joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001150
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180001196
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180001196
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14065a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14065a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14065a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065a06f
add dl, dl
jne 0x14065a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065a0f6
xor eax, eax
add dl, dl
jne 0x14065a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065a1ad
add dl, dl
jne 0x14065a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14065a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14065a07e
mov eax, 1
add dl, dl
jne 0x14065a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065a0fb
sub eax, ebx
mov ebx, 1
jne 0x14065a14c
mov ecx, 1
add dl, dl
jne 0x14065a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14065a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065a15d
cmp eax, 0x7d00
jae 0x14065a19b
cmp eax, 0x500
jb 0x14065a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065a07e
cmp eax, 0x7f
ja 0x14065a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14065a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14065a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1805f7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805f71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1805f7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805f706f
add dl, dl
jne 0x1805f7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805f70f6
xor eax, eax
add dl, dl
jne 0x1805f70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805f71ad
add dl, dl
jne 0x1805f70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805f70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1805f707e
mov eax, 1
add dl, dl
jne 0x1805f7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805f70fb
sub eax, ebx
mov ebx, 1
jne 0x1805f714c
mov ecx, 1
add dl, dl
jne 0x1805f712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805f713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805f7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805f707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1805f7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805f7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805f715d
cmp eax, 0x7d00
jae 0x1805f719b
cmp eax, 0x500
jb 0x1805f7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805f707e
cmp eax, 0x7f
ja 0x1805f719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805f707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805f71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1805f707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1406c78f0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406c7a77
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406c7921
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c7907
add dl, dl
jne 0x1406c792e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c798e
xor eax, eax
add dl, dl
jne 0x1406c793d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c7a45
add dl, dl
jne 0x1406c794e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c795b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c7968
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c7975
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406c7982
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406c7916
mov eax, 1
add dl, dl
jne 0x1406c799e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c79ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c7993
sub eax, ebx
mov ebx, 1
jne 0x1406c79e4
mov ecx, 1
add dl, dl
jne 0x1406c79c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c79d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c79bb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c7916
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406c7a00
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c7a0d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c79f5
cmp eax, 0x7d00
jae 0x1406c7a33
cmp eax, 0x500
jb 0x1406c7a2e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c7916
cmp eax, 0x7f
ja 0x1406c7a36
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c7916
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406c7a6a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406c7916
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1806e6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806e61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1806e6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806e606f
add dl, dl
jne 0x1806e6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806e60f6
xor eax, eax
add dl, dl
jne 0x1806e60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806e61ad
add dl, dl
jne 0x1806e60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806e60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806e60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806e60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806e60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1806e607e
mov eax, 1
add dl, dl
jne 0x1806e6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806e6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806e60fb
sub eax, ebx
mov ebx, 1
jne 0x1806e614c
mov ecx, 1
add dl, dl
jne 0x1806e612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1806e613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806e6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806e607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1806e6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1806e6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806e615d
cmp eax, 0x7d00
jae 0x1806e619b
cmp eax, 0x500
jb 0x1806e6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806e607e
cmp eax, 0x7f
ja 0x1806e619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806e607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806e61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1806e607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180023f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180023fa7
xor eax, eax
jmp 0x1800473fb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x28], rax
sub byte [rax - 0x7d], cl
jl 0x180023fdf
sub byte [rax], al
jne 0x180023fc6
xor eax, eax
jmp 0x18004741a
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x60]
and eax, 0xf
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jbe 0x18002402f
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jae 0x18002402f
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
jmp 0x180023ff9
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18002403f
xor eax, eax
jmp 0x180024054
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
test eax, eax
jne 0x18002404f
xor eax, eax
jmp 0x180024054
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
lea edx, [rcx + rcx*4]
rol byte [rax], 0
add bh, bh
leave
Function at 0x180023f89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180023fa7
xor eax, eax
jmp 0x1800473fb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x28], rax
sub byte [rax - 0x7d], cl
jl 0x180023fdf
sub byte [rax], al
jne 0x180023fc6
xor eax, eax
jmp 0x18004741a
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x60]
and eax, 0xf
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jbe 0x18002402f
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jae 0x18002402f
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
jmp 0x180023ff9
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18002403f
xor eax, eax
jmp 0x180024054
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
test eax, eax
jne 0x18002404f
xor eax, eax
jmp 0x180024054
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
lea edx, [rcx + rcx*4]
rol byte [rax], 0
add bh, bh
leave

Function at 0x18002ed03
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and al, 8
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ecx, ecx
call fcn.18005cb87
mov dil, 1
lea rsi, [rbx + 2]
mov r12d, 4
add byte [rbp + rcx*4 + 0x2d], cl
insd dword [rdi], dx
retf
or byte [rax], al

Function at 0x18002ef7c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, rdi
mov byte [rbx + 4], al
mov r9, r11
mov al, byte [rbx - 4]
mov byte [rbx], al
mov al, byte [rbx - 8]
mov byte [rbx - 4], al
Function at 0x18002f6b2
Capabilities:
Write file on windows

Disassembly:
add al, byte [rax]
lea rax, [0x1800d13f0]
jmp 0x18005e07f
xor eax, eax
jmp 0x1800bb477
movsd xmm0, qword [rax]
mov edi, dword [rax + 8]
jmp 0x1800bb57e
test byte [rcx + rsi + 0x38], 0x80
je 0x18005e0d3
movsx ecx, bl
test bl, bl
je 0x18005e0bf
sub ecx, 1
je 0x18005e0ab
cmp ecx, 1
jne 0x18005e110
mov r9d, r15d
lea rcx, [rbp - 0x30]
mov r8, rsi
mov edx, r12d
call 0x1800bafed
jmp 0x18005e067
mov r9d, r15d
lea rcx, [rbp - 0x30]
mov r8, rsi
mov edx, r12d
call 0x1800bb11d
jmp 0x18005e067
mov r9d, r15d
lea rcx, [rbp - 0x30]
mov r8, rsi
mov edx, r12d
call 0x1800baf0d
jmp 0x18005e067
mov rcx, qword [rcx + r14 + 0x28]
lea r9, [rbp - 0x2c]
and dword [rbp - 0x30], edi
xor eax, eax
and qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rsi
mov qword [rbp - 0x2c], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18005e103
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
mov edi, dword [rbp - 0x28]
movsd xmm0, qword [rbp - 0x30]
movsd qword [rbp - 0x20], xmm0
mov rax, qword [rbp - 0x20]
shr rax, 0x20
test eax, eax
jne 0x18005e184
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x18005e150
lea rax, [0x1800d2e90]
mov rax, qword [rax + r13*8]
test byte [rax + r14 + 0x38], 0x40
je 0x18005e16c
cmp byte [rsi], 0x1a
je 0x18005dee7
call 0x1800adb19
mov dword [rax], 0x1c
call 0x1800adb04
and dword [rax], 0
jmp 0x1800bb48e
mov eax, dword [rbp - 0x1c]
sub eax, edi
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18002fc6b
Capabilities:
Enumerate files on windows

Disassembly:
add dword [rdi], ecx
test dword [rdx + 0x48000008], esp
lea eax, [0x1800d07f0]
jmp 0x18005f5c5

Function at 0x180030c90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rcx
xor r9d, r9d
mov qword [rsp + 0x10], rdx
and al, 0x10
invalid
invalid

Function at 0x180035a31
Capabilities:
Enumerate pe sections

Disassembly:
and r15d, 7
shl r9, 8
shl rbp, 8
shl rdi, 8
shl rdx, 8
shl rsi, 8
or rsi, rax
shl r8, 8
movzx eax, byte [rcx + 0x2f]
shr rax, 2
shl r12, 0x10
shl rsi, 6
or rsi, rax
movzx eax, byte [rcx + 0x33]
or r9, rax
movzx eax, byte [rcx + 0x32]
shl r9, 8
or r9, rax
movzx eax, byte [rcx + 0x31]
shr rax, 7
add r9, r9
or r9, rax
movzx eax, byte [rcx + 0x36]
or rbp, rax
Function at 0x180036b70
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r11d, dword [rcx + 0x24]
xor eax, eax
cmp byte [rcx + 0x50], al
mov r14, r8
mov edi, dword [rcx]
mov r15d, 0x1000000
mov r8d, dword [rcx + 8]
cmovne r15d, eax
mov eax, dword [rcx + 4]
mov rbx, rdx
mov r9d, dword [rcx + 0xc]
mov r10d, dword [rcx + 0x10]
mov edx, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
lea esi, [rax + rax*4]
mov r12d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x20]
mov dword [rsp + 0xa0], r11d
cmp r14, 0x10
jb 0x180036e28
lea ecx, [r8 + r8*4]
mov qword [rsp + 0xa8], r8
lea r11d, [r10 + r10*4]
mov qword [rsp + 0x28], rcx
mov ecx, esi
lea r8, [rbx + 6]
mov qword [rsp + 0x30], r11
lea r11d, [r9 + r9*4]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], r9

Function at 0x180036b71
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r11d, dword [rcx + 0x24]
xor eax, eax
cmp byte [rcx + 0x50], al
mov r14, r8
mov edi, dword [rcx]
mov r15d, 0x1000000
mov r8d, dword [rcx + 8]
cmovne r15d, eax
mov eax, dword [rcx + 4]
mov rbx, rdx
mov r9d, dword [rcx + 0xc]
mov r10d, dword [rcx + 0x10]
mov edx, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
lea esi, [rax + rax*4]
mov r12d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x20]
mov dword [rsp + 0xa0], r11d
cmp r14, 0x10
jb 0x180036e28
lea ecx, [r8 + r8*4]
mov qword [rsp + 0xa8], r8
lea r11d, [r10 + r10*4]
mov qword [rsp + 0x28], rcx
mov ecx, esi
lea r8, [rbx + 6]
mov qword [rsp + 0x30], r11
lea r11d, [r9 + r9*4]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], r9

Function at 0x180037283
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x38], rax
add rcx, 0x10
lea r10, [rsp + 0x488]
sub r10, r11
mov edx, eax
nop dword [rax]
invalid

Function at 0x180037580
Capabilities:
Encode data using xor

Disassembly:
rol edi, 1
lea r8, [rdx + rcx*2]
mov rdx, qword [r14 + 8]
add r8, r12
mov ecx, edx
xor r11, r8
ror r11, 0x20
mov eax, r11d
imul rcx, rax
lea rdx, [rdx + rcx*2]
mov ecx, r8d
add rdx, r11
xor r12, rdx
ror r12, 0x18
mov eax, r12d
imul rcx, rax
lea r14, [r8 + rcx*2]
mov ecx, edx
add r14, r12
xor r11, r14
ror r11, 0x10
mov eax, r11d
imul rcx, rax
mov eax, ebp
lea r10, [rdx + rcx*2]
mov ecx, ebx
imul rcx, rax
add r10, r11
xor r12, r10
rol r12, 1
lea rdx, [rbx + rcx*2]
mov rbx, qword [rsp]
and al, 0x48
add edx, ebp
mov ecx, r9d
xor r11, rdx
ror r11, 0x20
mov eax, r11d
imul rcx, rax
lea r8, [r9 + rcx*2]
mov ecx, edx
add r8, r11
xor rbp, r8
ror rbp, 0x18
mov eax, ebp
imul rcx, rax
lea rcx, [rdx + rcx*2]
add rcx, rbp
xor r11, rcx
mov qword [rbx - 0x50], rcx
ror r11, 0x10
mov qword [rbx + 0x28], r11
mov ecx, r8d
mov eax, r11d
imul rcx, rax
mov eax, r15d
Function at 0x180039b7d
Capabilities:
Encode data using xor

Disassembly:
mov es, word [0x1a4482423]
add dword [rbp + 0x32], eax
rol byte [rdi + rcx - 0x4a], 0x5c
and al, 4
mov r14, rcx
movzx ebx, byte [rsp + 3]
mov rbp, rcx
movzx edi, byte [rsp + 2]
sub r14, r15
mov word [rsp + 5], ax
movzx r10d, al
movzx r9d, byte [rsp + 6]
movzx esi, al
nop dword [rax]
nop word [rax + rax]
lea rcx, [r14 + rax]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax + r15]
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
int1
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
inc rax
or r9b, cl
cmp rax, 0x1f
jb 0x180039b60
movzx edx, byte [rax + rbp]
movzx ecx, byte [rax + r15]
and dl, 0x7f
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
movzx eax, bl
dec eax
movzx edx, dil
or r9b, cl
dec edx
or edx, eax
movzx ecx, r9b
dec ecx
movzx eax, r11b
dec eax
or edx, eax
movzx eax, r10b
dec eax
or eax, edx
or eax, ecx
movzx ecx, sil
dec ecx
or eax, ecx
movzx ecx, r8b
dec ecx
or eax, ecx
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.18007df29
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret
Function at 0x180039ef4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0xe0], rax
mov r10, rdx
mov edx, edx
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x90], rcx
mov rax, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x88], rdx
test r9, r9
je 0x18003a483
mov r8d, dword [rcx]
mov edx, dword [rcx + 0x14]
mov qword [r11 + 0x10], rbx
mov ebx, dword [rcx + 0x34]
mov qword [r11 - 8], rbp
mov ebp, dword [rcx + 0xc]
mov qword [r11 - 0x10], rsi
mov esi, dword [rcx + 8]
mov qword [r11 - 0x18], rdi
mov edi, dword [rcx + 4]
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov r13d, dword [rcx + 0x10]
mov qword [r11 - 0x30], r14
mov r14d, dword [rcx + 0x38]
mov qword [r11 - 0x38], r15
mov r11d, dword [rcx + 0x18]
mov dword [rsp + 0x64], r11d
mov r11d, dword [rcx + 0x1c]
mov dword [rsp + 0x68], r11d
mov r11d, dword [rcx + 0x20]
mov dword [rsp + 0x38], r11d
mov r11d, dword [rcx + 0x24]
mov dword [rsp + 0x3c], r11d
mov r11d, dword [rcx + 0x28]
mov dword [rsp + 0x40], r11d
mov r11d, dword [rcx + 0x2c]
mov dword [rsp + 0x44], r11d
mov r11d, dword [rcx + 0x30]
mov ecx, dword [rcx + 0x3c]
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x10], r11d
mov dword [rsp + 0x14], ebx
mov dword [rsp + 0x48], r14d
cmp r9, 0x40
jae 0x18003a070
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rcx
test r9, r9
je 0x18003a04a
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rax + r10]
inc edx
mov byte [rsp + rax + 0xa0], cl
mov eax, edx
cmp rax, r9
jb 0x18003a030
mov rax, qword [rsp + 0x28]
mov edx, dword [rsp + 0x20]
lea r10, [rsp + 0xa0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r10
mov eax, dword [rsp + 0x64]
mov r14d, r8d
mov r10d, dword [rsp + 0x3c]
mov r15d, edi
mov r8d, dword [rsp + 0x44]
mov r12d, esi
mov edi, dword [rsp + 0x48]
mov r9d, r13d
mov r13d, dword [rsp + 0x38]
mov ecx, edx
mov edx, dword [rsp + 0x40]
mov esi, dword [rsp + 0x4c]
mov dword [rsp], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x18], eax
mov dword [rsp + 0x1c], 0x14
jmp 0x18003a0bf