joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7578
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400c75a8
xor eax, eax
jmp 0x1400c766b
mov rbp, rbx
cmp word [rax], si
je 0x1400c75cd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400c75b4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400c75b0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400c5e38
movsxd r14, eax
test eax, eax
jne 0x1400c760b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400c75a1
mov rcx, r14
call fcn.1400c1c9c
mov rdi, rax
test rax, rax
jne 0x1400c7624
xor ecx, ecx
call fcn.1400bec44
jmp 0x1400c7600
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400c5e38
test eax, eax
jne 0x1400c7655
mov rcx, rdi
call fcn.1400bec44
jmp 0x1400c765f
xor ecx, ecx
call fcn.1400bec44
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400ca748
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400beff8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400ca7e9
cmp ebx, dword [rsp + 0x30]
je 0x1400ca7e2
test esi, esi
je 0x1400ca7e2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400ca7bd
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400ca7ca
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400ca7a7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400ca7ce
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400ca7eb
mov eax, 1
jmp 0x1400ca7eb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cdf74
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400ac1ec
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400cdffe
cmp byte [rbp - 0x21], r15b
je 0x1400cdff9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400ce034
call fcn.1400c1228
test eax, eax
jne 0x1400ce020
cmp byte [rbp - 0x21], r15b
je 0x1400ce018
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400ce034
cmp byte [rbp - 0x21], r15b
je 0x1400ce031
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400bbb08
test eax, eax
jne 0x1400ce0d4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400ac1ec
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400ce073
cmp byte [rbp - 0x21], r15b
je 0x1400ce0a8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400ce0a8
call fcn.1400c1228
test eax, eax
jne 0x1400ce094
cmp byte [rbp - 0x21], r15b
je 0x1400ce08d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400ce0a8
cmp byte [rbp - 0x21], r15b
je 0x1400ce0a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400bbb08
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400ce0d4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400ce0d7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400ce0e5
mov rcx, rdi
call fcn.1400bec44
cmp byte [rbp + 0x3f], r15b
je 0x1400ce0f4
mov rcx, qword [rbp + 0x27]
call fcn.1400bec44
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400cee20
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400c3bb0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400c3bb0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400cef70
cmp rax, 0xffffffffffffffff
je 0x1400cef70
xor edi, edi
test rbp, rbp
jle 0x1400cef1b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400c0e90
mov rbx, rax
test rax, rax
jne 0x1400ceea8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400cef11
mov edx, 0x8000
mov ecx, r14d
call fcn.1400bd1d4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400c0378
cmp eax, 0xffffffff
je 0x1400ceef1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400ceeb8
mov edx, r15d
mov ecx, r14d
call fcn.1400bd1d4
jmp 0x1400cef11
cmp byte [rsi + 0x38], dil
je 0x1400cef08
cmp dword [rsi + 0x34], 5
jne 0x1400cef08
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400cef11
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400bec44
jmp 0x1400cef84
jns 0x1400cef84
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400c3bb0
cmp rax, 0xffffffffffffffff
jne 0x1400cef3c
cmp byte [rsi + 0x30], dil
je 0x1400cef84
mov edi, dword [rsi + 0x2c]
jmp 0x1400cef84
mov ecx, r14d
call fcn.1400c81f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400cef84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400cef84
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400cef7d
mov eax, dword [rsi + 0x2c]
jmp 0x1400cef82
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400c3bb0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400cfde0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400cfe08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400cfe08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1a9f4
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r12, r8
mov edi, edx
mov rbx, rcx
mov r15d, 0x1a7e
mov r8d, 0x656e6f4e
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r14d, r14d
mov rsi, rax
cmp rax, r14
jne 0x1aa51
mov eax, 0xc000009a
jmp 0x1abed
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.000171a0
cmp dword [0x00018374], 0x10
jae 0x1abe8
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8d, 0x34
call fcn.00016e50
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.000235fc
cmp eax, r14d
jl 0x1abed
mov edx, dword [0x00018374]
mov eax, dword [rbx + 4]
lea r8, [0x00010000]
mov dword [r8 + rdx*4 + 0x8280], eax
mov eax, dword [rbx + 8]
lea r13, [rdi - 0x34]
mov dword [r8 + rdx*4 + 0x82c0], eax
shr r13, 1
mov ebp, 1
add edx, ebp
lea eax, [r13 - 1]
mov dword [0x00018374], edx
cmp r14w, word [rbx + rax*2 + 0x34]
jne 0x1abe8
lea eax, [r13 - 2]
cmp r14w, word [rbx + rax*2 + 0x34]
jne 0x1abe8
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [r12 + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r11, [r12 + 0x30]
mov rax, qword [r11]
cmp rax, r11
je 0x1ab1e
mov ecx, dword [rbx + 4]
cmp ecx, dword [rax - 8]
je 0x1ab1b
mov rax, qword [rax]
cmp rax, r11
jne 0x1ab0c
jmp 0x1ab1e
mov bpl, r14b
lea rcx, [r12 + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
cmp bpl, r14b
je 0x1abe8
mov rcx, qword [r12]
lea rax, [rsp + 0x40]
mov r9d, 0x2a
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x1ad0
mov byte [rsp + 0x28], r14b
add r13d, r13d
mov dword [rsp + 0x20], 0x180
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r14d
mov edi, eax
jl 0x1abed
mov rax, qword [rsp + 0x40]
mov r8d, 0x62735556
mov rdx, r13
mov rbp, qword [rax + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp + 0x28], rax
cmp rax, r14
jne 0x1aba8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x1aa47
lea rdx, [rbx + 0x34]
mov r8, r13
mov rcx, rax
call fcn.00016e50
mov r11d, dword [rbx + 4]
mov rdx, r12
mov dword [rbp + 0x30], r11d
mov rcx, qword [rsp + 0x40]
call fcn.0001a940
lea rcx, [rbp + 0x50]
mov r8, r15
mov rdx, rsi
call fcn.00016e50
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
mov eax, edi
jmp 0x1abed
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.00016de0
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x26868
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9b, byte [rcx + 1]
mov dil, byte [rcx + 2]
mov r11b, byte [rcx]
shr dil, 7
mov al, r9b
mov rbx, rcx
shr al, 5
not dil
and al, 1
and dil, 1
mov byte [rcx + 0xa], al
jne 0x268ad
not r11b
and dword [rsp + 0x50], 0
mov esi, 0x1f
mov r10b, byte [rsp + 0x50]
lea edx, [rsi - 0x1b]
and r9b, sil
mov al, r10b
mov cl, r9b
shl al, 2
add cl, cl
not cl
and cl, 2
mov r10b, cl
or r10b, al
mov al, r9b
shr r9b, 1
and al, 1
or r10b, al
sub rdx, 1
jne 0x268c2
mov bpl, r10b
xor r12d, r12d
mov byte [rsp + 0x50], r10b
not bpl
or r13d, 0xffffffff
lea r14d, [rdx + 0x18]
mov byte [rsp + 0x52], bpl
mov r15d, 0xfe
lea rax, [r14 - 0x10]
mov r8d, r13d
dec r13d
sar rax, 2
and r8d, 7
and rax, r15
mov cl, r8b
mov dl, byte [rax + rbx + 2]
mov rax, r14
inc r14
shr dl, cl
mov ecx, r12d
sar rax, 2
and dl, 1
and rax, r15
xor dl, r9b
shl dl, cl
mov cl, r8b
xor r10b, dl
mov dl, byte [rax + rbx + 2]
shr dl, cl
mov ecx, r12d
inc r12d
and dl, 1
xor dl, r9b
shl dl, cl
xor bpl, dl
cmp r13d, 0xfffffff7
jg 0x2690a
and dword [rbx + 0xb], 0
movzx r12d, r11b
xor r13d, r13d
mov r14d, r12d
mov byte [rsp + 0x51], r10b
mov byte [rsp + 0x53], bpl
shl r14d, 3
mov r15, rsi
mov dword [rbx + 0xf], r14d
mov ebp, 0xc
mov rdx, rbx
mov ecx, esi
call fcn.000267ac
sub rbp, 1
mov r11d, eax
jne 0x2698b
mov eax, dword [rsp + 0x50]
mov rcx, r15
dec r15
sar rcx, 2
and ecx, 0xfe
movzx edx, byte [rcx + rbx + 2]
mov ecx, 0xff
sub cl, sil
and ecx, 7
shr edx, cl
mov ecx, esi
shr eax, cl
xor edx, eax
movzx eax, r11b
xor edx, esi
and edx, 1
xor edx, eax
lea eax, [r13 + r13]
mov r13d, edx
or r13d, eax
sub esi, 1
jns 0x26982
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
lea ecx, [r12 + r12]
mov dword [rbx + 0xb], r13d
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
mov dword [rbx + 0xf], ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x28008
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.00013a88
mov dword [0x00018390], eax
test eax, eax
je 0x28051
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8d, dword [0x00018390]
add r8, rax
cmp byte [r8 + 0xd], 0
jne 0x28045
mov byte [r8 + 0xd], 0x20
jmp 0x28051
cmp byte [r8 + 0xc], 0
jne 0x28051
mov byte [r8 + 0xc], 0x20
call fcn.00013a88
movzx r11d, word [rbx]
mov ecx, 1
add r11w, 2
mov r8d, 0x62735556
mov word [0x00018382], r11w
movzx eax, word [rbx]
movzx edx, r11w
mov word [reloc.ntoskrnl.exe_ExAllocatePoolWithTag], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x00018388], rax
test rax, rax
jne 0x2809c
mov eax, 0xc000009a
jmp 0x2811e
lea rcx, [reloc.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea r11, [0x0001a008]
lea rax, [0x0001a364]
mov qword [rdi + 0x148], rax
lea rax, [0x00013c4c]
lea rcx, [0x0001a1fc]
mov qword [rdi + 0x120], rax
lea rax, [0x0001a0a4]
mov qword [rdi + 0x80], r11
mov qword [rdi + 0xe0], rax
lea rax, [0x000225ec]
mov qword [rdi + 0x70], r11
mov qword [rdi + 0xe8], rax
lea rax, [0x0001a1cc]
mov qword [rdi + 0x68], rax
mov rax, qword [rdi + 0x30]
mov qword [rax + 8], rcx
lea rcx, [0x000281b0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00028130
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x28008

Function at 0x2818c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.00013a88
mov dword [0x00018390], eax
test eax, eax
je 0x28051
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8d, dword [0x00018390]
add r8, rax
cmp byte [r8 + 0xd], 0
jne 0x28045
mov byte [r8 + 0xd], 0x20
jmp 0x28051
cmp byte [r8 + 0xc], 0
jne 0x28051
mov byte [r8 + 0xc], 0x20
call fcn.00013a88
movzx r11d, word [rbx]
mov ecx, 1
add r11w, 2
mov r8d, 0x62735556
mov word [0x00018382], r11w
movzx eax, word [rbx]
movzx edx, r11w
mov word [reloc.ntoskrnl.exe_ExAllocatePoolWithTag], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x00018388], rax
test rax, rax
jne 0x2809c
mov eax, 0xc000009a
jmp 0x2811e
lea rcx, [reloc.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea r11, [0x0001a008]
lea rax, [0x0001a364]
mov qword [rdi + 0x148], rax
lea rax, [0x00013c4c]
lea rcx, [0x0001a1fc]
mov qword [rdi + 0x120], rax
lea rax, [0x0001a0a4]
mov qword [rdi + 0x80], r11
mov qword [rdi + 0xe0], rax
lea rax, [0x000225ec]
mov qword [rdi + 0x70], r11
mov qword [rdi + 0xe8], rax
lea rax, [0x0001a1cc]
mov qword [rdi + 0x68], rax
mov rax, qword [rdi + 0x30]
mov qword [rax + 8], rcx
lea rcx, [0x000281b0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00028130
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x28008
Function at 0x140005595
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rax, rax
sub rcx, 0xd55f
add rax, rcx
add rax, 0xd55f
add rcx, 0xd55f
sub rsp, 0x3f0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
and rcx, 0
add rcx, rsi
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x5aa1
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x441e
lea r9, [0x140001374]
add byte [rax - 0x7d], cl
invalid
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140005652
je 0x140005669
insb byte [rdi], dx
cld
add byte [rax], al
je 0x140005673
jne 0x14000563d
lea rax, [0x140004b66]
add rax, 0xb32
call rax
je 0x14000560e
push rsp
ror byte [rax - 0x39], cl
shl dword [rsi], 0x3e
add byte [rax], al
mov rcx, 0x3e26
mov r9d, 0x8d68
mov r10d, 0x92819200
lea eax, [rax]
add byte [rcx - 0x46], al
add byte [rdx - 0xb76d7f], dl
leave
dec rcx
xor byte [rax + rcx], r9b
add r9d, r10d
rol r9d, 1
test rcx, rcx
jne 0x14000567c
add rax, 0x1ebd
mov rsp, rbp
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x18001d460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x18001d4b6
mov rax, qword [rcx]
test rax, rax
je 0x18001d4b6
mov r9, qword [rax + 0x10]
or r8d, 0xffffffff
or rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x18001d479
test eax, eax
je 0x18001d4af
mov r10d, eax
movsx ecx, byte [r9]
mov eax, r8d
xor rcx, rax
shr r8d, 8
movzx edx, cl
lea rax, [0x18007d740]
inc r9
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18001d48a
not r8d
mov eax, r8d
ret
xor eax, eax
ret

Function at 0x180025a5c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
sub rsp, 0x118
mov rax, qword [0x180093020]
xor rax, rsp
mov qword [rsp + 0x100], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x64
lea rax, [rsp + 0x30]
mov r8, rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
jmp 0x180025ad6
mov rcx, qword [rax + 0x60]
lea r8, [rsp + 0x30]
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x180025acf
add rcx, 2
test r9d, r9d
jne 0x180025ab9
test edx, edx
je 0x180025af7
mov rax, qword [rax]
cmp qword [rax + 0x30], 0
jne 0x180025aad
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800774c0
add rsp, 0x118
ret
mov rax, qword [rax + 0x30]
jmp 0x180025adf

Function at 0x180025b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180093020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x64616f4c
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], 0x7262694c
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x41797261
mov byte [rbp - 0x24], 0
mov dword [rbp - 0x20], 0x4e52454b
mov dword [rbp - 0x1c], 0x41424c45
mov dword [rbp - 0x18], 0x642e4553
mov word [rbp - 0x14], 0x6c6c
mov byte [rbp - 0x12], 0
call fcn.180025b80
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800774c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180025bc4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800a6738]
xor ebp, ebp
test rax, rax
je 0x180025c3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180025c3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180025c3a
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
movzx esi, word [rcx + 6]
add rbx, rax
movzx edi, bp
cmp bp, si
jae 0x180025c35
lea rdx, str..text
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x180025c35
add rbx, 0x28
inc di
cmp di, si
jb 0x180025c16
mov rax, rbx
jmp 0x180025c3c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180025c54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x180093020]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x180025dcf
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
mov r11d, dword [rax + rcx + 0x8c]
lea r8, [rcx + r9]
test r11d, r11d
je 0x180025dcf
lea r13d, [r12 + 1]
cmp rdx, 0xffff
ja 0x180025d7e
mov ecx, dword [r8 + 0x1c]
movzx eax, bp
sub ax, word [r8 + 0x10]
add rcx, rbx
add ax, r13w
movzx edx, ax
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x180025d7e
lea eax, [r9 + r11]
cmp edi, eax
jae 0x180025d7e
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x180025d0a
test r8, r8
je 0x180025dcf
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x2e
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_strchr]
lea rdi, [rax + r13]
mov byte [rax], r12b
cmp byte [rdi], 0x23
jne 0x180025d4f
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movzx edi, ax
lea rcx, [rsp + 0x20]
call fcn.180025b00
mov rsi, rax
cmp rax, rbx
jne 0x180025d71
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180025dcf
mov rdx, rdi
mov rcx, rsi
call fcn.180025c54
jmp 0x180025dd1
mov ecx, dword [r8 + 0x18]
mov edi, r12d
mov r15d, dword [r8 + 0x20]
sub ecx, r13d
lea r10d, [rdi + rcx]
mov rsi, rbp
shr r10d, 1
lea rax, [r15 + r10*4]
mov edx, dword [rax + rbx]
add rdx, rbx
sub rsi, rdx
mov al, byte [rdx]
cmp al, byte [rdx + rsi]
jne 0x180025db6
add rdx, r13
test al, al
jne 0x180025da3
mov eax, r12d
jmp 0x180025dbb
sbb eax, eax
or eax, r13d
test eax, eax
jns 0x180025dc5
lea edi, [r10 + 1]
jmp 0x180025dcb
jle 0x180025dfc
lea ecx, [r10 - 1]
cmp edi, ecx
jbe 0x180025d8c
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800774c0
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r8 + 0x24]
add rcx, rbx
cmp word [rcx + r10*2], r12w
je 0x180025dcf
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rbx
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x180025e4e
lea eax, [r9 + r11]
cmp edi, eax
jae 0x180025e4e
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x180025e40
jmp 0x180025d13
lea rax, [rbx + rdi]
jmp 0x180025dd1