joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bf50
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140004670
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000bfda
cmp byte [rbp - 0x21], r15b
je 0x14000bfd5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c010
call fcn.14000a0a0
test eax, eax
jne 0x14000bffc
cmp byte [rbp - 0x21], r15b
je 0x14000bff4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c010
cmp byte [rbp - 0x21], r15b
je 0x14000c00d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140006e48
test eax, eax
jne 0x14000c0b0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140004670
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c04f
cmp byte [rbp - 0x21], r15b
je 0x14000c084
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c084
call fcn.14000a0a0
test eax, eax
jne 0x14000c070
cmp byte [rbp - 0x21], r15b
je 0x14000c069
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c084
cmp byte [rbp - 0x21], r15b
je 0x14000c081
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140006e48
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c0b0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c0b3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c0c1
mov rcx, rdi
call fcn.140006df8
cmp byte [rbp + 0x3f], r15b
je 0x14000c0d0
mov rcx, qword [rbp + 0x27]
call fcn.140006df8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000ef00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000ef28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000ef28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140131000
Capabilities:
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
ret 0xe10b
xchg rsi, r9
mov qword [rsp + 0x20], rsi
xchg rsi, r9
xchg r8, r14
mov qword [rsp + 0x18], r14
xchg r14, r8
xchg rbx, rdx
je 0x14013104a
jne 0x14013104a
test edx, 0x32bd355e
rol r15d, 0x22
neg r15
ror ebx, 0xbd
rcr ebx, 0x99
lea esi, [rdi + 0x7d63]
jb 0x1401300c9
lea r10d, [rbx + 0xf9db]
popf
rol ebx, 0x72
movabs r14, 0x333af000000d9e9
jmp 0x140131128
mov qword [rsp - 8], rbp
sub rsp, 8
push rbx
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword gs:[0x60]
jmp 0x14013108a
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
xchg rcx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rcx
nop
jmp 0x1401310ff
Function at 0x14013204e
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
jmp 0x140131e22
clc
jmp 0x140131e95
test al, al
jne 0x140131e68
cmp edx, 0x5a280ad4
jmp 0x140131e35
je 0x140131f24
inc r8d
jmp 0x140131eca
xchg rcx, r13
mov r13, qword [rdx + 0x10]
xchg r13, rcx
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x30]
movsxd rcx, dword [r9 + 0x3c]
jmp 0x140131ebb
test al, al
je 0x140131e3b
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
jmp 0x140131dff
call r10
mov rcx, qword gs:[0x60]
mov r8d, r15d
mov rdx, qword [rcx + 0x18]
jmp 0x140131e43
add rcx, r9
movzx eax, byte [rcx]
inc rcx
jmp 0x140131e5d
mov ebx, dword [rcx + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop
mov r10d, r8d
mov edx, 0x1a8c70d1
lea rax, [r9 + r10*4]
mov ecx, dword [rax + r11]
jne 0x140131f11
je 0x140131f11
rcl r11d, 0x86
lea edi, [rdx - 0x5c7]
cmp r12d, 0x7833d20d
ror esi, 0xad
mov r14d, 0xb3254647
lea r8d, [rdi + 0x6832]
test esi, 0x75d6c321
jmp rax
jmp 0x140131ead
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
jmp 0x1401320a8
test cl, cl
jne 0x140131f6d
cmp r8d, 0x98a4afa2
je 0x1401320b9
test r9d, r9d
jne 0x140132085
jmp 0x140132093
je 0x140131f56
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
jmp 0x140131f41
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
sbb byte [rax - 0x75], cl
adc byte [rsi + 0xf], spl
invalid
add byte [rax], r8b
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
jmp 0x140131fb3
add rdi, r10
cmp rdi, r10
je 0x140132093
mov r9d, dword [rdi + 0x18]
test r9d, r9d
jmp 0x140132070
jne 0x140132730
mov r9d, 0x8000
xchg rcx, r15
mov qword [rbp + 0x118], rcx
xchg r15, rcx
jmp 0x140132053
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
je 0x14013201f
jne 0x14013201f
ret
jmp 0x14013209b
call rax
xchg rdx, rcx
mov rdx, qword [rsp + 0x30]
xchg rdx, rcx
call r14
test eax, eax
jmp 0x140131fcb
lea r8, [rbp + 0x118]
mov rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x120]
call r12
jmp 0x140131f87
je 0x140132093
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xbdcbfd7
jmp 0x140131fe9
mov rax, qword [rax]
jmp 0x140131f9e
movzx ecx, byte [rdx]
inc rdx
test cl, cl
jmp 0x140131f64
xchg r15, rcx
mov r15, rdi
xchg r15, rcx
add rax, r9
jmp 0x14013203c
mov ecx, dword [rdi + 0x24]
add rcx, r10

Function at 0x140132b67
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
add al, 0x44
lea edi, [rbx + 0xd906]
call rcx
jno 0x140131cc9
ret
Function at 0x140134eb0
Capabilities:
Execute syscall

Disassembly:
idiv esi
invalid
popf
ret 0x28
mov dword [rbp + 0x100], 0x6f7c6b2a
mov dword [rbp + 0xb0], 0xf6f6f6f6
mov dword [rbp + 0x104], 0x7d78732a
mov dword [rbp + 0xb4], 0xf6f6f6f6
mov dword [rbp + 0x108], 0x76766b7e
mov word [rbp + 0xb8], 0xf6f6
jne 0x140134b7e
je 0x140134b7e
call rax
movabs rsi, 0x2a69710000026fe9
neg r12
ror r12d, 0x4d
rcr ebx, 0xc5
ret 0x18
jmp 0x140134df2
div dh
jle 0x140134c3a
or ecx, dword [rdx]
sub eax, ecx
invalid
test eax, esp
add byte [rax], al
add byte [rdx], ch
jle 0x140134d12
outsd dx, dword [rsi]
add byte [rbp + 0x7e], bh
jl 0x140134d8a
jmp 0x140134d1c
mov dword [rbp + 0xa4], 0xf6f6f6f6
mov dword [rbp + 0xf8], 0x6b7e7f6c
mov dword [rbp + 0xa8], 0xf6f6f6f6
mov dword [rbp + 0xfc], 0x7d6f766c
mov dword [rbp + 0xac], 0xf6f6f6f6
jmp 0x140134b3b
add byte [rbp + 0x35], cl
xor eax, 0x9c85c72a
add byte [rax], al
add dh, dh
div dh
div byte [rdi + rdi + 0x75]
cmp eax, 0xf10cec1
mov ebx, esp
stc
invalid
mov dword [rbp + 0x10c], 0x386e6f
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
jmp 0x140134ef3
mov dword [rsp + 8], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
jmp 0x140134f50
sub rsp, 0x28
lea rax, [0x140135110]
xchg r8, rax
mov qword [rsp + 0x18], r8
xchg r8, rax
jmp 0x140134ec3
xchg rcx, r8
mov qword [rsp + 8], r8
xchg rcx, r8
or byte [rdi + rax*4 - 0x3f], cl
je 0x140134f29
sub dword [rbp + 0x27], esi
jne 0x140134f29
popf
cpuid
lea edi, [rbp + 0x6d0]
lea esi, [rdx - 0xc679]
invalid
invalid
Function at 0x140001d00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140003078]
test rax, rax
je 0x140001d4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d4c
xor al, al
add rsp, 0x28
ret

Function at 0x1407b6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407b61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407b6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b606f
add dl, dl
jne 0x1407b6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b60f6
xor eax, eax
add dl, dl
jne 0x1407b60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b61ad
add dl, dl
jne 0x1407b60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407b60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407b607e
mov eax, 1
add dl, dl
jne 0x1407b6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b60fb
sub eax, ebx
mov ebx, 1
jne 0x1407b614c
mov ecx, 1
add dl, dl
jne 0x1407b612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407b6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b615d
cmp eax, 0x7d00
jae 0x1407b619b
cmp eax, 0x500
jb 0x1407b6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b607e
cmp eax, 0x7f
ja 0x1407b619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407b61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407b607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003100
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x180061008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rcx
mov dword [rsp + 0x38], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
xor esi, esi
call fcn.1800081b0
cmp rax, 0x12
je 0x180003243
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rdi
mov rdi, rbp
mov qword [rsp + 0x88], r14
mov r14, rbp
mov qword [rsp + 0x50], r15
neg r14
lea r15, str.svogfiifotuz
nop dword [rax]
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.180017504
mov rbx, rax
mov r8d, VariantTimeToDosDateTime
mov byte [rax + 0xb], 0
test rdi, rdi
je 0x1800031a1
mov r9, rdi
mov rcx, rax
sub r9, rax
nop word [rax + rax]
movzx edx, byte [r9 + rcx]
mov byte [rcx], dl
lea rcx, [rcx + 1]
sub r8d, 1
jne 0x180003190
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
je 0x180003204
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180003204
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.zsadsgjea
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180003204
cmp qword [rsp + 0x30], 0
je 0x180003204
inc rsi
mov rcx, rbx
add rdi, 6
call fcn.180017494
mov rcx, rbp
call fcn.1800081b0
sub rax, 0x12
lea rcx, [r14 + rdi]
cmp rcx, rax
jb 0x180003160
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
cmp rsi, 0xa
seta al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180017470
add rsp, 0x58
pop rsi
pop rbp
ret

Function at 0x1800070d0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 8
mov rax, qword [0x1800645d8]
test rax, rax
jne 0x180007166
mov rax, qword gs:[0x60]
mov qword [rsp], rbx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov r11, qword [rbx]
cmp r11, rbx
je 0x18000715b
mov r10, qword [r11 + 0x60]
movzx r8d, word [r11 + 0x58]
test r10, r10
je 0x180007153
movzx eax, byte [r10]
xor edx, edx
xor r9d, r9d
test al, al
je 0x180007153
nop dword [rax]
test r8d, r8d
je 0x18000712a
cmp r9d, r8d
jae 0x18000714b
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x180007134
add al, 0x20
add r10, 2
rol edx, 7
movsx ecx, al
inc r9d
xor edx, ecx
movzx eax, byte [r10]
test al, al
jne 0x180007120
cmp edx, 0x4b1ffe8e
je 0x18000716b
mov r11, qword [r11]
cmp r11, rbx
jne 0x180007101
mov rax, qword [0x1800645d8]
mov rbx, qword [rsp]
add rsp, 8
ret
mov rax, qword [r11 + 0x30]
mov rbx, qword [rsp]
mov qword [0x1800645d8], rax
add rsp, 8
ret
Function at 0x180007180
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x138
mov rax, qword [0x180061008]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rdx, rcx
test rcx, rcx
jne 0x1800071bb
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180017470
add rsp, 0x138
ret
mov eax, 0xff
lea rcx, [rsp + 0x20]
nop word [rax + rax]
mov byte [rcx], 0
lea rcx, [rcx + 1]
sub rax, 1
jne 0x1800071d0
xor r8d, r8d
mov r9d, r8d
cmp byte [rdx], r8b
je 0x18000720c
movzx eax, byte [rdx]
lea r10, [rsp + 0x20]
sub r10, rdx
mov rcx, rdx
cmp al, 0x2e
je 0x18000720c
mov byte [r10 + rcx], al
inc r9d
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1800071f6
movsxd rax, r9d
add rdx, rax
je 0x1800071a1
mov byte [rsp + rax + 0x20], 0x2e
inc r9d
movsxd rax, r9d
inc rdx
inc r9d
mov byte [rsp + rax + 0x20], 0x64
movsxd rax, r9d
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r9 + 1]
movsxd rcx, eax
movzx eax, byte [rdx]
mov byte [rsp + rcx + 0x20], 0x6c
cmp al, 0x23
jne 0x180007284
inc rdx
mov r9d, 1
cmp byte [rdx], 0x2d
jne 0x18000725a
or r9d, 0xffffffff
inc rdx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x18000727e
cmp al, 0x39
jg 0x18000727e
movsx eax, al
lea r8d, [r8 + r8*4]
inc rdx
lea r8d, [r8 - 0x18]
lea r8d, [rax + r8*2]
movzx eax, byte [rdx]
cmp al, 0x30
jge 0x180007261
imul r8d, r9d
jmp 0x1800072a5
test al, al
je 0x1800072a5
nop dword [rax + rax]
rol r8d, 7
lea rdx, [rdx + 1]
movsx eax, al
xor r8d, eax
movzx eax, byte [rdx]
test al, al
jne 0x180007290
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180007490
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180017470
add rsp, 0x138
ret

Function at 0x1800072d0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov edi, edx
mov r11, rcx
mov ebx, dword [rax + rcx + 0x88]
mov ebp, dword [rax + rcx + 0x8c]
add rbx, rcx
mov eax, edx
shr eax, 0x10
test ax, ax
jne 0x180007310
movzx eax, di
sub eax, dword [rbx + 0x10]
jmp 0x180007382
mov r8d, dword [rbx + 0x20]
xor r9d, r9d
mov r10d, dword [rbx + 0x24]
add r8, r11
mov esi, dword [rbx + 0x18]
add r10, r11
test esi, esi
je 0x180007367
mov edx, dword [r8]
add rdx, r11
jne 0x180007335
or eax, 0xffffffff
jmp 0x180007353
movzx ecx, byte [rdx]
xor eax, eax
test cl, cl
je 0x180007353
nop
rol eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
xor eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180007340
cmp eax, edi
je 0x18000737e
add r8, 4
add r10, 2
inc r9d
cmp r9d, esi
jb 0x180007328
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, word [r10]
test eax, eax
js 0x180007367
mov ecx, dword [rbx + 0x1c]
add rcx, r11
movsxd rdx, eax
mov r8d, dword [rcx + rdx*4]
add r8, r11
cmp r8, rbx
jbe 0x1800073b1
mov rdx, r8
sub rdx, rbx
cmp rdx, rbp
jae 0x1800073b1
mov rcx, r8
call fcn.180007180
mov r8, rax
mov rax, r8
jmp 0x180007369
Function at 0x180007490
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov edi, r8d
mov rbx, rcx
cmp edx, 1
jne 0x1800074b6
mov r9, qword [0x1800645d8]
test r9, r9
jne 0x18000750e
jmp 0x1800074c5
test rcx, rcx
jne 0x1800074ca
mov ecx, edx
call fcn.1800073c0
mov rbx, rax
test rbx, rbx
je 0x18000750e
cmp byte [rbx], 0
je 0x18000750e
mov edx, 1
xor ecx, ecx
mov r8d, 0xa48d6762
lea r9d, [rdx + 0x2a]
call fcn.180007540
mov rcx, rbx
call rax
mov r9, rax
test rax, rax
jne 0x18000750e
lea edx, [rax + 1]
xor ecx, ecx
lea r9d, [rax + 2]
mov r8d, 0xc8ac8026
call fcn.180007540
mov rcx, rbx
call rax
mov r9, rax
test edi, edi
jne 0x180007520
mov rax, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, edi
mov rcx, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800072d0

Function at 0x180008030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xe0
movdqa xmm0, xmmword [0x180056550]
movdqa xmm1, xmmword [0x180056570]
mov rcx, qword [0x180064560]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x180056590]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x1800565a0]
movdqa xmmword [rax - 0x28], xmm0
movdqa xmm0, xmmword [0x180056520]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x180056530]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [str.XD_t6_a]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x180056540]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rax - 0x38], xmm1
movdqa xmm1, xmmword [0x180056510]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x180056560]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rax - 0x78], 0x9e
mov dword [rax - 0x74], 0x7e
mov dword [rax - 0x70], 0xad
mov dword [rax - 0x18], 0x26
mov dword [rax - 0x14], 0x13
mov dword [rax - 0x10], 0xe4
call fcn.180007f80
xor r9d, r9d
mov rbx, rax
mov r10d, r9d
mov r11, rax
movabs rdi, 0x642c8590b21642c9
nop dword [rax]
nop word [rax + rax]
movsxd r8, r10d
lea r11, [r11 + 1]
mov rcx, r8
mov rax, rdi
mul r8
inc r10d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 4
imul rax, rcx, 0x17
sub r8, rax
movzx eax, byte [rsp + r8*4 + 0x20]
xor byte [r11 - 1], al
cmp r10d, 0x12600
jb 0x180008120
mov r8, rbx
nop dword [rax]
movsxd rcx, r9d
lea r8, [r8 + 1]
mov rax, rdi
inc r9d
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0x17
sub rcx, rax
movzx eax, byte [rsp + rcx*4 + 0x80]
xor byte [r8 - 1], al
cmp r9d, 0x12600
jb 0x180008160
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
Function at 0x1800082f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov rsi, rdx
mov rbp, rcx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
jne 0x180008317
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbx
lea rax, [r8 + rcx]
mov ebx, dword [rax + 0x20]
xor r11d, r11d
mov qword [rsp + 0x48], rdi
add rbx, rbp
mov edi, dword [rax + 0x24]
mov qword [rsp + 0x50], r14
add rdi, rbp
mov r14d, dword [rax + 0x18]
mov qword [rsp + 0x20], r15
mov r15d, dword [rax + 0x1c]
add r15, rbp
test r14, r14
je 0x1800083ac
nop
mov edx, dword [rbx]
mov rcx, rsi
call fcn.1800081b0
mov r8, rax
add rdx, rbp
je 0x18000839c
test rsi, rsi
je 0x18000839c
test rax, rax
je 0x1800083ac
mov r10, rsi
mov r9, rdx
sub r10, rdx
neg r9
nop dword [rax + rax]
movzx eax, byte [rdx]
movzx ecx, byte [r10 + rdx]
cmp al, cl
jb 0x18000839c
ja 0x18000839c
inc rdx
lea rax, [r9 + rdx]
cmp rax, r8
jb 0x180008380
jmp 0x1800083ac
inc r11
add rbx, 4
add rdi, 2
cmp r11, r14
jb 0x180008350
movzx eax, word [rdi]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x1800083c6
lea r15, [r15 + rax*4]
mov eax, dword [r15]
mov r15, qword [rsp + 0x20]
add rax, rbp
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x180008940
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x20]
test r9, r9
je 0x1800089a4
nop word [rax + rax]
mov rdx, qword [r9 + 0x50]
xor eax, eax
movzx r8d, word [r9 + 0x48]
nop dword [rax + rax]
movzx ecx, byte [rdx]
ror eax, 0xd
cmp cl, 0x61
jb 0x180008986
movzx ecx, cl
sub ecx, 0x20
movsxd rcx, ecx
jmp 0x180008989
movzx ecx, cl
add rax, rcx
inc rdx
sub r8, 1
jne 0x180008970
cmp eax, 0x6a4abc5b
je 0x1800089a7
mov r9, qword [r9]
test r9, r9
jne 0x180008960
xor eax, eax
ret
mov r10, qword [r9 + 0x20]
movsxd rax, dword [r10 + 0x3c]
mov r11d, dword [rax + r10 + 0x88]
mov r8d, dword [r11 + r10 + 0x20]
mov r9d, dword [r11 + r10 + 0x24]
add r8, r10
add r9, r10
nop word [rax + rax]
mov edx, dword [r8]
add rdx, r10
xor ecx, ecx
movzx eax, byte [rdx]
nop dword [rax + rax]
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800089e0
cmp ecx, 0x3bd09a55
je 0x180008a05
add r8, 4
add r9, 2
jmp 0x1800089d0
mov ecx, dword [r11 + r10 + 0x1c]
movzx edx, word [r9]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
ret

Function at 0x18000c100
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x2b8], rbx
mov rax, qword [0x180061008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.18001d6f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x18000c226
mov qword [rsp + 0x48], 7
xor edi, edi
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp word [rsp + 0x80], di
jne 0x18000c18f
mov r8d, edi
jmp 0x18000c1aa
lea rax, [rsp + 0x80]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x18000c1a0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.18000d2f0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.18000dd30
mov rdx, rax
mov rcx, rbx
call fcn.18000c860
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x18000c1f4
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000d280
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x18000c224
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18000d280
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180017470
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret