joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5160
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400c8080
nop
test rbx, rbx
je 0x1400d51b6
add rbx, 0xc
mov rdx, rbx
jmp 0x1400d51b8
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140002bf0
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140002c40
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1400d5235
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400c80c0
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140120180
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x14012021d
xor eax, eax
cmp r8d, 4
jl 0x1401201d1
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x140120218
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x140120211
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x140120209
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x140120201
add rax, 4
test r8d, r8d
jle 0x1401203fa
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x140120218
inc rax
test r8d, r8d
jg 0x1401201e0
jmp 0x1401203fa
add eax, 3
jmp 0x1401203f5
add eax, 2
jmp 0x1401203f5
inc eax
jmp 0x1401203f5
jmp 0x1401203f5
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x140120336
add rax, 0x10
cmp rax, r10
jbe 0x140120240
mov eax, r8d
test al, 7
je 0x1401203fa
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1401203fa
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1401203ec
mov ecx, 0x20
jmp 0x1401203ef
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1401203dd
mov r8d, 0x20
jmp 0x1401203e1
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1401203f5
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1401264c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x140126511
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x14012673b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x140126505
inc edx
cmp edx, r9d
jl 0x1401264e5
jmp 0x14012673b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x1401ce0f0]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x14012667b
add rax, 0x10
cmp rax, r8
jb 0x140126558
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x14012673b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180002a5f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18010a170]
jne 0x1800011aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1800011a6
repz ret
ror rcx, 0x10
jmp 0x1800029b8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18010e010]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18010e108]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180002a3d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18010e010]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180002a5f
mov rax, qword [rsp + 0x88]
mov qword [0x18010e108], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18010e0a8], rax
mov rax, qword [0x18010e108]
mov qword [0x18010df80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18010e090], rax
mov dword [0x18010df70], 0xc0000409
mov dword [0x18010df74], 1
mov rax, qword [0x18010a170]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18010a178]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18010e008], eax
mov ecx, 1
call fcn.180006bd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800e34f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18010e008], 0
jne 0x180002ae6
mov ecx, 1
call fcn.180006bd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180004ba0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.180006e30
nop
cmp dword [0x18010e600], 1
je 0x180004b4c
mov dword [0x18010e5fc], 1
mov byte [0x18010e5f8], r12b
test ebx, ebx
jne 0x180004b38
mov rcx, qword [0x1801105f0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180004b25
mov rcx, qword [0x1801105e8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x180004ac4
call fcn.180003f78
cmp qword [rdi], rax
jne 0x180004ac4
jmp 0x180004aaa
cmp rdi, rsi
jb 0x180004b25
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.180003f78
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1801105f0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1801105e8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x180004b03
cmp r13, rax
je 0x180004b23
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x180004aaa
lea rdx, [0x1800e3470]
lea rcx, [0x1800e3458]
call fcn.1800048f4
lea rdx, [0x1800e3480]
lea rcx, [0x1800e3478]
call fcn.1800048f4
nop
test r12d, r12d
je 0x180004b5b
mov ecx, 8
call fcn.180006d30
test r12d, r12d
jne 0x180004b86
mov dword [0x18010e600], 1
lea ecx, [r12 + 8]
call fcn.180006d30
mov ecx, r15d
call fcn.180004888
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180004a14
Function at 0x180008e04
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180003f78
xor ebx, ebx
mov rdi, rax
cmp qword [0x18010ed30], rbx
jne 0x180008f0a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180008fdf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008fdf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18010ed30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18010ed38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18010ed40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18010ed50], rax
test rax, rax
je 0x180008f01
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18010ed48], rax
jmp 0x180008f11
mov rax, qword [0x18010ed48]
jmp 0x180008f18
mov rax, qword [0x18010ed48]
mov r11, qword [0x18010ed50]
cmp rax, rdi
je 0x180008f80
cmp r11, rdi
je 0x180008f80
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18010ed50]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180008f80
test rax, rax
je 0x180008f80
call rsi
test rax, rax
je 0x180008f7a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180008f7a
test byte [rsp + 0x38], 1
jne 0x180008f80
bts ebp, 0x15
jmp 0x180008fbe
mov rcx, qword [0x18010ed38]
cmp rcx, rdi
je 0x180008fbe
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180008fbe
call rax
mov rbx, rax
test rax, rax
je 0x180008fbe
mov rcx, qword [0x18010ed40]
cmp rcx, rdi
je 0x180008fbe
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180008fbe
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18010ed30]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180008fdf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180008fe1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18000fc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18000fe07
test rdx, rdx
je 0x18000fe07
mov r11d, dword [rcx + 4]
mov ecx, dword [rdx + 4]
mov qword [rsp + 0x30], rsi
mov esi, ecx
or esi, r11d
bt esi, 0xa
jae 0x18000fcf1
and ecx, r11d
bt ecx, 0xa
jae 0x18000fdfd
mov eax, dword [rdx + 8]
cmp dword [rdi + 8], eax
jne 0x18000fdfd
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rdi]
cmp dl, byte [rbx]
je 0x18000fd36
cmp dl, 0x5f
jne 0x18000fd0e
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.18000fc80
cmp eax, 2
jl 0x18000fd2f
cmp byte [rbx], 0x5f
jne 0x18000fdfd
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.18000fc80
cmp eax, 2
jge 0x18000fdfd
mov eax, 1
jmp 0x18000fcdc
cmp dl, 0x9a
je 0x18000fd7b
cmp dl, 0x9c
je 0x18000fd7b
mov rax, qword [rdi + 8]
test rax, rax
je 0x18000fd7b
mov r10, qword [rbx + 8]
sub r10, rax
movzx r9d, byte [rax]
movzx r8d, byte [rax + r10]
sub r9d, r8d
jne 0x18000fd66
inc rax
test r8d, r8d
jne 0x18000fd50
test r9d, r9d
je 0x18000fd7b
xor ecx, ecx
cmp dl, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x18000fcdc
xor ecx, r11d
test cl, 0x10
jne 0x18000fdfd
bt esi, 0xe
jb 0x18000fcda
bt esi, 0xb
jb 0x18000fdfd
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, ebp
call fcn.18000fc80
test eax, eax
jne 0x18000fdfd
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, ebp
call fcn.18000fc80
test eax, eax
jne 0x18000fdfd
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
call fcn.18000fbb0
test eax, eax
jne 0x18000fdfd
bt esi, 0xd
jb 0x18000fcda
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x18000fdfd
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x18000fcda
cmp ecx, ebp
jne 0x18000fdfd
test eax, eax
js 0x18000fcda
mov eax, 2
jmp 0x18000fcdc
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xor ecx, ecx
cmp rdx, rdi
mov eax, 2
cmove eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x180013370
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movzx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x1800133a2
lea r10, [0x1800e6870]
movzx edx, cl
lea ecx, [rax*8]
inc r9
movzx r8d, byte [rdx + r10]
xor r8d, ecx
mov cl, byte [r9]
xor eax, r8d
test cl, cl
jne 0x180013383
repz ret
Function at 0x18001e560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9, qword [rcx + 0x10]
mov rbx, r8
xor r8d, r8d
mov r11, rdx
mov r10, rcx
lea rdi, [0x1800e6870]
test r9, r9
je 0x18001e5ca
movzx eax, byte [rdx]
test al, al
je 0x18001e5ad
nop dword [rax]
movzx eax, al
inc rdx
movzx ecx, byte [rax + rdi]
lea eax, [r8*8]
xor ecx, eax
mov al, byte [rdx]
xor r8d, ecx
test al, al
jne 0x18001e590
mov eax, r8d
xor edx, edx
div dword [r10]
mov eax, edx
mov r8d, edx
shl rax, 4
add rax, r9
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x18001e5d2
mov r9, qword [rcx + 8]
mov r10d, dword [rcx + 4]
mov dword [rbx], r8d
test r10d, r10d
je 0x18001e64a
nop word [rax + rax]
mov rdx, qword [r9 + 0x18]
dec r10d
test rdx, rdx
jne 0x18001e5f6
mov rax, r11
neg rax
sbb edx, edx
jmp 0x18001e63e
test r11, r11
je 0x18001e642
movzx ecx, byte [rdx]
mov r8, r11
test cl, cl
je 0x18001e62d
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rdi]
cmp byte [rcx + rdi], al
jne 0x18001e62d
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18001e610
movzx eax, byte [r8]
movzx ecx, byte [rax + rdi]
movzx eax, byte [rdx]
movzx edx, byte [rax + rdi]
sub edx, ecx
test edx, edx
je 0x18001e657
mov r9, qword [r9]
test r10d, r10d
jne 0x18001e5e0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov rax, r9
ret

Function at 0x180028ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov ebp, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov r12, rdx
test ebp, ebp
jle 0x180028f8d
mov qword [rsp + 0x48], rsi
mov rsi, qword [rcx + 0x20]
mov qword [rsp + 0x50], r13
lea r13, [0x1800e6870]
cmp ebx, 2
jge 0x180028ee4
mov eax, ebx
xor eax, 1
jmp 0x180028ee6
mov eax, ebx
movsxd rdx, eax
shl rdx, 5
mov r10, qword [rdx + rsi + 0x18]
test rdi, rdi
je 0x180028f44
mov rdx, qword [rdx + rsi]
test rdx, rdx
je 0x180028f68
movzx ecx, byte [rdi]
mov r8, rdi
test cl, cl
je 0x180028f2f
nop word [rax + rax]
movzx eax, byte [rdx]
movzx ecx, cl
movzx eax, byte [rax + r13]
cmp byte [rcx + r13], al
jne 0x180028f2f
mov cl, byte [r8 + 1]
inc r8
inc rdx
test cl, cl
jne 0x180028f10
movzx eax, byte [rdx]
movzx edx, byte [rax + r13]
movzx eax, byte [r8]
movzx ecx, byte [rax + r13]
sub ecx, edx
jne 0x180028f68
lea rcx, [r10 + 0x20]
lea r8, [rsp + 0x40]
mov rdx, r12
call fcn.18001e560
test rax, rax
je 0x180028f65
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x180028f72
jmp 0x180028f68
xor r9d, r9d
inc ebx
cmp ebx, ebp
jl 0x180028ed8
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rax, r9
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
mov rax, r9
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x180028fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov ebp, dword [rcx + 0x28]
xor r10d, r10d
xor ebx, ebx
mov rdi, r8
mov r12, rdx
mov rsi, rcx
test ebp, ebp
jle 0x1800290ad
mov qword [rsp + 0x48], r13
lea r13, [0x1800e6870]
cmp ebx, 2
jge 0x180028ff5
mov r9d, ebx
xor r9d, 1
jmp 0x180028ff8
mov r9d, ebx
test rdi, rdi
je 0x180029054
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x180029088
movzx ecx, byte [rdi]
mov r8, rdi
test cl, cl
je 0x18002903f
nop dword [rax + rax]
movzx eax, byte [rdx]
movzx ecx, cl
movzx eax, byte [rax + r13]
cmp byte [rcx + r13], al
jne 0x18002903f
mov cl, byte [r8 + 1]
inc r8
inc rdx
test cl, cl
jne 0x180029020
movzx eax, byte [rdx]
movzx edx, byte [rax + r13]
movzx eax, byte [r8]
movzx ecx, byte [rax + r13]
sub ecx, edx
jne 0x180029088
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
lea r8, [rsp + 0x40]
shl rcx, 5
mov rdx, r12
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.18001e560
test rax, rax
je 0x180029085
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x180029092
jmp 0x180029088
xor r10d, r10d
inc ebx
cmp ebx, ebp
jl 0x180028fe7
mov r13, qword [rsp + 0x48]
mov rax, r10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
mov rax, r10
jmp 0x18002909a
Function at 0x18002e170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, edx
mov edi, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova edi, ecx
cmp edi, dword [rbx]
jne 0x18002e1a4
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18010f148]
test rax, rax
je 0x18002e1b2
call rax
mov ecx, edi
shl rcx, 4
call fcn.18002ad40
mov rcx, qword [0x18010f150]
mov rdi, rax
test rcx, rcx
je 0x18002e1ce
call rcx
test rdi, rdi
je 0x18002e197
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call sym.SQLite.Interop.dll_sqlite3_free
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x18010b5a0]
xor edx, edx
mov rcx, rdi
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rbx], esi
shl r8, 4
call fcn.180003c00
mov r8, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test r8, r8
je 0x18002e2e1
mov qword [rsp + 0x30], rbp
lea rbp, [0x1800e6870]
nop dword [rax + rax]
mov r9, qword [r8 + 0x18]
mov eax, r11d
movzx ecx, byte [r9]
test cl, cl
je 0x18002e25c
nop
movzx ecx, cl
inc r9
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r9]
xor eax, edx
test cl, cl
jne 0x18002e240
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rdi
je 0x18002e2b4
mov eax, dword [r9]
test eax, eax
je 0x18002e27c
mov rcx, qword [r9 + 8]
jmp 0x18002e27f
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x18002e2b4
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x18002e2aa
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x18002e2d0
mov qword [rbx + 8], r8
mov qword [rcx + 8], r8
jmp 0x18002e2d0
mov rax, qword [rbx + 8]
mov qword [r8], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x18002e2c8
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rbx + 8], r8
mov r8, r10
test r10, r10
jne 0x18002e230
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18002eb80
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, r9
mov edi, r8d
mov rbp, rdx
mov r12, rcx
test r9, r9
jne 0x18002ebe7
call sym.SQLite.Interop.dll_sqlite3_initialize
test eax, eax
jne 0x18002ec6f
lea ecx, [rsi + 0x30]
call fcn.18002ad40
mov rbx, rax
test rax, rax
je 0x18002ec6f
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
jmp 0x18002ebea
mov rbx, r9
cmp edi, 0xffffffff
jne 0x18002ebf5
mov edi, dword [rbp + 0xbc]
mov rcx, qword [rbx + 0x20]
mov qword [rbx], rbp
lea rbp, [rbx + 0x28]
mov dword [rbp], edi
mov dword [rbx + 0x18], edi
xor edi, edi
test rcx, rcx
je 0x18002ec16
call sym.SQLite.Interop.dll_sqlite3_free
mov qword [rbx + 0x20], rdi
mov eax, dword [rbp]
xor r9d, r9d
xor edx, edx
add eax, eax
lea r8d, [r9 + 1]
mov rcx, r12
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebp, dword [rbp]
add ebp, 0x10
call sym.SQLite.Interop.dll_sqlite3_initialize
test eax, eax
jne 0x18002ec59
test ebp, ebp
jle 0x18002ec59
movsxd rcx, ebp
call fcn.18002ad40
mov rdi, rax
mov qword [rbx + 0x20], rdi
test rdi, rdi
jne 0x18002ec73
cmp rbx, rsi
je 0x18002ec6f
mov rcx, rbx
call sym.SQLite.Interop.dll_sqlite3_free
xor eax, eax
jmp 0x18002ec76
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret