joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d6c10
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.1801d6c40
test rax, rax
jne 0x1801d6c39
test rbx, rbx
je 0x1801d6c39
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1801d5ee0
add rsp, 0x20
pop rbx
ret

Function at 0x1801d75a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x1802b1f70]
test rax, rax
je 0x1801d75df
mov rax, qword [0x18029e080]
inc rax
mov qword [0x18029e080], rax
mov rax, qword [0x1802b1f70]
xor rax, 0x11223344
jne 0x1801d7623
mov edx, 6
mov dword [rsp + 0x20], 0x767d677f
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x32382435
mov dword [rsp + 0x28], 0x7d76096a
mov dword [rsp + 0x2c], 0x5e6a7675
mov dword [rsp + 0x30], 0x576e2439
mov dword [rsp + 0x34], 0x18044a44
call fcn.1801d7260
test rax, rax
je 0x1801d763f
mov qword [0x1802b1f70], rax
mov rcx, qword [0x1802b1f70]
xor rcx, 0x11223344
mov qword [0x1802b1f70], rcx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x58
ret
Function at 0x1801dec70
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov edi, eax
test eax, eax
je 0x1801dece5
mov edx, edi
mov rcx, rbx
call fcn.1800dcde0
mov r9d, edi
mov r8, qword [rbx]
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call fcn.1801de9a0
lea rdx, [0x18027f3e8]
lea rcx, [rsp + 0x28]
call fcn.18020aad0
int3
Function at 0x1801e0ca0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rdx + 8]
mov rsi, rcx
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1801e0dbb
mov qword [rsp + 0x50], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x58], r14
movabs r14, 0xcbf29ce484222325
movzx eax, byte [rbx + 0x11]
movzx edx, byte [rbx + 0x10]
mov r8, qword [rsi + 8]
xor rdx, r14
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rbx + 0x12]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rbx + 0x13]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rbx + 0x14]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rbx + 0x15]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rbx + 0x16]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rbx + 0x17]
imul rdx, rbp
xor rdx, rax
imul rdx, rbp
and rdx, qword [rsi + 0x30]
shl rdx, 4
add rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x1801e0d7b
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1801e0d6f
nop
cmp rax, rdx
je 0x1801e0d7b
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1801e0d60
test rax, rax
cmove rax, r8
cmp rax, r8
jne 0x1801e0d9f
mov rax, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov eax, dword [rbx + 0x18]
mov rcx, rsi
mov dword [rsp + 0x28], eax
call fcn.1801df340
jmp 0x1801e0da5
mov ecx, dword [rbx + 0x18]
add dword [rax + 0x18], ecx
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1801e0ce0
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1801e1800
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1801e19df
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1801ced60
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1801e19a8
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1801e191c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1801e1997
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1801e1959
mov r10, qword [rax]
cmp r10, rcx
je 0x1801e1953
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1801e1997
mov r8, rax
cmp r10, rax
je 0x1801e1973
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1801e19b9
cmp r10, rax
jne 0x1801e1961
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1801e18a0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1801e1997
lea rcx, [0x1800744b8]
call fcn.1801e7600
int3
Function at 0x1801e19f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1801e1bc9
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.1801ced60
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1801e1b90
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x14]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x15]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x16]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x17]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1801e1afc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1801e1b77
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1801e1b39
mov r10, qword [rax]
cmp r10, rcx
je 0x1801e1b33
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1801e1b77
mov r8, rax
cmp r10, rax
je 0x1801e1b53
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1801e1ba3
cmp r10, rax
jne 0x1801e1b41
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1801e1a80
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1801e1b77
lea rcx, [0x1800744b8]
call fcn.1801e7600
int3
Function at 0x1801e1db0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov r8d, select
lea rdx, [rsp + 0x50]
lea rcx, [0x180075ef8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, 0xc
jne 0x1801e1f50
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], sendto
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1801e1e20
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180099770
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, 0x10
cmovae rcx, rdi
lea rdx, [rsp + 0x30]
cmovae rdx, rdi
mov r8, qword [rsp + 0x40]
add rdx, r8
cmp rcx, rdx
je 0x1801e1e8f
movabs r9, 0x7e0000007e03ff
movzx eax, byte [rcx]
sub al, 0x30
cmp al, 0x36
ja 0x1801e1f1c
bt r9, rax
jae 0x1801e1f1c
inc rcx
cmp rcx, rdx
jne 0x1801e1e70
xor eax, eax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
cmp rsi, 0x10
cmovae rdx, rdi
test r8, r8
je 0x1801e1eba
lea rcx, [rsp + 0x20]
call fcn.18020b840
mov eax, dword [rsp + 0x28]
mov byte [rbx], 0
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
movups xmmword [rbx + 0x18], xmm0
mov byte [rbx + 0x28], 0
movsd xmm0, qword [rsp + 0x20]
movsd qword [rbx + 0x29], xmm0
mov dword [rbx + 0x31], eax
mov byte [rbx + 0x28], 1
cmp rsi, 0x10
jb 0x1801e1f6b
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1801e1f11
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801e1f93
mov rcx, rdi
call fcn.1801e61d0
nop
jmp 0x1801e1f6b
cmp rsi, 0x10
jb 0x1801e1f50
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1801e1f47
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801e1f8d
mov rcx, rdi
call fcn.1801e61d0
nop
mov byte [rbx], 0
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
movups xmmword [rbx + 0x18], xmm0
mov byte [rbx + 0x28], 0
xor eax, eax
mov qword [rbx + 0x29], rax
mov dword [rbx + 0x31], eax
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.18010fa40
nop
call fcn.18010fa40
int3
Function at 0x1801e4780
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x80]
lea rcx, [0x180075fe0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1801e48fc
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], sendto
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1801e47f2
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x28]
call fcn.180099770
nop
lea rsi, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
cmp rbp, 0x10
cmovae rsi, rdi
cmp qword [rsp + 0x38], 9
jb 0x1801e48c8
mov rbx, rsi
cmp byte [rbx], 0x43
jne 0x1801e4853
mov r8d, 9
lea rdx, [0x180075dd8]
mov rcx, rbx
call fcn.18020c090
test eax, eax
je 0x1801e485d
cmp rbx, rsi
je 0x1801e48c8
dec rbx
jmp 0x1801e4835
sub rbx, rsi
jne 0x1801e48c8
lea rcx, [rsp + 0x48]
call fcn.1801e1db0
cmp byte [rsp + 0x70], bl
je 0x1801e48bd
mov byte [rsp + 0x70], bl
lea rcx, [rsp + 0x48]
call fcn.1801ce2e0
nop
cmp rbp, 0x10
jb 0x1801e48b9
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1801e48b0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801e492d
mov rcx, rdi
call fcn.1801e61d0
nop
mov al, 1
jmp 0x1801e48fe
lea rcx, [rsp + 0x48]
call fcn.1801ce2e0
nop
cmp rbp, 0x10
jb 0x1801e48fc
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1801e48f3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801e4927
mov rcx, rdi
call fcn.1801e61d0
nop
xor al, al
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.18010fa40
nop
call fcn.18010fa40
int3
Function at 0x180218f50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, r8
mov rbp, rdx
mov r12, rcx
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
lea r14, [r8 + 1]
movdqu xmmword [rsp + 0x28], xmm0
xor esi, esi
mov qword [rsp + 0x38], rsi
xor ebx, ebx
test r14, r14
je 0x180219013
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x18021918d
cmp r14, 0x1000
jb 0x180218fe3
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x180219193
call fcn.1801e6190
test rax, rax
je 0x180219199
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180218fee
mov rcx, r14
call fcn.1801e6190
mov rbx, rax
mov rdi, rbx
mov qword [rsp + 0x28], rbx
lea rsi, [rbx + r14]
mov qword [rsp + 0x38], rsi
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.18020bef0
mov qword [rsp + 0x30], rsi
jmp 0x180219018
mov rdi, qword [rsp + 0x28]
test rbp, rbp
je 0x1802190f7
test rbx, rbx
je 0x1802190f7
xor r8d, r8d
test r15, r15
je 0x1802190f2
cmp r15, 0x40
jb 0x1802190cc
lea rcx, [r15 - 1]
add rcx, rbx
lea rax, [rbp - 1]
add rax, r15
cmp rbx, rax
ja 0x180219058
cmp rcx, rbp
jae 0x1802190cc
mov rax, r15
and eax, 0x3f
mov r9, r15
sub r9, rax
movdqa xmm2, xmmword [0x18007a910]
lea rax, [rbx + 0x10]
mov rcx, rbp
sub rcx, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax - 0x10]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm1, xmmword [rcx + rax]
pxor xmm1, xmm2
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rcx + rax + 0x10]
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm1, xmmword [rcx + rax + 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax + 0x20], xmm1
add r8, 0x40
lea rax, [rax + 0x40]
cmp r8, r9
jb 0x180219080
cmp r8, r15
jae 0x1802190f2
lea rcx, [rbx + r8]
sub rbp, rbx
mov rdx, r15
sub rdx, r8
nop dword [rax]
movzx eax, byte [rcx + rbp]
xor al, 0x67
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1802190e0
mov byte [r15 + rbx], 0
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], sendto
mov byte [r12 + 8], 0
lea rax, [0x1800567d8]
mov qword [r12], rax
movsxd r8, r15d
mov rdx, rdi
mov rcx, r12
call fcn.1800f1680
nop
test rdi, rdi
je 0x18021915e
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x180219152
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180219187
mov rdx, rsi
mov rcx, rdi
call fcn.1801e61d0
nop
mov rax, r12
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.18010fa40
nop
call fcn.180099420
int3
call fcn.180099270
int3
call fcn.18010fa40
int3
Function at 0x1802191a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r9, rcx
test rcx, rcx
je 0x18021928a
test rdx, rdx
je 0x18021928a
xor ecx, ecx
test r8, r8
je 0x180219285
cmp r8, 0x40
jb 0x180219261
lea rdx, [r8 - 1]
lea rax, [r8 - 1]
add rdx, r10
add rax, r9
cmp r10, rax
ja 0x1802191e9
cmp rdx, r9
jae 0x180219261
mov r11, r8
mov qword [rsp], rbx
and r11, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x18007a910]
lea rax, [r10 + 0x10]
mov rdx, r9
sub rdx, r10
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rdx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
pxor xmm0, xmm2
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r11
jb 0x180219210
mov rbx, qword [rsp]
cmp rcx, r8
jae 0x180219285
sub r9, r10
lea rax, [rcx + r10]
mov rdx, r8
sub rdx, rcx
nop
movzx ecx, byte [rax + r9]
lea rax, [rax + 1]
xor cl, 0x67
mov byte [rax - 1], cl
sub rdx, 1
jne 0x180219270
mov byte [r10 + r8], 0
add rsp, 8
ret
Function at 0x140004550
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, qword [0x1400076b0]
lea rsi, section..rdata
mov rax, qword [rbx]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, rcx
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea r10, [rsp + 0x148]
mov r11, rdx
lea rbp, [rsp + 0x48]
mov rdx, rax
mov byte [rax + r10], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx + 0x28]
mov byte [rax + rbp - 1], dl
cmp rax, 0x100
jne 0x14000459b
mov r12, r10
xor esi, esi
xor r13d, r13d
mov edi, 0x100
movzx eax, byte [r12]
movzx edx, byte [rbp + rsi]
inc rsi
add eax, r13d
add eax, edx
cdq
idiv edi
movsxd rcx, edx
mov rdx, r12
inc r12
mov r13, rcx
add rcx, r10
call fcn.140004520
cmp rsi, 0x100
jne 0x1400045c5
lea rdi, [r9 + r11]
xor ebp, ebp
xor r12d, r12d
cmp rdi, r9
je 0x140004655
lea eax, [rbp + 1]
cdq
idiv esi
movsxd r13, edx
movzx eax, byte [rsp + r13 + 0x148]
lea rcx, [r10 + r13]
mov rbp, r13
add eax, r12d
cdq
idiv esi
movsxd r14, edx
lea rdx, [r10 + r14]
mov r12, r14
call fcn.140004520
mov cl, byte [rsp + r14 + 0x148]
add cl, byte [rsp + r13 + 0x148]
movzx ecx, cl
mov al, byte [rsp + rcx + 0x148]
xor byte [r9], al
inc r9
jmp 0x140004600
mov rax, qword [rsp + 0x248]
sub rax, qword [rbx]
je 0x140004667
call fcn.140003dd0
mov rax, r11
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x7ffbf1568920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x7ffbf1569ca0
push rbp
push rbx
push rsi
btc ebp, 0x61
movsx eax, sp
push rdi
mov ax, 0x3689
mov dword [rbp + 0x40], eax
jmp 0x7ffbf1568ac8

Function at 0x7ffbf1569cb0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
jne 0x7ffbf156a239
mov rdx, qword [r10 + 0x30]
btr ecx, 4
movzx r11d, bx
movsxd rax, dword [rdx + 0x3c]
shl r10w, cl
shrd r10d, edi, 0x44
adc sil, 0x4a
mov ecx, dword [rax + rdx + 0x88]
neg dil
jmp 0x7ffbf156a356
jne 0x7ffbf1568ac8
xor ebx, ebx
jmp 0x7ffbf156a2ae
lock dec dword [rbp + 0x40]
test r10b, 0xc5
sub rax, r12
jmp 0x7ffbf1568abb
xor r8d, eax
movsx rax, r10w
cdqe
movzx eax, word [r9]
jmp 0x7ffbf1569fc6
rcl ah, 0x88
push r12
movzx bp, r12b
push r14
lahf
push r15
cmp r11b, 0xf0
or ax, ax
mov rbp, rsp
cmp spl, 0x3c
sub rsp, 0x40
cmovge r12, rsp
nop
mov eax, 0x7fffffff
not r12d
mov r12b, 0x30
movsxd r12, ebp
mov r12d, 1
jmp 0x7ffbf156a0e2
jne 0x7ffbf156a26c
cmp r8d, 0x66b65ce9
jmp 0x7ffbf1569dfa
je 0x7ffbf1568a3f
mov rcx, qword [rcx]
cmc
cmp rcx, rdx
jmp 0x7ffbf1568a39
invalid
invalid
invalid
Function at 0x7ffbf158a614
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x7ffbf1530000], ax
jne 0x7ffbf158a69f
movsxd rcx, dword [0x7ffbf153003c]
lea rdx, [0x7ffbf1530000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x7ffbf158a69f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ffbf158a69f
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x7ffbf158a69b
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x7ffbf158a695
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x7ffbf158a695
test rdx, rdx
je 0x7ffbf158a69b
cmp dword [rdx + 0x24], 0
jge 0x7ffbf158a691
xor al, al
jmp 0x7ffbf158a6a5
mov al, 1
jmp 0x7ffbf158a6a5
add rdx, 0x28
jmp 0x7ffbf158a667
xor al, al
jmp 0x7ffbf158a6a5
xor al, al
jmp 0x7ffbf158a6a5
add rsp, 0x18
ret
Function at 0x1400099f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140009a23
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140009a66
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140009a61
cmp rbx, r11
jae 0x140009a66
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140009a50
cmp rbx, r11
jb 0x140009a6a
xor eax, eax
jmp 0x140009a76
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000aa20
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r13
push r14
push r15
sub rsp, 0x48
mov r8, qword [rcx]
mov r11d, dword [rcx + 0x24]
mov rbp, rcx
movzx eax, word [r8 + 0x14]
mov r15, qword [r8 + 0x30]
dec r11d
mov r10d, dword [rax + r8 + 0x20]
lea r9, [rax + r8 + 0x18]
movabs rax, 0xffffffff00000000
and r15, rax
mov eax, dword [r9 + 0x10]
not r11d
or r10, r15
and r11, r10
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], r11
test eax, eax
jne 0x14000aa8b
mov ecx, dword [r9 + 0x24]
test cl, 0x40
je 0x14000aa83
mov eax, dword [r8 + 0x20]
jmp 0x14000aa8b
test cl, cl
jns 0x14000aa8b
mov eax, dword [r8 + 0x24]
mov ecx, dword [r9 + 0x24]
mov qword [rsp + 0x70], rbx
mov edx, eax
mov eax, 1
xor r14d, r14d
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x3c], r14d
mov r13d, eax
cmp ax, word [r8 + 6]
jae 0x14000ab7c
lea rbx, [r9 + 0x4c]
mov edi, dword [rbp + 0x24]
mov r12d, dword [rbx - 0x1c]
mov esi, dword [rbx - 0x14]
dec edi
or r12, r15
not edi
and rdi, r12
test esi, esi
jne 0x14000aafc
mov eax, dword [rbx]
test al, 0x40
je 0x14000aaf4
mov esi, dword [r8 + 0x20]
jmp 0x14000aafc
test al, al
jns 0x14000aafc
mov esi, dword [r8 + 0x24]
cmp r11, rdi
je 0x14000ab35
lea rax, [rdx + r10]
cmp rax, rdi
ja 0x14000ab35
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.14000a920
test eax, eax
je 0x14000abb9
mov ecx, dword [rbx]
mov r10, r12
mov qword [rsp + 0x20], r12
mov r11, rdi
mov qword [rsp + 0x28], rdi
mov edx, esi
jmp 0x14000ab55
mov eax, dword [rbx]
bt eax, 0x19
jae 0x14000ab47
bt ecx, 0x19
jae 0x14000ab47
or ecx, eax
jmp 0x14000ab4d
or ecx, eax
btr ecx, 0x19
mov edx, esi
sub rdx, r10
add rdx, r12
mov r8, qword [rbp]
inc r13d
add rbx, 0x28
movzx eax, word [r8 + 6]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rdx
cmp r13d, eax
jl 0x14000aad0
mov eax, 1
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov dword [rsp + 0x3c], eax
call fcn.14000a920
test eax, eax
setne r14b
mov eax, r14d
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x48
pop r15
pop r14
pop r13
pop rbp
ret
xor eax, eax
jmp 0x14000ab96