joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007fa70
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x2f8], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor edi, edi
call fcn.180006030
test rax, rax
je 0x18007fcb0
lea rcx, [rsp + 0x30]
call fcn.180003c60
nop
mov rcx, rbx
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x40
jne 0x18007fb17
mov rcx, rbx
call fcn.180006030
lea r8d, [rax - 1]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.18008dc80
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180005c40
nop
lea rcx, [rsp + 0x50]
call fcn.180003b80
jmp 0x18007fb24
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180003ae0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.1800f7810
lea rcx, [rsp + 0x30]
call fcn.180003a80
mov rcx, rax
mov r8d, 0x104
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
cmp eax, 0x104
jb 0x18007fba9
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800d85d0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.180003a80
mov rcx, rax
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180004070
mov rcx, rbx
call fcn.1800d80b0
jmp 0x18007fbb7
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.180004070
lea rdx, [0x18019f7cc]
lea rcx, [rsp + 0x70]
call fcn.180003bb0
nop
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18000a2d0
mov rsi, rax
lea rdx, [rsp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x18007fc8a
mov r8d, esi
lea rcx, [rsp + 0x50]
call fcn.18008dc20
nop
mov rdx, rax
mov rcx, r15
call fcn.180005c40
nop
lea rcx, [rsp + 0x50]
call fcn.180003b80
test r14, r14
je 0x18007fc86
lea rcx, [rsp + 0x30]
call fcn.180006030
mov rbx, rax
sub ebx, esi
lea rcx, [rsp + 0x70]
call fcn.180006030
sub ebx, eax
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.18008dc80
nop
lea rcx, [rsp + 0x50]
call fcn.180003a80
movzx ecx, word [rax]
cmp cx, 0x30
jb 0x18007fc79
cmp cx, 0x39
ja 0x18007fc79
lea rdi, [rdi + rdi*4]
movzx ecx, cx
lea rdi, [rdi - 0x18]
lea rdi, [rcx + rdi*2]
add rax, 2
movzx ecx, word [rax]
cmp cx, 0x30
jae 0x18007fc57
mov dword [r14], edi
lea rcx, [rsp + 0x50]
call fcn.180003b80
mov bl, 1
jmp 0x18007fc98
mov rcx, r15
call fcn.180003ae0
test r14, r14
sete bl
lea rcx, [rsp + 0x70]
call fcn.180003b80
nop
lea rcx, [rsp + 0x30]
call fcn.180003b80
movzx eax, bl
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007fce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2d0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.18000a130
mov rcx, qword [rbx]
test rcx, rcx
je 0x18007fec3
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.RegEnumKeyExW
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, str.RegCloseKey
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x18007fec3
test rdi, rdi
je 0x18007fec3
test rax, rax
je 0x18007fec3
mov dword [rsp + 0x78], 0x6f0053
mov dword [rsp + 0x7c], 0x740066
mov dword [rbp - 0x80], 0x610077
mov dword [rbp - 0x7c], 0x650072
mov dword [rbp - 0x78], 0x4d005c
mov dword [rbp - 0x74], 0x630069
mov dword [rbp - 0x70], 0x6f0072
mov dword [rbp - 0x6c], 0x6f0073
mov dword [rbp - 0x68], 0x740066
mov dword [rbp - 0x64], 0x43005c
mov dword [rbp - 0x60], 0x460054
mov dword [rbp - 0x5c], 0x54005c
mov dword [rbp - 0x58], 0x500049
xor r12d, r12d
mov word [rbp - 0x54], r12w
mov qword [rsp + 0x68], r12
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, 0xffffffff80000002
call r15
test eax, eax
jne 0x18007fec3
mov ebx, r12d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.1800f7810
mov dword [rsp + 0x70], 0x104
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call rdi
test eax, eax
jne 0x18007febb
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.180003bb0
nop
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.18000dee0
nop
lea rcx, [rsp + 0x48]
call fcn.180003b80
inc ebx
mov dword [rsp + 0x70], 0x104
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x50]
mov edx, ebx
mov rcx, qword [rsp + 0x68]
call rdi
test eax, eax
je 0x18007fe60
mov rcx, qword [rsp + 0x68]
call r14
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1800d8050
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180080620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800807e2
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.RegCloseKey
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r15, r15
je 0x1800807e2
test r14, r14
je 0x1800807e2
test rax, rax
je 0x1800807e2
mov dword [rbp - 9], 0x65004b
mov dword [rbp - 5], 0x620079
mov dword [rbp - 1], 0x61006f
mov dword [rbp + 3], 0x640072
mov dword [rbp + 7], 0x4c0020
mov dword [rbp + 0xb], 0x790061
mov dword [rbp + 0xf], 0x75006f
mov dword [rbp + 0x13], 0x5c0074
mov dword [rbp + 0x17], 0x720050
mov dword [rbp + 0x1b], 0x6c0065
mov dword [rbp + 0x1f], 0x61006f
mov dword [rbp + 0x23], 0x64
mov qword [rbp - 0x19], rbx
lea rcx, [rbp - 0x19]
call fcn.1800038c0
nop
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x21], rbx
mov edx, 0x20019
lea rcx, [rbp - 0x19]
call fcn.1800a5410
mov rcx, rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 9]
call r15
test eax, eax
jne 0x1800807a4
xor eax, eax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov dword [rbp + 0x37], eax
mov dword [rbp - 0x11], 0x14
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180199920]
mov rcx, qword [rbp - 0x21]
call r14
test eax, eax
jne 0x18008079e
xor edx, edx
lea r8d, [rbx + 0x10]
lea rcx, [rbp + 0x27]
call fcn.180100848
mov ebx, eax
mov rcx, qword [rbp - 0x21]
call rsi
cmp qword [rbp - 0x19], 0
je 0x1800807b4
lea rcx, [rbp - 0x19]
call fcn.1800a5550
test ebx, ebx
je 0x1800807c4
mov edx, ebx
mov rcx, rdi
call fcn.180080810
mov ebx, eax
cmp qword [rbp - 0x19], 0
je 0x1800807d5
lea rcx, [rbp - 0x19]
call fcn.1800a5550
nop
lea rcx, [rbp - 0x19]
call fcn.180003800
mov eax, ebx
jmp 0x1800807e4
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1800d8050
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180080810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, edx
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800809ec
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.RegCloseKey
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test r14, r14
je 0x1800809ec
test rsi, rsi
je 0x1800809ec
test rax, rax
je 0x1800809ec
mov dword [rbp - 0x29], 0x65004b
mov dword [rbp - 0x25], 0x620079
mov dword [rbp - 0x21], 0x61006f
mov dword [rbp - 0x1d], 0x640072
mov dword [rbp - 0x19], 0x4c0020
mov dword [rbp - 0x15], 0x790061
mov dword [rbp - 0x11], 0x75006f
mov dword [rbp - 0xd], 0x5c0074
mov dword [rbp - 9], 0x750053
mov dword [rbp - 5], 0x730062
mov dword [rbp - 1], 0x690074
mov dword [rbp + 3], 0x750074
mov dword [rbp + 7], 0x650074
mov dword [rbp + 0xb], 0x73
xor r15d, r15d
mov qword [rbp - 0x59], r15
lea rcx, [rbp - 0x59]
call fcn.1800038c0
nop
mov qword [rbp - 0x59], r15
mov qword [rbp - 0x61], r15
mov edx, 0x20019
lea rcx, [rbp - 0x59]
call fcn.1800a5410
mov rcx, rax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x29]
call r14
test eax, eax
je 0x1800809d2
lea rcx, [rbp - 0x49]
call fcn.180003c60
nop
mov r8d, ebx
lea rdx, str._08x
lea rcx, [rbp - 0x49]
call fcn.18008ded0
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], eax
mov dword [rbp - 0x51], 0x14
lea rcx, [rbp - 0x49]
call fcn.180003a80
mov rdx, rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x61]
call rsi
test eax, eax
jne 0x1800809c1
xor edx, edx
lea r8d, [r15 + 0x10]
lea rcx, [rbp + 0xf]
call fcn.180100848
mov ebx, eax
mov rcx, qword [rbp - 0x61]
call rdi
nop
lea rcx, [rbp - 0x49]
call fcn.180003b80
nop
cmp qword [rbp - 0x59], 0
je 0x1800809e3
lea rcx, [rbp - 0x59]
call fcn.1800a5550
nop
lea rcx, [rbp - 0x59]
call fcn.180003800
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180080a20
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call fcn.1800f7810
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180080a83
cmp dword [rsp + 0x24], 6
jb 0x180080a83
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x158
ret
Function at 0x180081560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rcx, qword [rcx]
mov rsi, r9
mov r14, r8
mov rdi, rdx
test rcx, rcx
je 0x1800816b8
lea rdx, str.RegQueryValueExW
mov qword [rsp + 0x280], rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800816b0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1800f7810
mov rcx, r14
mov dword [rsp + 0x30], 0x208
call fcn.180003a80
mov rdx, rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call rbx
lea rcx, [rsi + 0x50]
lea rdx, [rsp + 0x60]
call fcn.180004070
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea rdx, str.Profile
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call rbx
lea rcx, [rsi + 0x70]
lea rdx, [rsp + 0x60]
call fcn.180004070
xor eax, eax
mov dword [rsp + 0x38], 0x65004b
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x3c], 0x620079
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov dword [rsp + 0x40], 0x61006f
mov dword [rsp + 0x44], 0x640072
mov dword [rsp + 0x48], 0x61004c
mov dword [rsp + 0x4c], 0x6f0079
mov dword [rsp + 0x50], 0x740075
mov dword [rsp + 0x30], 4
call rbx
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x288
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180082a50
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x178], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.1800038c0
nop
mov ecx, 1
call fcn.1800d8074
mov qword [rsp + 0x28], rax
mov byte [rax], 0
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x34]
call fcn.1800f7810
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180082add
cmp dword [rsp + 0x34], 6
setae cl
mov rax, qword [rsp + 0x28]
mov byte [rax], cl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.1800a32c0
test al, al
je 0x180082b05
lea rcx, [rsp + 0x28]
call fcn.1800a2a90
test al, al
jne 0x180082b05
xor bl, bl
jmp 0x180082b73
lea rdx, [rbx + 8]
xor ecx, ecx
call fcn.180099e90
test al, al
jne 0x180082b1d
lea rcx, [rbx + 8]
call fcn.18001ee30
lea rdx, [rbx + 0x28]
mov ecx, 0x1a
call fcn.180099e90
test al, al
jne 0x180082b38
lea rcx, [rbx + 0x28]
call fcn.18001ee30
lea rdx, [rbx + 0x48]
mov ecx, 2
call fcn.180099e90
test al, al
jne 0x180082b53
lea rcx, [rbx + 0x48]
call fcn.18001ee30
lea rdx, [rbx + 0x68]
mov ecx, VariantTimeToDosDateTime
call fcn.180099e90
test al, al
jne 0x180082b6e
lea rcx, [rbx + 0x68]
call fcn.18001ee30
mov byte [rbx], 1
mov bl, 1
lea rcx, [rsp + 0x28]
call fcn.1800a22c0
movzx eax, bl
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x180082c80
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov rdi, rdx
mov qword [r11 - 0x58], rdx
xor r15d, r15d
mov dword [r11 - 0x68], r15d
lea edx, [r15 + 0x25]
xor r8d, r8d
mov rcx, rsi
call fcn.18001c8c0
mov rdx, rsi
cmp rax, 0xffffffffffffffff
jne 0x180082ce8
mov rcx, rdi
call fcn.1800096b0
nop
mov dword [rsp + 0x20], 1
jmp 0x180082d98
lea rcx, [rsp + 0x38]
call fcn.1800096b0
nop
mov rcx, rsi
call fcn.180003a80
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
jne 0x180082d1c
mov rdx, rsi
mov rcx, rdi
call fcn.1800096b0
jmp 0x180082d86
lea ecx, [rax + 2]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800d85d0
mov r14, rax
mov rcx, rsi
call fcn.180003a80
mov rcx, rax
lea r8d, [rbp + 1]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x180082d71
cmp eax, ebp
ja 0x180082d71
mov eax, eax
mov word [r14 + rax*2], r15w
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.180004070
mov rcx, r14
call fcn.1800d80b0
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.180005630
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x38]
call fcn.180003b80
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180083930
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x238]
sub rsp, 0x330
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rbx, rdx
mov dword [rbp - 0x40], 0x61004d
mov dword [rbp - 0x3c], 0x720063
mov dword [rbp - 0x38], 0x6d006f
mov dword [rbp - 0x34], 0x640065
mov dword [rbp - 0x30], 0x46005c
mov dword [rbp - 0x2c], 0x61006c
mov dword [rbp - 0x28], 0x680073
mov dword [rbp - 0x24], 0x46005c
mov dword [rbp - 0x20], 0x61006c
mov dword [rbp - 0x1c], 0x680073
mov dword [rbp - 0x18], 0x650048
mov dword [rbp - 0x14], 0x70006c
mov dword [rbp - 0x10], 0x720065
mov dword [rbp - 0xc], 0x650053
mov dword [rbp - 8], 0x760072
mov dword [rbp - 4], 0x630069
mov dword [rbp], 0x2e0065
mov dword [rbp + 4], 0x780065
mov dword [rbp + 8], 0x65
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.1800f7810
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.180003bb0
nop
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call fcn.180003bb0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x68]
call fcn.180099c60
nop
lea rcx, [rsp + 0x38]
call fcn.180003b80
nop
lea rcx, [rsp + 0x58]
call fcn.180003b80
lea rcx, [rbp - 0x68]
call fcn.180098ee0
test al, al
jne 0x180083a74
xor bl, bl
jmp 0x180083aaf
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.18009a5b0
nop
lea rcx, [rsp + 0x78]
call fcn.180005c00
test al, al
je 0x180083a95
xor bl, bl
jmp 0x180083aa4
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.180003ae0
mov bl, 1
lea rcx, [rsp + 0x78]
call fcn.180003b80
nop
lea rcx, [rbp - 0x68]
call fcn.180003b80
movzx eax, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1800d8050
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18008d180
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.18000a650
mov dword [rsp + 0x20], 1
mov ebx, edi
test ebp, ebp
je 0x18008d375
mov ecx, edi
nop word [rax + rax]
dec ebp
movzx eax, byte [r14]
mov byte [rsp + rcx + 0x80], al
inc ebx
inc rcx
lea r14, [r14 + 1]
movzx r13d, byte [rsp + 0x82]
movzx r15d, byte [rsp + 0x81]
movzx r12d, byte [rsp + 0x80]
cmp rcx, 3
jne 0x18008d28d
movzx eax, r12b
shr al, 2
mov byte [rsp + 0x88], al
movzx ecx, r12b
and cl, 3
shl cl, 4
movzx eax, r15b
shr al, 4
add cl, al
mov byte [rsp + 0x89], cl
movzx ecx, r15b
and cl, 0xf
shl cl, 2
movzx eax, r13b
shr al, 6
add cl, al
mov byte [rsp + 0x8a], cl
movzx eax, r13b
and al, 0x3f
mov byte [rsp + 0x8b], al
mov rbx, rdi
nop dword [rax]
movzx edx, byte [rsp + rbx + 0x88]
lea rcx, [0x18020e2b8]
call fcn.18000fda0
movzx edx, byte [rax]
mov rcx, rsi
call fcn.1800355b0
inc rbx
cmp rbx, 4
jl 0x18008d260
mov ebx, edi
mov rcx, rdi
test ebp, ebp
jne 0x18008d1d0
test ebx, ebx
je 0x18008d375
movsxd rax, ebx
cmp rax, 3
jge 0x18008d2d8
jae 0x18008d38d
mov byte [rsp + rax + 0x80], 0
inc rax
cmp rax, 3
jl 0x18008d2a6
movzx r13d, byte [rsp + 0x82]
movzx r15d, byte [rsp + 0x81]
movzx r12d, byte [rsp + 0x80]
movzx eax, r12b
shr al, 2
mov byte [rsp + 0x88], al
and r12b, 3
shl r12b, 4
movzx eax, r15b
shr al, 4
add r12b, al
mov byte [rsp + 0x89], r12b
and r15b, 0xf
shl r15b, 2
movzx eax, r13b
shr al, 6
add r15b, al
mov byte [rsp + 0x8a], r15b
and r13b, 0x3f
mov byte [rsp + 0x8b], r13b
lea eax, [rbx + 1]
movsxd rbp, eax
test eax, eax
jle 0x18008d357
movzx edx, byte [rsp + rdi + 0x88]
lea rcx, [0x18020e2b8]
call fcn.18000fda0
movzx edx, byte [rax]
mov rcx, rsi
call fcn.1800355b0
inc rdi
cmp rdi, rbp
jl 0x18008d330
cmp ebx, 3
jge 0x18008d375
mov eax, 3
sub eax, ebx
mov ebx, eax
mov dl, 0x3d
mov rcx, rsi
call fcn.1800355b0
sub rbx, 1
jne 0x18008d365
mov rax, rsi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800d86e0
int3
Function at 0x180094b50
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x180094b8e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov word [rbx + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1800ae210
nop
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
lea rdi, [rax + 0x10]
jne 0x180094bb4
mov rdi, rbp
mov rcx, rsi
call fcn.180005c00
test al, al
jne 0x180094bca
mov rcx, rsi
call fcn.180003a80
jmp 0x180094bcd
mov rax, rbp
mov r8, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x180094bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180094bf4
mov byte [rbx + 9], 1
cmp qword [rbx], 0
setne dil
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx]
test rbx, rbx
je 0x180094c2a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x28]
mov qword [rax], rbp
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 8]
test rax, rax
je 0x180094c4a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], rbp
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180094c5e
mov edx, 0x58
call fcn.1800d80b0
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.180003800
movzx eax, dil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180094c90
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x180094cce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov word [rbx + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1800ae2c0
nop
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
lea rsi, [rax + 0x10]
jne 0x180094cf4
mov rsi, rbp
mov rcx, rdi
call fcn.180005c00
test al, al
jne 0x180094d0a
mov rcx, rdi
call fcn.180003a80
jmp 0x180094d0d
mov rax, rbp
mov r8, rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
jne 0x180094d61
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180094d61
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.180005c00
test al, al
jne 0x180094d4d
mov rcx, rdi
call fcn.180003a80
jmp 0x180094d50
mov rax, rbp
mov r8, rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
mov rax, qword [rbx]
test rax, rax
je 0x180094d88
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180094d7a
mov byte [rbx + 9], 1
mov rcx, qword [rbx]
call fcn.1800a3650
mov rax, qword [rbx]
test rax, rax
setne dil
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx]
test rbx, rbx
je 0x180094dba
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x28]
mov qword [rax], rbp
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 8]
test rax, rax
je 0x180094dda
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], rbp
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180094dee
mov edx, 0x58
call fcn.1800d80b0
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.180003800
movzx eax, dil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret