joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1418a2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1418a21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1418a2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418a206f
add dl, dl
jne 0x1418a2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418a20f6
xor eax, eax
add dl, dl
jne 0x1418a20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418a21ad
add dl, dl
jne 0x1418a20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418a20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418a20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418a20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1418a20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1418a207e
mov eax, 1
add dl, dl
jne 0x1418a2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418a2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418a20fb
sub eax, ebx
mov ebx, 1
jne 0x1418a214c
mov ecx, 1
add dl, dl
jne 0x1418a212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1418a213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418a2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418a207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1418a2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1418a2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418a215d
cmp eax, 0x7d00
jae 0x1418a219b
cmp eax, 0x500
jb 0x1418a2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418a207e
cmp eax, 0x7f
ja 0x1418a219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418a207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1418a21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1418a207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800062d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rcx, [0x18009f2d8]
nop
nop
nop
nop
nop
nop
movzx eax, byte [0x1800c54d8]
test eax, eax
jne 0x18000637f
mov dword [rsp + 0x24], 0
jmp 0x18000630e
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x100
jge 0x180006378
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x2c], 8
jmp 0x180006334
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x180006363
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x180006357
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 0x20], eax
jmp 0x180006361
mov eax, dword [rsp + 0x20]
shr eax, 1
mov dword [rsp + 0x20], eax
jmp 0x18000632a
movsxd rax, dword [rsp + 0x24]
lea rcx, [0x1800c5d80]
mov edx, dword [rsp + 0x20]
mov dword [rcx + rax*4], edx
jmp 0x180006304
mov byte [0x1800c54d8], 1
mov dword [rsp + 0x28], 0xffffffff
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
dec rax
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x30], 0
je 0x1800063e7
mov eax, dword [rsp + 0x28]
shr eax, 8
and eax, 0xffffff
mov rcx, qword [rsp + 0x50]
movsx ecx, byte [rcx]
mov edx, dword [rsp + 0x28]
xor edx, ecx
mov ecx, edx
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1800c5d80]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x180006387
mov eax, dword [rsp + 0x28]
xor eax, 0xffffffff
jmp 0x1800063f6
add rsp, 0x48
ret

Function at 0x180023700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [0x1800a04f8]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x60], 0x47
mov byte [rsp + 0x61], 0x65
mov byte [rsp + 0x62], 0x74
mov byte [rsp + 0x63], 0x4e
mov byte [rsp + 0x64], 0x61
mov byte [rsp + 0x65], 0x74
mov byte [rsp + 0x66], 0x69
mov byte [rsp + 0x67], 0x76
mov byte [rsp + 0x68], 0x65
mov byte [rsp + 0x69], 0x53
mov byte [rsp + 0x6a], 0x79
mov byte [rsp + 0x6b], 0x73
mov byte [rsp + 0x6c], 0x74
mov byte [rsp + 0x6d], 0x65
mov byte [rsp + 0x6e], 0x6d
mov byte [rsp + 0x6f], 0x49
mov byte [rsp + 0x70], 0x6e
mov byte [rsp + 0x71], 0x66
mov byte [rsp + 0x72], 0x6f
mov byte [rsp + 0x73], 0
lea rcx, str.kernel32.dll
call int.18092c7f4
nop
mov rcx, rax
call qword [0x18008c0a0]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [0x18008c188]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800237e5
lea rcx, [rsp + 0x30]
call qword [rsp + 0x28]
movzx eax, word [rsp + 0x30]
cmp eax, 9
je 0x1800237dd
movzx eax, word [rsp + 0x30]
cmp eax, 6
jne 0x1800237e5
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
jmp 0x1800237f1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x88
ret
Function at 0x180028d70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rcx, [0x18009f2d8]
nop
nop
nop
nop
nop
nop
movzx eax, byte [0x1800c5940]
test eax, eax
jne 0x180028e1f
mov dword [rsp + 0x24], 0
jmp 0x180028dae
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x100
jge 0x180028e18
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x2c], 8
jmp 0x180028dd4
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x180028e03
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x180028df7
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 0x20], eax
jmp 0x180028e01
mov eax, dword [rsp + 0x20]
shr eax, 1
mov dword [rsp + 0x20], eax
jmp 0x180028dca
movsxd rax, dword [rsp + 0x24]
lea rcx, [0x1800c61a0]
mov edx, dword [rsp + 0x20]
mov dword [rcx + rax*4], edx
jmp 0x180028da4
mov byte [0x1800c5940], 1
mov dword [rsp + 0x28], 0xffffffff
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
dec rax
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x30], 0
je 0x180028e87
mov eax, dword [rsp + 0x28]
shr eax, 8
and eax, 0xffffff
mov rcx, qword [rsp + 0x50]
movsx ecx, byte [rcx]
mov edx, dword [rsp + 0x28]
xor edx, ecx
mov ecx, edx
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1800c61a0]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x180028e27
mov eax, dword [rsp + 0x28]
xor eax, 0xffffffff
jmp 0x180028e96
add rsp, 0x48
ret
Function at 0x1800290d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rcx, [0x1800a0bb8]
nop
nop
nop
nop
nop
nop
mov eax, 4
mov eax, eax
mov ecx, dword [0x1800c4cf8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1800c65a4], eax
jle 0x180029156
lea rcx, [0x1800c65a4]
call fcn.18007fec0
cmp dword [0x1800c65a4], 0xffffffff
jne 0x180029156
call fcn.180023700
mov dword [0x1800c65a8], eax
lea rcx, [0x1800c65a4]
call fcn.18007fe60
cmp dword [0x1800c65a8], 0
jne 0x180029166
xor al, al
jmp 0x1800292b7
cmp qword [0x1800c5938], 0
jne 0x180029269
mov byte [rsp + 0x150], 0x6e
mov byte [rsp + 0x151], 0x74
mov byte [rsp + 0x152], 0x64
mov byte [rsp + 0x153], 0x6c
mov byte [rsp + 0x154], 0x6c
mov byte [rsp + 0x155], 0x2e
mov byte [rsp + 0x156], 0x64
mov byte [rsp + 0x157], 0x6c
mov byte [rsp + 0x158], 0x6c
mov byte [rsp + 0x159], 0
lea rax, [rsp + 0x15a]
mov rdi, rax
xor eax, eax
mov ecx, 0xfa
rep stosb byte [rdi], al
mov byte [rsp + 0x40], 0x49
mov byte [rsp + 0x41], 0x73
mov byte [rsp + 0x42], 0x57
mov byte [rsp + 0x43], 0x6f
mov byte [rsp + 0x44], 0x77
mov byte [rsp + 0x45], 0x36
mov byte [rsp + 0x46], 0x34
mov byte [rsp + 0x47], 0x50
mov byte [rsp + 0x48], 0x72
mov byte [rsp + 0x49], 0x6f
mov byte [rsp + 0x4a], 0x63
mov byte [rsp + 0x4b], 0x65
mov byte [rsp + 0x4c], 0x73
mov byte [rsp + 0x4d], 0x73
mov byte [rsp + 0x4e], 0
lea rax, [rsp + 0x4f]
mov rdi, rax
xor eax, eax
mov ecx, 0xf5
rep stosb byte [rdi], al
lea rcx, str.kernel32.dll
call qword [0x18008c0a0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180029252
xor al, al
jmp 0x1800292b7
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [0x18008c188]
mov qword [0x1800c5938], rax
cmp qword [0x1800c5938], 0
jne 0x180029277
xor al, al
jmp 0x1800292b7
mov dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x280]
call qword [0x1800c5938]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1800292a1
xor al, al
jmp 0x1800292b7
cmp dword [rsp + 0x38], 0
je 0x1800292ac
xor al, al
jmp 0x1800292b7
mov al, 1
jmp 0x1800292b7
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x270
pop rdi
ret
Function at 0x180029e20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [0x1800a0c80]
nop
nop
nop
nop
nop
nop
cmp qword [rsp + 0x80], 0
jne 0x180029e57
xor eax, eax
jmp 0x180029f95
mov qword [rsp + 0x58], 0
lea r8, [0x18009f2b8]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.180063d60
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x58], 0
jne 0x180029e8c
xor eax, eax
jmp 0x180029f95
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.1800640a8
mov rcx, qword [rsp + 0x58]
call fcn.180063c8c
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.1800640a8
cmp dword [rsp + 0x20], 0x1f400000
jge 0x180029ecc
cmp dword [rsp + 0x20], 0
jg 0x180029ed3
xor eax, eax
jmp 0x180029f95
movsxd rax, dword [rsp + 0x20]
lea rdx, [0x18008c6b9]
mov rcx, rax
call fcn.18005f3c4
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180029f05
xor eax, eax
jmp 0x180029f95
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x58]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.180064340
mov rcx, qword [rsp + 0x58]
call fcn.180063e3c
movsxd rax, dword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.180028d70
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 1
mov rcx, qword [rsp + 0x38]
call fcn.18005f3b4
cmp qword [rsp + 0x38], 0
jne 0x180029f6d
mov qword [rsp + 0x50], 0
jmp 0x180029f80
mov qword [rsp + 0x28], 0x8123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x30]
jmp 0x180029f95
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x78
ret
Function at 0x180034d90
Capabilities:
Packed with generic packer

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rcx, [0x1800a15b0]
jmp loc.180786ab4
Function at 0x18003d970
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x70
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [0x1800a1a70]
mov rbp, r8
mov rbx, rdx
jmp loc.18030be27

Function at 0x1800512b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [0x1800a2798]
jmp 0x1809271c4

Function at 0x1800514b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rcx, [0x1800a27c8]
jmp 0x1809274ce
Function at 0x18005b8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
lea rcx, [0x1800a3390]
jmp 0x18092b2bb

Function at 0x18005bf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
sub esi, dword [rdi + 0x9c]
mov ecx, dword [rdi + 0x44]
sub esi, edx
add ecx, 0xfffffefa
add ecx, ebx
cmp edx, ecx
jb 0x18005bfbc
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1800601d0
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
lea rdx, [rdx - 2]
cmp eax, ebx
jb 0x18005bf80
sub eax, ebx
jmp 0x18005bf82
xor eax, eax
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x18005bf70
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
lea rcx, [rcx - 2]
cmp eax, ebx
jb 0x18005bfb0
sub eax, ebx
jmp 0x18005bfb2
xor eax, eax
mov word [rcx], ax
add edx, 0xffffffff
jne 0x18005bfa0
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x18005c0a9
mov edx, dword [rdi + 0x9c]
mov r8d, esi
mov eax, dword [rdi + 0x94]
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.18005bc80
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x18005c024
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x18005c03a
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x18005bf20
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x18005c0a9
mov ebx, dword [rdi + 0x94]
add ebx, r9d
cmp ecx, ebx
jae 0x18005c07b
sub esi, ebx
mov ecx, ebx
mov eax, 0x102
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
mov r8d, esi
xor edx, edx
call fcn.180060a90
lea eax, [rsi + rbx]
mov dword [rdi + 0x1718], eax
jmp 0x18005c0a9
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x18005c0a9
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
mov r8d, ebx
xor edx, edx
call fcn.180060a90
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180081c8d
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2cb8]
syscall
ret

Function at 0x180081ca3
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c94]
syscall
ret

Function at 0x180081cb9
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c7c]
syscall
ret

Function at 0x180081ccf
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2ca0]
syscall
ret

Function at 0x180081ce5
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c74]
syscall
ret

Function at 0x180081cfb
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c34]
syscall
ret

Function at 0x180081d11
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601a6
mov r10, rcx
mov eax, dword [0x1800c2c14]
syscall
ret

Function at 0x180081d27
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c6c]
syscall
ret

Function at 0x180081d3d
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c0c]
syscall
ret

Function at 0x180081d53
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c60]
syscall
ret

Function at 0x180081d69
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c04]
syscall
ret

Function at 0x180081d95
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c4c]
syscall
ret

Function at 0x180081dab
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c38]
syscall
ret

Function at 0x180081dc1
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c20]
syscall
ret

Function at 0x180081ded
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2cac]
syscall
ret

Function at 0x180081e19
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2be8]
syscall
ret

Function at 0x180081e2f
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c88]
syscall
ret

Function at 0x180081e45
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c8c]
syscall
ret

Function at 0x180081e5b
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c68]
syscall
ret

Function at 0x180081e71
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2bf8]
syscall
ret

Function at 0x180081e87
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c90]
syscall
ret

Function at 0x180081e9d
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2c10]
syscall
ret
Function at 0x180081eb3
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601a6
mov r10, rcx
mov eax, dword [0x1800c2c9c]
syscall
ret

Function at 0x180081ec9
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601ac
mov r10, rcx
mov eax, dword [0x1800c2ca8]
syscall
ret

Function at 0x1800d86e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1800d870d
xor al, al
jmp 0x1800d886f
mov rax, qword [0x1800f96c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1800f96c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1800f96d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1800f96d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1800f96e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1800f96e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1800f96f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1800f96f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1800f9700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1800d8861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1800d87b9
mov r11d, 2
jmp 0x1800d87dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1800d87d3
mov r11d, 1
jmp 0x1800d87dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1800d8885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1800d8822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1800d883a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1800d884a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1800d8858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1800d87a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1800d886a
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005a40]
mov dword [rax], 1
mov rax, qword [0x140005a50]
mov dword [rax], 1
mov rax, qword [0x140005a60]
mov dword [rax], 1
mov rax, qword [0x1400059e0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016d0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea r8, str.WinSetup_single_instance
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
jne 0x140001732
mov r9d, 0x10
lea r8, [0x140005069]
lea rax, str.Only_one_instance_is_allowed_to_run_at_the_same_time.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0
jmp 0x140001737
mov eax, 1
add rsp, 0x30
pop rbp
ret