joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x73
mov dword [rbp - 0x20], 0x37000d
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x200033
mov dword [rbp - 0x18], 0x2d004c
mov dword [rbp - 0x14], 0x28002e
mov dword [rbp - 0x10], 0x2b0036
call fcn.140005e60
mov rcx, rax
call 0x14000e6b0
mov ebx, 0x65
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], bx
mov dword [rbp - 0x20], 0x37000d
mov dword [rbp - 0x1c], 0x200033
mov dword [rbp - 0x18], 0x2d004c
mov dword [rbp - 0x14], 0x5b005f
call fcn.140002590
mov rcx, rax
call 0x14000e6b0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x60028
mov dword [rbp - 0x1c], 0x20005
mov dword [rbp - 0x18], 0x610065
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000e6b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000e712
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000a180
test al, al
jne 0x14000e724
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000e6e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000d3ce
mov word [rbp + 0x50], 0x7246
mov word [rbp + 0x58], 0x7246
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000d254
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000d240
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000d285
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000d270
cmp rdi, rbx
jne 0x14000d3a2
mov r13, rsi
mov word [rbp - 0x50], 0x7246
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000d2c6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000d2b2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000d3c8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x720027
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000d338
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x72003c
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000d338
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x720027
mov dword [rbp - 0x42], 0x720007
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x720027
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000d395
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x72003c
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000d395
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x720027
mov dword [rbp - 0x32], 0x720007
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000d3a2
inc r14
jmp 0x14000d2a0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000d3ce
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000d210
mov rax, qword [rbp - 8]
jmp 0x14000d3d0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e6b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x73
mov dword [rbp - 0x20], 0x37000d
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x200033
mov dword [rbp - 0x18], 0x2d004c
mov dword [rbp - 0x14], 0x28002e
mov dword [rbp - 0x10], 0x2b0036
call fcn.140005e60
mov rcx, rax
call 0x14000e6b0
mov ebx, 0x65
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], bx
mov dword [rbp - 0x20], 0x37000d
mov dword [rbp - 0x1c], 0x200033
mov dword [rbp - 0x18], 0x2d004c
mov dword [rbp - 0x14], 0x5b005f
call fcn.140002590
mov rcx, rax
call 0x14000e6b0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x60028
mov dword [rbp - 0x1c], 0x20005
mov dword [rbp - 0x18], 0x610065
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000e6b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000e712
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000a180
test al, al
jne 0x14000e724
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000e6e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140059590
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005959d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400595ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140059595
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400595c5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400595b2
sub eax, 3
jb 0x1400595df
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140059616
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140059606
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140059604
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400595f3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140059552
jmp 0x14005959d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x21400
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140059662
cmp rsi, rcx
jae 0x14005966a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140059649
cmp al, 0x8f
ja 0x140059649
cmp byte [rsi - 2], 0xf
je 0x14005964f
sub al, 0xe8
cmp al, 1
ja 0x140059633
cmp rsi, rcx
jae 0x14005966a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140059639
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005966a
lodsb al, byte [rsi]
jmp 0x140059649
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x57000]
mov eax, dword [rdi]
or eax, eax
je 0x1400596d3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5bb70]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140059677
jns 0x1400596ac
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400596b6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400596cd
mov qword [rbx], rax
add rbx, 8
jmp 0x140059697
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005970d
cmp al, 0xef
ja 0x1400596ff
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400596df
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400596ee
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140059761
sub rsp, 0xffffffffffffff80
jmp 0x1400088c4
Function at 0x180008ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x640
movzx ebx, byte [rsp + 0x688]
lea ebp, [rdx + 9]
mov r14, rcx
cmp edx, ebp
jae case.0x180009054.20
mov r15, qword [rsp + 0x690]
lea edi, [rdx - 0x8b]
mov esi, dword [rsp + 0x688]
lea r12, [0x180000000]
xor r13d, r13d
nop dword [rax]
cmp edi, 0x14
ja case.0x180009054.4
mov ecx, dword [r12 + rdi*4 + 0x9158]
add rcx, r12
jmp rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp case.0x180009054.4
mov ecx, 0xfffffdd4
lea rdx, [rsp + 0x50]
call qword [0x1800d5910]
mov word [0x1800d5918], r13w
jmp case.0x180009054.4
mov rcx, qword [0x1800c56b0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov rcx, qword [0x1800c56b0]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], 2
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov rcx, qword [0x1800c56b0]
xor edx, edx
movsxd r15, eax
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x180009054.4
cmp dword [rsp + 0x5b0], r13d
setne bl
jmp case.0x180009054.4
mov rax, qword [r14]
lea rdx, [rsp + 0x688]
mov r8d, 0x92
mov qword [rsp + 0x690], rax
lea rcx, [rsp + 0x690]
mov dword [rsp + 0x688], r15d
call fcn.18004ff10
jmp case.0x180009054.4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
jmp case.0x180009054.4
mov dword [rsp + 0x20], 0x2c
jmp case.0x180009054.4
add esi, dword [r14]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jbe 0x180009120
inc edi
lea eax, [rdi + 0x8b]
cmp eax, ebp
jb 0x180009040
movzx eax, bl
mov rbx, qword [rsp + 0x680]
add rsp, 0x640
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000df50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea esi, [rcx + 0xc6]
mov rdi, rdx
cmp ecx, esi
jae 0x18000e05d
mov ebp, dword [rsp + 0x60]
lea ebx, [rcx - 0x14]
mov r14, qword [rsp + 0x70]
lea r15, [0x180000000]
cmp ebx, 0xc7
ja case.0x18000dfa4.6
movzx eax, byte [r15 + rbx + 0xe0b0]
mov ecx, dword [r15 + rax*4 + 0xe094]
add rcx, r15
jmp rcx
xor ebp, ebp
cmp byte [rdi], 0xb
jne case.0x18000dfa4.6
mov ebp, dword [rdi + 2]
jmp case.0x18000dfa4.6
mov rax, qword [rdi]
lea rdx, [rsp + 0x60]
mov r8d, 0x92
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x60], r14d
call fcn.18004ff10
jmp case.0x18000dfa4.6
mov qword [rsp + 0x28], 0
lea r8, [0x18000dd40]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
test rax, rax
je 0x18000e072
mov byte [rdi + 0xc], 1
jmp case.0x18000dfa4.6
xor edx, edx
lea rcx, str.ReadPageTable
call qword [sym.imp.USER32.dll_FindWindowW]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1800c56b0]
xor edx, edx
movsxd r14, eax
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
add ebx, 0x21
lea eax, [rbx + 0x14]
cmp eax, esi
jb 0x18000df84
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x60], 0
jmp 0x18000e05d
mov byte [rsp + 0x60], 1
jmp 0x18000e05d
mov rbx, qword [rsp + 0x68]
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013f30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
push r15
sub rsp, 0x638
lea ebp, [rcx + 0xa]
mov r14, r9
mov r12, r8
mov r15, rdx
cmp ecx, ebp
jae 0x1800140c9
mov qword [rax + 0x10], rbx
xor r8d, r8d
mov ebx, dword [rsp + 0x660]
mov qword [rax + 0x18], rsi
mov rsi, qword [rsp + 0x30]
mov qword [rax + 0x20], rdi
lea edi, [rcx - 0xd]
mov qword [rax - 0x28], r13
lea r13, [0x180000000]
nop
cmp edi, 0x20
ja case.0x180013f9d.9
movzx eax, byte [rdi + r13 + 0x14108]
mov ecx, dword [r13 + rax*4 + 0x140e0]
add rcx, r13
jmp rcx
mov dword [rsp + 0x660], ebx
jmp case.0x180013f9d.9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0x200
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x240]
mov ecx, 0xad
call fcn.18006bdd0
mov ecx, 0xffffff22
lea rdx, [rsp + 0x40]
call qword [0x1800d5910]
xor r8d, r8d
jmp case.0x180013f9d.9
mov eax, dword [r14]
mov dword [rsp + 0x59c], eax
mov dword [rsp + 0x5a0], r15d
jmp case.0x180013f9d.9
mov word [0x1800d5918], r8w
jmp case.0x180013f9d.9
cmp byte [r14], 0x14
jne case.0x180013f9d.9
mov rdx, qword [r14 + 6]
test rdx, rdx
je case.0x180013f9d.9
movsxd rax, dword [r12]
test eax, eax
js case.0x180013f9d.9
cmp eax, dword [r14 + 2]
jg case.0x180013f9d.9
mov rdx, qword [rdx]
movups xmm0, xmmword [r15]
imul rcx, rax, 0x2a
add rdx, rcx
movups xmmword [rdx], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdx + 0x10], xmm1
movsd xmm0, qword [r15 + 0x20]
movsd qword [rdx + 0x20], xmm0
movzx eax, word [r15 + 0x28]
mov word [rdx + 0x28], ax
jmp case.0x180013f9d.9
mov rcx, r14
call qword [0x1800d5988]
mov byte [rsp + 0x660], al
xor r8d, r8d
jmp case.0x180013f9d.9
mov rdx, qword [r15]
mov rax, r8
test rdx, rdx
je case.0x180013f9d.9
nop
movzx ecx, byte [rax + rsi]
inc rax
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp rax, rdx
jb 0x180014080
jmp case.0x180013f9d.9
mov ebx, dword [r14]
mov rsi, r12
inc edi
lea eax, [rdi + 0xd]
cmp eax, ebp
jb 0x180013f80
mov rdi, qword [rsp + 0x678]
mov rsi, qword [rsp + 0x670]
mov rbx, qword [rsp + 0x668]
mov r13, qword [rsp + 0x630]
mov eax, dword [rsp + 0x660]
add rsp, 0x638
pop r15
pop r14
pop r12
pop rbp
ret
Function at 0x180016e80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea eax, [rdx + 0x36b]
mov r14d, edx
mov dword [rsp + 0x88], eax
mov r15, rcx
mov ebx, dword [rsp + 0x88]
cmp edx, eax
jae 0x180017016
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x90]
mov r13, qword [rsp + 0x90]
nop
cmp r14d, 0x11b
ja 0x180016fa2
je 0x180016f18
mov eax, r14d
sub eax, 0x57
je 0x180016f0a
sub eax, 0x7d
je 0x180016efd
cmp eax, 8
jne 0x180017004
xor r12d, r12d
jmp 0x180017004
mov dword [r13 + 2], 0x70
jmp 0x180017004
mov rax, qword [r15]
mov rcx, qword [rax]
mov r13, qword [rcx]
jmp 0x180017004
mov rcx, qword [r15]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180017004
mov edi, 0x94
cmp edi, 0x94
je 0x180016f7f
cmp edi, 0x130
jne 0x180016f92
test rbp, rbp
je 0x180016f74
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x14
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x24], xmm0
call rbp
test eax, eax
js 0x180016f74
movzx ebx, word [rsp + 0x24]
movzx eax, word [rsp + 0x28]
shl ebx, 0x10
or ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180016f92
lea rdx, str.CancelMeeting
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
add edi, 0x9c
cmp edi, 0x1cc
jb 0x180016f34
jmp 0x180017004
mov eax, r14d
sub eax, 0x159
je 0x180016ff3
sub eax, 0x3f
je 0x180017016
cmp eax, 0x3e
jne 0x180017004
test r12, r12
jle 0x180017004
mov rcx, r12
call fcn.180073cfc
mov r8, r12
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180070440
mov rcx, qword [r15]
mov r8d, r12d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x180017004
mov rcx, qword [r15]
call fcn.180073cf4
mov qword [r15], rdi
jmp 0x180017004
mov rcx, qword [r15]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r12d, eax
add r14d, 0x7d
cmp r14d, dword [rsp + 0x88]
jb 0x180016ed0
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180018a50
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
sub rsp, 0x188
lea edi, [r9 - 0xa]
mov r12, r8
mov rsi, rdx
mov r14, rcx
cmp r9d, edi
jbe 0x180018c93
mov qword [rax + 0x10], rbx
lea rdx, [0x180000000]
mov qword [rax - 0x28], rbp
lea ebx, [r9 - 0xbd]
mov rbp, qword [rsp + 0x1b0]
mov r8d, 1
mov qword [rax - 0x30], r13
mov r13d, dword [rsp + 0x1c8]
mov qword [rax - 0x38], r15
mov r15d, dword [rsp + 0x50]
nop
cmp ebx, 0x20
ja case.0x180018acb.9
movzx eax, byte [rdx + rbx + 0x18ccc]
mov ecx, dword [rdx + rax*4 + 0x18ca4]
add rcx, rdx
jmp rcx
mov ecx, 0x100
call fcn.180073cfc
mov qword [0x1800c5170], rax
mov r8d, 1
jmp case.0x180018acb.9
mov rax, qword [rsi]
lea r9, [rsp + 0x1b0]
mov word [rsp + 0x1c8], r8w
lea rdx, [rsp + 0x1c8]
mov r8d, 0x10c
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x60]
call fcn.180059270
mov r8d, 1
mov byte [rsp + rax + 0x60], 0
jmp case.0x180018acb.9
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
lea rcx, [rsp + 0x60]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
mov r8d, 1
jmp case.0x180018acb.9
cmp byte [rsi], 0x22
jne 0x180018ba4
mov rdx, qword [rsi + 6]
test rdx, rdx
je 0x180018ba4
movsxd rax, dword [r12]
test eax, eax
js 0x180018ba4
cmp eax, dword [rsi + 2]
jg 0x180018ba4
lea rcx, [rax + rax*4]
mov rax, qword [rdx]
movups xmm0, xmmword [rax + rcx*4]
mov r15d, dword [rax + rcx*4 + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov dword [r14 + 0x10], r15d
jmp case.0x180018acb.9
xor eax, eax
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movzx edx, byte [r8]
lea r8, [r8 + 1]
mov rcx, qword [0x1800c5170]
mov byte [rdx + rcx], al
inc eax
cmp eax, 0x40
jl 0x180018bc0
mov r8d, 1
jmp case.0x180018acb.9
cmp rbp, 0xffffffffffffffff
je 0x180018bfb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsi]
lea rdx, [rsp + 0x1c8]
mov r8d, 0x92
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x1b0]
mov dword [rsp + 0x1c8], r13d
call fcn.18004ff10
mov r8d, 1
jmp case.0x180018acb.9
mov qword [rsp + 0x44], 0
xor r15d, r15d
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
jmp case.0x180018acb.9
mov rax, qword [rsi]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x10]
mov qword [r14], rax
dec ebx
lea rdx, [0x180000000]
lea eax, [rbx + 0xbd]
cmp eax, edi
ja 0x180018ab0
mov r13, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1b8]
mov r15, qword [rsp + 0x170]
mov rax, r14
add rsp, 0x188
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18001f460
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc10
mov ebp, r8d
mov esi, r8d
shl ebp, 0xa
mov rdi, rdx
mov r14, rcx
mov ebx, r8d
cmp r8d, ebp
ja 0x18001f5cf
xor r15d, r15d
nop dword [rax]
cmp ebx, 0x505
ja 0x18001f538
je 0x18001f52b
cmp ebx, 5
je 0x18001f50f
cmp ebx, 0xa
je 0x18001f4fc
cmp ebx, 0xc4
je 0x18001f4e4
cmp ebx, 0x285
jne 0x18001f5c0
mov ecx, 0xfffffe64
lea rdx, [rsp + 0x620]
call qword [0x1800d5910]
jmp 0x18001f5c0
mov dword [rsp + 0x58c], 0x4e414d45
mov byte [rsp + 0x482], r15b
jmp 0x18001f5c0
mov qword [0x1800bd118], rdi
mov qword [rdi + 0x80], r14
jmp 0x18001f5c0
movzx eax, word [rdi]
mov word [rsp + 0xa68], ax
movzx eax, word [r14]
mov word [rsp + 0xa6a], ax
jmp 0x18001f5c0
mov word [0x1800d5918], r15w
jmp 0x18001f5c0
cmp ebx, 0x50a
je 0x18001f59b
cmp ebx, 0xa0a
je 0x18001f5f4
cmp ebx, 0x62c4
jne 0x18001f5c0
mov ecx, 0xfffffe52
lea rdx, [rsp + 0x30]
call qword [0x1800d5910]
lea rax, [rsp + 0x30]
mov word [0x1800d5918], r15w
lea r9, [rsp + 0xc40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0xc40], 0x200
mov rdx, rdi
mov ecx, 0xad
call fcn.18006bdd0
jmp 0x18001f5c0
mov qword [rsp + 0x28], r15
lea r8, [0x18003b060]
mov r9, rdi
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800bd120], rax
mov eax, esi
shl eax, 7
add ebx, eax
cmp ebx, ebp
jbe 0x18001f4a0
movzx eax, byte [rsp + 0xc40]
lea r11, [rsp + 0xc10]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp qword [0x1800bd120], r15
setne al
jmp 0x18001f5d7
Function at 0x180043a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180043a64
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180043a50
ret