joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180035720
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.1800060b0
mov rbx, rax
test rax, rax
jne 0x18003575b
lea eax, [rbx + 7]
jmp 0x1800357c6
cmp dword [0x18012ae24], 0
je 0x180035798
mov qword [rax + 0x10], rbp
lea r8, [0x180008e90]
mov qword [rax + 0x18], rsi
mov r9, rbx
add rax, 8
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1800d7e94
mov qword [rbx], rax
test rax, rax
jne 0x1800357a8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1800357c1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180037a40
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
xor ebx, ebx
mov r14, qword [rcx + 0x10]
mov r15, r9
mov ebp, r8d
mov r13, rdx
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jne 0x180037ac8
movzx eax, word [r14 + 6]
mov rcx, qword [r14 + 0x10]
imul rdx, rax, 0x38
add rdx, 0x58
call fcn.180006940
mov rdi, rax
test rax, rax
jne 0x180037a9c
mov edi, ebx
jmp 0x180037ab3
add rax, 0x20
mov qword [rdi], r14
mov qword [rdi + 0x10], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 8], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x180037ac4
lea eax, [rdi + 7]
jmp 0x180037b4a
mov word [rdi + 8], bp
cmp byte [rsi + 0x58], bl
je 0x180037b02
cmp byte [rsi + 0x59], bl
je 0x180037ae0
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x180037b0a
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x180037b0a
mov rax, qword [rsi + 0x38]
lea r8, [rax + 0x10]
mov edx, dword [rax]
mov r9, rdi
mov rcx, r14
call fcn.180029fa0
test ebp, ebp
jle 0x180037b32
mov rax, qword [rdi + 0x10]
add rax, 8
test byte [rax], 1
jne 0x180037b69
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x180037b23
mov rdx, qword [r13 + 0x10]
xor r9d, r9d
mov ecx, dword [r13 + 0xc]
mov r8, rdi
call fcn.18002a420
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x180037b48
Function at 0x18003e880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
xor r10d, r10d
mov rbx, rcx
mov esi, r9d
add rcx, 0x88
mov ebp, r8d
nop dword [rax]
cmp dword [rcx + 0xc], 0
jle 0x18003e8c2
cmp dword [rcx], esi
jne 0x18003e8c2
movsx eax, word [rcx + 4]
cmp eax, ebp
je 0x18003e918
inc r10d
add rcx, 0x14
cmp r10d, 0xa
jl 0x18003e8b0
mov qword [rsp + 0x40], rdi
mov r9d, ebp
mov edi, dword [rsp + 0x60]
mov r8d, esi
mov rcx, r14
mov dword [rsp + 0x20], edi
call fcn.18003e7a0
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x18003e9bf
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x18003e9cf
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x18003e9cf
mov eax, dword [rbx + 0x74]
mov dword [rcx + 0x10], eax
inc dword [rbx + 0x74]
mov eax, dword [rcx + 0xc]
cmp dword [rbx + 0x94], eax
jne 0x18003e933
mov byte [rbx + 0x8e], 0
cmp dword [rbx + 0xa8], eax
jne 0x18003e942
mov byte [rbx + 0xa2], 0
cmp dword [rbx + 0xbc], eax
jne 0x18003e951
mov byte [rbx + 0xb6], 0
cmp dword [rbx + 0xd0], eax
jne 0x18003e960
mov byte [rbx + 0xca], 0
cmp dword [rbx + 0xe4], eax
jne 0x18003e96f
mov byte [rbx + 0xde], 0
cmp dword [rbx + 0xf8], eax
jne 0x18003e97e
mov byte [rbx + 0xf2], 0
cmp dword [rbx + 0x10c], eax
jne 0x18003e98d
mov byte [rbx + 0x106], 0
cmp dword [rbx + 0x120], eax
jne 0x18003e99c
mov byte [rbx + 0x11a], 0
cmp dword [rbx + 0x134], eax
jne 0x18003e9ab
mov byte [rbx + 0x12e], 0
cmp dword [rbx + 0x148], eax
jne 0x18003e9ba
mov byte [rbx + 0x142], 0
mov eax, dword [rcx + 0xc]
jmp 0x18003e9d6
mov r9d, edi
mov r8d, ebp
mov edx, esi
mov rcx, rbx
call fcn.18003e060
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180040c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180040da8
test rdx, rdx
je 0x180040da8
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x180040c94
and r9d, r11d
bt r9d, 0xa
jae 0x180040d9e
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x180040d9e
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x180040cdc
cmp r8b, 0x5f
jne 0x180040cb4
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.180040c20
cmp eax, 2
jl 0x180040cd5
cmp byte [rbx], 0x5f
jne 0x180040d9e
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.180040c20
cmp eax, 2
jge 0x180040d9e
mov eax, 1
jmp 0x180040c7f
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x180040d1b
mov rax, qword [rcx + 8]
test rax, rax
je 0x180040d1b
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x180040d07
inc rax
test ecx, ecx
jne 0x180040cf4
test edx, edx
je 0x180040d1b
xor eax, eax
cmp r8b, 0x5f
setne al
inc eax
jmp 0x180040c7f
xor r9d, r11d
test r9b, 0x10
jne 0x180040d9e
bt esi, 0xe
jb 0x180040c7d
bt esi, 0xb
jb 0x180040d9e
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, qword [rdi + 0x10]
call fcn.180040c20
test eax, eax
jne 0x180040d9e
mov rdx, qword [rbx + 0x18]
mov r8d, ebp
mov rcx, qword [rdi + 0x18]
call fcn.180040c20
test eax, eax
jne 0x180040d9e
mov rdx, qword [rbx + 0x20]
mov r8d, ebp
mov rcx, qword [rdi + 0x20]
call fcn.180040dd0
test eax, eax
jne 0x180040d9e
bt esi, 0xd
jb 0x180040c7d
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x180040d9e
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x180040c7d
cmp ecx, ebp
jne 0x180040d9e
test eax, eax
js 0x180040c7d
mov eax, 2
jmp 0x180040c7f
mov rbp, qword [rsp + 0x40]
xor eax, eax
cmp rbx, rdi
mov ecx, 2
mov rbx, qword [rsp + 0x38]
cmove ecx, eax
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1800425c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
xor esi, esi
movsxd r15, edx
mov r12d, r8d
mov rbx, rcx
test rdi, rdi
jne 0x18004262e
call fcn.1800269d0
mov qword [rbx + 0x10], rax
mov rdi, rax
test rax, rax
je 0x18004260f
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov edx, 0x99
mov rcx, rax
call fcn.180026b30
cmp qword [rbx + 0x1c0], rsi
jne 0x180042625
mov rax, qword [rbx]
test byte [rax + 0x4c], 8
jne 0x180042625
mov byte [rbx + 0x23], 1
test rdi, rdi
je 0x1800427c2
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r14
test al, al
jne 0x18004264f
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x180042674
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
test al, al
jne 0x180042668
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x180042674
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, 0x33
mov rcx, rdi
call fcn.180026b30
mov eax, dword [rdi + 0x94]
bts eax, r15d
mov dword [rdi + 0x94], eax
cmp r15d, 1
je 0x1800426ce
mov rax, qword [rdi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], sil
je 0x1800426ce
mov eax, dword [rdi + 0x98]
bts eax, r15d
mov dword [rdi + 0x98], eax
mov r9d, ebp
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, 0x19
mov rcx, rdi
call fcn.180026b30
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8d, ebp
mov rcx, rdi
lea edx, [r9 + 0x53]
call fcn.180026b30
mov r12d, eax
mov rax, qword [rdi + 8]
test rax, rax
je 0x180042715
movsxd rcx, dword [rdi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov dword [rsp + 0x20], ebp
mov r8d, r15d
mov rcx, rdi
lea edx, [r9 + 0x32]
call fcn.180026b30
mov edx, dword [rdi + 0x3c]
cmp edx, r12d
jbe 0x180042745
mov rax, qword [rdi + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rdi + 0x3c]
mov rax, qword [rdi + 0x30]
lea ecx, [rdx - 1]
mov dword [rax + 0x64], ecx
test r14d, r14d
je 0x180042785
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x180042785
mov ecx, esi
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x180042781
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x180042766
mov dword [rbx + rdx*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x180042785
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x58]
test ebp, ebp
je 0x1800427bd
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x1800427bd
lea rax, [rbx + 0x88]
nop
cmp dword [rax + 0xc], ebp
je 0x1800427b9
inc esi
add rax, 0x14
cmp esi, 0xa
jl 0x1800427a0
mov dword [rbx + rcx*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x1800427bd
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x1800465e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, dword [rcx + 0x28]
xor edi, edi
xor ebx, ebx
mov rsi, r8
mov r15, rdx
mov rbp, rcx
test r14d, r14d
jle 0x1800466f4
mov qword [rsp + 0x58], r12
lea r12, [0x1801153f0]
nop word [rax + rax]
mov r11d, ebx
xor r11d, 1
cmp ebx, 2
cmovae r11d, ebx
test rsi, rsi
je 0x18004669d
mov rax, qword [rbp + 0x20]
movzx r9d, byte [rsi]
mov ecx, r11d
shl rcx, 5
mov r8, qword [rcx + rax]
test r9b, r9b
je 0x180046687
mov r10, rsi
movzx eax, r9b
sub r10, r8
nop word [rax + rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r12]
cmp byte [rcx + r12], al
jne 0x180046687
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x180046660
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, r9b
movzx eax, byte [rax + r12]
cmp eax, ecx
jne 0x1800466d0
mov rax, qword [rbp + 0x20]
lea r8, [rsp + 0x50]
mov ecx, r11d
mov rdx, r15
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.18000a8e0
test rax, rax
je 0x1800466ce
mov rdi, qword [rax + 0x10]
test rdi, rdi
jne 0x1800466db
jmp 0x1800466d0
xor edi, edi
inc ebx
cmp ebx, r14d
jl 0x180046620
mov r12, qword [rsp + 0x58]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov rax, rdi
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800467e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x28
mov ebp, dword [rcx + 0x28]
xor r11d, r11d
xor ebx, ebx
mov rdi, r8
mov r14, rdx
test ebp, ebp
jle 0x1800468d7
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
lea r12, [0x1801153f0]
mov qword [rsp + 0x20], r15
mov r15, qword [rcx + 0x20]
nop word [rax + rax]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovae eax, ebx
shl rax, 5
mov rsi, qword [rax + r15 + 0x18]
test rdi, rdi
je 0x18004688d
movzx r9d, byte [rdi]
mov r8, qword [rax + r15]
test r9b, r9b
je 0x180046877
mov r10, rdi
movzx eax, r9b
sub r10, r8
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r12]
cmp byte [rcx + r12], al
jne 0x180046877
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x180046850
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, r9b
movzx eax, byte [rax + r12]
cmp eax, ecx
jne 0x1800468b1
lea rcx, [rsi + 0x20]
mov rdx, r14
lea r8, [rsp + 0x50]
call fcn.18000a8e0
test rax, rax
je 0x1800468ae
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1800468bb
jmp 0x1800468b1
xor r11d, r11d
inc ebx
cmp ebx, ebp
jl 0x180046820
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
ret
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800583f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r13
push r14
sub rsp, 0x38
mov r14, qword [rcx + 0x1b8]
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
mov r13, qword [rcx]
test r14, r14
je 0x180058600
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd r9, dword [r14 + 0x10]
movzx eax, byte [rdi + 0x1f]
mov r15d, dword [r14 + 0x14]
shl r9, 5
add r9, qword [r13 + 0x20]
test al, al
jne 0x180058450
inc dword [rdi + 0x54]
mov esi, dword [rdi + 0x54]
jmp 0x18005845c
dec al
movzx eax, al
mov byte [rdi + 0x1f], al
mov esi, dword [rdi + rax*4 + 0x24]
mov r9, qword [r9 + 0x18]
xor edx, edx
mov r8d, dword [r14 + 0x10]
mov rcx, rdi
mov dword [rsp + 0x20], 0x37
mov r9, qword [r9 + 0x68]
call fcn.180057d70
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea r12d, [r15 + 1]
mov rcx, rbx
mov r8d, r12d
lea edx, [r9 + 0x4d]
call fcn.180026b30
xor r8d, r8d
mov ebp, eax
mov r9d, r12d
mov dword [rsp + 0x20], 0
mov rcx, rbx
lea edx, [r8 + 0x4a]
call fcn.180026b30
mov edx, dword [rbx + 0x3c]
cmp edx, ebp
jbe 0x1800584cd
mov rax, qword [rbx + 8]
lea rcx, [rbp*2]
add rcx, rbp
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rbx + 0x3c]
mov rax, qword [rbx + 0x30]
lea ecx, [rdx - 1]
mov dword [rax + 0x64], ecx
movsxd rbp, dword [rbx + 0x3c]
mov rax, qword [rbx + 0x30]
mov ecx, ebp
cmp dword [rax + 0x60], ebp
jg 0x1800584f5
mov rcx, rbx
call fcn.180026a80
test eax, eax
jne 0x180058533
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx + 1]
mov dword [rbx + 0x3c], eax
lea rcx, [rbp*2]
mov rax, qword [rbx + 8]
add rcx, rbp
mov word [rax + rcx*8], 0x31
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 8], 2
lea rdx, [rax + rcx*8]
lea eax, [r15 - 1]
mov dword [rdx + 0xc], esi
mov dword [rdx + 4], eax
mov qword [rdx + 0x10], 0
mov rax, qword [rbx + 0x30]
movsxd rbp, dword [rbx + 0x3c]
cmp dword [rax + 0x60], ebp
jg 0x18005854c
mov rcx, rbx
call fcn.180026a80
test eax, eax
jne 0x18005857f
inc dword [rbx + 0x3c]
lea rcx, [rbp*2]
mov rax, qword [rbx + 8]
add rcx, rbp
xor ebp, ebp
mov word [rax + rcx*8], 0x4b
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], ebp
mov dword [rax + rcx*8 + 8], esi
mov dword [rax + rcx*8 + 0xc], r12d
mov qword [rax + rcx*8 + 0x10], rbp
jmp 0x180058581
xor ebp, ebp
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x180058597
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], 8
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x3d]
call fcn.180026b30
test esi, esi
je 0x1800585e0
movzx edx, byte [rdi + 0x1f]
cmp dl, 8
jae 0x1800585e0
mov ecx, ebp
lea rax, [rdi + 0x88]
cmp dword [rax + 0xc], esi
je 0x1800585dc
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x1800585c3
mov dword [rdi + rdx*4 + 0x24], esi
inc byte [rdi + 0x1f]
jmp 0x1800585e0
mov byte [rax + 6], 1
mov r14, qword [r14]
test r14, r14
jne 0x180058430
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x180089c20
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x50
mov qword [rax + 0x10], rbp
mov rbx, rcx
xor ebp, ebp
mov qword [rax - 0x10], r12
mov qword [rax - 0x20], r14
mov r12d, ebp
mov qword [rcx + 0x10], rbp
mov r14, rdx
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov qword [rax - 0x28], r15
lea r15d, [rbp - 6]
cmp qword [rdx + 0x10], rbp
jbe 0x180089d91
mov qword [rax + 0x18], rsi
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov ecx, ebp
mov qword [rax + 0x20], rdi
mov qword [rax - 0x18], r13
mov qword [rsp + 0x20], rcx
nop word [rax + rax]
cmp qword [r14 + 0x18], 0x10
mov rax, r14
jb 0x180089c8d
mov rax, qword [r14]
movsx eax, byte [rcx + rax]
shl ebp, 8
add eax, ebp
add r15d, 8
movsxd rbp, eax
js 0x180089d1b
lea ecx, [r15 + 6]
movsxd rdi, r15d
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
imul eax, edx, 0xfffffffa
mov esi, edx
add r15d, eax
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
mov rcx, rdi
mov rax, rbp
sar rax, cl
mov rcx, qword [rbx + 0x10]
and eax, 0x3f
movzx r9d, byte [rax + r8]
cmp rcx, rdx
jae 0x180089cfd
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180089cf2
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180089d0c
mov rcx, rbx
call fcn.1800c3f80
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub rsi, 1
jne 0x180089cc0
mov rcx, qword [rsp + 0x20]
inc r12d
inc rcx
movsxd rax, r12d
mov qword [rsp + 0x20], rcx
cmp rax, qword [r14 + 0x10]
jb 0x180089c80
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
cmp r15d, 0xfffffffa
jle 0x180089d91
shl ebp, 8
lea ecx, [r15 + 8]
movsxd rdx, ebp
sar rdx, cl
mov rcx, qword [rbx + 0x10]
and edx, 0x3f
movzx r9d, byte [rdx + r8]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180089d89
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180089d7e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180089d91
mov rcx, rbx
call fcn.1800c3f80
mov rcx, qword [rbx + 0x10]
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
test cl, 3
je 0x180089de9
nop
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180089dd5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180089dcd
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x180089de0
mov r9b, 0x3d
mov rcx, rbx
call fcn.1800c3f80
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x180089db0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x18008a2f0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
sub rsp, 0x60
mov rbp, rdx
mov dword [rsp + 0x40], 0x67452301
mov edx, 4
mov dword [rsp + 0x44], 0xefcdab89
mov r12, r8
mov dword [rsp + 0x48], 0x98badcfe
mov r14, rcx
mov dword [rsp + 0x4c], 0x10325476
call fcn.1800c30d0
mov r8d, 0x10
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rbx, rax
lea rdi, [rax + 0x10]
call fcn.1800d33d0
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x18008a39d
mov rcx, qword [r14]
test rcx, rcx
je 0x18008a390
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18008a38b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008a5a7
mov rcx, r8
call fcn.1800cfd40
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rdi
jmp 0x18008a3af
test rbx, rbx
je 0x18008a3af
mov edx, 0x10
mov rcx, rbx
call fcn.1800cfd40
mov rcx, qword [r14 + 0x18]
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r15
test rcx, rcx
je 0x18008a3d7
call fcn.1800cfd40
mov qword [r14 + 0x18], 0
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1800c2820
mov rdx, rax
mov rcx, r14
call fcn.18008a5c0
mov edi, dword [r14 + 0x20]
xor ebx, ebx
shr edi, 6
test edi, edi
je 0x18008a410
nop dword [rax]
mov edx, ebx
mov rcx, r14
call fcn.18008a7b0
inc ebx
cmp ebx, edi
jl 0x18008a400
xor r15d, r15d
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
lea r13d, [r15 + 0x37]
nop dword [rax + rax]
mov rax, qword [r14]
xor esi, esi
mov edi, dword [r15 + rax]
nop dword [rax]
xor r8d, r8d
mov r9d, 0xf
mov qword [rsp + 0x30], r8
mov ebx, 1
mov qword [rsp + 0x38], r9
mov byte [rsp + 0x20], r8b
nop dword [rax]
movzx ecx, bl
movzx edx, dil
shl cl, 2
mov eax, 0x30
shr dl, cl
and dl, 0xf
cmp dl, 0xa
cmovae eax, r13d
add al, dl
cmp r8, r9
jae 0x18008a4a6
lea rcx, [r8 + 1]
cmp r9, 0x10
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov byte [rcx + r8], al
mov byte [rcx + r8 + 1], 0
jmp 0x18008a4b4
movzx r9d, al
lea rcx, [rsp + 0x20]
call fcn.1800c3f80
sub ebx, 1
mov r8, qword [rsp + 0x30]
js 0x18008a4c5
mov r9, qword [rsp + 0x38]
jmp 0x18008a460
cmp qword [rsp + 0x38], 0x10
lea rdx, [rsp + 0x20]
mov rcx, rbp
cmovae rdx, qword [rsp + 0x20]
call fcn.1800c2650
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18008a51b
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008a516
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008a5ad
call fcn.1800cfd40
shr edi, 8
inc esi
cmp esi, 4
jl 0x18008a440
add r15, 4
cmp r15, 0x10
jl 0x18008a430
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x18008a56f
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x18008a56a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008a5ad
mov rcx, r8
call fcn.1800cfd40
mov r13, qword [rsp + 0x58]
mov rax, rbp
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x50]
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
call fcn.1800defa0
int3
call fcn.1800defa0
int3
Function at 0x18008cf40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x18012a010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor edi, edi
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x40]
mov byte [rsp + 0x20], dil
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x18008cf93
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1800c2ee0
mov r8d, 1
lea rdx, [0x180118bb8]
lea rcx, [rsp + 0x20]
call fcn.1800c2650
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18008d020
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008d01b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d044
call fcn.1800cfd40
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800cfa80
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call fcn.1800defa0
int3
Function at 0x18008dc10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x18012a010]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor edi, edi
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov byte [rsp + 0x30], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x18008dc70
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1800c2ee0
mov r8d, 1
lea rdx, [0x180118bb8]
lea rcx, [rsp + 0x30]
call fcn.1800c2650
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18008dcfd
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008dcf8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008dd21
call fcn.1800cfd40
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800cfa80
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.1800defa0
int3