joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018770
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
in al, dx
jo case.0x140010853.227
mov eax, edx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140021630
add byte [rax], al
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
invalid
je case.0x140010853.197
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140022ca0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
jne case.0x1400115b2.228
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je case.0x1400108fd.206
test rdi, rdi
je 0x140018836
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140004ae0
xor eax, eax
jmp case.0x14000f6fe.245
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je case.0x14000f6fe.245
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140004ae0
jmp case.0x140010853.197
xor eax, eax
jmp case.0x14000f6fe.245

Function at 0x140018840
Capabilities:
Move file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
in al, dx
add byte [rax], 0
invalid
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.140021630
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1400188b6
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x48]
mov r8b, 1
call fcn.140022ca0
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
cmp rax, rbx
jne 0x1400188c7
mov rax, rdx
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x30]
mov rdx, rdi
mov r8, rsi
call fcn.140021630
mov rax, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
cmp rax, rbx
je case.0x140010de0.222
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x48]
mov r8b, 1
call fcn.140022ca0
mov rdi, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x58]
cmp rdi, rbx
jne case.0x140011bb9.106
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rsi
mov rcx, qword [rbp - 0x18]
Function at 0x140018d40
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x14007b238]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140018d78
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140018dda
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140018de5
xor edx, edx
jmp 0x140018df5
cmp eax, 0x103
je 0x140018e20
test eax, eax
js 0x140018e00
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14007b298]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.14000fe30
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.140008c10
mov ecx, 7
int 0x29
ud2

Function at 0x140018e90
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x14007b238]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140018ec8
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140018f31
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140018f65
test eax, eax
js 0x140018f45
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14007b298]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.14000fe30
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.140008c10
mov ecx, 7
int 0x29
ud2
Function at 0x14001ae90
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14001b003
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x14001aec7
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x14001afc8
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x14001afe6
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x14001af29
mov eax, dword [rsp + 0x2c]
mov ecx, 2
test rax, rax
je 0x14001af6e
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x14001af72
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x40], rax
movabs rcx, 0xffffffff00000000
and rcx, rax
movabs rdx, 0x6d00000000
cmp rcx, rdx
je 0x14001af76
movabs rdx, 0x3e500000000
cmp rcx, rdx
jne 0x14001afa5
lea rax, [rsp + 0x30]
jmp 0x14001af84
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x14001afab
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.1400085e0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
cmp rcx, 2
jne 0x14001afb5
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
test rcx, rcx
jne 0x14001af12
mov ecx, 1
jmp 0x14001af1c
mov r8d, 0x10
mov rcx, rbx
call fcn.140031380
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x14001aed4
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.140031380
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x14001aed4
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140031330
int3
Function at 0x14001f3d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140021630
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movabs r14, 0x8000000000000000
cmp rcx, r14
jne case.0x140018be6.129
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
jmp 0x14001f43a
Function at 0x140020d20
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140087141]
mov ecx, 0x10
mov edx, 8
call fcn.140004ad0
test rax, rax
je 0x140020dff
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140020eb0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140020df1
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov eax, dword [rbx + 8]
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
adc byte [rax], al
add byte [rax], al
Function at 0x14002f530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002f5aa
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002f5a0
cmp r11, r10
ja 0x14002f635
cmp r10, rdx
ja 0x14002f647
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14002f5a2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002f580
jmp 0x14002f617
ja 0x14002f5aa
mov r11, r10
cmp rax, r8
jne 0x14002f552
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002f61b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002f5f0
mov r8, r10
sub ecx, r9d
jns 0x14002f60e
jmp 0x14002f61d
cmp r10, rdx
je 0x14002f629
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002f61d
xor al, 1
cmp r8, rdx
jne 0x14002f5d0
jmp 0x14002f61d
xor eax, eax
jmp 0x14002f61d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140032080
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140032580
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140032570
int3

Function at 0x140030cf0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140030d3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140030d3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140030d3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140030d3a
cmp dword [rcx + 0x84], 0xe
jbe 0x140030d3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140030d3c
xor al, al
add rsp, 0x28
ret
Function at 0x180002454
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x18009fe60]
xor r8d, r8d
mov r9, qword [0x1800c6ca8]
movabs rbx, 0x8fb823ee08fb823f
mov dword [rsp + 0x30], eax
movzx eax, word [0x18009fe64]
mov word [rsp + 0x34], ax
mov al, byte [0x18009fe66]
mov byte [rsp + 0x36], al
mov rax, rbx
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, 0x30
xor byte [rsp + r8 + 0x30], al
inc r8
cmp r8, 7
jb 0x18000248e
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0001
call r9
test rax, rax
jne 0x18000252b
mov eax, dword [str.TmAA6]
xor r8d, r8d
mov r9, qword [0x1800c6cb0]
mov dword [rsp + 0x30], eax
movzx eax, word [0x18009fe6c]
mov word [rsp + 0x34], ax
mov al, byte [0x18009fe6e]
mov byte [rsp + 0x36], al
mov rax, rbx
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, 0x30
xor byte [rsp + r8 + 0x30], al
inc r8
cmp r8, 7
jb 0x1800024f1
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call r9
test rax, rax
je 0x18000252b
mov al, 1
jmp 0x180002535
xor ecx, ecx
call qword [0x1800c6bf0]
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180002dc4
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1800c69f0], eax
test eax, eax
je 0x180002e1b
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x180002e3c
mov rdx, qword [rbx + 8]
lea rcx, [method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1800041bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov eax, dword [0x1800a0470]
xor ebx, ebx
movsd xmm0, qword [str.YAZ_DTF]
mov r8d, ebx
mov dword [rsp + 0x28], eax
movabs rdi, 0x8fb823ee08fb823f
mov al, byte [0x1800a0474]
mov byte [rsp + 0x2c], al
movsd qword [rsp + 0x20], xmm0
mov rax, rdi
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, 0x30
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 0xd
jb 0x1800041f7
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
test rax, rax
je 0x180004285
movups xmm0, xmmword [str.wTFrPTFC_KIrR_Q___WRAA]
mov r9, qword [0x1800c6b18]
movdqu xmmword [rsp + 0x2d], xmm0
psrldq xmm0, 0xf
movd ecx, xmm0
test cl, cl
je 0x180004273
mov rax, rdi
mul rbx
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x39
mov al, bl
sub al, cl
add al, 0x30
xor byte [rsp + rbx + 0x2d], al
inc rbx
cmp rbx, 0x10
jb 0x180004250
lea rdx, [rsp + 0x2d]
mov rcx, r8
call r9
mov qword [0x1800c6d50], rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180005594
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov eax, dword [0x1800a0490]
xor ebx, ebx
movsd xmm0, qword [0x1800a0488]
mov r8d, ebx
mov dword [rsp + 0x28], eax
movabs rdi, 0x8fb823ee08fb823f
mov al, byte [0x1800a0494]
mov byte [rsp + 0x2c], al
movsd qword [rsp + 0x20], xmm0
mov rax, rdi
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, 0x30
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 0xd
jb 0x1800055cf
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
test rax, rax
je 0x180005665
cmp byte [0x1800a04af], bl
movups xmm0, xmmword [str.cHAGQXbU_nTjLV__6]
mov r9, qword [0x1800c6b18]
movsd xmm1, qword [0x1800a04a8]
movups xmmword [rsp + 0x2d], xmm0
movsd qword [rsp + 0x3d], xmm1
je 0x180005653
mov rax, rdi
mul rbx
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x39
mov al, bl
sub al, cl
add al, 0x30
xor byte [rsp + rbx + 0x2d], al
inc rbx
cmp rbx, 0x18
jb 0x180005630
lea rdx, [rsp + 0x2d]
mov rcx, r8
call r9
mov qword [0x1800c6d58], rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180007908
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, r9d
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
call fcn.18000732c
test ebx, ebx
je 0x1800079e7
mov ecx, dword [rdi + 0x1af88]
lea eax, [rcx + 3]
cmp eax, dword [rdi + 0x1af8c]
jb 0x180007961
mov rdx, qword [rdi + 0x1af80]
mov r8d, ecx
mov rcx, qword [rdi]
call fcn.18000d720
and dword [rdi + 0x1af88], 0
xor ecx, ecx
mov rax, qword [rdi + 0x1af80]
mov byte [rcx + rax], sil
movzx ecx, si
inc dword [rdi + 0x1af88]
mov edx, dword [rdi + 0x1af88]
mov rax, qword [rdi + 0x1af80]
shr cx, 8
mov byte [rdx + rax], cl
mov cl, sil
inc dword [rdi + 0x1af88]
not cl
mov edx, dword [rdi + 0x1af88]
mov rax, qword [rdi + 0x1af80]
mov byte [rdx + rax], cl
movzx ecx, si
inc dword [rdi + 0x1af88]
not cx
mov edx, dword [rdi + 0x1af88]
mov rax, qword [rdi + 0x1af80]
shr cx, 8
mov byte [rdx + rax], cl
inc dword [rdi + 0x1af88]
mov r8d, dword [rdi + 0x1af88]
mov rdx, qword [rdi + 0x1af80]
mov rcx, qword [rdi]
call fcn.18000d720
and dword [rdi + 0x1af88], 0
mov rcx, qword [rdi]
mov r8d, esi
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18000d720

Function at 0x180007a0c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, ecx
test rdx, rdx
jne 0x180007a1d
xor eax, eax
jmp 0x180007a89
lea rbx, [0x1800a1b70]
not r9d
cmp r8d, 8
jb 0x180007a61
mov r10d, r8d
shr r10, 3
mov r11d, 8
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r11, 1
jne 0x180007a3a
add r8d, 0xfffffff8
sub r10, 1
jne 0x180007a34
test r8d, r8d
je 0x180007a83
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
add r8d, 0xffffffff
jne 0x180007a66
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
ret

Function at 0x180007a90
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x20], 0
mov edi, edx
mov dword [rax - 0x28], 0x18
mov rsi, rcx
mov dword [rax - 0x18], 1
mov al, byte [rcx]
test al, al
je 0x180007aca
cmp byte [rcx + 1], 0x3a
jne 0x180007aca
add rcx, 2
mov al, byte [rcx]
mov dl, al
cmp al, 0x5c
jne 0x180007ad3
mov dl, byte [rcx + 1]
lea rbx, [rcx + 1]
cmovne rbx, rcx
test dl, dl
je 0x180007b2e
mov al, byte [rbx]
test al, al
je 0x180007af8
cmp al, 0x5c
je 0x180007aee
inc rbx
jmp 0x180007adf
test rbx, rbx
je 0x180007afa
mov byte [rbx], 0
jmp 0x180007afe
xor ebx, ebx
test edi, edi
je 0x180007b2e
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x180007b1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180007b43
test rbx, rbx
je 0x180007b2e
mov byte [rbx], 0x5c
inc rbx
mov al, byte [rbx]
test al, al
jne 0x180007ae1
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x180007b4b
mov byte [rbx], 0x5c
xor eax, eax
jmp 0x180007b33
Function at 0x180007b50
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
xor ebp, ebp
mov dword [rax - 0x28], 0x18
mov qword [rax - 0x20], rbp
mov edi, edx
mov dword [rax - 0x18], 1
mov rsi, rcx
movzx eax, word [rcx]
test ax, ax
je 0x180007b98
cmp word [rcx + 2], 0x3a
jne 0x180007b98
add rcx, 4
movzx eax, word [rcx]
mov r14d, 0x5c
movzx edx, ax
cmp ax, r14w
jne 0x180007bab
movzx edx, word [rcx + 2]
lea rbx, [rcx + 2]
cmovne rbx, rcx
test dx, dx
je 0x180007c11
movzx eax, word [rbx]
test ax, ax
je 0x180007bd6
cmp ax, r14w
je 0x180007bcc
add rbx, 2
jmp 0x180007bb8
test rbx, rbx
je 0x180007bd9
mov word [rbx], bp
jmp 0x180007bdd
mov rbx, rbp
test edi, edi
je 0x180007c11
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180007bfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180007c31
test rbx, rbx
je 0x180007c11
mov word [rbx], r14w
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x180007bbb
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
test rbx, rbx
je 0x180007c3a
mov word [rbx], r14w
xor eax, eax
jmp 0x180007c16
Function at 0x180009424
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x88]
lea rdx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x180009458
mov eax, 1
jmp 0x180009675
mov r8d, dword [rbp - 0x38]
mov eax, r8d
mov r9d, r8d
and r9d, 1
mov ecx, r9d
or ecx, 2
and al, 2
mov eax, r8d
cmove ecx, r9d
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov ecx, r8d
mov eax, edx
or eax, 0x10
and ecx, 0x10
cmove eax, edx
mov edx, eax
or edx, 0x20
and r8b, 0x20
cmove edx, eax
mov eax, ecx
neg eax
mov eax, 0xc0000000
sbb edi, edi
and edi, eax
add edi, 0x81000000
or edi, edx
test r9d, r9d
jne 0x1800094c1
neg ecx
sbb edi, edi
and edi, eax
add edi, 0x81800000
or edi, edx
mov rcx, qword [rbx + 0x88]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov qword [rbx + 0x70], rax
cmp rax, 0x28
jbe 0x1800095db
cmp qword [rbx + 0x20], 0
jne 0x1800095db
mov rcx, qword [rbx + 0x88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x88]
lea r9, [rbp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rbp + 0x20]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbx + 0x88]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x88]
lea r9, [rbp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rbp + 0x38]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [rbp + 0x20], ax
jne 0x1800095c6
mov edx, dword [rbp + 0x38]
lea ecx, [rdx + 0x34]
cmp qword [rbx + 0x70], rcx
jbe 0x1800095c6
mov rcx, qword [rbx + 0x88]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x88]
lea r9, [rbp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rbp - 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x40]
cmp eax, 0x5a4d
je 0x1800095c2
add eax, 0xffffbab4
cmp eax, 4
ja 0x1800095c6
mov ecx, reloc.WS2_32.dll_setsockopt
bt ecx, eax
jae 0x1800095c6
bts edi, 0x16
mov rcx, qword [rbx + 0x88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbp - 0x2c]
movabs r9, 0xd6bf94d5e57a42bd
movabs r8, 0xfe624e212ac18000
mov dword [rsi + 0x10], edi
add rcx, r8
mov rax, r9
imul rcx
add rdx, rcx
mov rcx, qword [rbp - 0x24]
sar rdx, 0x17
add rcx, r8
add r8, qword [rbp - 0x34]
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r9
mov dword [rsi], edx
imul rcx
mov rax, r9
add rdx, rcx
sar rdx, 0x17
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
lea rcx, [rbp - 0x24]
mov dword [rsi + 4], edx
imul r8
add rdx, r8
lea r8, [rbp + 0x30]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [rsi + 8], edx
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx eax, word [rbp + 0x30]
movzx ecx, word [rbp + 0x20]
shl ecx, 0x10
or ecx, eax
mov dword [rsi + 0xc], ecx
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000b928
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14d, edx
mov rdi, rcx
mov byte [rcx + 0x6afbd], 1
mov dword [rcx + 0x6af90], 0x10000
xor ebx, ebx
mov dword [rcx + 0x6af8c], ebx
xor edx, edx
add rcx, 0x4af90
mov r8d, 0x1fffc
call fcn.180056d30
lea rcx, [0x1800a19a0]
movzx eax, word [rcx + r14*8 + 2]
lea ebp, [rbx + 2]
mov dword [rdi + 0x6afb0], eax
movzx eax, word [rcx + r14*8]
mov dword [rdi + 0x6afb4], eax
movzx eax, word [rcx + r14*8 + 4]
mov dword [rdi + 0x6afb8], eax
movzx eax, word [rcx + r14*8 + 6]
mov dword [rdi + 0x6afac], eax
cmp r14d, ebp
ja 0x18000b9bb
or word [rsi], 4
jmp 0x18000b9c4
cmp r14d, 8
jb 0x18000b9c4
or word [rsi], bp
mov rcx, qword [rdi]
lea rsi, [rdi + 0x1af90]
mov rdx, rsi
mov r8d, 0x10000
call fcn.18000c5bc
mov dword [rdi + 0x6afa8], eax
test eax, eax
je 0x18000ba2a
mov byte [rdi + 0x6afbc], bl
mov dword [rdi + 0x6af94], ebx
mov dword [rdi + 0x6afa0], ebx
cmp eax, 0x106
jae 0x18000ba07
mov rcx, rdi
call fcn.180008770
mov dword [rdi + 0x6af98], ebx
movzx eax, byte [rsi]
inc rsi
shl ebx, 5
xor ebx, eax
and ebx, 0x7fff
mov dword [rdi + 0x6af98], ebx
sub rbp, 1
jne 0x18000ba0d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret