140009c0e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140009c10
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140009c69
test ecx, ecx
jle 0x140009c49
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140009c69
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140009c69
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140009c90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140009cb2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140009cc8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140009ce4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009ce6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009d22
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140009dbe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140009d5d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140009d9e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140009dbe
cmp rbx, rax
ja 0x140009d70
test rbx, rbx
je 0x140009dbe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret