joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180027810
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180299398], eax
je 0x18002783e
mov eax, 0x10dd
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, dword [0x18029939c]
test eax, eax
jne 0x180027975
test rbp, rbp
jne 0x18002785f
lea eax, [rbp + 0x57]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
test rsi, rsi
je 0x18002787b
cmp qword [rsi], 0
jne 0x18002788b
mov dword [0x18029939c], 6
mov qword [0x1802993a0], rsi
mov eax, 6
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbx
mov ecx, 0x30
mov qword [rsp + 0x38], rdi
call fcn.1801860bc
mov rbx, rax
test rax, rax
jne 0x1800278af
lea edi, [rax + 8]
jmp 0x18002794a
mov rcx, qword [rsi]
xor edx, edx
call fcn.180027a10
xor edx, edx
mov rcx, rbp
mov rdi, rax
call fcn.180027a10
movzx ecx, byte [rdi + 0x3e]
mov rbp, qword [rdi + 0x48]
sub rbp, rcx
test cl, cl
je 0x18002793c
mov edx, ecx
cmp rcx, 0x1e
ja 0x18002793c
cmp qword [rdi + 0x50], rax
jne 0x18002793c
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, 0x40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18002790d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18002794a
mov dword [rbx + 8], 1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], rbp
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x28], eax
mov rax, qword [0x1802993b0]
mov qword [rbx], rax
xor eax, eax
mov qword [0x1802993b0], rbx
jmp 0x18002796b
cmp dword [0x180299390], 0
mov edi, 9
jne 0x180027955
mov dword [0x18029939c], edi
test rbx, rbx
je 0x180027962
mov edx, 0x30
mov rcx, rbx
call fcn.180186100
mov qword [0x1802993a0], rsi
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x180027d20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x180027d4e
xor al, al
jmp 0x180027d90
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x180027d5f
xor al, al
jmp 0x180027d90
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180027d86
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180027d86
mov al, 1
jmp 0x180027d90
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x180027eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x180027ed2
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x180027f8d
nop dword [rax + rax]
cmp rbx, qword [0x18028f918]
jb 0x180027efe
cmp rbx, qword [0x18028f920]
ja 0x180027efe
add rbx, 0x8000000
jmp 0x180027f84
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180027f8d
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180027f69
cmp rcx, 0x10000
jb 0x180027f69
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180027f8f
add rbx, 0x10000
jmp 0x180027f84
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180027f84
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180027ee0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180027fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x18002807b
nop dword [rax]
cmp rbx, qword [0x18028f918]
jb 0x180027fee
cmp rbx, qword [0x18028f920]
ja 0x180027fee
sub rbx, 0x8000000
jmp 0x180028072
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18002807b
cmp dword [rsp + 0x40], 0x10000
jne 0x180028056
cmp qword [rsp + 0x38], 0x10000
jb 0x180028056
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18002807d
sub rbx, 0x10000
jmp 0x180028072
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180027fd0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180028170
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx - 0x7ff80000]
mov r9, rcx
cmp rcx, 0x7ff80000
ja 0x18002818e
mov ebx, 0x80000
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x7ff80000]
cmp r9, 0xffffffff80000000
jb 0x1800281aa
mov rdi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x1800281c1
cmp byte [rcx + 1], 0x25
jne 0x180028205
movsxd rax, dword [rcx + 2]
add rcx, 6
jmp 0x1800281cd
cmp al, 0xe9
jne 0x180028205
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
cmp rcx, r9
jae 0x1800281f0
cmp rcx, 0xffffffff80000000
jae 0x1800281e7
lea rdi, [rcx + 0x7ff80000]
jmp 0x180028205
mov rdi, 0xfffffffffff80000
jmp 0x180028205
lea rbx, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180028205
mov ebx, 0x80000
mov rax, qword [0x180299388]
mov rcx, qword [0x180299380]
test rax, rax
jne 0x180028227
test rcx, rcx
je 0x18002823e
mov rax, rcx
mov qword [0x180299388], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x18002823e
cmp rdx, rbx
jb 0x18002823e
cmp rdx, rdi
jbe 0x1800282e9
mov qword [0x180299388], rcx
mov rax, rcx
test rcx, rcx
je 0x180028279
test rcx, rcx
je 0x180028269
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x180028269
cmp rcx, rbx
jb 0x180028269
cmp rcx, rdi
jbe 0x1800282e9
mov rax, qword [rax + 8]
mov qword [0x180299388], rax
test rax, rax
jne 0x180028252
movzx eax, r9w
mov r8, rdi
sub r9, rax
mov rdx, rbx
mov rcx, r9
call fcn.180028090
test rax, rax
je 0x18002832c
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x180299388], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x180299380]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x180299380], rax
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x1800282d1
mov qword [rax + 0x10], r8
mov rdx, qword [rax + 0x10]
cmp rdx, rbx
jb 0x18002832c
cmp rdx, rdi
ja 0x18002832c
mov rcx, qword [rdx + 0x48]
movdqa xmm0, xmmword [0x1801e5e70]
mov qword [rax + 0x10], rcx
mov rax, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180031680
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov edi, dword [rcx + 0x20]
mov rsi, rcx
mov eax, dword [rcx + 0xa4]
mov rbp, rdx
mov edx, dword [rcx + 0xa0]
dec eax
lea r8d, [rdi + rax]
not eax
and r8d, eax
mov dword [rcx + 0x20], r8d
lea ecx, [rdx - 1]
add ecx, dword [rsi + 0x24]
neg edx
and ecx, edx
mov dword [rsi + 0x24], ecx
cmp rbp, 0xffffffffffffffff
je 0x180031791
cmp r8d, edi
jbe 0x180031791
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1800316ec
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], rbx
mov edx, 0x1000
mov ebx, dword [rsi + 0x20]
mov rcx, rsi
sub ebx, edi
call fcn.1800317b0
test eax, eax
jne 0x180031718
mov rbx, qword [rsp + 0x58]
xor edi, edi
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsi + 0x418]
xor edx, edx
mov r8d, 0x1000
mov qword [rsp + 0x60], r14
call fcn.1801a4970
test ebx, ebx
je 0x180031778
xor edi, edi
mov r14d, 8
nop dword [rax]
mov rdx, qword [rsi + 0x418]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov dword [rsp + 0x50], edi
cmp ebx, r14d
mov qword [rsp + 0x20], rdi
mov rcx, rbp
cmova r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18003177d
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180031778
sub ebx, eax
jne 0x180031740
mov edi, 1
mov r14, qword [rsp + 0x60]
mov eax, edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov eax, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x180032500
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180032540
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800325d2
cmp dword [rsp + 0x40], 0x1000
jne 0x1800325b6
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1800325b6
bt eax, 8
jb 0x1800325b6
mov rbx, qword [rsp + 0x28]
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x180032576
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800325d2
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x180032592
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800325d2
cmp word [rax + rbx + 0x14], 0
jne 0x1800325a9
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800325d2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x1800325d2
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800325d2
add rsp, 0x50
pop rbx
ret
Function at 0x1800325e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rcx + 0x10000]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov edi, 0x5a4d
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180032634
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
cmp dword [rsp + 0x40], 0x1000
jne 0x180032677
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x180032677
bt eax, 8
jb 0x180032677
cmp word [rbx], di
jne 0x180032670
mov eax, dword [rbx + 0x3c]
cmp rax, qword [rsp + 0x38]
ja 0x180032670
cmp eax, 0x40
jb 0x180032670
cdqe
cmp dword [rax + rbx], 0x4550
jne 0x180032677
mov rax, rbx
jmp 0x180032629
jmp 0x180032677
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x180032610

Function at 0x1800327c0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rcx
test rcx, rcx
jne 0x1800327d5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x1800327ee
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003283c
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
cmp dword [rbx], 0x4550
je 0x18003280c
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003283c
cmp word [rbx + 0x14], 0
jne 0x180032822
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003283c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rbx + 0x50]
jmp 0x18003283c
add rsp, 0x20
pop rbx
ret
Function at 0x180032a60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r13, rdx
mov r14, rcx
test rcx, rcx
jne 0x180032a93
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
je 0x180032ab0
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180032c3d
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
je 0x180032ad0
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180032c3d
cmp word [rax + r14 + 0x14], 0
jne 0x180032aeb
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180032c3d
mov ecx, dword [rax + r14 + 0x90]
test ecx, ecx
je 0x180032afd
lea rdi, [r14 + rcx]
jmp 0x180032aff
xor edi, edi
mov qword [rsp + 0x28], rdi
test rdi, rdi
jne 0x180032b20
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180032c3d
mov ecx, dword [rdi]
test ecx, ecx
je 0x180032c0d
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x180032bfe
mov ebx, eax
add rbx, r14
je 0x180032bfe
lea r12, [r14 + rcx]
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x180032b51
lea r15, [r14 + rax]
jmp 0x180032b54
xor r15d, r15d
mov rcx, qword [r15]
call fcn.180032500
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x180032b7a
mov r8, rbx
mov rdx, rax
mov rcx, r13
call r9
test eax, eax
je 0x180032c0d
xor ebx, ebx
mov dword [rsp + 0x24], ebx
test r12, r12
je 0x180032bf0
nop word [rax + rax]
lea r9, [rbx*8]
mov rax, qword [r9 + r12]
test rax, rax
je 0x180032bde
xor edx, edx
mov dword [rsp + 0x20], edx
xor r8d, r8d
test rax, rax
jns 0x180032bb8
movzx edx, ax
mov dword [rsp + 0x20], edx
jmp 0x180032bc5
lea ecx, [rax + 2]
test ecx, ecx
je 0x180032bc5
mov r8d, ecx
add r8, r14
test rsi, rsi
je 0x180032bd6
add r9, r15
mov rcx, r13
call rsi
test eax, eax
je 0x180032bde
inc ebx
mov dword [rsp + 0x24], ebx
jmp 0x180032b90
test rsi, rsi
je 0x180032bf0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rsi
add rdi, 0x14
mov qword [rsp + 0x28], rdi
jmp 0x180032b20
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180032c3d
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x180032c21
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x180032c3d
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180033460
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x180033477
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x180033494
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003356b
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x1800334b6
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003356b
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x1800334d2
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003356b
lea r11, [r10 + 0x18]
add r11, rax
xor r8d, r8d
lea rbx, str..detour
mov dword [rsp + 0x20], r8d
movzx eax, word [r10 + 6]
cmp r8d, eax
jae 0x18003354f
lea rcx, [r8 + r8*4]
lea rdx, [r11 + rcx*8]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x18003354a
cmp rcx, 8
jne 0x180033500
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x18003354f
cmp dword [rdx + 0x10], 0
je 0x18003354f
lea rbx, [r9 + rax]
mov eax, dword [rbx]
cmp eax, 0x40
jb 0x18003354f
cmp dword [rbx + 4], 0x727444
jne 0x18003354f
cmp dword [rbx + 8], 0
jne 0x18003353d
mov dword [rbx + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x18003356b
inc r8d
jmp 0x1800334e3
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18003356b
add rsp, 0x30
pop rbx
ret

Function at 0x180033620
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], 0
mov r9, rdx
test r8, r8
je 0x180033650
sub rcx, rdx
movzx eax, byte [r9]
movzx edx, byte [rcx + r9]
lea r9, [r9 + 1]
xor edx, eax
movzx eax, byte [rsp + 0x18]
or eax, edx
mov byte [rsp + 0x18], al
sub r8, 1
jne 0x180033630
movzx ecx, byte [rsp + 0x18]
test cl, cl
sete al
ret
Function at 0x1800376d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r14
sub rsp, 0x30
mov rbx, qword [rcx + 0x20]
mov rsi, rdx
sub rbx, qword [rcx + 0x18]
xor edx, edx
mov rax, r8
mov r12, r8
div rbx
mov rbp, rcx
mov r14, rax
test rdx, rdx
jne 0x180037887
test rax, rax
je 0x180037870
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov rax, qword [rbp + 0x38]
mov rdi, r14
sub rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 8]
mov r8, qword [rbp + 0x30]
imul rdi, rbx
mov r10, qword [rcx]
cmp rax, rdi
cmovb rdi, rax
xor edx, edx
mov rax, rdi
div rbx
mov rdx, rsi
mov r9, rax
mov r15, rax
call qword [r10 + 0x48]
mov r8, qword [rbp + 0x18]
mov r9, rbx
mov rcx, qword [rbp + 0x30]
cmp rbx, 0x10
jb 0x1800377a0
mov r10, rbx
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbx
nop word [rax + rax]
mov rdx, qword [r8 + 8]
xor rdx, qword [rcx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rcx], rax
mov qword [rcx + 8], rdx
add rcx, 0x10
sub r10, 1
jne 0x180037780
test r9, r9
je 0x1800377c1
sub r8, rcx
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1800377b0
mov rdx, qword [rbp + 0x30]
mov r11, rdi
sub r11, rbx
add rdx, rbx
mov r9, r11
mov r8, rsi
cmp r11, 0x10
jb 0x180037810
mov r10, r11
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add r9, rax
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x1800377f0
test r9, r9
je 0x180037831
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180037820
test rbx, rbx
je 0x180037846
mov rcx, qword [rbp + 0x18]
lea rdx, [r11 + rsi]
mov r8, rbx
call fcn.1801a4560
test rdi, rdi
je 0x18003785a
mov rdx, qword [rbp + 0x30]
mov r8, rdi
mov rcx, rsi
call fcn.1801a4560
add rsi, rdi
sub r14, r15
jne 0x180037720
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rax, r12
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rsi
ret
lea r9, str.gold
mov dword [rsp + 0x20], 0xd2
lea r8, str.process
lea rdx, str.Input_is_full_blocks
lea rcx, str.sz___BS__0
call fcn.180043540
int3
Function at 0x1800378c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rcx + 0x20]
mov r12, rdx
sub rbx, qword [rcx + 0x18]
xor edx, edx
mov rax, r8
mov rdi, r8
div rbx
mov r14, rcx
mov r15, rax
test rdx, rdx
jne 0x180037a21
test rax, rax
je 0x180037a0b
mov rdx, qword [rcx + 0x18]
mov r8, rbx
mov rcx, r12
call fcn.180023950
mov rcx, qword [r14 + 8]
mov r9d, 1
mov r8, r12
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp r15, 1
je 0x1800379df
mov qword [rsp + 0x60], rbp
lea rdi, [rbx + r12]
mov qword [rsp + 0x68], rsi
lea rbp, [r15 - 1]
mov rsi, rbx
neg rsi
nop dword [rax]
lea r8, [rsi + rdi]
mov r9, rbx
mov rax, rdi
cmp rbx, 0x10
jb 0x180037990
mov r10, rbx
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbx
nop
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x180037970
test r9, r9
je 0x1800379b1
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1800379a0
mov rcx, qword [r14 + 8]
mov r9d, 1
mov r8, rdi
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x40]
add rdi, rbx
sub rbp, 1
jne 0x180037950
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rax, qword [r14 + 0x18]
lea rdx, [r15 - 1]
imul rdx, rbx
mov qword [r14 + 0x20], rax
lea rcx, [r14 + 0x18]
xor eax, eax
mov r8, r15
imul r8, rbx
add rdx, r12
movzx r9d, al
add r8, r12
call fcn.180036000
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r9, str.gold
mov dword [rsp + 0x20], 0x65
lea r8, str.process
lea rdx, str.CBC_input_is_full_blocks
lea rcx, str.sz___BS__0
call fcn.180043540
int3
Function at 0x180037ce0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r14, rcx
lea r12, [0x1801e6d80]
xor r15d, r15d
nop word [rax + rax]
movzx edi, byte [r15 + r12]
movzx eax, dil
movzx r9d, dil
shr al, 7
add r9b, r9b
movzx eax, al
imul edx, eax, 0x1b
movzx ebp, dl
xor r9b, bpl
movzx eax, r9b
movzx edx, r9b
shr al, 7
add dl, dl
movzx eax, al
xor dl, dil
imul ebx, eax, 0x1b
add dl, dl
movzx eax, r9b
movzx r8d, r9b
add al, al
xor bl, al
movzx eax, r9b
shr al, 7
xor r8b, bl
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, bl
shr al, 7
add bl, bl
movzx eax, al
shr r9b, 7
movzx r11d, cl
imul ecx, eax, 0x1b
movzx eax, r8b
add al, al
xor r8b, dil
movzx r10d, al
add r8b, r8b
movzx eax, r9b
xor r10d, edi
movzx esi, cl
imul ecx, eax, 0x36
xor r10d, esi
xor r10d, r11d
movzx eax, bl
xor eax, edi
xor eax, esi
xor dl, cl
movzx r9d, dl
xor r9d, edi
movzx edx, r8b
xor edx, ebp
xor r9d, ebp
xor edx, esi
xor r9d, esi
xor edx, r11d
shl edx, 8
or edx, eax
shl edx, 8
or edx, r10d
shl edx, 8
or edx, r9d
mov dword [r14 + r15*4], edx
inc r15
cmp r15, 0x100
jne 0x180037d10
mov rbx, qword [rsp + 0x20]
mov rax, r14
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x180037e70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov ecx, dword [0x1802a2cc0]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x180299820], eax
jg 0x180037ea6
lea rax, [0x180299420]
add rsp, 0x20
pop rbx
ret
lea rcx, [0x180299820]
call fcn.180186618
cmp dword [0x180299820], 0xffffffff
jne 0x180037e99
xor r9d, r9d
lea r10, str.cw
lea rbx, [0x180299420]
nop dword [rax]
movzx edx, byte [r9 + r10]
movzx eax, dl
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, dl
add al, al
movzx eax, al
movzx r8d, cl
xor r8d, eax
mov eax, edx
mov edx, r8d
xor r8d, eax
shl edx, 8
or edx, eax
shl edx, 8
or edx, eax
shl edx, 8
or edx, r8d
mov dword [rbx + r9*4], edx
inc r9
cmp r9, 0x100
jne 0x180037ed0
lea rcx, [0x180299820]
call fcn.1801865b8
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x18003c740
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18003c300
mov rcx, qword [rbx + 0x58]
mov r8, qword [rbx + 0x60]
sub r8, rcx
and r8, 0xfffffffffffffffc
je 0x18003c766
xor edx, edx
call fcn.1801a4970
mov rax, qword [rbx + 0x40]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x40]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbx + 0x40]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbx + 0x40]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbx + 0x40]
mov dword [rax + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x1800410a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
je 0x1800410fe
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
imul rdx, rax, 0xb
cmp rcx, rdx
jbe 0x1800410fe
sub rcx, rdx
mov eax, 0x80000
cmp rcx, rax
cmovb rax, rcx
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret