joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003d430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, [0x1800a19c0]
nop
nop
nop
nop
nop
nop
xor eax, eax
mov dword [rsp + 0x20], 0x790079
lea rdx, [rsp + 0x20]
mov word [rsp + 0x38], ax
mov dword [rsp + 0x24], 0x6e0061
mov dword [rsp + 0x28], 0x680063
mov dword [rsp + 0x2c], 0x72006f
mov dword [rsp + 0x30], 0x65002e
mov dword [rsp + 0x34], 0x650078
call fcn.18003db30
mov rdi, rax
test rax, rax
je 0x18003d4d3
lea r8, [rbx + 8]
mov dword [rbx], 2
mov rdx, rdi
mov dword [rbx + 4], 1
call fcn.18003d970
mov rdx, rdi
call fcn.18003d670
test eax, eax
je 0x18003d4ce
mov dword [rbx + 4], 2
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005ef70
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x18003d4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, [0x1800a19e8]
nop
nop
nop
nop
nop
nop
xor eax, eax
mov dword [rsp + 0x20], 0x77006b
lea rdx, [rsp + 0x20]
mov word [rsp + 0x38], ax
mov dword [rsp + 0x24], 0x690061
mov dword [rsp + 0x28], 0x69004c
mov dword [rsp + 0x2c], 0x650076
mov dword [rsp + 0x30], 0x65002e
mov dword [rsp + 0x34], 0x650078
call fcn.18003db30
mov rdi, rax
test rax, rax
je 0x18003d593
lea r8, [rbx + 8]
mov dword [rbx], 3
mov rdx, rdi
mov dword [rbx + 4], 1
call fcn.18003d970
mov rdx, rdi
call fcn.18003d670
test eax, eax
je 0x18003d58e
mov dword [rbx + 4], 2
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005ef70
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x18003d5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, [0x1800a1a18]
nop
nop
nop
nop
nop
nop
xor eax, eax
mov dword [rsp + 0x20], 0x590044
lea rdx, [rsp + 0x20]
mov word [rsp + 0x38], ax
mov dword [rsp + 0x24], 0x6f0054
mov dword [rsp + 0x28], 0x6c006f
mov dword [rsp + 0x2c], 0x780045
mov dword [rsp + 0x30], 0x65002e
mov dword [rsp + 0x34], 0x650078
call fcn.18003db30
mov rdi, rax
test rax, rax
je 0x18003d653
lea r8, [rbx + 8]
mov dword [rbx], 5
mov rdx, rdi
mov dword [rbx + 4], 1
call fcn.18003d970
mov rdx, rdi
call fcn.18003d670
test eax, eax
je 0x18003d64e
mov dword [rbx + 4], 2
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005ef70
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18003fc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [0x1800a1c60]
nop
nop
nop
nop
nop
nop
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call fcn.180028c70
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x18003fc85
xor eax, eax
jmp 0x18003fd95
mov byte [rsp + 0x70], 0x31
mov byte [rsp + 0x71], 0x32
mov byte [rsp + 0x72], 0x33
mov byte [rsp + 0x73], 0x34
mov byte [rsp + 0x74], 0x35
mov byte [rsp + 0x75], 0x36
mov byte [rsp + 0x76], 0x37
mov byte [rsp + 0x77], 0x38
mov byte [rsp + 0x78], 0x39
mov byte [rsp + 0x79], 0x41
mov byte [rsp + 0x7a], 0x42
mov byte [rsp + 0x7b], 0x43
mov byte [rsp + 0x7c], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov r8d, 0xc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18002f4d0
nop
mov eax, dword [rsp + 0x48]
sub eax, 4
mov r9d, eax
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.18002f6c0
mov r9, qword [rsp + 0xb8]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
call fcn.18003fdb0
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.18005f3b4
cmp qword [rsp + 0x28], 0
jne 0x18003fd5a
mov qword [rsp + 0x30], 0
jmp 0x18003fd6d
mov qword [rsp + 0x40], 0x8123
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x50]
call fcn.18002f5a0
mov eax, dword [rsp + 0x24]
jmp 0x18003fd95
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x90
pop rdi
ret
Function at 0x18004e360
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x208
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
lea rcx, [0x1800a2410]
nop
nop
nop
nop
nop
nop
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18004e3bd
jmp 0x18004e4f3
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x230]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18004e3eb
jmp 0x18004e4f3
mov rax, qword [rsp + 0x30]
add rax, 0x108
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0
jmp 0x18004e413
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x238]
call fcn.18004e5d0
cmp qword [rsp + 0x20], rax
jae 0x18004e4ed
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x238]
call fcn.18004e5c0
lea rcx, [rsp + 0x50]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x198
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
mov ecx, dword [rsp + 0x50]
sub rcx, qword [rsp + 0x228]
mov r8, qword [rsp + 0x40]
mov edx, eax
call fcn.180028470
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x230]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x50]
lea r9, [rsp + 0x1f0]
mov r8d, 0x40
mov edx, 0x41
mov ecx, eax
call qword [0x18008c308]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
je 0x18004e4e8
mov eax, dword [rsp + 0x50]
mov edi, eax
mov rsi, qword [rsp + 0x48]
mov ecx, 0x41
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x50]
lea r9, [rsp + 0x1f0]
mov r8d, dword [rsp + 0x1f0]
mov edx, 0x41
mov ecx, eax
call qword [0x18008c308]
jmp 0x18004e406
nop
nop
nop
nop
nop
nop
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x208
pop rdi
pop rsi
ret
Function at 0x1800512b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [0x1800a2798]
nop
nop
nop
nop
nop
nop
mov byte [rsp + 0x40], 0x4d
mov byte [rsp + 0x41], 0x44
mov byte [rsp + 0x42], 0x49
mov byte [rsp + 0x43], 0x43
mov byte [rsp + 0x44], 0x6c
mov byte [rsp + 0x45], 0x69
mov byte [rsp + 0x46], 0x65
mov byte [rsp + 0x47], 0x6e
mov byte [rsp + 0x48], 0x74
mov byte [rsp + 0x49], 0
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov edx, 5
mov rcx, qword [rsp + 0x188]
mov rax, qword [rsp + 0x180]
call qword [rax + VariantCopy]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180051355
xor eax, eax
jmp 0x180051490
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x180]
call qword [rax + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1800633f0
test eax, eax
je 0x18005138a
xor eax, eax
jmp 0x180051490
mov edx, 5
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x180]
call qword [rax + VariantCopy]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180051486
mov edx, 5
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x180]
call qword [rax + VariantCopy]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180051467
xor edx, edx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x180]
call qword [rax + 0x18]
mov dword [rsp + 0x20], eax
mov edx, 4
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x180]
call qword [rax + 0x18]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x20], 0x4cd6a8
je 0x180051441
cmp dword [rsp + 0x24], 0x4cd6a8
je 0x180051441
cmp dword [rsp + 0x20], 0x5e63c4
je 0x180051441
cmp dword [rsp + 0x24], 0x5e63c4
je 0x180051441
cmp dword [rsp + 0x20], 0x5376e0
je 0x180051441
cmp dword [rsp + 0x24], 0x5376e0
jne 0x180051448
mov eax, 1
jmp 0x180051490
mov edx, 2
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x180]
call qword [rax + VariantCopy]
mov qword [rsp + 0x28], rax
jmp 0x1800513ca
mov edx, 2
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x180]
call qword [rax + VariantCopy]
mov qword [rsp + 0x30], rax
jmp 0x1800513a4
xor eax, eax
jmp 0x180051490
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x170
pop rdi
ret
Function at 0x1800514b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rcx, [0x1800a27c8]
nop
nop
nop
nop
nop
nop
mov byte [rsp + 0x20], 0x49
mov byte [rsp + 0x21], 0x44
mov byte [rsp + 0x22], 0x41
mov byte [rsp + 0x23], 0
mov byte [rsp + 0x28], 0x51
mov byte [rsp + 0x29], 0x74
mov byte [rsp + 0x2a], 0x35
mov byte [rsp + 0x2b], 0x51
mov byte [rsp + 0x2c], 0x57
mov byte [rsp + 0x2d], 0x69
mov byte [rsp + 0x2e], 0x6e
mov byte [rsp + 0x2f], 0x64
mov byte [rsp + 0x30], 0x6f
mov byte [rsp + 0x31], 0x77
mov byte [rsp + 0x32], 0x49
mov byte [rsp + 0x33], 0x63
mov byte [rsp + 0x34], 0x6f
mov byte [rsp + 0x35], 0x6e
mov byte [rsp + 0x36], 0
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x150], 0
lea rax, [rsp + 0x151]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x288]
mov rax, qword [rsp + 0x280]
call qword [rax + 0x10]
mov r8d, 0x104
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x288]
mov rax, qword [rsp + 0x280]
call qword [rax + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1800633f0
test eax, eax
je 0x1800515c8
xor eax, eax
jmp 0x1800515f5
mov r8d, 3
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x150]
call fcn.180079b3c
test eax, eax
je 0x1800515e8
xor eax, eax
jmp 0x1800515f5
mov eax, 1
jmp 0x1800515f5
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x270
pop rdi
ret
Function at 0x180051610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rcx, [0x1800a27f0]
nop
nop
nop
nop
nop
nop
mov byte [rsp + 0x58], 0x51
mov byte [rsp + 0x59], 0x74
mov byte [rsp + 0x5a], 0x35
mov byte [rsp + 0x5b], 0x51
mov byte [rsp + 0x5c], 0x57
mov byte [rsp + 0x5d], 0x69
mov byte [rsp + 0x5e], 0x6e
mov byte [rsp + 0x5f], 0x64
mov byte [rsp + 0x60], 0x6f
mov byte [rsp + 0x61], 0x77
mov byte [rsp + 0x62], 0x49
mov byte [rsp + 0x63], 0x63
mov byte [rsp + 0x64], 0x6f
mov byte [rsp + 0x65], 0x6e
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x48], 0x4d
mov byte [rsp + 0x49], 0x48
mov byte [rsp + 0x4a], 0x54
mov byte [rsp + 0x4b], 0x61
mov byte [rsp + 0x4c], 0x62
mov byte [rsp + 0x4d], 0x57
mov byte [rsp + 0x4e], 0x69
mov byte [rsp + 0x4f], 0x64
mov byte [rsp + 0x50], 0x67
mov byte [rsp + 0x51], 0x65
mov byte [rsp + 0x52], 0x74
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x71]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x180], 0
lea rax, [rsp + 0x181]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x2b0]
call qword [rax + 0x10]
mov r8d, 0x104
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x2b0]
call qword [rax + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.1800633f0
test eax, eax
je 0x180051753
xor eax, eax
jmp 0x18005187d
mov edx, 5
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x2b0]
call qword [rax + VariantCopy]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18005177f
xor eax, eax
jmp 0x18005187d
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x104
jae 0x18005179a
jmp 0x18005179f
call fcn.18005f860
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x70], 0
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x104
jae 0x1800517c4
jmp 0x1800517c9
call fcn.18005f860
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x180], 0
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x2b0]
call qword [rax + 0x10]
mov r8d, 0x104
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x2b0]
call qword [rax + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.1800633f0
test eax, eax
je 0x180051826
xor eax, eax
jmp 0x18005187d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0xffffffffffffffff
inc qword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
cmp byte [rax + rcx], 0
jne 0x180051839
mov rax, qword [rsp + 0x20]
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x180]
call fcn.180079b3c
test eax, eax
je 0x180051870
xor eax, eax
jmp 0x18005187d
mov eax, 1
jmp 0x18005187d
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x2a0
pop rdi
ret
Function at 0x180052370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
lea rcx, [0x1800a2968]
nop
nop
nop
nop
nop
nop
mov byte [rsp + 0x48], 0x5c
mov byte [rsp + 0x49], 0x5c
mov byte [rsp + 0x4a], 0x2e
mov byte [rsp + 0x4b], 0x5c
mov byte [rsp + 0x4c], 0x70
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0x73
mov byte [rsp + 0x4f], 0x6e
mov byte [rsp + 0x50], 0x74
mov byte [rsp + 0x51], 0
lea r8, [rsp + 0x48]
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call fcn.180068d1c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rsp + 0x60]
call qword [0x18008c3d0]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x180052422
jmp 0x180052447
xor edx, edx
mov ecx, 0xfeedfb01
call fcn.180050fe0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xfeedfb01
call qword [0x18008c0e8]
nop
nop
nop
nop
nop
nop
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0xf8
ret
Function at 0x180055100
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1098
call fcn.180080180
sub rsp, rax
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0x1080], rax
lea rcx, [0x1800a2d80]
nop
nop
nop
nop
nop
nop
mov byte [rsp + 0x80], 0
lea rax, [rsp + 0x81]
mov rdi, rax
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
cmp qword [rsp + 0x10b8], 0
jne 0x180055170
xor al, al
jmp 0x180055347
mov rcx, qword [rsp + 0x10c8]
call fcn.18000fc70
test rax, rax
jne 0x1800552b6
mov qword [rsp + 0x50], 0
lea r8, [0x18009f2b8]
mov rdx, qword [rsp + 0x10b8]
lea rcx, [rsp + 0x50]
call fcn.180063d60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1800551bb
cmp qword [rsp + 0x50], 0
jne 0x1800551c2
xor al, al
jmp 0x180055347
mov r9, qword [rsp + 0x50]
mov r8d, 1
mov edx, 0x1000
lea rcx, [rsp + 0x80]
call fcn.180064340
mov rcx, qword [rsp + 0x50]
call fcn.180063e3c
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18005520c
xor al, al
jmp 0x180055347
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
lea rax, [rsp + rax + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x180055236
xor al, al
jmp 0x180055347
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 4]
cmp eax, 0x8664
jne 0x180055261
mov rax, qword [rsp + 0x28]
add rax, 0x108
mov qword [rsp + 0x30], rax
jmp 0x180055271
mov rax, qword [rsp + 0x28]
add rax, 0xf8
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x180055293
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x1800552b6
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x10c8]
call fcn.1800578d0
jmp 0x18005527b
mov qword [rsp + 0x38], 0
jmp 0x1800552ce
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x10c8]
call fcn.18000fc70
cmp qword [rsp + 0x38], rax
jae 0x180055327
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x10c8]
call fcn.18000fc60
lea rcx, [rsp + 0x58]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x10c0]
cmp dword [rsp + 0x7c], eax
jne 0x180055325
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x10d0]
call fcn.1800578d0
jmp 0x1800552c1
mov rcx, qword [rsp + 0x10d0]
call fcn.18000fc70
test rax, rax
je 0x18005533d
mov al, 1
jmp 0x180055347
xor al, al
jmp 0x180055347
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0x1098
pop rdi
pop rsi
ret
Function at 0x18005bf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
sub esi, dword [rdi + 0x9c]
mov ecx, dword [rdi + 0x44]
sub esi, edx
add ecx, 0xfffffefa
add ecx, ebx
cmp edx, ecx
jb 0x18005bfbc
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1800601d0
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
lea rdx, [rdx - 2]
cmp eax, ebx
jb 0x18005bf80
sub eax, ebx
jmp 0x18005bf82
xor eax, eax
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x18005bf70
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
lea rcx, [rcx - 2]
cmp eax, ebx
jb 0x18005bfb0
sub eax, ebx
jmp 0x18005bfb2
xor eax, eax
mov word [rcx], ax
add edx, 0xffffffff
jne 0x18005bfa0
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x18005c0a9
mov edx, dword [rdi + 0x9c]
mov r8d, esi
mov eax, dword [rdi + 0x94]
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.18005bc80
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x18005c024
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x18005c03a
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x18005bf20
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x18005c0a9
mov ebx, dword [rdi + 0x94]
add ebx, r9d
cmp ecx, ebx
jae 0x18005c07b
sub esi, ebx
mov ecx, ebx
mov eax, 0x102
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
mov r8d, esi
xor edx, edx
call fcn.180060a90
lea eax, [rsi + rbx]
mov dword [rdi + 0x1718], eax
jmp 0x18005c0a9
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x18005c0a9
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
mov r8d, ebx
xor edx, edx
call fcn.180060a90
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d86e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1800d870d
xor al, al
jmp 0x1800d886f
mov rax, qword [0x1800f96c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1800f96c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1800f96d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1800f96d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1800f96e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1800f96e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1800f96f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1800f96f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1800f9700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1800d8861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1800d87b9
mov r11d, 2
jmp 0x1800d87dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1800d87d3
mov r11d, 1
jmp 0x1800d87dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1800d8885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1800d8822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1800d883a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1800d884a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1800d8858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1800d87a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1800d886a

Function at 0x1802806c2
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601a6
mov r10, rcx
setns al
mov eax, dword [0x1800c2c14]
jmp 0x1803f2d00
syscall
ret

Function at 0x18033d6ed
Capabilities:
Execute syscall

Disassembly:
call fcn.1800601a6
mov r10, rcx
movsx eax, cx
mov eax, dword [0x1800c2c9c]
jmp 0x1807f9f5e
syscall
ret