joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x10
cmp dword [0x140005680], 0
jne 0x140001203
mov rax, qword gs:[0x60]
xor r15d, r15d
mov edx, r15d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000120f
nop word [rax + rax]
mov r10, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x14000107d
lea rdx, [r10 + rcx]
mov ecx, dword [r10 + rcx + 0xc]
mov eax, dword [rcx + r10]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14000107d
mov eax, dword [rcx + r10 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140001089
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001040
test rdx, rdx
je 0x14000120f
mov r11d, dword [rdx + 0x18]
mov qword [rsp + 0x20], rbx
mov ebx, r15d
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x38], rdi
add rsi, r10
mov edi, dword [rdx + 0x20]
mov qword [rsp + 8], r12
add rdi, r10
mov qword [rsp], r14
add rbp, r10
mov r12d, 0x775a
lea r14, [0x140005680]
nop word [rax + rax]
lea eax, [r11 - 1]
mov r9d, dword [rdi + rax*4]
add r9, r10
cmp word [r9], r12w
jne 0x140001144
mov edx, r15d
mov r8d, 0x7a18c5d4
mov rax, r9
nop dword [rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc edx
add ecx, eax
mov eax, edx
add rax, r9
xor r8d, ecx
cmp byte [rax], r15b
jne 0x140001100
mov edx, ebx
lea eax, [r11 - 1]
add rdx, rdx
inc ebx
mov dword [r14 + rdx*8 + 8], r8d
movzx eax, word [rbp + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [r14 + rdx*8 + 0xc], eax
mov qword [r14 + rdx*8 + 0x10], r15
cmp ebx, 0x258
je 0x14000114a
add r11d, 0xffffffff
jne 0x1400010e0
mov r12, qword [rsp + 8]
lea eax, [rbx - 1]
mov rbp, qword [rsp + 0x28]
mov r11d, r15d
mov dword [0x140005680], ebx
test eax, eax
je 0x1400011f0
nop dword [rax + rax]
mov ecx, ebx
mov eax, r15d
sub ecx, r11d
cmp ecx, 1
je 0x1400011e5
nop dword [rax]
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov esi, dword [r14 + r9*8 + 0xc]
mov edi, dword [r14 + r8*8 + 0xc]
cmp esi, edi
jbe 0x1400011d6
mov eax, dword [r14 + r8*8 + 8]
mov edx, dword [r14 + r9*8 + 8]
mov rcx, qword [r14 + r9*8 + 0x10]
mov dword [r14 + r9*8 + 8], eax
mov rax, qword [r14 + r8*8 + 0x10]
mov qword [r14 + r9*8 + 0x10], rax
mov dword [r14 + r9*8 + 0xc], edi
mov dword [r14 + r8*8 + 8], edx
mov dword [r14 + r8*8 + 0xc], esi
mov qword [r14 + r8*8 + 0x10], rcx
mov ebx, dword [0x140005680]
mov ecx, ebx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x140001180
inc r11d
lea eax, [rbx - 1]
cmp r11d, eax
jb 0x140001170
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp]
mov eax, 1
add rsp, 0x10
pop r15
ret
xor eax, eax
add rsp, 0x10
pop r15
ret
Function at 0x1400014c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xcce72b74
call fcn.140001220
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001dd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e22
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e24
xor al, al
add rsp, 0x28
ret
Function at 0x18000ce10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x20], 0
mov rcx, rdx
call fcn.18000c1e0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.180052b78
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ebx, [rax*4]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, edi
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000ce99
add ecx, 0x30
jmp 0x18000ce9c
add ecx, 0x37
mov byte [rsp + 0x38], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000ceb2
add ecx, 0x30
jmp 0x18000ceb5
add ecx, 0x37
mov byte [rsp + 0x39], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000cecb
add ecx, 0x30
jmp 0x18000cece
add ecx, 0x37
mov byte [rsp + 0x3a], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000cee4
add ecx, 0x30
jmp 0x18000cee7
add ecx, 0x37
mov byte [rsp + 0x3b], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000cefd
add ecx, 0x30
jmp 0x18000cf00
add ecx, 0x37
mov byte [rsp + 0x3c], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000cf16
add ecx, 0x30
jmp 0x18000cf19
add ecx, 0x37
mov byte [rsp + 0x3d], cl
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18000cf2f
add ecx, 0x30
jmp 0x18000cf32
add ecx, 0x37
mov byte [rsp + 0x3e], cl
cmp eax, 0xa
jae 0x18000cf40
add eax, 0x30
jmp 0x18000cf43
add eax, 0x37
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.18000c560
call fcn.180052b4c
mov edx, eax
mov rcx, rsi
call fcn.18000c720
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18002fe60
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18000e060
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18000e099
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18000e099
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov rbx, qword [rsp + 0x38]
mov qword [rdi], rcx
add rsp, 0x20
pop rdi
ret

Function at 0x18000e140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rsi, r9
mov dword [r9], ebp
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
nop dword [rax]
nop word [rax + rax]
cmp ebx, dword [0x180097c80]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
mov r8d, ebx
cmova r8d, dword [0x180097c80]
mov rdx, rdi
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x60]
add dword [rsi], ecx
test eax, eax
je 0x18000e1b6
test ecx, ecx
je 0x18000e1b2
add rdi, rcx
mov eax, ecx
sub ebx, ecx
jne 0x18000e170
mov al, 1
jmp 0x18000e1b8
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x18000ee70
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x120
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebx, ebx
test rcx, rcx
je 0x18000eeb8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18000eeb8
mov qword [rdi], rbx
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.18000c150
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x88]
call fcn.18000f110
nop
mov r8d, 0x20
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.18000ee50
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18000c470
nop
mov rcx, qword [rsp + 0x78]
call fcn.18002fdbc
nop
mov rcx, qword [rsp + 0x88]
call fcn.18002fdbc
nop
mov rcx, qword [rsp + 0x50]
call fcn.18002fdbc
mov dword [rsp + 0xb0], 0x68
mov qword [rsp + 0xb8], rbx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0xec], ebx
mov word [rsp + 0xf2], bx
mov qword [rsp + 0xf8], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18000efa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18000efbd
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x98]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x60]
call fcn.18002fdbc
mov eax, ebx
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18000eff0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp byte [rsp + 0xf0], 0
jne 0x18000f02d
call fcn.18000ee70
jmp 0x18000f0f5
mov rcx, qword [rcx]
xor edi, edi
test rcx, rcx
je 0x18000f044
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18000f044
mov qword [rbx], rdi
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.18000c150
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000f110
nop
mov rcx, qword [rsp + 0x20]
call fcn.18002fdbc
mov dword [rsp + 0x50], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x54]
call fcn.18004fb10
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x54], 0x240
mov dword [rsp + 0x80], 1
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
mov rcx, rbx
call fcn.18000f1f0
lea rcx, str.runas
test eax, eax
cmovne rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x18000f0de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18000f0e9
mov rax, qword [rsp + 0xb8]
mov qword [rbx], rax
mov rcx, qword [rsp + 0x30]
call fcn.18002fdbc
mov eax, edi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18000f1f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub rsp, 0x188
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x11c
call fcn.18004fb10
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x54], 5
jg 0x18000f264
cmp dword [rsp + 0x58], 2
jg 0x18000f264
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x188
ret
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x188
ret

Function at 0x18000f380
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
lea r9, [rsp + 0x58]
xor eax, eax
mov dword [rsp + 0x58], 0
cmp byte [r8], al
mov rbx, r8
mov dword [rsp + 0x50], 4
setne al
xor r8d, r8d
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 0
setne cl
mov byte [rbx], cl
add rsp, 0x30
pop rbx
ret
Function at 0x18000fbb0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rax, qword [0x1800a72c0]
test rax, rax
jne 0x18000fc04
mov ecx, 0x1a8
call fcn.18002fd78
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18000fbfa
mov rcx, rax
call fcn.1800205c0
jmp 0x18000fbfd
mov rax, rbx
mov qword [0x1800a72c0], rax
mov rcx, rax
call fcn.1800206f0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rax], 0
jne 0x18000fc2a
mov r8, rbx
jmp 0x18000fc3b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18000fc30
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000ae80
nop
mov r8d, 0xb
lea rdx, str.TGDmhlp.exe
lea rcx, [rsp + 0x40]
call fcn.1800102b0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000fca4
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.b959a1
call fcn.18001c6c0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x18000fcc1
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000afd0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x70
pop rbx
ret

Function at 0x18000fce0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.GDefmng.exe
call fcn.18001d260
xor edx, edx
lea rcx, str.GDVCDbus.exe
add rsp, 0x28
jmp fcn.18001d260
Function at 0x18000fd10
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov qword [rsp + 0x78], 7
xor edi, edi
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x60], di
xor r8d, r8d
lea rdx, [0x18006de50]
lea rcx, [rsp + 0x60]
call fcn.18000ae80
nop
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
xor r8d, r8d
lea rdx, [0x18006de50]
lea rcx, [rsp + 0x40]
call fcn.18000ae80
nop
mov rax, qword [0x1800a72c0]
test rax, rax
jne 0x18000fdca
mov ecx, 0x1a8
call fcn.18002fd78
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18000fdc0
mov rcx, rax
call fcn.1800205c0
jmp 0x18000fdc3
mov rax, rdi
mov qword [0x1800a72c0], rax
mov rcx, rax
call fcn.1800206f0
or rbx, 0xffffffffffffffff
cmp word [rax], 0
jne 0x18000fde1
mov r8, rdi
jmp 0x18000fdef
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x18000fde4
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000ae80
mov r8d, 0xc
lea rdx, str.GDVCDbus.exe
lea rcx, [rsp + 0x40]
call fcn.1800102b0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000fef7
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.18004fb10
lea r8, str.7c4585
lea rdx, [0x18006e9d8]
lea rcx, [rbp - 0x80]
call fcn.180010750
mov r8d, 1
lea rdx, [0x18006e9e0]
lea rcx, [rsp + 0x60]
call fcn.18000ae80
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180010180
mov r8d, 2
lea rdx, [0x18006e9e4]
lea rcx, [rsp + 0x60]
call fcn.1800102b0
cmp word [rbp - 0x80], 0
jne 0x18000fea9
mov rbx, rdi
jmp 0x18000feba
lea rax, [rbp - 0x80]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000feb0
mov r8, rbx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1800102b0
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov r9d, 0x1388
mov r8b, 1
lea rdx, [0x18006de50]
call fcn.18001c6c0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x18000ff14
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000afd0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x18000ff44
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18000afd0
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.18002fe60
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1800107d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor ebx, ebx
movsxd rbp, edx
xor r11d, r11d
xor r10d, r10d
mov r14, r9
mov r15, r8
mov rdi, rcx
test edx, edx
jle 0x18001090c
mov rsi, rcx
lea r12, [0x18006eab0]
neg rsi
mov rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x3d
jne 0x180010826
inc r11d
cmp r11d, 2
jg 0x180010879
cmp al, 0x7f
ja 0x180010879
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x180010879
cmp cl, 0x40
jae 0x180010841
test r11d, r11d
jne 0x180010879
inc rdx
inc ebx
inc r10d
lea rax, [rsi + rdx]
cmp rax, rbp
jl 0x180010816
test ebx, ebx
je 0x18001090c
lea eax, [rbx + rbx*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x180010883
mov dword [r9], eax
mov eax, 0xfffffff0
jmp 0x18001090e
mov eax, 0xffffffee
jmp 0x18001090e
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rax, r15
test r10d, r10d
jle 0x180010906
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rcx + r12]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc r11d
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp r11d, 4
jne 0x1800108fb
xor r11d, r11d
test r9d, r9d
jle 0x1800108de
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x1800108ef
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x1800108fb
mov byte [rax], r8b
inc rax
dec r10d
inc rdi
test r10d, r10d
jg 0x1800108a0
sub eax, r15d
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x180010930
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x89], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x18001096f
mov rdx, qword [rdx]
call fcn.180012040
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180012b90
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov edi, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rcx
lea r9, [rcx + 0xc0]
cmp qword [r9 + 0x18], 8
jb 0x180012bdf
mov r9, qword [r9]
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x180012d5b
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x18006de50]
lea rcx, [rsp + 0x38]
call fcn.18000ae80
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.18004fb10
mov r8d, edi
lea rdx, [0x18006ee10]
lea rcx, [rbp - 0x80]
call fcn.180010750
lea rax, [rbp - 0x80]
mov r9, r14
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
cmp byte [rbx + 9], r15b
je 0x180012cb6
call fcn.180012a50
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180012cb4
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180012c92
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.18000afd0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180012220
nop
jmp 0x180012d07
call fcn.180012b50
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180012d07
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180012ce5
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.18000afd0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180012220
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180012d24
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.18000afd0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180056ab0
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180012d59
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.18000afd0
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180012d80
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor edi, edi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.18004fb10
lea rax, [rbp + 0xc0]
cmp qword [rax + 0x18], 8
jb 0x180012ded
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x180012e26
mov rax, qword [rbx]
jmp 0x180012e29
mov rax, rbx
mov word [rax], di
cmp word [rsp + 0x70], di
je 0x180012e4a
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180012e40
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18000ae80
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x180012e6e
mov rax, qword [rbx]
jmp 0x180012e71
mov rax, rbx
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x180012e96
add rax, 2
test edx, edx
jne 0x180012e80
test r10d, r10d
jne 0x180012ee8
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, r14
lea rdx, [rsp + 0x48]
mov rcx, rbp
cmp byte [rbp + 9], r10b
je 0x180012ebb
call fcn.180012a50
jmp 0x180012ec0
call fcn.180012b50
mov rdx, rax
mov rcx, rbx
call fcn.180012170
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180012ee8
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18000afd0
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret