joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006e10
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180105010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180006f5f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180006f56
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x180006f0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180006f0c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180006f0c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x180006ecd
mov rcx, qword [0x180107090]
mov r8d, 0x200
mov dword [rdi + 8], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x180006f35
lea rbx, [rdi + 0xc]
jmp 0x180006f01
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x180006f01
mov rcx, qword [0x180107090]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180006f35
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180006e73
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180006f51
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x180006f51
mov rcx, qword [0x180107090]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180008290
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180006f80
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.180006e10
test eax, eax
jne 0x180006fc7
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x18000703e
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x180007026
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000701a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.180006c60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180006fe0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180007060
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180105010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1801070d0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800070d3
mov eax, 0xa
jmp 0x180007166
test esi, esi
je 0x1800070f5
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180007118
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180007118
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180007111
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180007118
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
Function at 0x180007190
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1801070dc]
mov ebx, edi
test ecx, ecx
je 0x180007343
mov rax, qword [0x1801070d0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800071e0
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800071c0
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
cmp ebx, 0xffffffff
je 0x180007343
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
call fcn.180006e10
test eax, eax
jne 0x18000720e
mov eax, 9
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov r12, qword [rsp + 0x20]
mov qword [rsp + 0x70], r13
mov r13d, dword [rsp + 0x2c]
test r12, r12
je 0x180007293
test r13d, r13d
je 0x180007293
mov qword [rsp + 0x38], r14
mov r14, r12
mov qword [rsp + 0x30], r15
mov r15d, r13d
mov r8d, dword [r14]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x18000727f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, edi
test esi, esi
mov edx, 0xffffffff
mov rcx, rbp
setne r8b
call fcn.180006c60
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14, 4
sub r15, 1
jne 0x180007241
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r8d, dword [0x1801070dc]
cmp ebx, r8d
jae 0x1800072d8
nop
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1801070d0]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800072d1
mov edx, esi
mov ecx, ebx
call fcn.180007060
mov edi, eax
test eax, eax
jne 0x1800072d8
mov r8d, dword [0x1801070dc]
inc ebx
cmp ebx, r8d
jb 0x1800072a0
test r12, r12
je 0x180007334
test r13d, r13d
je 0x180007322
mov rsi, r12
mov rbp, r13
nop dword [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x180007318
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
sub rbp, 1
jne 0x1800072f0
mov rcx, qword [0x180107090]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180007ec8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.180007bdc
mov ebx, eax
test eax, eax
jne 0x180007ef8
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x180007f54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180007f4b
test al, 0x10
je 0x180007f4b
bt eax, 0xa
jae 0x180007f44
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, pe_nt_image_headers64
mov rdx, rdi
call fcn.180007f6c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x180007f40
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x180007f64
test edi, edi
jne 0x180007f4b
and dword [rsp + 0x3c], 0
jmp 0x180007f50
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.18000d1dc
int3

Function at 0x180007fc4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180008048
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800173f0]
cmp byte [rcx + rax], 0
je 0x180008048
dec r8
sub rdx, 1
jne 0x18000802e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x180008a88
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x180015cd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180015cf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180015cf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18010b27b
Capabilities:
Packed with generic packer

Disassembly:
push 0x46a80414
sub byte [rsp], r9b
lea rax, [rax + 1]
jo 0x180124628
jbe fcn.180161987
add r9w, word [rsp + 5]
test r9b, 0x87
mov qword [rsp + 0x28], rax
jno 0x18011160f
push rcx
jo 0x1801d5550
mov rcx, r9
add qword [rsp + 0x10], 0x5c20c
xor cl, r9b
or ecx, dword [rsp + 9]
push rbp
movabs rbp, 0xb081aba01317d29d
jns 0x1801f1865
je fcn.180229f68
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
call fcn.1801b5eb4
stosb byte [rdi], al
sbb byte [rdi - 0x35fb1df1], r10b
sbb ch, bh
int3
call fcn.180222d78
sti
in al, dx
jo 0x180124652
add byte [rax], al
add byte [rax - 0x46ffeeab], ah
push rbp
adc dword [rax], eax
sbb al, 0x42
sbb eax, dword [rax]
jo 0x1801bff5e
or ecx, esp
int3
ror esp, 0xa5
push 0xffffffffb8357cb1
sbb al, 0x8d
add cl, ch
movsb byte [rdi], byte [rsi]
lodsd eax, dword [rsi]
invalid
xor dword [rsp], 0xbeb903ac
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.18022a6eb

Function at 0x18010b8e2
Capabilities:
Encode data using base64

Disassembly:
push r13
pushfq
movabs r13, 0x3b856b1e37830a15
push r15
xchg qword [rsp + 0x38], rsi
push r10
push r11
movabs r10, 0xff92190e180cd402
bswap r13
call fcn.18015c396

Function at 0x18012db30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x18012db4d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x18012dba8
test al, 7
jne 0x18012db40
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x18012db61
mov rdx, qword [rax - 8]
test dl, dl
je 0x18012dbd2
test dh, dh
je 0x18012dbcc
shr rdx, 0x10
test dl, dl
je 0x18012dbc6
test dh, dh
je 0x18012dbc0
shr rdx, 0x10
test dl, dl
je 0x18012dbba
test dh, dh
je 0x18012dbb4
shr edx, 0x10
test dl, dl
je 0x18012dbae
test dh, dh
jne 0x18012db61
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x180153ede
Capabilities:
Packed with generic packer

Disassembly:
mov dword [rsp + rbp*4 - 0xaf1c], ebp
mov r15, qword [rsp + rbp - 0x2b7f]
mov rbp, qword [rsp + rbp*2 - 0x5776]
jg 0x180228034
movabs rsi, 0x3ab46b9d3e8943a3
shr sil, 0xe
call fcn.18010b70e
Function at 0x180160d38
Capabilities:
Packed with generic packer

Disassembly:
shr r15b, 0xe3
movabs r14, 0x7815d19fd6256483
sub r14d, 0xabbe93a8
movsx r14d, r14w
add r14, 0xffffffff8f1174ac
mov r14, qword [rsp + r15*2 - 0xc5f0]
call fcn.1801c004f
movsx ebx, word [rsp + rbx - 0x794000be]
add qword [rsp + rbx - 0x97], 0x7fea7e85
mov qword [rsp + r11*2 - 0x17df8], rbx
or r11w, word [rsp + r11 - 0xbee0]
and bx, word [rsp + r11*4 - 0x2fc1a]
jl 0x180121f3d
xchg qword [rsp + r11*8 - 0x5f848], rax
mov rbx, qword [rsp + r11*2 - 0x17df0]
mov r8, qword [rsp + r11 - 0xbee4]
jl 0x1801e7919
jne 0x1802283a3
call fcn.1801e9ff3
push rax
call fcn.18018a4fe
and dword [rsp + 0x10], 0xc93f3998
neg word [rsp + 0x10]
add qword [rsp + 0x18], 0x7fee6cb5
call fcn.1801db933
mov byte [rsp + 0x10], 0x3d
not qword [rsp + 0x10]
lea rcx, [rcx + 0x3495e78d]
call fcn.180216938
and eax, 0x54429623
xlatb
movabs byte [0xe38d257c1dd92fd], al
mov ch, 0x32
movsd dword [rdi], dword [rsi]
pop rdx
pop rdi
retf 0x1a42

Function at 0x18017790c
Capabilities:
Get number of processors
Packed with generic packer

Disassembly:
cmovae r10d, r14d
mov qword [rsp + r10*4 - 0x1c884], rax
mov r12, r14
shl r14w, 0xb5
call fcn.18019db84
mov rax, qword [rsp + 0x18]
push r10
movabs r10, 0x1481012be911722f
movsx r10, r10w
lea rax, [rax + r10*4 - 0x1c8bb]
pushfq
or r10b, r10b
cmp r10, 0x169dafa1
push r12
push r14
movabs r14, 0xa33ccba7a82c898a
js 0x1801155a0
not qword [rsp + 0x30]

Function at 0x180179f39
Capabilities:
Packed with generic packer

Disassembly:
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rdx
ja 0x18021800c
mov rdi, r15
call fcn.18017bc99
xchg qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x48]
mov r11, qword [rsp + r14 + 0x40]
pop r11
call fcn.18021bf03
push rsi
call fcn.18018e9e5
mov rax, qword [rax + r9 - 0x2581]
lea r9, [r9 + r9 - 0x42f90277]
movabs r10, 0x6a1dfc0e8380fd3b
movzx r10, r10w
js 0x18015d577
not r10
sub r9d, r10d
bswap r10d
add r10, 0xffffffffcab21724
call fcn.1801f3f0e

Function at 0x180187386
Capabilities:
Terminate process

Disassembly:
adc eax, 0x4ab0d5
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.18000d678
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
not bp
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
jle 0x1801d6936
call fcn.1802160f3
movabs r15, 0xe1a9b189392e4482
pushfq
shr r15b, 0xb7
shr r15b, 0x3a
mov qword [rsp + 0x58], rax
add qword [rsp + 0x40], 0xffffffffffef1c47
cmp r15d, 0xca183d0c
setno r15b
lea r15, [r15 + r15 - 0x3e4cc9fb]
and r15, 0xfffffffff3b0628a
and r15, 0x763f1d14
add qword [rsp + 0x30], 0xfffffffffff8677c
movabs rax, 0x843727280517ae07
or al, 0x3b
jbe 0x18000d656
mov eax, 0x4b20787
call fcn.180183dd6
pushfq
call fcn.18015d552
jbe 0x180187434
mov ebx, 0xc3ea6786
invalid
push rdi
rcr dword [rdi], cl
out 0xb5, al
or al, 0xd2
xor bh, byte [rsi - 0x33]
add dword [rax], eax
add byte [rax], al
sti
jg 0x1801874bc
cli
invalid
or eax, dword [rsi]
invalid
Function at 0x18018739e
Capabilities:
Terminate process

Disassembly:
adc eax, 0x4ab0d5
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.18000d678
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
not bp
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
jle 0x1801d6936
call fcn.1802160f3
movabs r15, 0xe1a9b189392e4482
pushfq
shr r15b, 0xb7
shr r15b, 0x3a
mov qword [rsp + 0x58], rax
add qword [rsp + 0x40], 0xffffffffffef1c47
cmp r15d, 0xca183d0c
setno r15b
lea r15, [r15 + r15 - 0x3e4cc9fb]
and r15, 0xfffffffff3b0628a
and r15, 0x763f1d14
add qword [rsp + 0x30], 0xfffffffffff8677c
movabs rax, 0x843727280517ae07
or al, 0x3b
jbe 0x18000d656
mov eax, 0x4b20787
call fcn.180183dd6
pushfq
call fcn.18015d552
jbe 0x180187434
mov ebx, 0xc3ea6786
invalid
push rdi
rcr dword [rdi], cl
out 0xb5, al
or al, 0xd2
xor bh, byte [rsi - 0x33]
add dword [rax], eax
add byte [rax], al
sti
jg 0x1801874bc
cli
invalid
or eax, dword [rsi]
invalid

Function at 0x180192f87
Capabilities:
Packed with generic packer

Disassembly:
bswap r11d
js 0x18016cf9f
add qword [rsp + 8], 0xf1302
mov rdx, r11
shr r11d, 0xc1
add rdx, 0xffffffffc734f788
lea r11, [r11*2 - 0x95638dc]
xor r11, r11
ja 0x18020a20b
mov rdx, qword [rsp + r11 + 8]
mov rdx, qword [rdx + r11]
setno r11b
shl r11w, 0x58
test r11, 0xffffffffbe8ef41b
jb 0x180197b80
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
ret

Function at 0x18019c39d
Capabilities:
Encode data using xor

Disassembly:
call fcn.180184263
push rax
test byte [rbp + 0x4d3c2110], cl
lock adc dword [rbp + rax*8 + 0x48], ebx
xor dword [0x1461c93a9], eax
or ecx, dword [rsi + rsi*2 - 0x37]
movabs eax, dword [0xfc950d7ffffffe32]
lahf
mov word [rcx + 0x75b3d3e9], gs
shl dword [rcx - 0x1ce], 0x7f
pop rsp
fisttp word [rcx]
fsubr st(2)
invalid

Function at 0x18019e37b
Capabilities:
Encode data using base64
Get number of processors
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x28]
push r11
ja 0x1801bfa2f
xor sil, sil
not sil
call fcn.1801edae1
and rax, 0xffffffffd4205fde
add esp, edi
mov dword [rdx - 0x32da1e68], edi
sbb esi, esi
xor al, 0xcb
pop rdi
int3
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]

Function at 0x1801ab69e
Capabilities:
Terminate process

Disassembly:
adc eax, 0x4afdaf
js 0x180008a94
movsx r14, byte [rsp + r14 - 0x60bdfb1a]
and byte [rsp + r14*2 + 0x20], 0xbb
push rcx
xchg qword [rsp + r14 + 0x48], rcx
mov r14, qword [rsp + r14*8 + 0x40]
add word [rsp + 0x20], 0xd00b
add dword [rsp + 0x20], 0x95a224af
call fcn.180227b7b
push r11
pushfq
movabs r11, 0xc13e5628ff238593
add r11d, 0x1104a539
mov rcx, qword [rcx + r11*2 - 0x20505598]
movsx r11, r11w
call fcn.1801fd6a4

Function at 0x1801b41f9
Capabilities:
Encode data using base64

Disassembly:
setns r8b
mov qword [rsp + 0x40], r8
xchg qword [rsp + r8 - 0x1ffd6ba1], rsi
mov r15, qword [rsp + 0x38]
cmovno r12w, word [rsp + r8*2 - 0x3ffad7c2]
cmp r8, r12
call fcn.1802232b9
jno 0x1801835b6
jl 0x1801b4252
invalid
mov esi, edi
mov ebp, dword [rdi - 0x4d5f]
invalid
Function at 0x1801b6a3c
Capabilities:
Packed with generic packer

Disassembly:
setb bl
movsx bx, bl
add bx, word [rsp + 0x4d]
not rbx
lea rsi, [rsi + 0x283c4db5]
jae 0x180153f00

Function at 0x1801bbdb7
Capabilities:
Get number of processors
Packed with generic packer

Disassembly:
mov r13, rdi
jne 0x1801bc6d9
call fcn.1801a0808

Function at 0x1801bbdc0
Capabilities:
Get number of processors
Packed with generic packer

Disassembly:
cmovle r12d, r15d
call fcn.18011f3b0

Function at 0x1801c3651
Capabilities:
Packed with generic packer

Disassembly:
push rbx
push r12
not r13
neg r13d
and qword [rsp + r13*2 - 0x439fffba], r13
mov rdi, qword [rsp + 0x70]
mov rdi, qword [rdi + r13 - 0x21d00001]
setne r13b
jb 0x1801f6447
mov byte [rsp + r13*2 - 0x439fffea], 0xa1
not dword [rsp + 0x18]
call fcn.18015eb42
lea rbx, [rbx + 0x1d0b461f]
call fcn.18020e039

Function at 0x1801c3697
Capabilities:
Packed with generic packer

Disassembly:
sub word [rsp + 0x20], r15w
mov rcx, rsi
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], r11
add ecx, dword [rsp + 0x23]
jo 0x1801849f7
sub byte [rsp + 0x30], r15b
push rbp
lea rax, [rax - 0x23508feb]
js 0x18010c43f
movsx r14d, byte [rsp + 0x4c]
and r15d, r15d
sub r11d, dword [rsp + 0x4c]
shr r15b, cl
xchg qword [rsp + 0x70], rax
mov r11, qword [rsp + r11 - 0x4a8db861]
js fcn.1801a08ea
add r14d, r14d
lea rcx, [r15 + r14*8 - 0x5fdff3db]
mov rbp, qword [rsp + rcx - 0x595788cd]
call fcn.1801899cf

Function at 0x1801c6efa
Capabilities:
Encode data using base64
Get number of processors
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push rsi
shl qword [rsp + rcx + 0x3573000e], cl
mov rcx, qword [rsp + rcx*2 + 0x6ae60004]
mov rcx, qword [rcx + r9 - 6]
mov rsi, qword [rsp + r9 + 0xa]
mov qword [rsp + 8], r9
shr sil, 0xf5
call fcn.1801602a4
jae 0x18020ade1
js 0x1801bfa37
lea rax, [rax + rbp*4 + 0x577207d5]
mov qword [rsp + r8 - 0x754f2b9f], r8
test rbp, r8
push rsi
movsx ebp, r8w
lea r8, [rbp + rbp*2 - 0xc6238d5]
push r15
xchg qword [rsp + rbp*8 - 0x15e90], rax
mov r8, qword [rsp + rbp*2 - 0x579e]
call fcn.18019ec30
pushfq
shl bpl, 0xc9
shr ebp, 0x4e
or ebp, 0xcd15e63e
call fcn.180225b08
pop rdi
call fcn.180125350
push qword [rdi - 0x11d50456]
invalid
jb 0x1801e856d
js 0x1801ee352
add qword [rsp], 0xfffffffffffe7a6b
mov rcx, qword [rsp + r9 + 0xa]
test qword [rsp + rcx*2 + 0x6ae60004], 0xffffffff8e1eafbb
seta byte [rsp + rcx + 0x35730006]
jno 0x180160bbb
pop rsp
push rcx
sbb ah, bl
fst qword es:[rdx]
jrcxz 0x1801fdf0d
xchg byte [rax + 0x38db32fa], bh
shl rsi, 0x56
mov qword [rsp + 0x20], r14
je 0x1801fdf3b
lea rax, [rax - 0x41c6a24a]
call fcn.1801ef17e
pushfq
pushfq
call fcn.1801c5994

Function at 0x1801c7b31
Capabilities:
Packed with generic packer

Disassembly:
movabs rdi, 0x78102f9421089888
lea rdi, [rdi + r9*2 + 0x32b40b29]
shr r13d, 0x1a
nop
movabs rsi, 0x671817130e34c122
push rdi
test dword [rsp + 4], r13d
call fcn.18019dab7
Function at 0x1801c94f2
Capabilities:
Encode data using base64

Disassembly:
movabs r10, 0x9c089d012a128c98
cmp r10d, 0xe3175a1d
push r13
mov r13, r10
mov r13d, 0xfe929784
push r9
mov r9, r10
xchg qword [rsp + 0x20], rsi
jbe 0x1801ef0f6
js fcn.1801aadaf
mov r9, qword [rsp + 0x78]
jo 0x1801d0183
test qword [rsp + 0x90], 0x14be0fa3
mov r10, qword [rsp + 0x90]
not qword [rsp + r10*2 - 0x20a0]
jl 0x180126828
shl r10, 0xf2
mov r10, qword [rsp + 0x38]
add dword [rax], eax
neg r9
sub r10w, 0x872a
call fcn.18020a81a
je 0x1801ef0d6
adc dword [rcx*2 + 0x35ec21d0], ebp
test al, 0x99
xchg esp, eax
sub eax, 0xcd4c7190
sbb byte [rcx], 0x54
int 0x70
adc dword [rbp + rax*2 - 0x78], ebx
sar esp, 0xbd
invalid
Function at 0x1801d3843
Capabilities:
Encode data using base64
Get number of processors
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
je 0x1801fdf31
lea rdi, [rdi - 0x49f9ba4c]
add qword [rsp], 0x7fe79d5c
call fcn.18012210e
shr word [rsp + r9*4 - 8], 0x2e

Function at 0x1801d55e8
Capabilities:
Encode data using xor

Disassembly:
jl 0x18019a6a0
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
jae 0x1801e7683
jbe fcn.18015128c
movabs r14, 0xb4379c050083be9a
movabs r10, 0xe8b4a9ac0f974d97
lea rax, [rax + 0x7caece36]
add qword [rsp + 0x48], 0x7fe6c786
call fcn.1802157cd

Function at 0x1801e3845
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x28], 0xfffffffffc06489f
mov qword [rsp + 0x28], 0xfffffffff920040a
lea rsi, [rsi - 0x2ad6d757]
test qword [rsp + 0x28], 0x1c96b612
mov qword [rsp + 0x18], 0x7eb72829
call fcn.180189245
push rax
add dword [riz*4 + 0x256ca168], ecx
test al, 0x51
pop rsp
xor eax, 0x2df439e8
mov al, 0xc1
cld
mov ebp, 0xdfce100
sub byte [rcx + 0x54], 0xd5
pop rax
loope 0x1801e3881
add eax, 0x11dca0c4
mov al, 0x99
cmp dword [rdx], edx
invalid

Function at 0x1801e7934
Capabilities:
Packed with generic packer

Disassembly:
movzx rsi, byte [rsp + rsi*2 - 0x5d371f34]
shl rsi, 0xb8
xchg qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x28]
jne 0x1801f8ede
imul ebp, dword [0x11d1efb17], 0x1598e1ec
cmp al, 1
movabs al, byte [0x385964ad60110c3d]
mov ch, 0x5c
xchg ecx, eax
fadd dword [rbp - 0x4c]
jmp 0x1aa033ee9
neg byte [rsp + 0x30]

Function at 0x1801f3810
Capabilities:
Packed with generic packer

Disassembly:
bswap r12d
neg r11b
and r12w, 0xa7aa
cmovo r12, r11
mov r12b, r11b
mov r11, qword [rsp + 0x48]
jne 0x18021bae6
lea r12, [r12 + 0x1928ecaa]
shl r12d, 0x2b
jb 0x180192fb2
call fcn.1801afbb2

Function at 0x1801f7335
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x28]
call fcn.18022a6eb