joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043bb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a2040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400a3488]
mov edi, ecx
cmp byte [rbx + 0x4cf1], 0
jne 0x140043c11
cmp byte [rbx + 0x4cf2], 0
jne 0x140043c11
movsx r9d, word [rbx + 0x5e38]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400324a0
test dil, 2
je 0x140043d3f
jmp 0x140043c9a
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5e38]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400921ac]
mulss xmm1, dword [0x1400921a0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe48]
addss xmm1, dword [rbx + 0xe4c]
mov qword [rbx + 0x49d0], rax
mov dword [rbx + 0x49bc], 1
movss dword [rbx + 0x49c8], xmm0
movss dword [rbx + 0x49cc], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x1400920d4]
or dword [rbx + 0x49b8], 0x41
movss dword [rbx + 0x4a18], xmm0
call fcn.1400324a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140043cf0
lea r11, [0x1400834f0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140043cd3
cmp byte [r8], r9b
jne 0x140043cd3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140043cc0
not ecx
call fcn.14003a720
test rax, rax
je 0x140043d3f
cmp byte [rax + 0xbe], 0
je 0x140043d3f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5e38]
movsx r9d, word [rbx + 0x5e38]
call fcn.1400324a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14003d250
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007c620
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140049480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5f90], 0
lea rbx, [rcx + 0x5f98]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140049527
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400494da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14004bd00
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140032e80
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5f90]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5fa0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400a346a]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14004952f
mov rcx, rbx
call fcn.140032e80
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140049850
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1400a3488]
xor ebp, ebp
cmp byte [rbx + 0x5ee8], bpl
jne 0x14004992f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140049928
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140032830
mov rsi, rax
test rax, rax
je 0x140049928
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400498b4
mov rcx, rax
call fcn.140049a80
mov r8, qword [0x1400a3488]
test r8, r8
je 0x14004991f
movsx rdx, word [r8 + 0x6048]
lea rcx, [r8 + 0x604c]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140049914
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6048], cx
movsx rax, cx
lea rcx, [r8 + 0x604c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x6044]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5ee8], 1
movss xmm0, dword [rbx + 0x5eec]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1400499be
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5eec], xmm0
jb 0x1400499be
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400499b1
mov rax, qword [0x1400a3488]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5eec], ebp
call fcn.140049ce0
lea rdx, [0x140091218]
mov rcx, rdi
mov rsi, rax
call fcn.140032740
mov rdi, rax
test rax, rax
je 0x1400499b8
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400499b8
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5eec], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400499e0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400a3488]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140049a43
mov qword [rsp], rbx
lea rbx, [0x1400834f0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140049a23
cmp byte [r8], r9b
jne 0x140049a23
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140049a10
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f00]
not eax
mov r8, qword [r10 + 0x5f08]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x140049a6f
cmp dword [r8 + 8], eax
je 0x140049a76
add r8, 0x48
cmp r8, rcx
jne 0x140049a60
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x14005ebc0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1400a2040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1400a3488]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14005edde
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14005edde
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1400a3488]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x14005ec94
movsx rdx, word [r8 + 0x6048]
lea rax, [r8 + 0x604c]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x14005ec89
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6048], cx
movsx rax, cx
lea rax, [rax*8 + 0x604c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6040]
test rdi, rdi
je 0x14005ecb1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x14005ecb4
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x14005ecf7
mov rsi, qword [r8 + 0x90]
jmp 0x14005ecfa
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14005ed25
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1400a3488]
mov rcx, qword [rax + 0x4ad0]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, [0x1400919a0]
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14005ed9e
inc rbx
cmp rbx, 5
jl 0x14005ed80
jmp 0x14005edca
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x14005ede0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007c620
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x140070460
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x1400704ec
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1400704c0
lea r11, [0x1400834f0]
nop
cmp r9b, 0x23
jne 0x1400704a3
cmp byte [r8], r9b
jne 0x1400704a3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140070490
mov rcx, qword [0x1400a3488]
not eax
cmp dword [rcx + 0x406c], eax
jne 0x1400704d7
mov dword [rcx + 0x4070], eax
cmp dword [rcx + 0x4098], eax
jne 0x140070549
mov byte [rcx + 0x409c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1400a3488]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4008]
movsxd rax, dword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140032690
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4054], eax
jne 0x140070542
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.14004ac50
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14007d168
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007d1b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007d1b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007d1b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007d1b2
cmp dword [rcx + 0x84], 0xe
jbe 0x14007d1b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007d1b4
xor al, al
add rsp, 0x28
ret

Function at 0x14007d3a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14007d3da
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14007d3df
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14007d428
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140082d10]
cmp byte [rcx + rax], 0
je 0x14007d428
dec r8
sub rdx, 1
jne 0x14007d40e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14007dbec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.14007d4b8
mov ebx, eax
test eax, eax
jne 0x14007dc1c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14007dc7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007dc76
test al, 0x10
je 0x14007dc76
bt eax, 0xa
jae 0x14007dc6f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.14007dc90
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14007dc6b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14007dc6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x14007dc76
and dword [rsp + 0x3c], 0
jmp 0x14007dc7b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180083b38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp fcn.18011ab59
mov r8, qword [rdx]
jmp 0x180081aec

Function at 0x180084f3a
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x18008967a
mov ecx, dword [rax + 8]
clc
cmc
add ecx, edx
cmp r10, rcx
jmp 0x180089674
movsxd r8, dword [rcx + 0x3c]
sub r9d, r9d
jmp 0x180089466
jb 0x180088e2d
sub eax, eax
jmp 0x1800881ef
ret
cmp r10, rdx
jmp 0x180081560
je 0x180085e36
mov edx, dword [rax + 0xc]
test r14w, sp
cmp r8b, 0xd9
jmp 0x180088bf7
lea r8, [r8 + rcx]
movsx r11, r11w
mov r10, rdx
movzx eax, word [r8 + 0x14]
bt r11d, r13d
movzx r11d, word [r8 + 6]
stc
add rax, 0x18
cmp ebp, 0x2cd6017a
test r11b, r8b
lea rax, [rax + r8]
cmp dl, ch
test r12w, 0x5e81
test r11d, r11d
jmp 0x180088e27
jb 0x1800881ef
inc r9d
cmc
test bh, 0xd7
add rax, 0x28
test rdx, rbp
cmp r9d, r11d
jmp 0x180085e30

Function at 0x1800850dc
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
bswap r8w
sbb r8b, 0x5a
xor ecx, ecx
movsx r8, cx
lea r8d, [rdx + 1]
jmp 0x18008aa13
jmp 0x1801224b0
mov dword [rsp + 0x18], r8d
clc
cmp r11b, dl
mov dword [rsp + 0x10], edx
clc
push rbp
stc
shld bp, r14w, 0xba
mov rbp, rsp
cmp ebx, r12d
sub rsp, 0x50
jmp 0x1801224d9
mov qword [rbp - 0x20], 0xfffffffffffffffe
test r9w, bx
cmp r8w, r14w
mov qword [rsp + 0x60], rbx
and bh, 0x74
btr ebx, 0x46
mov ebx, ecx
test r8d, r8d
jmp 0x1801224ff
jne 0x180122593
xor ecx, ecx
jmp 0x18012250c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180122593
mov ecx, 0x5a4d
cmc
cmp word [rax], cx
jmp 0x180122529
jne 0x180122593
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
jmp 0x18012253c
cmp dword [rcx], 0x4550
jmp 0x180122547
jne 0x180122593
mov eax, 0x20b
cmc
stc
cmp word [rcx + 0x18], ax
jmp 0x18012255d
jne 0x180122593
cmp dword [rcx + 0x84], 0xe
jmp 0x18012256f
jbe 0x180122593
cmp dword [rcx + 0xf8], 0
jmp 0x180122581
je 0x180122593
mov ecx, ebx
jmp 0x18012258e
call fcn.1801226fd
mov byte [rbp + 0x28], 0
cmovs r8, r11
movzx rdx, dx
seto al
lea rax, [rbp + 0x18]
setle dh
mov qword [rbp - 0x18], rax
movzx r8d, sp
movsx r9d, r10w
movzx r9w, dil
lea rax, [rbp + 0x20]
cmovl cx, r10w
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
movsx rdx, di
mov edx, edi
mov qword [rbp - 8], rax
movsx r8w, r10b
mov cl, r9b
movsx r9d, r13w
mov eax, 2
movsxd r9, ebp
movzx r9w, r11b
mov dword [rbp - 0x2c], eax
movsx ecx, r8w
cdq
mov dword [rbp - 0x28], eax
cqo
lea r9, [rbp - 0x2c]
movsx rdx, r9w
movzx ecx, r15w
cwd
lea r8, [rbp - 0x18]
cmovge rdx, r13
jmp 0x180122616
lea rdx, [rbp - 0x28]
movsx ecx, r12w
movsxd rcx, r8d
movsx cx, bh
lea rcx, [rbp - 0x30]
jmp 0x18012262e
call fcn.180122287
nop
cmp dword [rbp + 0x20], 0
je 0x18012265b
mov rbx, qword [rsp + 0x60]
ror bpl, 0x53
shr bpl, cl
rcl rbp, 0xcf
add rsp, 0x50
xchg ebp, ebp
pop rbp
jmp 0x18012265a
ret
mov ecx, ebx
jmp 0x180122662
call fcn.18012266d
int3
Function at 0x180087c7c
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
jmp 0x180083bf0
ret
ret
jne 0x1800831cb
movsxd rax, dword [rcx + 0x3c]
test r9b, r9b
test ah, 0xe8
add rax, rcx
stc
cmp dword [rax], 0x4550
jne 0x1800831cb
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1800831cb
mov eax, 1
jmp 0x180083edd
mov eax, 0x5a4d
cmc
cmp word [rcx], ax
jmp 0x180086bb0

Function at 0x18008adf3
Capabilities:
Parse pe header

Disassembly:
jmp 0x1801224b0
lea edx, [r8 + 2]
jmp 0x18008335a
xor r8d, r8d
jmp 0x180087e36
Function at 0x1800bcf30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
lahf
push rbp
cbw
push rsi
btr eax, 0xf8
push rdi
xadd bh, ah
rcl al, cl
push r14
sub eax, 0x7a572060
rcr bh, 0x31
push r15
clc
add r15w, r15w
movsx eax, r9w
sub rsp, 0x20
cmovge eax, esi
rcl ebx, cl
movsx r15d, r11w
mov r15, rdx
sal rax, 0x45
shld ax, r9w, 0x6d
neg ax
mov rbx, rcx
rcl ah, cl
add al, 0xae
cmp spl, 0xc7
mov eax, dword [rcx + 0xc]
jmp 0x1800bcf89
mov ecx, dword [rcx + 8]
cmc
jmp 0x1800bcf93
cmp ecx, eax
jmp 0x1800bcf9a
jne 0x1800bd0c9
test eax, eax
lea r14d, [rax + rax]
jmp 0x1800bcfab
jg 0x1800bcfb7
mov r14d, 4
movsxd rdi, r14d
rcr eax, cl
shl al, 0x8a
mov qword [rsp + 0x50], rdi
xor dl, 0xa7
shrd rcx, rbx, 0x54
dec dl
mov eax, 0x18
mul rdi
movsx cx, r12b
movsxd rcx, r8d
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
not ecx
mov rcx, rax
jmp 0x1800bcff3
call fcn.18008701d
mov rbp, rax
btc rsi, 0x46
rcl sil, cl
mov qword [rsp + 0x58], rax
stc
dec sil
sub sil, sil
mov rsi, rax
cmp ah, 0x32
stc
test r14d, r14d
je 0x1800bd043
mov rcx, rsi
jmp 0x1800bd027
call fcn.18008b0f4
add rsi, 0x18
test r8b, r13b
clc
sub rdi, 1
jmp 0x1800bd03d
jne 0x1800bd01f
xor edx, edx
cmp ebx, r12d
jmp 0x1800bd050
cmp dword [rbx + 8], edx
jle 0x1800bd0a0
mov ecx, edx
jmp 0x1800bd060
mov rax, qword [rbx]
jmp 0x1800bd068
movups xmm0, xmmword [rcx + rax]
jmp 0x1800bd071
movups xmmword [rcx + rbp], xmm0
movsd xmm1, qword [rcx + rax + 0x10]
jmp 0x1800bd080
movsd qword [rcx + rbp + 0x10], xmm1
jmp 0x1800bd08b
inc edx
lea rcx, [rcx + 0x18]
cmc
jmp 0x1800bd097
cmp edx, dword [rbx + 8]
jl 0x1800bd060
mov rcx, qword [rbx]
jmp 0x1800bd0a8
call fcn.1800810fd
mov qword [rbx], rbp
movsx rsi, ax
cmovno cx, bp
lahf
mov dword [rbx + 0xc], r14d
mov dil, 0x2c
setnp cl
mov ecx, dword [rbx + 8]
movsxd rdi, ecx
movsxd rax, ecx
inc bp
movzx r14w, r12b
jmp 0x1800bd0d9
lea rcx, [rax + rax*2]
movsx r14, ax
movsx ax, bh
mov rax, qword [rbx]
movzx rdi, r11w
movsx rbp, r13w
movups xmm0, xmmword [r15]
bswap r14d
movsxd r14, r10d
movups xmmword [rax + rcx*8], xmm0
mov dil, 0x90
mov r14b, sil
movzx rdi, cx
movsd xmm1, qword [r15 + 0x10]
movsd qword [rax + rcx*8 + 0x10], xmm1
not esi
movsx rsi, dx
inc dword [rbx + 8]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
bswap bp
movsxd rsi, r10d
pop r15
xchg r14d, ebp
movzx bp, r10b
pop r14
movzx bp, spl
movsxd rbp, r12d
movsx si, r9b
pop rdi
pop rsi
bswap rbp
pop rbp
jmp 0x1800bd150
ret
Function at 0x1801158b4
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx ecx, r11w
movsx ecx, r13w
jmp 0x1801158c5
lea rcx, [rsp + 0x30]
jmp 0x1801158cf
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp cl, dil
cmc
stc
add rsp, 0x28
jmp 0x1801158e8
ret

Function at 0x180116ae0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
setge r8b
mov r8, rcx
rcr ax, cl
clc
mov eax, 0x5a4d
cmp word [0x180000000], ax
jmp 0x180116b00
jne 0x180116c4c
movsxd rcx, dword [0x18000003c]
movzx dx, al
movsxd rdx, r10d
bts dx, bp
lea rdx, [0x180000000]
stc
lea rcx, [rcx + rdx]
cmp r14b, r9b
test esp, 0x62c80f82
cmp dword [rcx], 0x4550
jmp 0x180116b38
jne 0x180116c4c
mov eax, 0x20b
stc
test r15d, 0x43175c90
cmp word [rcx + 0x18], ax
jmp 0x180116b54
jne 0x180116c4c
sub r8, rdx
or al, spl
cmp ah, 0x94
movzx eax, word [rcx + 0x14]
and r9, r11
lea rdx, [rcx + 0x18]
add r9b, 6
lea rdx, [rdx + rax]
bt eax, 0xbc
movzx eax, word [rcx + 6]
sal r9b, cl
bswap r9d
mov cx, dx
lea rcx, [rax + rax*4]
movzx r9w, spl
lea r9, [rdx + rcx*8]
test rbp, 0x7ed31e22
cmp r10d, r15d
mov qword [rsp], rdx
jmp 0x180116ba7
cmp rdx, r9
jmp 0x180116baf
je 0x180116c04
mov ecx, dword [rdx + 0xc]
test r10b, r8b
cmp r11d, 0x7de776d4
jmp 0x180116bc7
cmp r8, rcx
jmp 0x180116bcf
jb 0x180116bf6
mov eax, dword [rdx + 8]
test r13w, bp
add eax, ecx
cmp si, 0x3fa7
jmp 0x180116be8
cmp r8, rax
jmp 0x180116bf0
jb 0x180116c10
add rdx, 0x28
jmp 0x180116bff
jmp 0x180116b9e
sub edx, edx
cmp ebx, 0x6cc82364
test ax, r11w
test rdx, rdx
jne 0x180116c25
xor al, al
jmp 0x180116c20
jmp 0x180116c5d
cmp dword [rdx + 0x24], 0
jmp 0x180116c2e
jge 0x180116c40
xor al, al
jmp 0x180116c3b
jmp 0x180116c5d
mov al, 1
jmp 0x180116c47
jmp 0x180116c5d
xor al, al
jmp 0x180116c5d
add rsp, 0x18
jmp 0x180116c66
ret
Function at 0x18011843e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
xadd r10b, r10b
mov qword [rax + 8], rbx
test r14b, cl
mov qword [rax + 0x10], rbp
shr r11b, cl
shr bl, 0xa8
rcr r10w, 0x13
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsx ebp, r11w
xadd r10b, r11b
dec r11b
push r14
ror bpl, 0x8c
shr r10b, 0xd9
mov bl, byte [rcx]
bt r14, rax
btr r14w, bx
lea r10, [rcx + 1]
btc r11w, 0x6f
ror r11d, 0xa1
mov byte [rdx], bl
xor r14b, 0x2c
movzx r14d, r12w
mov esi, r9d
sbb di, si
add r14b, r12b
lea r14, [0x180000000]
sub r11d, r14d
not di
bts edi, eax
mov rbp, r8
sbb edi, r9d
mov r11, rdx
cmp r11b, 0xf7
rol dil, 0x36
ror dil, cl
mov rdi, rcx
cmp r8b, 0x1d
cmc
test bl, 4
je 0x180118508
movzx ecx, byte [r10]
shrd ax, bx, 0xcf
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x6c8a0]
mov cl, byte [rcx + r14 + 0x6c8b0]
cmp ax, r12w
test al, 0xdf
sub r10, rax
mov eax, dword [r10 - 4]
shr eax, cl
mov dword [rdx + 4], eax
test bl, 8
jmp 0x180118510
je 0x180118531
mov eax, dword [r10]
jmp 0x180118521
add r10, 4
mov dword [rdx + 8], eax
jmp 0x180118531
test bl, 0x10
je 0x180118554
mov eax, dword [r10]
dec r8d
add r10, 4
mov dword [rdx + 0xc], eax
xchg r8d, r8d
shrd ax, r8w, 0x73
sbb r8w, bp
movsxd rax, dword [r10]
bt r8w, 0xd8
lea r8, [r10 + 4]
jmp 0x180118566
xor r9d, r9d
test eax, eax
cmp r10b, bl
cmp byte [rsp + 0x30], r9b
jmp 0x180118578
jne 0x180118640
test bl, 2
jmp 0x180118586
je 0x180118640
lea rdx, [rax + rbp]
movzx ecx, byte [rdx]
and r10, rbp
and ecx, 0xf
adc r10b, r11b
bt eax, r8d
ror rax, cl
movsx rax, byte [rcx + r14 + 0x6c8a0]
sbb r10b, 5
adc r10b, 0x72
bts r10w, si
mov cl, byte [rcx + r14 + 0x6c8b0]
shl r10b, 0x7e
neg r10d
btr r10d, 0xae
sub rdx, rax
stc
shr r10d, 0xd8
mov r10d, dword [rdx - 4]
test r13w, 0x1a06
cmp r11b, 0x43
shr r10d, cl
test rdx, rcx
mov dword [r11 + 0x10], r9d
test bpl, 0xd0
cmc
test r10d, r10d
jmp 0x1801185fa
je 0x180118643
mov eax, dword [rdx]
ror ch, 0x3a
movsx rcx, r8w
mov ecx, dword [rdx + 4]
lea rdx, [rdx + 8]
stc
cmp r9, r10
cmp eax, esi
je 0x180118632
inc r9d
cmp r9d, r10d
jmp 0x180118627
jb 0x180118600
jmp 0x180118643
mov dword [r11 + 0x10], ecx
jmp 0x18011863b
jmp 0x180118643
mov dword [rdx + 0x10], eax
test bl, 1
jmp 0x18011864b
je 0x18011869f
movzx ecx, byte [r8]
ror edx, 0xd0
and ecx, 0xf
movsxd rbx, r14d
cwde
movsx rdx, byte [rcx + r14 + 0x6c8a0]
mov bp, r9w
bts bp, r12w
btr ax, r8w
mov cl, byte [rcx + r14 + 0x6c8b0]
dec r14
sub r8, rdx
sub bpl, bpl
cmc
cmovnp si, r12w
mov edx, dword [r8 - 4]
shr al, cl
shr edx, cl
mov dword [r11 + 0x14], edx
adc al, 0xd7
movsx r14, r13w
mov rbx, qword [rsp + 0x10]
rcr sil, cl
cmp bpl, bl
rcr ah, 0xec
sub r8, rdi
movsxd r14, eax
setne sil
mov rbp, qword [rsp + 0x18]
mov rax, r8
bswap esi
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
movsx r14, r15w
not r14b
mov r14b, r15b
pop r14
jmp 0x1801186dc
ret