joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026cec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001e39c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001e39c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140026e3c
cmp rax, 0xffffffffffffffff
je 0x140026e3c
xor edi, edi
test rbp, rbp
jle 0x140026de7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001e9d0
mov rbx, rax
test rax, rax
jne 0x140026d74
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140026ddd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a1b4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d774
cmp eax, 0xffffffff
je 0x140026dbd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140026d84
mov edx, r15d
mov ecx, r14d
call fcn.14001a1b4
jmp 0x140026ddd
cmp byte [rsi + 0x38], dil
je 0x140026dd4
cmp dword [rsi + 0x34], 5
jne 0x140026dd4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140026ddd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a5d0
jmp 0x140026e50
jns 0x140026e50
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001e39c
cmp rax, 0xffffffffffffffff
jne 0x140026e08
cmp byte [rsi + 0x30], dil
je 0x140026e50
mov edi, dword [rsi + 0x2c]
jmp 0x140026e50
mov ecx, r14d
call fcn.14002140c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140026e50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140026e50
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140026e49
mov eax, dword [rsi + 0x2c]
jmp 0x140026e4e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001e39c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140078920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x140078952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400789fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x140078996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400789e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400789b2
mov dword [rsp + 0x1c], 1
jmp 0x1400789ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400789e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14007898c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x140078948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret
Function at 0x140006880
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140011238], rbx
je 0x1400068cc
cmp rax, rbx
jne 0x1400068bf
mov ebx, 1
mov esi, ebx
jmp 0x1400068d1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400068a4
mov ebx, 1
mov eax, dword [0x140011240]
cmp eax, ebx
jne 0x1400068e7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000694c
mov eax, dword [0x140011240]
test eax, eax
jne 0x140006946
mov dword [0x140011240], ebx
lea r15, [0x140008668]
lea rdi, [0x140008650]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140006938
test eax, eax
jne 0x14000693c
cmp qword [rdi], 0
je 0x14000692d
mov rax, qword [rdi]
mov rcx, qword [0x140008610]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000690e
test eax, eax
je 0x14000694c
mov eax, 0xff
jmp 0x140006a28
mov dword [0x14000f894], ebx
mov eax, dword [0x140011240]
cmp eax, ebx
jne 0x140006973
lea rdx, [0x140008648]
lea rcx, [0x140008618]
call sub.msvcrt.dll__initterm
mov dword [0x140011240], 2
test esi, esi
jne 0x140006980
xor eax, eax
xchg qword [0x140011238], rax
cmp qword [0x140011258], 0
je 0x1400069b4
lea rcx, [0x140011258]
call fcn.140007050
test eax, eax
je 0x1400069b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140011258]
mov r9, qword [0x140008610]
call r9
mov r8, qword [0x14000f8a8]
mov rdx, qword [0x14000f8a0]
mov ecx, dword [0x14000f898]
call fcn.14000166c
mov dword [0x14000f890], eax
cmp dword [0x14000f8b0], 0
jne 0x1400069e4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000f894], 0
jne 0x1400069f9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000f890]
jmp 0x140006a28
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400a1000
add rsp, 0x28
jmp 0x140006880

Function at 0x140006f3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006f88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140006f80
cmp dword [rcx + 0x3c], edx
jl 0x140006f80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140006f80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140006f88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x402520
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004089a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00408980]
test rbx, rbx
je 0x402574
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40256b
test rsi, rsi
je 0x40256b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402550
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004089a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x402790
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4027d1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4027c8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x4027d3
add rax, 0x28
cmp rax, r9
jne 0x4027b4
xor eax, eax
repz ret

Function at 0x402880
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004054f0]
cmp word [rbx], 0x5a4d
je 0x4028a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.00402750
test eax, eax
je 0x402894
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00402790
Function at 0x1400648d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400648dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400648ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400648d5
lea eax, [rcx + 1]
jmp 0x1400648fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006490e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400648f4
sub eax, 3
jb 0x14006492e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14006497d
sar eax, 1
movsxd rbp, eax
jb 0x140064964
jmp 0x14006493c
add ebx, ebx
jne 0x14006493a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140064964
inc ecx
add ebx, ebx
jne 0x14006494a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140064964
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14006495d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14006494c
add ecx, 2
jmp 0x140064969
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140064892
jmp 0x1400648dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28a00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400649c9
cmp rsi, rcx
jae 0x1400649d1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400649b0
cmp al, 0x8f
ja 0x1400649b0
cmp byte [rsi - 2], 0xf
je 0x1400649b6
sub al, 0xe8
cmp al, 1
ja 0x14006499a
cmp rsi, rcx
jae 0x1400649d1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400649a0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400649d1
lodsb al, byte [rsi]
jmp 0x1400649b0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x62000]
mov eax, dword [rdi]
or eax, eax
je 0x140064a2e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7302c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400649de
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140064a28
mov qword [rbx], rax
add rbx, 8
jmp 0x1400649fe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140064a68
cmp al, 0xef
ja 0x140064a5a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140064a3a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140064a49
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140064abc
sub rsp, 0xffffffffffffff80
jmp 0x14000a6a0
Function at 0x140011253
Capabilities:
Terminate process

Disassembly:
jmp 0x140013b10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112ee
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e80
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e93
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ebd
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ed1
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ee3
xor al, al
jmp 0x140014f01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014eff
xor al, al
jmp 0x140014f01
mov al, 1
add rsp, 0x38
ret
Function at 0x180001090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
call fcn.18001a7d0
mov rsi, rax
cmp qword [rax + 8], 6
jae 0x1800012d7
mov qword [rsp + 0x40], r14
xor r14d, r14d
mov qword [rsp + 0x48], rdi
nop
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
cmp qword [rbx + 8], rax
jb 0x1800010e4
call fcn.180024b50
mov rcx, qword [rbx]
mov rdi, rax
call fcn.180035110
mov qword [rbx], rdi
mov qword [rbx + 8], r14
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
lea rax, [r8 + 1]
movzx edx, byte [r8 + rcx]
mov qword [rbx + 8], rax
mov ecx, edx
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x180001282
sub ecx, 1
je 0x1800011fe
cmp ecx, 1
jne 0x1800012bf
movdqa xmm0, xmmword [str.bcdfghjklmnpqrst_]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x79787776
mov byte [rbp - 0x1c], 0x7a
call section..text
mov r8d, eax
mov eax, 0x86186187
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
imul ecx, ecx, 0x15
sub r8d, ecx
mov rcx, rsi
mov eax, r8d
mov r8d, 1
movzx edx, byte [rbp + rax - 0x30]
call fcn.18001a080
mov rcx, rbx
mov dword [rbp + 0x28], 0x6f696561
mov byte [rbp + 0x2c], 0x75
call section..text
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 2
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov rcx, rsi
mov eax, r8d
mov r8d, 1
movzx edx, byte [rbp + rax + 0x28]
call fcn.18001a080
movdqa xmm0, xmmword [str.bcdfghjklmnpqrst_]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x79787776
mov byte [rbp - 0x1c], 0x7a
call section..text
mov r8d, eax
mov eax, 0x86186187
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
imul ecx, ecx, 0x15
sub r8d, ecx
mov eax, r8d
movzx edx, byte [rbp + rax - 0x30]
jmp 0x1800012b1
movdqa xmm0, xmmword [str.bcdfghjklmnpqrst_]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x79787776
mov byte [rbp - 0x1c], 0x7a
call section..text
mov r8d, eax
mov eax, 0x86186187
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
imul ecx, ecx, 0x15
sub r8d, ecx
mov rcx, rsi
mov eax, r8d
mov r8d, 1
movzx edx, byte [rbp + rax - 0x30]
call fcn.18001a080
mov rcx, rbx
mov dword [rbp + 0x30], 0x6f696561
mov byte [rbp + 0x34], 0x75
call section..text
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 2
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
movzx edx, byte [rbp + rax + 0x30]
jmp 0x1800012b1
mov rcx, rbx
mov dword [rbp + 0x38], 0x6f696561
mov byte [rbp + 0x3c], 0x75
call section..text
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 2
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
movzx edx, byte [rbp + rax + 0x38]
mov r8d, 1
mov rcx, rsi
call fcn.18001a080
cmp qword [rsi + 8], 6
jb 0x1800010c0
mov r14, qword [rsp + 0x40]
mov rax, rsi
mov rdi, qword [rsp + 0x48]
add rsp, 0x50
pop rsi
pop rbx
pop rbp
ret
Function at 0x180006dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov ebp, edx
mov rdi, rcx
xor edx, edx
mov ecx, 0x9e
movzx esi, r8w
call fcn.18001e7e0
mov r14d, 1
mov r15d, 2
mov edx, r14d
mov ecx, r15d
xor r8d, r8d
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006efd
xor edx, edx
mov dword [rsp + 0x30], r14d
mov ecx, 0xa3
call fcn.18001e7e0
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rbx
call rax
xor edx, edx
test eax, eax
jne 0x180006eee
mov dword [rsp + 0x88], r14d
lea ecx, [rdx + 0x68]
mov word [rsp + 0x8a], ax
call fcn.18001e7e0
lea r9, [rsp + 0x88]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
lea r8d, [r14 + 0x7f]
mov rcx, rbx
call rax
test eax, eax
jne 0x180006eec
xor eax, eax
mov word [rsp + 0x38], r15w
mov qword [rsp + 0x3a], rax
movzx ecx, si
mov dword [rsp + 0x3c], ebp
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
call fcn.18001d3d0
xor edx, edx
mov word [rsp + 0x3a], ax
mov ecx, pe_nt_image_headers64
call fcn.18001e7e0
lea r8d, [r14 + 0xf]
mov rcx, rbx
lea rdx, [rsp + 0x38]
call rax
cmp eax, 0xffffffff
jne 0x180006eec
xor edx, edx
mov ecx, 0xa4
call fcn.18001e7e0
call rax
add eax, 0xffffd8cd
cmp eax, r14d
ja 0x180006eec
mov byte [rdi], r14b
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebp
mov word [rdi + 0x14], si
call fcn.18001f550
mov qword [rdi + 0x18], rax
jmp 0x180006efd
xor edx, edx
mov ecx, 0xbc
call fcn.18001e7e0
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x18000b080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
movsxd r13, r9d
mov r12d, edx
mov rsi, rcx
cmp r13d, 0xc8
jne 0x18000b0bc
lea r14d, [r13 - 0x40]
jmp 0x18000b0c8
mov r14d, 0x64
sub r14d, r13d
add r14d, r14d
mov eax, r14d
lea rcx, [rsp + 0x20]
cdq
mov r8d, 0xc8
and edx, 7
add eax, edx
xor edx, edx
sar eax, 3
movsxd rdi, eax
call fcn.180045640
xor r15d, r15d
mov rbp, rdi
cmp r12d, r14d
jl 0x18000b1e4
movsxd rbx, r14d
nop dword [rax + rax]
mov rax, r15
test edi, edi
jle 0x18000b199
cmp edi, 4
jb 0x18000b199
lea ecx, [rdi - 1]
movsxd rdx, ecx
lea r8, [rsp + 0x20]
lea rcx, [rsi + rdx*8]
lea r8, [r8 + rdx*8]
lea rdx, [rsp + 0x20]
cmp rdx, rcx
ja 0x18000b136
cmp r8, rsi
jae 0x18000b199
mov edx, edi
and edx, 0x80000003
jge 0x18000b147
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, edi
sub ecx, edx
mov rdx, rsi
movsxd r8, ecx
lea rcx, [rsp + 0x20]
sub rdx, rcx
nop dword [rax]
movdqu xmm1, xmmword [rsp + rax*8 + 0x20]
lea rcx, [rdx + rax*8]
movdqu xmm0, xmmword [rsp + rcx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax*8 + 0x20], xmm1
movdqu xmm0, xmmword [rsp + rax*8 + 0x30]
movdqu xmm1, xmmword [rsp + rcx + 0x30]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax*8 + 0x30], xmm1
add rax, 4
cmp rax, r8
jl 0x18000b160
cmp rax, rbp
jge 0x18000b1c6
lea rcx, [rsp + 0x20]
mov r8, rsi
sub r8, rcx
nop dword [rax]
lea rcx, [r8 + rax*8]
mov rdx, qword [rsp + rcx + 0x20]
xor qword [rsp + rax*8 + 0x20], rdx
inc rax
cmp rax, rbp
jl 0x18000b1b0
mov edx, 0x18
lea rcx, [rsp + 0x20]
call fcn.18000b300
sub r12d, r14d
add rsi, rbx
cmp r12d, r14d
jge 0x18000b100
movsxd rbx, r12d
lea rcx, [rsp + 0xf0]
mov r8, rbx
mov rdx, rsi
call fcn.1800455b0
mov eax, r14d
mov byte [rsp + rbx + 0xf0], 1
inc r12d
lea rcx, [rsp + 0xf0]
sub eax, r12d
xor edx, edx
movsxd r8, eax
movsxd rax, r12d
add rcx, rax
call fcn.180045640
lea eax, [r14 - 1]
movsxd rcx, eax
or byte [rsp + rcx + 0xf0], 0x80
mov ecx, r15d
test edi, edi
jle 0x18000b297
cmp edi, 4
jb 0x18000b297
mov eax, edi
and eax, 0x80000003
jge 0x18000b24e
dec eax
or eax, 0xfffffffc
inc eax
sub edi, eax
movsxd rax, edi
movdqu xmm0, xmmword [rsp + r15*8 + 0x20]
add ecx, 4
movdqu xmm1, xmmword [rsp + r15*8 + 0xf0]
pxor xmm1, xmm0
movdqu xmmword [rsp + r15*8 + 0x20], xmm1
movdqu xmm0, xmmword [rsp + r15*8 + 0x30]
movdqu xmm1, xmmword [rsp + r15*8 + 0x100]
pxor xmm1, xmm0
movdqu xmmword [rsp + r15*8 + 0x30], xmm1
add r15, 4
cmp r15, rax
jl 0x18000b253
movsxd rcx, ecx
cmp rcx, rbp
jge 0x18000b2b5
nop
mov rax, qword [rsp + rcx*8 + 0xf0]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, rbp
jl 0x18000b2a0
mov edx, 0x18
lea rcx, [rsp + 0x20]
call fcn.18000b300
mov rcx, qword [rsp + 0x1c0]
lea rdx, [rsp + 0x20]
mov r8, r13
call fcn.1800455b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000b300
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x18000b517
push rbx
push rbp
push rsi
sub rsp, 0x30
mov qword [rsp + 0x50], rdi
mov rbx, rcx
mov qword [rsp + 0x58], r12
xor esi, esi
mov qword [rsp + 0x60], r14
lea r12, [0x180000000]
mov qword [rsp + 0x68], r15
movsxd rbp, edx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0xa0]
lea r9, [rbx + 0x50]
xor rax, qword [rbx + 0x78]
mov r10d, 4
xor rax, qword [rbx + 0x50]
xor rax, qword [rbx + 0x28]
xor rax, qword [rbx]
mov qword [rsp], rax
lea r11d, [r10 + 1]
mov rax, qword [rbx + 0xa8]
xor rax, qword [rbx + 0x80]
xor rax, qword [rbx + 0x58]
xor rax, qword [rbx + 0x30]
xor rax, qword [rbx + 8]
mov qword [rsp + 8], rax
mov rax, qword [rbx + 0x88]
xor rax, qword [rbx + 0x60]
xor rax, qword [rbx + 0x38]
xor rax, qword [rbx + 0x10]
xor rax, qword [rbx + 0xb0]
mov qword [rsp + 0x10], rax
mov rax, qword [rbx + 0xb8]
xor rax, qword [rbx + 0x90]
xor rax, qword [rbx + 0x68]
xor rax, qword [rbx + 0x40]
xor rax, qword [rbx + 0x18]
mov qword [rsp + 0x18], rax
mov rax, qword [rbx + 0xc0]
xor rax, qword [rbx + 0x98]
xor rax, qword [rbx + 0x70]
xor rax, qword [rbx + 0x48]
xor rax, qword [rbx + 0x20]
mov qword [rsp + 0x20], rax
nop dword [rax]
nop dword [rax + rax]
lea ecx, [r10 - 3]
mov eax, 0x66666667
imul ecx
lea r9, [r9 + 8]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
mov ecx, r10d
mov r8, qword [rsp + rax*8]
mov eax, 0x66666667
imul r10d
rol r8, 1
inc r10d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
xor r8, qword [rsp + rax*8]
xor qword [r9 - 0x58], r8
xor qword [r9 - 0x30], r8
xor qword [r9 - 8], r8
xor qword [r9 + 0x20], r8
xor qword [r9 + 0x48], r8
sub r11, 1
jne 0x18000b3f0
mov r8, qword [rbx + 8]
lea r10d, [r11 + 0x18]
xor r9d, r9d
nop
movsxd rax, dword [r9 + r12 + 0x46460]
mov ecx, dword [r9 + r12 + 0x46400]
lea r9, [r9 + 4]
rol r8, cl
mov rdx, qword [rbx + rax*8]
mov qword [rbx + rax*8], r8
mov r8, rdx
sub r10, 1
jne 0x18000b460
lea rax, [rbx + 0x10]
lea edi, [r10 + 5]
mov r10, qword [rax - 8]
mov rdx, qword [rax]
mov rcx, r10
mov r8, qword [rax + 8]
not rcx
mov r9, qword [rax + 0x10]
and rcx, rdx
mov r11, qword [rax - 0x10]
lea rax, [rax + 0x28]
xor rcx, r11
not rdx
and rdx, r8
mov qword [rax - 0x38], rcx
xor qword [rax - 0x30], rdx
not r8
and r8, r9
not r9
xor qword [rax - 0x28], r8
and r9, r11
xor qword [rax - 0x20], r9
not r11
and r11, r10
xor qword [rax - 0x18], r11
sub rdi, 1
jne 0x18000b490
mov rax, qword [r12 + rsi*8 + 0x46340]
inc rsi
xor qword [rbx], rax
cmp rsi, rbp
jl 0x18000b340
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000bdb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pshufd xmm0, xmmword [rcx], 0x55
mov r11, rsp
pshufd xmm1, xmmword [rcx], 0xff
lea rcx, str.cw
movd dword [rsp + 0x18], xmm0
movd dword [rsp + 0x10], xmm1
movzx eax, byte [r11 + 0x18]
movzx r8d, dl
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x18], al
movzx eax, byte [r11 + 0x19]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x19], al
movzx eax, byte [r11 + 0x1a]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x1a], al
movzx eax, byte [r11 + 0x1b]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x1b], al
movzx eax, byte [r11 + 0x10]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x10], al
movzx eax, byte [r11 + 0x11]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x11], al
movzx eax, byte [r11 + 0x12]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x12], al
movzx eax, byte [r11 + 0x13]
movzx eax, byte [rax + rcx]
mov ecx, dword [rsp + 0x18]
mov byte [rsp + 0x13], al
mov eax, ecx
mov r9d, dword [r11 + 0x10]
mov edx, r9d
ror edx, 8
ror eax, 8
xor edx, r8d
xor eax, r8d
movd xmm0, ecx
movd xmm1, r9d
punpckldq xmm0, xmm1
movd xmm2, edx
movd xmm3, eax
punpckldq xmm3, xmm2
punpckldq xmm0, xmm3
ret