joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800019f0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180082098]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r14, r9
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.180039590
add rbx, 0xc0
cmp qword [rbx + 0x18], 8
jb 0x180001a5f
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x180001aa0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1800046a0
mov dword [rsp + 0x30], 1
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x180001acc
mov rax, qword [rdi]
mov r10, rsi
sub r10, rax
movzx edx, word [rax]
movzx ecx, word [rax + r10]
sub edx, ecx
jne 0x180001ae6
add rax, 2
test ecx, ecx
jne 0x180001ad2
test edx, edx
jne 0x180001b69
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbp
lea rdx, [0x18005c890]
lea rcx, [rsp + 0x48]
call fcn.1800071c0
lea rax, [rsp + 0x48]
cmp rdi, rax
je 0x180001b2b
mov rcx, rdi
call fcn.180004410
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdi + 0x10], xmm1
jmp 0x180001b69
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180001b69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001b64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001b8c
call fcn.18001b158
mov rax, rdi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.18001b2e0
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18003cd34
int3
Function at 0x180004a90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r8
mov rcx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180006190
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1800061b0
movsxd rcx, edi
mov eax, 2
inc rcx
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.18001b648
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x1800061e0
movsxd rdi, edi
mov ebp, 1
test rdi, rdi
js 0x180006256
mov qword [rsp + 0x40], r14
xor r14d, r14d
mov qword [rsp + 0x48], r15
mov ebx, r14d
mov r15d, 0x5c
cmp word [rsi + rbx*2], r15w
jne 0x18000623f
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call fcn.1800055f0
test al, al
jne 0x18000623a
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180006249
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x180006213
jmp 0x18000624c
mov ebp, r14d
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rcx, rsi
call fcn.18001b158
mov rbx, qword [rsp + 0x50]
mov eax, ebp
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x180006270
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x180082098]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r9d, r9d
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800062c0
test eax, eax
je 0x18000637a
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800062e0
mov eax, dword [0x18005c8cc]
lea rdx, [rsp + 0x20]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x180006300
xor r8d, r8d
nop
movzx ecx, word [rdi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x180006310
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180006330
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call fcn.1800055f0
test al, al
jne 0x180006355
lea rcx, [rsp + 0x20]
call fcn.180006190
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180006360
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800046a0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18001b2e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180006780
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
xor bl, bl
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movzx ecx, bl
mov edx, 1
test eax, eax
cmovne ecx, edx
movzx eax, cl
add rsp, 0x20
pop rbx
ret
Function at 0x180006e40
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180082098]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.180039590
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], bx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], bx
jne 0x180006ea5
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800046a0
nop
lea rcx, [rsp + 0x28]
call fcn.18000d740
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180006ff2
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180006fe8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180006f20
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.1800046a0
nop
lea rcx, [rsp + 0x48]
call fcn.18000d740
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
lea r8, [rsp + 0x48]
mov r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x60]
cmp r10, 8
cmovae r8, r9
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x38]
jne 0x18000705a
test rdx, rdx
je 0x180006fa8
sub r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x18000705a
add rax, 2
sub rdx, 1
jne 0x180006f90
mov ebx, 1
cmp r10, 8
jb 0x180006fe8
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x180006fe0
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800070a9
mov rcx, r9
call fcn.18001b158
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180007034
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000702f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800070af
call fcn.18001b158
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18001b2e0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
cmp r10, 8
jb 0x180007091
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x180007089
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800070a3
mov rcx, r9
call fcn.18001b158
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180006ef3
call fcn.18003cd34
int3
call fcn.18003cd34
nop
call fcn.18003cd34
int3
Function at 0x1800071c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x180082098]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov rdx, qword [rbp + 0x810]
movdqa xmm0, xmmword [0x18005caf0]
movdqu xmmword [rbp - 0x78], xmm0
xor r12d, r12d
mov word [rsp + 0x78], r12w
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x180007230
lea rcx, [rsp + 0x78]
call fcn.1800046a0
nop
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800072c3
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1800072d8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbx + 0x10], xmm1
jmp 0x1800073ff
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180007323
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
jmp 0x1800072bd
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x60]
call fcn.180039590
mov dword [rsp + 0x68], 0x400
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x60]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180007390
test edi, edi
je 0x1800072c3
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.1800046a0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1800073ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800073fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007423
call fcn.18001b158
mov rax, rbx
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.18001b2e0
add rsp, 0x8b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18003cd34
int3
Function at 0x180007430
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180007574
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180007569
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180007519
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x18000756e
mov rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x180007520
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800076e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor r10d, r10d
movsxd rbp, edx
mov r14, r9
mov r15, r8
mov rsi, rcx
mov edi, r10d
mov ebx, r10d
mov r11d, r10d
test edx, edx
jle 0x180007735
mov edx, r10d
lea r12, [0x18005f3d0]
movzx eax, byte [rdx + rsi]
cmp al, 0x3d
jne 0x180007756
inc ebx
cmp ebx, 2
jle 0x18000775a
mov r10d, 0xffffffee
mov rbx, qword [rsp + 0x20]
test r10d, r10d
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
sete al
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
cmp al, 0x7f
ja 0x18000772f
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x18000772f
cmp cl, 0x40
jae 0x180007770
test ebx, ebx
jne 0x18000772f
inc edi
inc r11d
inc rdx
cmp rdx, rbp
jl 0x180007720
test edi, edi
je 0x180007735
lea eax, [rdi + rdi*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x18000779e
mov dword [r9], eax
mov r10d, 0xfffffff0
jmp 0x180007735
mov r9d, 3
mov r8d, r10d
mov ebx, r10d
mov rax, r15
test r11d, r11d
jle 0x180007817
movzx ecx, byte [rsi]
movzx edx, byte [rcx + r12]
mov ecx, r10d
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc ebx
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp ebx, 4
jne 0x18000780c
mov ebx, r10d
test r9d, r9d
jle 0x1800077ef
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x180007800
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x18000780c
mov byte [rax], r8b
inc rax
dec r11d
inc rsi
test r11d, r11d
jg 0x1800077b2
sub eax, r15d
mov dword [r14], eax
jmp 0x180007735
Function at 0x180007830
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
mov rsi, r9
mov r14, r8
mov ebx, edx
mov r10, rcx
test edx, edx
je 0x1800079c5
lea ecx, [rdx*8]
mov eax, 0x2aaaaaab
imul ecx
lea ecx, [rbx*8]
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x18000787d
cmp ecx, 4
jne 0x180007880
add edx, 2
jmp 0x180007880
add edx, 3
inc edx
cmp dword [r9], edx
jge 0x180007898
mov dword [r9], edx
mov eax, 0xfffffff0
mov rbx, qword [rsp + 0x30]
pop r14
pop rsi
ret
xor r11d, r11d
mov qword [rsp + 0x18], rbp
mov eax, 0x55555556
mov qword [rsp + 0x28], r15
imul ebx
mov ebp, r11d
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov eax, edx
mov rcx, r14
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
test edx, edx
jle 0x180007956
dec edx
mov qword [rsp + 0x20], rdi
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov edi, edx
lea ebp, [rdx + rdx*2]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10]
movzx r9d, byte [r10 + 2]
mov eax, edx
movzx r8d, byte [r10 + 1]
and edx, 3
shr rax, 2
add r10, 3
shl edx, 4
movzx eax, byte [rax + r15]
mov byte [rcx], al
mov eax, r8d
shr eax, 4
and r8d, 0xf
add edx, eax
movzx eax, byte [rdx + r15]
mov byte [rcx + 1], al
mov eax, r9d
shr eax, 6
and r9d, 0x3f
lea eax, [rax + r8*4]
movzx eax, byte [rax + r15]
mov byte [rcx + 2], al
movzx eax, byte [r9 + r15]
mov byte [rcx + 3], al
add rcx, 4
sub rdi, 1
jne 0x1800078f0
mov rdi, qword [rsp + 0x20]
cmp ebp, ebx
jge 0x1800079b1
movzx edx, byte [r10]
inc ebp
cmp ebp, ebx
jge 0x180007969
movzx r11d, byte [r10 + 1]
mov rax, rdx
and edx, 3
shr rax, 2
shl edx, 4
movzx eax, byte [rax + r15]
mov byte [rcx], al
mov eax, r11d
shr eax, 4
add edx, eax
movzx eax, byte [rdx + r15]
mov byte [rcx + 1], al
cmp ebp, ebx
jge 0x1800079a3
and r11d, 0xf
shl r11d, 2
movzx eax, byte [r11 + r15]
mov byte [rcx + 2], al
jmp 0x1800079a7
mov byte [rcx + 2], 0x3d
add rcx, 3
mov byte [rcx], 0x3d
inc rcx
mov r15, qword [rsp + 0x28]
mov eax, ecx
mov rbp, qword [rsp + 0x18]
sub eax, r14d
mov dword [rsi], eax
mov byte [rcx], 0
mov rbx, qword [rsp + 0x30]
xor eax, eax
pop r14
pop rsi
ret

Function at 0x180007b50
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x89], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x180007b8f
mov rdx, qword [rdx]
call fcn.180008900
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x18000c7f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
mov eax, 0x2288
call fcn.18001b270
sub rsp, rax
mov rax, qword [0x180082098]
xor rax, rsp
mov qword [rsp + 0x2270], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.180039590
lea r8, [0x18005c890]
lea rdx, str.C:log_s.log
lea rcx, [rsp + 0x60]
call fcn.1800047e0
lea rcx, [rsp + 0x60]
call fcn.1800055f0
test al, al
je 0x18000c9a6
mov qword [rsp + 0x22b0], rbx
xor ecx, ecx
mov qword [rsp + 0x2280], rbp
call fcn.180040954
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.180041b78
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbx]
lea rdx, str.__d__d__d__d__d__d___d_:_s
mov r9d, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
inc r9d
mov qword [rsp + 0x48], rdi
add r8d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x270]
mov dword [rsp + 0x20], eax
call fcn.18000c2b0
mov rcx, rsi
xor edi, edi
call fcn.1800055f0
test al, al
lea rdx, [0x18005fae8]
mov ebp, 1
mov rcx, rsi
cmovne edi, ebp
call fcn.180040fd0
mov rbx, rax
test rax, rax
je 0x18000c996
test edi, edi
jne 0x18000c91d
mov eax, 0xfeff
lea r8d, [rbp + 1]
mov r9, rbx
mov word [rsp + 0x54], ax
mov edx, ebp
lea rcx, [rsp + 0x54]
call fcn.180041668
lea rcx, [rsp + 0x270]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000c930
add eax, eax
lea rcx, [rsp + 0x270]
movsxd r8, eax
mov r9, rbx
mov rdx, rbp
call fcn.180041668
mov eax, 0xd
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 0xb]
call fcn.180041668
mov eax, 0xa
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 8]
call fcn.180041668
mov rcx, rbx
call fcn.180041208
mov rbx, qword [rsp + 0x22b0]
mov rbp, qword [rsp + 0x2280]
mov rcx, qword [rsp + 0x2270]
xor rcx, rsp
call fcn.18001b2e0
add rsp, 0x2288
pop rdi
pop rsi
ret
Function at 0x18001ee80
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18001ee93
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18001f4a0
lea rdx, [0x1800801a0]
lea rcx, [rsp + 0x20]
call fcn.18003986c
int3

Function at 0x18002971c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180085e10]
xor edx, edx
jmp fcn.18001ee80

Function at 0x18002a0b4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180085e10]
jmp fcn.18001ee80

Function at 0x180035d2c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180035de8]
mov r9, qword [r9 + 8]
jmp fcn.1800270d4

Function at 0x180035dc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180035df8]
mov r9, qword [r9 + 8]
jmp fcn.1800270d4
Function at 0x140002cd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001a680]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002da3
cmp byte [rcx + 0x71], 0
je 0x140002da3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002d9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002d64
sub eax, 1
je 0x140002d68
cmp eax, 2
jne 0x140002d9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ea10
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002d96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002d9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002d4c
xor al, al
jmp 0x140002d4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ea10
add rsp, 0x60
pop rbx
ret