joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011370d
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
and al, bpl
push r14
add eax, 0x5ba90c5b
or ebp, 0x1e584ff3
sub rsp, 0x58
ror rbp, cl
dec r14d
test sil, 0x47
mov rax, qword [0x180079010]
xor bpl, dil
bt bp, 2
xor rax, rsp
sar r9b, cl
movzx r9w, bl
mov qword [rsp + 0x48], rax
add al, al
xadd ax, bp
mov r9, qword [0x18007c088]
dec ah
adc bpl, r11b
rcl r14b, 0xe5
mov rbp, r8
inc r14w
mov rax, qword [rcx]
mov r14, rdx
setno r8b
adc r8b, sil
shld cx, bp, 0x10
mov qword [rsp + 0x30], rax
xor ecx, r13d
ror r8d, cl
mov rcx, qword [r9]
rol r8w, 0xb
mov r8, rcx
test r12b, 0xd4
cmc
cmp rcx, r9
jmp 0x18011379e
je 0x1801137dc
nop word [rax + rax]
cmp qword [r8 + 0x10], rax
jmp 0x1801137b6
je 0x1801139ca
cmp qword [r8 + 0x18], rax
jmp 0x1801137c5
je 0x1801139ba
mov r8, qword [r8]
jmp 0x1801137d3
cmp r8, r9
jne 0x1801137ad
mov qword [rsp + 0x80], rbx
stc
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x50], rdi
test si, 0x376b
cmc
mov qword [rsp + 0x38], rax
jmp 0x180113806
cmp rcx, r9
jmp 0x180113817
je 0x180113861
nop dword [rax + rax]
cmc
cmp r14b, 0x94
jmp 0x18011382c
cmp qword [rcx + 0x10], rax
jmp 0x180113835
je 0x18011393a
cmp qword [rcx + 0x18], rax
jmp 0x180113844
je 0x18011393a
mov rcx, qword [rcx]
clc
jmp 0x180113853
cmp rcx, r9
jmp 0x18011385b
jne 0x18011382c
sub esi, esi
mov edi, esi
test bh, ah
cmp qword [rax], rsi
jmp 0x18011386f
je 0x18011388a
nop dword [rax]
inc rdi
cmp qword [rax + rdi*8], rsi
jmp 0x180113884
jne 0x180113878
sub ecx, ecx
seta r8b
movsx r8d, r14w
cwd
lea rdx, [rdi*8]
xchg r8b, r9b
movsx r8w, bl
mov r8d, 0x3000
lea r9d, [rcx + 4]
jmp 0x1801138b5
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
stc
cmp r11b, r8b
test rax, rax
jmp 0x1801138ca
je 0x18011395a
test rdi, rdi
jmp 0x1801138d8
je 0x180113911
mov rax, qword [rsp + 0x38]
inc cl
mov rcx, qword [rax + rsi*8]
jmp 0x1801138ee
mov qword [rbx + rsi*8], rcx
jmp 0x1801138f7
inc rsi
cmp r15b, 0xcc
jmp 0x180113903
cmp rsi, rdi
jmp 0x18011390b
jb 0x1801138de
lea r8, [rsp + 0x38]
movsx dx, r14b
lea rdx, [rsp + 0x20]
jmp 0x180113925
call fcn.180113ac0
mov rcx, qword [rax]
movsx dx, bpl
cdq
xchg rdx, r8
mov qword [rcx + 0x18], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180113ac0
mov rax, qword [rax]
xor dil, sil
mov rax, qword [rax + 0x18]
stc
mov qword [rax + r14*8], rbp
mov al, 1
mov rsi, qword [rsp + 0x88]
btc di, 0x1c
movzx rcx, dx
mov rbx, qword [rsp + 0x80]
or ecx, 0x4c594073
add edi, r9d
mov rdi, qword [rsp + 0x50]
sub cl, dil
xchg cx, cx
bts ecx, r9d
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
jmp 0x180113998
call fcn.1801157b3
add rsp, 0x58
bswap bp
jmp 0x1801139ae
pop r14
movsxd rbp, ebp
pop rbp
jmp 0x1801139b9
ret
mov qword [rax + rdx*8], rbp
mov al, 1
jmp 0x1801139c5
jmp 0x18011398b
lea r8, [rsp + 0x30]
setle dh
movsx dx, r10b
xchg dh, dl
lea rdx, [rsp + 0x38]
jmp 0x1801139e3
call fcn.180113ac0
mov rax, qword [rax]
jmp 0x1801139f0
mov rax, qword [rax + 0x18]
mov qword [rax + r14*8], rbp
mov al, 1
jmp 0x1801139ff
jmp 0x18011398b
Function at 0x180115101
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx ecx, dx
movsx rcx, sp
lea rcx, [rsp + 0x30]
jmp 0x180115116
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmc
test r9w, 0x7240
test r12w, cx
add rsp, 0x28
jmp 0x180115135
ret

Function at 0x180116367
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
rcr al, 0xbb
stc
cdqe
mov r8, rcx
mov eax, 0x5a4d
cmp cx, ax
stc
cmp word [0x180000000], ax
jmp 0x180116389
jne 0x1801164ab
movsxd rcx, dword [0x18000003c]
btc dx, r9w
shl dx, cl
btr edx, r12d
lea rdx, [0x180000000]
lea rcx, [rcx + rdx]
cmp esi, 0x3cc4b02
cmp dword [rcx], 0x4550
jmp 0x1801163be
jne 0x1801164ab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1801163d2
jne 0x1801164ab
sub r8, rdx
movzx eax, word [rcx + 0x14]
shld r9w, bp, 0x87
dec dl
test r12w, r12w
lea rdx, [rcx + 0x18]
not r9b
sal r9w, 0x6e
add rdx, rax
movzx r9, r15w
bts rax, r8
movzx eax, word [rcx + 6]
clc
dec ch
movsx r9d, r13w
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
test r14, r9
cmp r12b, r9b
cmp rdx, r9
jmp 0x180116427
je 0x18011646c
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x180116438
jb 0x18011645e
mov eax, dword [rdx + 8]
cmp r11b, 0xb0
clc
add eax, ecx
cmp r13b, r12b
clc
test r8w, r8w
cmp r8, rax
jmp 0x180116458
jb 0x180116474
add rdx, 0x28
jmp 0x180116467
jmp 0x180116415
sub edx, edx
test dil, 0xe
cmc
clc
test rdx, rdx
jmp 0x18011647c
jne 0x18011648e
xor al, al
jmp 0x180116489
jmp 0x1801164bc
cmp dword [rdx + 0x24], 0
jge 0x18011649f
xor al, al
jmp 0x1801164bc
mov al, 1
jmp 0x1801164a6
jmp 0x1801164bc
sub al, al
jmp 0x1801164bc
add rsp, 0x18
jmp 0x1801164c5
ret
Function at 0x1801177d1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
bt rbx, rbp
sbb bh, 0x3b
mov rbp, rsp
not bl
bt eax, 0xa3
sub rsp, 0x20
movsx eax, r14w
movzx ebx, bx
mov rax, qword [0x180079010]
rol bx, cl
cmc
movabs rbx, 0x2b992ddfa232
jmp 0x18011780c
cmp rax, rbx
jmp 0x180117814
jne 0x1801178e7
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x180117832
mov qword [rbp + 0x10], rax
jmp 0x18011783b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmp dx, ax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
btc rcx, rbp
rcr cl, cl
btr cx, r9w
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x18011786a
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
cmp sil, 0x92
shl rax, 0x20
xor rax, qword [rbp + 0x20]
cmp al, dil
jmp 0x18011788b
xor rax, qword [rbp + 0x10]
and bp, bx
shr bp, 5
xor rax, rcx
bt cx, r10w
neg cl
movabs rcx, 0xffffffffffff
movsx rbp, si
adc bpl, r13b
inc ebp
and rax, rcx
movsx rbp, di
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
cmp bl, r15b
bsr ebp, r11d
sar rbp, 0x55
mov qword [0x180079010], rax
rcr bx, cl
sal bh, 0xe2
and bx, r14w
mov rbx, qword [rsp + 0x48]
adc bpl, 0x6c
bt bp, 0x82
not rax
movsx rbp, r8w
mov bpl, 0xbd
mov qword [0x180079008], rax
adc bpl, dl
btc bp, 0xc9
and ebp, 0x38592304
add rsp, 0x20
movzx rbp, bx
pop rbp
jmp 0x180117922
ret
Function at 0x18011a301
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
or r10b, bpl
stc
mov qword [rax + 8], rbx
bswap r10w
mov qword [rax + 0x10], rsi
sbb bl, bpl
mov qword [rax + 0x18], rdi
bsr r10w, r14w
mov qword [rax + 0x20], r14
cmp dword [rcx + 0x10], 0
movzx r10w, dil
not r10
mov rbx, r8
movzx r10w, r12b
mov r10, rdx
jmp 0x18011a340
je 0x18011a4c7
movsxd r9, dword [rcx + 0x10]
cmovns di, di
lea r14, [0x180000000]
inc di
sbb al, ch
shld rcx, r14, 0x44
mov rdi, qword [rdx + 8]
xor esi, esi
xchg rcx, r11
bswap r11
rcl cl, 0x84
lea r9, [r9 + rdi]
or edx, 0xffffffff
or ch, dl
sub r8d, r8d
not r11b
movzx ecx, byte [r9]
movsx eax, r10w
mov al, 0xd1
cmp eax, r9d
and ecx, 0xf
xor al, r14b
movsx rax, byte [rcx + r14 + 0x6c8a0]
btr r11w, 0x1e
clc
movzx r11w, bl
mov cl, byte [rcx + r14 + 0x6c8b0]
rcr r11w, cl
sub r9, rax
movzx r11, r11w
bt r11d, ecx
add r11b, 0xba
mov r11d, dword [r9 - 4]
stc
cmp r9d, 0x1cab76ac
shr r11d, cl
stc
test r8b, 0x49
test r11d, r11d
je 0x18011a4c7
mov rax, qword [r10 + 0x10]
shl ch, cl
sub r10d, r11d
mov r10d, dword [rax]
jmp 0x18011a3f0
movzx ecx, byte [r9]
shrd rax, rax, 0xc4
or eax, esp
sete al
and ecx, 0xf
setg al
movsx rax, byte [rcx + r14 + 0x6c8a0]
test r15w, si
mov cl, byte [rcx + r14 + 0x6c8b0]
cmp r8b, bl
cmp r15b, 0x39
sub r9, rax
rol ah, 0x32
btc ax, 0x23
xadd ax, ax
mov eax, dword [r9 - 4]
shr eax, cl
clc
add esi, eax
cmp dx, 0x6335
mov eax, esi
lea rax, [rax + r10]
lea rax, [rax + rdi]
cmp rbx, rax
jb 0x18011a4ad
movzx ecx, byte [r9]
cbw
inc r8d
movzx ax, sil
rcr ax, 0x40
and ecx, 0xf
movsx rdx, cx
rol rax, cl
cmc
movsx rax, byte [rcx + r14 + 0x6c8a0]
movzx edx, bx
or dh, 0xb1
mov cl, byte [rcx + r14 + 0x6c8b0]
rcl rdx, cl
sub r9, rax
ror dl, 0x6b
movsx edx, r9w
mov edx, dword [r9 - 4]
shr edx, cl
jmp 0x18011a49c
dec edx
cmc
cmp r8d, r11d
jmp 0x18011a4a7
jb 0x18011a3f0
test r8d, r8d
jmp 0x18011a4b5
je 0x18011a4c7
mov eax, edx
jmp 0x18011a4c2
jmp 0x18011a4d1
or eax, 0xffffffff
movsx rsi, si
bswap r14d
mov rbx, qword [rsp + 8]
not dil
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
jmp 0x18011a4ed
ret
Function at 0x18011cfe0
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rbx
jmp 0x18011cffe
mov qword [rax + 0x10], rbp
cmovbe rbp, r9
sub bpl, spl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
shr dil, cl
push r14
sub rsp, 0x20
cmovge edi, r9d
movsx rdi, r11w
stc
sub ebx, ebx
mov r14, r8
mov rbp, rdx
cmovp di, r15w
sal edi, 0xb2
bts di, di
mov rdi, rcx
jmp 0x18011d03f
cmp dword [rcx + 4], ebx
jmp 0x18011d047
je 0x18011d23e
movsxd rsi, dword [rcx + 4]
jmp 0x18011d056
call fcn.180118d67
mov r9, rax
cmp r12, r11
jmp 0x18011d066
add r9, rsi
jmp 0x18011d06e
je 0x18011d23e
test esi, esi
je 0x18011d098
movsxd rsi, dword [rdi + 4]
jmp 0x18011d085
call fcn.180118d67
lea rcx, [rsi + rax]
jmp 0x18011d093
jmp 0x18011d0a3
mov rcx, rbx
stc
adc sil, 0x87
mov esi, ebx
clc
cmp byte [rcx + 0x10], bl
je 0x18011d23e
test byte [rdi], 0x80
jmp 0x18011d0b4
je 0x18011d0c4
test byte [rbp], 0x10
jne 0x18011d23e
test esi, esi
jmp 0x18011d0cb
je 0x18011d0eb
call fcn.180118d67
mov rsi, rax
sbb al, bl
movsxd rax, dword [rdi + 4]
test r11b, 0x41
add rsi, rax
jmp 0x18011d0f3
mov rsi, rbx
jmp 0x18011d0f3
call fcn.180118d87
mov rcx, rax
movsxd rax, dword [rbp + 4]
test esp, 0x684b47f2
cmc
add rcx, rax
test cl, 0x2b
stc
cmp rsi, rcx
jmp 0x18011d115
je 0x18011d1bf
cmp dword [rdi + 4], ebx
jmp 0x18011d123
je 0x18011d14b
call fcn.180118d67
mov rsi, rax
or ah, cl
add ax, 0x485e
movsxd rax, dword [rdi + 4]
test sil, r15b
add rsi, rax
jmp 0x18011d146
jmp 0x18011d153
mov rsi, rbx
jmp 0x18011d153
call fcn.180118d87
movsxd r8, dword [rbp + 4]
adc cl, 0xdc
add r8, 0x10
add r8, rax
sar ax, 0xbf
add rcx, 0x67c41cd
lea rax, [rsi + 0x10]
sub r8, rax
shl rcx, 0xf9
movzx ecx, byte [rax]
shl dh, cl
movsx dx, r10b
movzx edx, byte [rax + r8]
cmp r15, r10
sub ecx, edx
jmp 0x18011d195
jne 0x18011d1a6
inc rax
test edx, edx
jne 0x18011d17c
test ecx, ecx
jmp 0x18011d1ad
je 0x18011d1bf
sub eax, eax
jmp 0x18011d1ba
jmp 0x18011d246
mov al, 2
test bp, r8w
cmc
test byte [rbp], al
jmp 0x18011d1ce
je 0x18011d1e2
test byte [rdi], 8
jmp 0x18011d1dc
je 0x18011d232
test byte [r14], 1
je 0x18011d1fa
test byte [rdi], 1
jmp 0x18011d1f4
je 0x18011d232
test byte [r14], 4
jmp 0x18011d203
je 0x18011d212
test byte [rdi], 4
je 0x18011d232
test byte [r14], al
jmp 0x18011d21a
je 0x18011d22d
test byte [rdi], al
jmp 0x18011d227
je 0x18011d232
mov ebx, 1
mov eax, ebx
jmp 0x18011d239
jmp 0x18011d246
mov eax, 1
shl bl, 0x90
mov rbx, qword [rsp + 0x30]
seta dil
shrd bp, r13w, 0xa3
mov rbp, qword [rsp + 0x38]
and sil, dil
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp al, 0xcc
rol r14b, 0x1b
add rsp, 0x20
pop r14
jmp 0x18011d278
ret
Function at 0x18011ff88
Capabilities:
Get thread local storage value

Disassembly:
push rbx
xchg r9d, ebx
sub rsp, 0x20
movsx r9w, cl
bswap r8w
mov ebx, ecx
lea r9, [0x18006d8c0]
mov dx, 0x5031
movsx dx, dh
bswap cx
mov ecx, 2
movzx rdx, r13w
mov dl, bl
lea r8, [0x18006d8b8]
not dl
cdq
mov rdx, 0xf9364e0
lea rdx, [0x18006c438]
jmp 0x18011ffd6
call fcn.18011fbe3
mov ecx, ebx
test rax, rax
jmp 0x18011ffe5
je 0x180120003
add rsp, 0x20
movsx bx, spl
not ebx
pop rbx
jmp 0x18011fffc
push qword [0x18006c288]
ret
add rsp, 0x20
jmp 0x180120011
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180120019
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
add r8b, r11b
cmp r8b, al
push rdi
sub rsp, 0x20
movsx r8, cx
mov rbx, rdx
lea r9, [0x18006d8c8]
movsxd rdx, r13d
bswap di
mov edi, ecx
movsx rcx, r11w
mov dh, 0xc
not cx
lea rdx, [0x18006c448]
mov ecx, 3
movsx r8w, bpl
movsxd r8, ebx
mov r8w, 0x6859
lea r8, [0x18006d8c0]
call fcn.18011fbe3
mov rdx, rbx
sub cl, 0xb
mov ecx, edi
test r10w, r14w
jmp 0x180120080
test rax, rax
je 0x180120094
call qword [0x18006c288]
jmp 0x18012009a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movzx rdi, cx
bsf rdi, rcx
sal edi, cl
add rsp, 0x20
pop rdi
jmp 0x1801200b3
ret

Function at 0x180121eab
Capabilities:
Terminate process

Disassembly:
push rbx
bswap rbx
add bx, 0x67d
sub rsp, 0x20
mov ebx, ecx
jmp 0x180121ec0
call fcn.180121efe
test al, al
jmp 0x180121ecc
je 0x180121ee5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
not edx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.180121f38
mov ecx, ebx
jmp 0x180121ef3
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1801282bb
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r13w, 0x6324
test r15d, r14d
jmp 0x1801282d4
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
jmp 0x1801282f1
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
shr bh, 0xea
test r9b, r13b
mov rbx, rax
cmp si, 0x5b25
test rax, rax
jmp 0x180128313
jne 0x180128325
sub eax, eax
jmp 0x180128320
jmp 0x1801284a2
mov rbp, rbx
cmp word [rax], si
jmp 0x180128330
je 0x18012836d
or rax, 0xffffffffffffffff
jmp 0x18012833f
inc rax
cmp word [rbp + rax*2], si
jmp 0x18012834c
jne 0x18012833f
lea rbp, [rbp + rax*2]
add rbp, 2
test r12b, r11b
cmp word [rbp], si
jmp 0x180128367
jne 0x180128336
mov qword [rsp + 0x38], rsi
sub rbp, rbx
shr r8w, cl
btr r9w, ax
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
cmp r10b, al
test spl, 0x81
mov dword [rsp + 0x28], esi
jmp 0x1801283a0
sub edx, edx
mov qword [rsp + 0x20], rsi
cmp r12b, 0x17
sub ecx, ecx
jmp 0x1801283b2
call fcn.1801280e3
movsxd r14, eax
test ah, 0x89
test r14, rcx
test eax, eax
jmp 0x1801283c7
jne 0x1801283db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180128319
mov rcx, r14
jmp 0x1801283e3
call fcn.180124c54
mov rdi, rax
jmp 0x1801283f1
test rax, rax
jmp 0x1801283f9
jne 0x180128410
sub ecx, ecx
jmp 0x180128406
call fcn.180124fb6
jmp 0x1801283cd
mov qword [rsp + 0x38], rsi
mov r9d, ebp
rcl r8w, cl
shrd r8d, ecx, 0x52
rcr r8d, 0xf2
mov qword [rsp + 0x30], rsi
shr r8b, cl
cmc
bts r8, r8
mov r8, rbx
test cx, 0x72bf
stc
mov dword [rsp + 0x28], r14d
test r8b, 0x2b
sub edx, edx
test dx, cx
xor ecx, ecx
jmp 0x180128450
mov qword [rsp + 0x20], rdi
jmp 0x18012845a
call fcn.1801280e3
test eax, eax
jmp 0x180128466
jne 0x18012847e
mov rcx, rdi
jmp 0x180128474
call fcn.180124fb6
jmp 0x180128491
sub ecx, ecx
jmp 0x180128485
call fcn.180124fb6
mov rsi, rdi
cmove rcx, r15
mov rcx, rbx
jmp 0x180128499
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
test rbp, 0x3a195236
mov rbp, qword [rsp + 0x58]
sar r14b, 0x1b
cmovg r14w, r11w
mov rsi, qword [rsp + 0x60]
bswap r14
rol edi, cl
test r13w, dx
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movsx r14, dx
mov r14w, r13w
pop r14
jmp 0x1801284e2
ret
Function at 0x1801290e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sub ebx, 0x731b6377
mov qword [rax + 0x10], rbp
dec ecx
rol ch, 0xf9
rcr bl, cl
mov qword [rax + 0x18], rsi
test spl, dl
mov cx, 0x133b
mov qword [rax + 0x20], rdi
setne bl
shr cx, 0x50
push r14
movzx ebx, r11w
sub rsp, 0x20
rcl edi, cl
xor esi, esi
jmp 0x18012912d
xor r14d, r14d
movsxd rcx, esi
xchg bx, di
or bx, r14w
lea rdi, [0x18007bb40]
mov rax, rcx
shrd bx, r13w, 0xdc
and ecx, 0x3f
sar rax, 6
or ebx, esp
mov rbx, r14
movzx rbx, bp
lea rbx, [rcx + rcx*8]
mov rdi, qword [rdi + rax*8]
mov rax, qword [rdi + rbx*8 + 0x28]
cmp bh, 0x9a
stc
jmp 0x180129170
add rax, 2
cmp rax, 1
jmp 0x18012917d
jbe 0x180129192
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x18012918d
jmp 0x1801292c4
mov byte [rdi + rbx*8 + 0x38], 0x81
xor rcx, rax
shl rcx, 0x4e
shr rcx, 0x4d
mov ecx, esi
clc
test esi, esi
jmp 0x1801291ac
je 0x1801291e5
sub ecx, 1
jmp 0x1801291ba
je 0x1801291d6
cmp ecx, 1
movsx rcx, r8w
mov ecx, 0xfffffff4
jmp 0x1801291d1
jmp 0x1801291ef
mov ecx, 0xfffffff5
jmp 0x1801291e0
jmp 0x1801291ef
mov ecx, 0xfffffff6
jmp 0x1801291ef
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
and ecx, 0x21b5583f
bsf rcx, rsp
cmp r9d, edi
lea rcx, [rax + 1]
test dl, 0x6c
clc
stc
cmp rcx, 1
jmp 0x180129217
jbe 0x180129282
mov rcx, rax
jmp 0x180129225
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x180129232
je 0x180129282
movzx eax, al
test r12w, 0x53a0
mov qword [rdi + rbx*8 + 0x28], rbp
cmc
clc
cmp eax, 2
jmp 0x180129250
jne 0x180129265
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x180129260
jmp 0x1801292c4
cmp eax, 3
jmp 0x18012926d
jne 0x1801292c4
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x18012927d
jmp 0x1801292c4
or byte [rdi + rbx*8 + 0x38], 0x40
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
movzx rax, bx
cbw
bts eax, esp
mov rax, qword [0x18007bf78]
test bp, 0x422
stc
test rax, rax
je 0x1801292c4
mov rax, qword [r14 + rax]
jmp 0x1801292b8
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1801292c4
inc esi
add r14, 8
clc
test r9d, ebp
cmp r11w, 0x6873
cmp esi, 3
jmp 0x1801292dc
jne 0x180129130
mov rbx, qword [rsp + 0x30]
movsx ebp, bx
mov rbp, qword [rsp + 0x38]
inc r14b
mov rsi, qword [rsp + 0x40]
mov r14d, 0xa6218dd
shr r14d, cl
movsx rdi, r11w
mov rdi, qword [rsp + 0x48]
bt r14w, 0x81
rcr r14w, cl
add rsp, 0x20
pop r14
ret
Function at 0x180129d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
or ch, 0x1b
shr cx, cl
mov qword [rsp + 0x20], r9
sub cl, 0x32
xor cx, bx
or cl, bl
push rsi
push rdi
jmp 0x180129d7f
push r14
sub rsp, 0x60
movzx rcx, si
movsxd rcx, esp
mov rdi, r9
mov rsi, r8
mov cx, 0x5b8e
mov ecx, dword [rdx]
jmp 0x180129d9d
call fcn.1800899ca
nop
bt bx, r11w
mov rbx, qword [0x18007bf78]
movsxd rax, dword [0x18007bf70]
lea r14, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
test rsp, 0x26cb1144
cmp rbx, r14
jmp 0x180129dce
je 0x180129ef7
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
shl dx, cl
jmp 0x180129de4
mov rdx, qword [rsi]
clc
test rax, rax
jmp 0x180129df0
je 0x180129e4d
mov ecx, dword [rax + 0x14]
nop
rcl ax, 0xef
mov eax, ecx
test edx, 0x7cf42e0
cmp r10w, r10w
test bpl, spl
shr eax, 0xd
clc
and al, 1
jmp 0x180129e18
je 0x180129e4d
mov eax, ecx
cmp r12b, r8b
and al, 3
cmp al, 2
jne 0x180129e36
test cl, 0xc0
jne 0x180129e56
bt ecx, 0xb
jmp 0x180129e3f
jb 0x180129e56
inc dword [rdx]
cmc
jmp 0x180129e4d
add rbx, 8
jmp 0x180129dba
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov r9w, 0x4f44
movsxd r9, r14d
mov rax, qword [rsi]
bswap r9w
movzx r9, di
movzx r8w, bl
lea r8, [rsp + 0x20]
movzx r9d, sp
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
setae r9b
mov qword [rsp + 0x50], rcx
cwde
movzx rcx, dx
movzx r9w, bl
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
movzx rcx, bp
movzx r9d, r15w
cqo
mov qword [rsp + 0x30], rax
movzx dx, r12b
movsx rdx, r11w
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x40]
movsxd rdx, r8d
movsx rdx, sp
lea rdx, [rsp + 0x30]
bswap rcx
mov cx, 0x606b
lea rcx, [rsp + 0x88]
jmp 0x180129eed
call fcn.180129bd3
jmp 0x180129e4d
mov ecx, dword [rdi]
jmp 0x180129efe
call fcn.180084a95
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
cmove di, r11w
movsxd rsi, esi
movzx r14w, r15b
pop r14
movsx si, bpl
pop rdi
movzx esi, ax
pop rsi
jmp 0x180129f2d
ret
Function at 0x18012e7f3
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
cwde
cbw
jmp 0x18012e820
push r14
mov ax, di
mov eax, 0x1450
jmp 0x18012e82f
call fcn.180132078
sub rsp, rax
rol dil, 0xd2
movsx di, r13b
mov rax, qword [0x180079010]
xor rax, rsp
mov qword [rsp + 0x1440], rax
ror dil, 0x99
sal di, 0x69
sbb sil, 0x81
movsxd r10, edx
mov rdi, rcx
mov rax, r10
rcl r14b, cl
sar sil, 0x87
mov ebp, r9d
rcl esi, cl
inc ch
movzx rcx, bp
sar rax, 6
sub r14b, dl
adc dl, ch
lea rcx, [0x18007bb40]
cmovne rsi, rcx
sbb r14, rsp
and r10d, 0x3f
xor sil, bl
shl r14d, 0x85
add rbp, r8
mov rsi, r8
movzx r14d, bx
mov rax, qword [rcx + rax*8]
cqo
lea rdx, [r10 + r10*8]
test r15b, r10b
mov r14, qword [rax + rdx*8 + 0x28]
cmp r14b, r9b
test bx, 0x561a
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
clc
cmp r8, rbp
jmp 0x18012e8d0
jae 0x18012e9b5
lea rbx, [rsp + 0x40]
cmp spl, 0x87
cmp rsi, rbp
jmp 0x18012e8e7
jae 0x18012e937
mov al, byte [rsi]
inc rsi
cmc
clc
cmp al, 0xa
jmp 0x18012e8fb
jne 0x18012e914
inc dword [rdi + 8]
jmp 0x18012e909
mov byte [rbx], 0xd
inc rbx
jmp 0x18012e914
mov byte [rbx], al
mov ax, si
dec al
inc rbx
shl ah, 0x41
rol ah, cl
cbw
lea rax, [rsp + 0x143f]
clc
cmp rbx, rax
jb 0x18012e8df
and qword [rsp + 0x20], 0
rdtsc
clc
movsx r9d, cx
lea rax, [rsp + 0x40]
dec r9b
sar r9, cl
sub ebx, eax
movsxd rdx, ebx
movzx r8w, r10b
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
xchg cl, ch
mov rcx, r14
jmp 0x18012e970
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18012e9aa
mov eax, dword [rsp + 0x30]
cmp r11d, 0x4e104426
stc
clc
add dword [rdi + 4], eax
stc
cmp eax, ebx
jmp 0x18012e996
jb 0x18012e9b5
cmp rsi, rbp
jb 0x18012e8d6
jmp 0x18012e9b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
xor ah, 3
mov rax, rdi
bsr rcx, rsi
mov rcx, qword [rsp + 0x1440]
cmp cl, r12b
xor rcx, rsp
jmp 0x18012e9cf
call fcn.1801157b3
lea r11, [rsp + 0x1450]
jmp 0x18012e9e1
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
xchg r14d, edi
movzx rdi, bp
mov rsp, r11
movzx si, dl
pop r14
movsxd rsi, r11d
xchg esi, edi
pop rdi
not esi
pop rsi
jmp 0x18012ea07
ret
Function at 0x18012ea08
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movzx ax, dl
movsx eax, bx
push rsi
push rdi
bswap ax
lahf
push r14
cbw
mov eax, 0x1450
jmp 0x18012ea35
call fcn.180132078
sub rsp, rax
ror r10, 0xa
mov rax, qword [0x180079010]
xor rax, rsp
setb bpl
and di, r14w
not rdi
mov qword [rsp + 0x1440], rax
sar sil, 0x5a
add al, sil
movsxd r10, edx
add bpl, r12b
xor sil, r15b
mov rdi, rcx
mov rax, r10
bswap r14d
cwd
not r14b
mov ebp, r9d
cmp r15b, r15b
rcr r14b, cl
dec ch
sar rax, 6
neg r14b
movzx r14, sp
bts esi, edx
lea rcx, [0x18007bb40]
movsx rsi, r10w
and r10d, 0x3f
cwd
lea rbp, [rbp + r8]
movsxd r14, r13d
ror esi, cl
mov rsi, r8
bts r14, rax
shld r14w, cx, 0x6b
stc
mov rax, qword [rcx + rax*8]
sal dh, 0x2d
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x18012ead3
sub eax, eax
mov qword [rdi], rax
test r11b, r14b
mov dword [rdi + 8], eax
stc
cmp r8, rbp
jmp 0x18012eae7
jae 0x18012ec27
lea rbx, [rsp + 0x40]
cmp r8w, 0x2bd1
jmp 0x18012eafe
cmp rsi, rbp
jmp 0x18012eb06
jae 0x18012eb87
movzx eax, word [rsi]
test dx, r13w
cmp sil, r14b
add rsi, 2
cmp r13, rdx
cmc
cmp dx, 0x2a24
cmp ax, 0xa
jne 0x18012eb56
add dword [rdi + 8], 2
shld cx, r11w, 0x96
movsx rcx, r14w
mov ecx, 0xd
cmc
cmp r8, rdx
mov word [rbx], cx
stc
clc
add rbx, 2
cmc
test r8b, r13b
jmp 0x18012eb56
mov word [rbx], ax
movsx rax, bp
or eax, esp
shl al, 0xcd
add rbx, 2
bts rax, r8
movzx ax, r9b
lea rax, [rsp + 0x143e]
cmc
clc
cmp rbx, rax
jmp 0x18012eb81
jb 0x18012eafe
and qword [rsp + 0x20], 0
cmc
rcr ch, 0x94
lea rax, [rsp + 0x40]
ror r9b, cl
sub rbx, rax
lea r9, [rsp + 0x30]
bt ecx, 0xc9
sar ch, 0x92
movzx dx, al
sar rbx, 1
movsxd rcx, esp
xadd r8b, dl
lea rdx, [rsp + 0x40]
add ebx, ebx
setbe cl
cmovg r8w, r14w
movzx ecx, bx
mov rcx, r14
movsx r8, r10w
not r8b
mov r8d, ebx
jmp 0x18012ebda
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x18012ebe7
je 0x18012ec1f
mov eax, dword [rsp + 0x30]
clc
stc
add dword [rdi + 4], eax
cmp r10b, 0x12
jmp 0x18012ebff
cmp eax, ebx
jmp 0x18012ec06
jb 0x18012ec27
cmp rsi, rbp
jmp 0x18012ec14
jb 0x18012eaed
jmp 0x18012ec27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
inc cx
or rcx, 0xa7b2f0d
mov rcx, qword [rsp + 0x1440]
jmp 0x18012ec41
xor rcx, rsp
jmp 0x18012ec49
call fcn.1801157b3
lea r11, [rsp + 0x1450]
cmovbe bp, bp
setns bl
mov rbx, qword [r11 + 0x20]
movzx bp, al
setno sil
mov rbp, qword [r11 + 0x30]
movsx rdi, dx
movzx esi, r14w
mov rsp, r11
movzx r14w, dil
mov di, di
not sil
pop r14
bswap esi
pop rdi
setae sil
pop rsi
jmp 0x18012ec92
ret