joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180062be8
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18010ad70], 0
je 0x18005f3b8
xor al, al
ret
mov rcx, qword [rcx]
jmp 0x180062be8
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x40
mov edi, r9d
mov r13, r8
mov r14, rcx
lea r12, [rcx + 0x10]
mov qword [rbp - 0x20], r12
mov rcx, r12
call fcn.180007dac
mov byte [rbp - 0x18], 1
mov rdx, qword [rbp + 0x38]
mov rcx, r14
call fcn.1800652ac
mov rsi, rax
xor ebx, ebx
test rax, rax
jne 0x180062c42
cmp byte [rbp + 0x50], bl
je 0x180062dfc
mov edx, edi
mov rcx, r13
call fcn.18006526c
cmp edi, 0x18
jb 0x180062d82
cmp eax, 0x1000
jne 0x180062d82
test rsi, rsi
jne 0x180062dfa
lea rdx, [0x1800db740]
mov ecx, 0x348
call fcn.18009d8bc
mov qword [rbp + 0x30], rax
test rax, rax
je 0x180062c94
mov rdx, qword [rbp + 0x38]
mov rcx, rax
call fcn.18005fd84
mov rsi, rax
jmp 0x180062c97
mov rsi, rbx
test rsi, rsi
je 0x180062dfc
mov rdx, qword [rbp + 0x58]
test rdx, rdx
je 0x180062dfc
mov rcx, rsi
call fcn.180063b74
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x10]
mov rcx, r14
call fcn.18005f994
mov rcx, qword [rax]
mov qword [rcx + 0x28], rsi
cmp byte [0x18010a364], bl
je 0x180062d6f
lea rcx, [rbp + 0x30]
call fcn.180061de4
mov r9, rax
movabs r14, 0xd993efbb19cfe32d
cmp byte [rax + 0x3c], bl
je 0x180062d16
mov r8, rbx
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r14
shr rax, cl
xor byte [r8 + r9], al
inc r8
cmp r8, 0x3c
jb 0x180062cf6
mov byte [r9 + 0x3c], bl
mov r8, qword [rbp + 0x38]
mov rdx, r9
mov ecx, 4
call fcn.18006a848
cmp byte [0x18010a364], bl
je 0x180062d6f
lea rcx, [rbp + 0x30]
call fcn.1800613f4
cmp byte [rax + 0x2c], bl
je 0x180062d5f
mov r9, rbx
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x2c
jb 0x180062d40
mov byte [rax + 0x2c], bl
mov r8d, edi
mov rdx, rax
mov ecx, 4
call fcn.18006a848
cmp edi, 0x18
jbe 0x180062dfa
lea r8d, [rdi - 0x18]
lea rdx, [r13 + 0x18]
jmp 0x180062dee
mov rdx, qword [rbp + 0x38]
mov rcx, r14
call fcn.180062b70
test al, al
je 0x180062dfc
cmp byte [0x18010a364], bl
je 0x180062de8
lea rcx, [rbp + 0x30]
call fcn.180060cec
mov r9, rax
cmp byte [rax + 0x26], bl
je 0x180062dd8
mov r8, rbx
movabs r14, 0xd993efbb19cfe32d
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r14
shr rax, cl
xor byte [r8 + r9], al
inc r8
cmp r8, 0x26
jb 0x180062db8
mov byte [r9 + 0x26], bl
mov r8d, edi
mov rdx, r9
mov ecx, 4
call fcn.18006a848
mov r8d, edi
mov rdx, r13
mov r9b, byte [rbp + 0x50]
mov rcx, rsi
call fcn.180063014
mov bl, 1
mov rcx, r12
call fcn.180007dc4
nop
mov al, bl
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180062e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebx, 9
mov r14, r9
mov edi, r8d
mov rsi, rdx
cmp r8d, ebx
jae 0x180062e4f
xor al, al
jmp 0x180062ed9
jge 0x180062e55
xor edx, edx
jmp 0x180062e61
mov ecx, dword [rdx]
call sub.WS2_32.dll_ntohl
mov edx, eax
shr edx, 8
lea ecx, [rdx + 9]
cmp edi, ecx
jb 0x180062e87
test byte [rsi + 4], 8
je 0x180062e7b
movzx eax, byte [rsi + 9]
mov ebx, 0xa
sub edx, eax
dec edx
mov rax, qword [rsp + 0x50]
mov dword [rax], ebx
mov dword [r14], edx
jmp 0x180062ed7
cmp byte [0x18010a364], 0
je 0x180062ed7
lea rcx, [rsp + 0x40]
call fcn.180060c00
cmp byte [rax + 0x3a], 0
je 0x180062eca
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3a
jb 0x180062ea3
mov byte [rax + 0x3a], 0
mov rdx, rax
mov ecx, 2
call fcn.18006a848
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180062ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, r9
mov edi, r8d
mov r14, rdx
cmp r8d, 9
jae 0x180062f22
xor al, al
jmp 0x180062ff6
jge 0x180062f28
xor ebx, ebx
jmp 0x180062f34
mov ecx, dword [rdx]
call sub.WS2_32.dll_ntohl
mov ebx, eax
shr ebx, 8
mov al, byte [r14 + 4]
xor esi, esi
xor ebp, ebp
xor r15d, r15d
xor r12d, r12d
test al, 8
je 0x180062f53
cmp edi, 9
jbe 0x180062f53
movzx r12d, byte [r14 + 9]
lea esi, [rbp + 1]
test al, 0x20
je 0x180062f7e
lea eax, [rsi + 0xe]
cmp edi, eax
jb 0x180062f7e
mov ebp, 4
lea eax, [rsi + 0xd]
lea r15d, [rbp - 3]
cmp edi, eax
jbe 0x180062f7e
lea eax, [rsi + 9]
mov ecx, dword [rax + r14]
btr ecx, 0x1f
call sub.WS2_32.dll_ntohl
lea eax, [rbx + 9]
cmp edi, eax
jb 0x180062fa4
mov rax, qword [rsp + 0x70]
lea ecx, [rbp + 9]
sub ebx, r12d
add ecx, r15d
sub ebx, r15d
add ecx, esi
sub ebx, ebp
sub ebx, esi
mov dword [rax], ecx
mov dword [r13], ebx
jmp 0x180062ff4
cmp byte [0x18010a364], 0
je 0x180062ff4
lea rcx, [rsp + 0x60]
call fcn.1800616b8
cmp byte [rax + 0x3c], 0
je 0x180062fe7
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3c
jb 0x180062fc0
mov byte [rax + 0x3c], 0
mov rdx, rax
mov ecx, 2
call fcn.18006a848
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800638d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov r15d, edx
mov r13, rcx
lea r12, [rcx + 0x2f0]
mov qword [rbp - 0x39], r12
mov rcx, r12
call fcn.180007dac
mov r14d, 1
mov byte [rbp - 0x31], r14b
mov r8, qword [r13 + 0x88]
mov rax, qword [r8 + 8]
mov rbx, r8
xor ecx, ecx
jmp 0x18006393a
cmp dword [rax + 0x20], r15d
jae 0x180063934
mov rax, qword [rax + 0x10]
jmp 0x18006393a
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], cl
je 0x180063928
cmp byte [rbx + 0x19], cl
jne 0x180063afb
cmp r15d, dword [rbx + 0x20]
jb 0x180063afb
cmp rbx, r8
je 0x180063afb
mov rdi, qword [rbx + 0x28]
mov rsi, rbx
test rdi, rdi
je 0x180063aea
mov rsi, qword [r13 + 0x98]
mov r8d, 0x1bb
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x29]
call fcn.1800045e0
lea rdx, [rsi + 0x20]
movzx r8d, word [rsi + 0x3a]
lea rcx, [rbp - 9]
call fcn.1800045e0
mov r9d, dword [rsi + 0x3c]
xor eax, eax
lea r8, [rbp - 0x29]
lea rdx, [rbp - 9]
test r9d, r9d
je 0x1800639dc
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov eax, dword [rsi + 0x40]
mov dword [rsp + 0x20], eax
mov ecx, 4
call fcn.180092014
jmp 0x180063a74
lea rcx, [rbp + 0x17]
call fcn.18003d904
nop
call fcn.180049c04
add rax, 0x28
cmp qword [rax + 0x18], 0x10
jb 0x1800639f9
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.18003de44
mov edx, 4
lea rcx, [rbp + 0x17]
call fcn.18003e07c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rbp + 0x17]
call fcn.18003e084
mov edx, r14d
lea rcx, [rbp + 0x17]
call fcn.18003e074
mov edx, 0x1bb
lea rcx, [rbp + 0x17]
call fcn.18003e08c
mov r9d, reloc.WS2_32.dll_recv
mov r8d, r15d
mov edx, dword [rdi + 4]
lea rcx, [rbp + 0x17]
call fcn.18003e098
call fcn.180049c04
mov rcx, rax
mov r8d, 0x1388
lea rdx, [rbp + 0x17]
call fcn.180077d64
nop
lea rcx, [rbp + 0x17]
call fcn.18001d6c0
mov rsi, rbx
cmp byte [0x18010a364], 0
je 0x180063acb
lea rcx, [rbp + 0x67]
call fcn.18006030c
mov r9, rax
cmp byte [rax + 0x41], 0
je 0x180063abb
xor edx, edx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xd993efbb19cfe32d
shr rax, cl
xor byte [rdx + r9], al
add rdx, r14
cmp rdx, 0x41
jb 0x180063a94
mov byte [r9 + 0x41], 0
mov r8d, r15d
mov rdx, r9
mov ecx, 4
call fcn.18006a848
lea rcx, [rdi + 0x60]
call fcn.180060190
lea rcx, [rdi + 0x10]
call fcn.180060190
mov edx, 0xb8
mov rcx, rdi
call fcn.18009d1f4
mov rdx, rsi
lea rcx, [r13 + 0x88]
call fcn.180065110
jmp 0x180063afe
mov r14b, cl
mov rcx, r12
call fcn.180007dc4
nop
mov al, r14b
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180067998
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15b, r9b
mov r12, r8
mov r14, rdx
mov rsi, rcx
xor r13d, r13d
mov qword [rbp - 8], r13
mov rax, qword [rdx]
lea r8, [rbp - 8]
lea rdx, [0x1800d3510]
mov rcx, r14
call qword [rax]
mov edi, eax
test eax, eax
jns 0x1800679f0
lea r9, str.QueryInterface_for_IUnknown_failed
lea ecx, [r13 + 2]
jmp 0x180067a3f
mov dword [rbp - 0x10], r13d
mov rbx, qword [rbp - 8]
mov rax, qword [rsi]
lea r8, [rbp - 0x10]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x38]
mov edi, eax
test eax, eax
js 0x180067b34
cmp dword [rbp - 0x10], r13d
jne 0x180067ad6
lea r8, [rbp + 0x38]
lea rdx, [0x1800d4ce8]
xor ecx, ecx
call fcn.1800688f4
mov edi, eax
test eax, eax
jns 0x180067a65
lea r9, str.CreateInstance_for_CBrowserMonitorSinkFTM_failed
mov ecx, 3
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
lea rdx, str.NewBrowserMonitor
lea r8, str.CNewBrowserMonitor::AddEventSinkIfNecessary
mov dword [rsp + 0x20], eax
call fcn.18005dd20
jmp 0x180067b34
mov rax, qword [rbp + 0x38]
mov byte [rax + 0xe8], r15b
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r9d, ebx
mov r8, r14
mov rdx, rsi
call qword [rax + 0x20]
mov edi, eax
test eax, eax
jns 0x180067ac5
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.pBrowserEventSink::Start_failed
lea r8, str.CNewBrowserMonitor::AddEventSinkIfNecessary
lea rdx, str.NewBrowserMonitor
mov ecx, 4
call fcn.18005dd20
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsi]
mov r8, qword [rbp + 0x38]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x28]
jmp 0x180067b34
cmp byte [0x18010a364], r13b
je 0x180067b34
lea rcx, [rbp + 0x38]
call fcn.180066ca0
mov rsi, rax
cmp byte [rax + 0x41], r13b
je 0x180067b1a
mov rax, r13
mov cl, al
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [rax + rsi], r8b
inc rax
cmp rax, 0x41
jb 0x180067af4
mov byte [rsi + 0x41], r13b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8d, ebx
mov rdx, rsi
mov ecx, 4
call fcn.18006a848
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x180067b43
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180068e50
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
sub rsp, 0x48
mov qword [rax - 0x28], rdx
lea rdx, [rsp + 0x20]
mov qword [rax - 0x20], rcx
lea rcx, [0x180068ddc]
mov byte [rax - 0x10], 0
mov byte [rax - 0x18], r8b
mov byte [rax - 0x17], r9b
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
call qword [sym.imp.USER32.dll_EnumWindows]
add rsp, 0x48
ret
Function at 0x180069380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
cmp edx, 0xc8
jne 0x18006949e
xor ebx, ebx
movabs rbp, 0xd993efbb19cfe32d
cmp dword [0x18010a5a0], ebx
jne 0x180069423
call fcn.180069538
movzx eax, al
mov dword [0x18010a5a0], eax
test eax, eax
je 0x18006941b
cmp byte [0x18010a364], bl
je 0x180069417
lea rcx, [rsp + 0x38]
call fcn.180067590
mov rdi, rax
cmp byte [rax + 0x3e], bl
je 0x1800693fb
mov eax, ebx
mov cl, al
mov r8, rbp
and cl, 7
shl cl, 3
shr r8, cl
xor byte [rax + rdi], r8b
inc rax
cmp rax, 0x3e
jb 0x1800693dd
mov byte [rdi + 0x3e], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rdi
mov ecx, 4
mov r8d, eax
call fcn.18006a848
mov eax, dword [0x18010a5a0]
test eax, eax
jne 0x180069423
cmp byte [0x18010a5a4], bl
je 0x180069428
call fcn.180069880
mov rcx, qword [0x18010a5e0]
test rcx, rcx
je 0x18006949e
cmp byte [0x18010a364], bl
je 0x180069498
lea rcx, [rsp + 0x38]
call fcn.18006706c
mov rdi, rax
cmp byte [rax + 0x68], bl
je 0x18006946f
mov rax, rbx
mov cl, al
mov r9, rbp
and cl, 7
shl cl, 3
shr r9, cl
xor byte [rax + rdi], r9b
inc rax
cmp rax, 0x68
jb 0x180069451
mov byte [rdi + 0x68], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x18010a5a0], ebx
mov rdx, rdi
mov r9d, eax
mov ecx, 4
setne bl
mov r8d, ebx
call fcn.18006a848
mov rcx, qword [0x18010a5e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180069880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
movabs rdi, 0xd993efbb19cfe32d
cmp byte [0x18010a364], 0
je 0x1800698fe
lea rcx, [rbp + 0x20]
call fcn.180067340
mov rbx, rax
cmp byte [rax + 0x2e], 0
je 0x1800698e8
xor eax, eax
mov cl, al
and cl, 7
shl cl, 3
mov r8, rdi
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x2e
jb 0x1800698c9
mov byte [rbx + 0x2e], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Internet_Explorer_Server
lea rcx, [rbp - 0x20]
call fcn.180068e50
xor r14d, r14d
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x180069a5b
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x18010a070]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
jne 0x1800699d7
xor ebx, ebx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x18010a070]
mov rcx, qword [rbp - 0x20]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
jne 0x1800699d7
inc ebx
cmp ebx, 4
jl 0x180069956
cmp byte [0x18010a364], al
je 0x180069a3d
mov rsi, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.180066d74
mov rbx, rax
cmp byte [rax + 0x4b], 0
je 0x180069a23
xor r9d, r9d
movabs rax, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r9 + rbx], r8b
inc r9
cmp r9, 0x4b
jb 0x1800699b5
mov byte [rbx + 0x4b], 0
jmp 0x180069a23
cmp byte [0x18010a364], 0
je 0x180069a3d
mov rsi, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.1800666dc
mov rbx, rax
cmp byte [rax + 0x4e], 0
je 0x180069a23
xor r9d, r9d
movabs rax, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r9 + rbx], r8b
inc r9
cmp r9, 0x4e
jb 0x180069a03
mov byte [rbx + 0x4e], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8, qword [rsi + rdi*8]
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
inc r14d
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rax, rcx
sar rax, 3
mov edi, r14d
cmp rdi, rax
jb 0x180069936
test rcx, rcx
je 0x180069a91
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x180069a8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180069aa6
call fcn.18009d1f4
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
int3
Function at 0x18006d3f8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0xf0
xor edi, edi
mov dword [rax + 8], edi
cmp byte [0x18010a364], dil
je 0x18006d45f
lea rcx, [rax + 8]
call fcn.18006b3b0
mov r8, rax
cmp byte [rax + 0x17], dil
je 0x18006d452
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
movabs rax, 0xd993efbb19cfe32d
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x17
jb 0x18006d42a
mov byte [r8 + 0x17], 0
mov rdx, r8
mov ecx, 4
call fcn.18006a848
lea rcx, [rsp + 0x20]
call fcn.180005664
nop
call fcn.180013d48
test al, al
je 0x18006d4b6
lea rcx, [rsp + 0x38]
call fcn.180013578
nop
mov edi, 1
mov dword [rsp + 0x100], edi
mov rbx, qword [rsp + 0x28]
mov rcx, rax
call fcn.1800054fc
mov r8, rax
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x20]
call fcn.1800053a8
cmp qword [rax], rbx
je 0x18006d4b6
mov bl, dil
jmp 0x18006d4b8
xor bl, bl
test dil, 1
je 0x18006d4c8
lea rcx, [rsp + 0x38]
call fcn.180012d04
call fcn.18001279c
mov dil, al
test bl, bl
je 0x18006d4da
call fcn.180013db4
nop
lea rcx, [rsp + 0x20]
call fcn.1800061bc
mov al, dil
jmp 0x18006d4eb
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
ret

Function at 0x18006e4c8
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 8]
mov dword [rbp - 0x10], ebx
mov qword [rsp + 0x50], rax
mov r9d, r8d
mov dword [rsp + 0x48], ebx
mov r8d, edx
mov dword [rsp + 0x40], ebx
mov dl, cl
mov dword [rsp + 0x38], ebx
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18006e541
mov rdx, qword [rbp - 8]
lea r8, [rbp + 0x28]
xor ecx, ecx
mov dword [rbp + 0x28], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x18006e535
cmp dword [rbp + 0x28], ebx
je 0x18006e535
mov bl, 1
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18006efe0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.1800a02d0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x18006f0e6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18006e550
lea rbx, [0x180102570]
cmp rbx, rax
je 0x18006f03c
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.180007418
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18006f075
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f070
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006f0ef
call fcn.18009d1f4
cmp qword [reloc.OLEAUT32.dll_SysReAllocString], 0
je 0x18006f0e6
cmp byte [0x18010a364], 0
je 0x18006f0e6
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x180102570]
lea rcx, [rsp + 0x260]
call fcn.18006dfa8
cmp byte [rax + 0x32], 0
je 0x18006f0d5
xor r8d, r8d
mov cl, r8b
and cl, 7
shl cl, 3
movabs r9, 0xd993efbb19cfe32d
shr r9, cl
xor byte [r8 + rax], r9b
inc r8
cmp r8, 0x32
jb 0x18006f0ae
mov byte [rax + 0x32], 0
mov r8, rbx
mov rdx, rax
mov ecx, 4
call fcn.18006a848
nop
add rsp, 0x250
pop rbx
ret
call fcn.1800a45b8
nop
int3
Function at 0x180070850
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
mov qword [rbp - 0x51], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x69], r15b
lea rdx, [rbp + 0x7f]
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test eax, eax
je 0x180070990
mov ecx, ebx
lea rdx, [0x1800db740]
call fcn.18009d8d0
mov r14, rax
test rax, rax
je 0x180070990
mov r9, rax
mov r8d, ebx
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x180070988
mov dword [rbp + 0x77], r15d
lea r9, [rbp + 0x77]
lea r8, [rbp - 0x49]
lea rdx, [0x1800ea574]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x180070988
xor edx, edx
lea r8d, [r15 + 0x64]
lea rcx, [rbp - 0x39]
call fcn.1800a02d0
mov r8, qword [rbp - 0x49]
movzx eax, word [r8 + 0xc]
movzx ecx, word [r8 + 0xe]
movzx edx, word [r8 + 8]
movzx r9d, word [r8 + 0xa]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._d._d._d._d
lea edx, [r15 + 0x63]
lea rcx, [rbp - 0x39]
call fcn.18006d598
lea rax, [rbp - 0x39]
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], r15b
jne 0x18007093f
cmp rsi, qword [rbp - 0x51]
ja 0x180070975
lea rbx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae rbx, qword [rbp - 0x69]
mov qword [rbp - 0x59], rsi
mov r8, rsi
lea rdx, [rbp - 0x39]
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + rsi], r15b
jmp 0x180070988
lea r9, [rbp - 0x39]
mov r8b, r15b
mov rdx, rsi
lea rcx, [rbp - 0x69]
call fcn.180003a38
mov rcx, r14
call fcn.18009d1f4
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x59]
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180070d3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
call fcn.180007af8
test al, al
jne 0x180070d62
call fcn.18005ceb8
test al, al
jne 0x180070e47
call fcn.18006a890
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx]
call fcn.18006a890
mov r8, qword [rax]
mov dl, 1
mov rcx, rax
call qword [r8 + 0x18]
movabs r14, 0xd993efbb19cfe32d
mov al, byte [0x18010a364]
test al, al
je 0x180070dfa
call fcn.1800658a0
lea rbx, [rax + 0x70]
cmp qword [rbx + 0x18], 0x10
jb 0x180070da7
mov rbx, qword [rbx]
lea rcx, [rsp + 0x50]
call fcn.18006daf0
mov rdi, rax
cmp byte [rax + 0x1c], 0
je 0x180070ddb
xor eax, eax
mov cl, al
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [rax + rdi], r8b
inc rax
cmp rax, 0x1c
jb 0x180070dbc
mov byte [rdi + 0x1c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8, rbx
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov al, byte [0x18010a364]
cmp byte [0x18010a5a6], 0
je 0x180070e47
test al, al
je 0x180070e47
lea rcx, [rsp + 0x50]
call fcn.18006de2c
cmp byte [rax + 0x41], 0
je 0x180070e3a
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x41
jb 0x180070e1a
mov byte [rax + 0x41], 0
mov rdx, rax
mov ecx, 4
call fcn.18006a848
call fcn.180049c04
mov rcx, rax
call fcn.180077350
call fcn.18006a890
mov rdi, rax
call fcn.1800658a0
mov rbx, rax
call fcn.180072560
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call fcn.1800866fc
test eax, eax
jne 0x180070e84
or dword [0x18010a5c8], 1
jmp 0x180070e8b
or dword [0x18010a5cc], 1
call fcn.18006a890
mov rdi, rax
call fcn.1800658a0
mov rbx, rax
call fcn.180072560
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call fcn.180086980
call fcn.18005cf84
test al, al
je 0x180070ec0
cmp dword [0x18010a5cc], 0
jne 0x180070ec5
call fcn.180093b20
call fcn.1800709bc
lea rcx, [rsp + 0x20]
call fcn.18003d8c0
nop
mov edx, 0x53b
lea rcx, [rsp + 0x20]
call fcn.18003e08c
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [0x18010a5c0]
lea rcx, [rsp + 0x20]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
mov r8d, 0x3e8
lea rdx, [rsp + 0x20]
call fcn.180077c5c
nop
lea rcx, [rsp + 0x20]
call fcn.18001d6c0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret