joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004a180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov sil, byte [rdx + 0x100]
mov bpl, byte [rdx + 0x101]
xor r11d, r11d
mov rdi, r9
mov rbx, r8
mov r10, rdx
test r9, r9
je 0x18004a245
nop word [rax + rax]
movzx eax, sil
movzx ecx, bpl
inc eax
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r8d, al
mov esi, eax
add r8, r10
movzx eax, byte [r8]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r9d, al
mov ebp, eax
add r9, r10
cmp r8, r9
je 0x18004a20b
movzx ecx, byte [r9]
movzx edx, byte [r8]
mov byte [r8], cl
mov byte [r9], dl
movzx ecx, byte [r8]
movzx eax, byte [r9]
inc r11
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx ecx, al
movzx eax, byte [rcx + r10]
xor byte [r11 + rbx - 1], al
cmp r11, rdi
jne 0x18004a1c0
mov byte [r10 + 0x100], sil
mov byte [r10 + 0x101], bpl
jmp 0x18004a253
mov byte [rdx + 0x100], sil
mov byte [rdx + 0x101], bpl
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x18004a590
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x18004a5be
nop dword [rax]
cmp byte [rcx + r9 - 1], 0x3d
jne 0x18004a5be
sub r9, 1
jne 0x18004a5b0
mov rbx, r9
xor r11d, r11d
and r9d, 3
shr rbx, 2
mov r8, r11
lea rsi, [0x18012eb40]
test rbx, rbx
je 0x18004a656
nop dword [rax + rax]
movsx rax, byte [r10 + r8]
add r11, 3
add r8, 4
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 3]
movzx ecx, byte [rax + rsi]
shl dl, 2
sar cl, 4
and cl, 3
or dl, cl
mov byte [rdi + r11 - 3], dl
movsx rax, byte [r10 + r8 - 2]
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 3]
movzx ecx, byte [rax + rsi]
sar dl, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [rdi + r11 - 2], dl
movsx rax, byte [r10 + r8 - 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 2]
movzx ecx, byte [rax + rsi]
and dl, 0x3f
shl cl, 6
or dl, cl
sub rbx, 1
mov byte [rdi + r11 - 1], dl
jne 0x18004a5e0
sub r9, 2
je 0x18004a6aa
cmp r9, 1
jne 0x18004a6cc
movsx rax, byte [r8 + r10 + 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10]
movzx ecx, byte [rax + rsi]
sar dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [r11 + rdi], dl
movsx rax, byte [r8 + r10 + 2]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10 + 1]
movzx ecx, byte [rax + rsi]
sar dl, 2
shl cl, 4
and dl, 0xf
or dl, cl
mov byte [r11 + rdi + 1], dl
jmp 0x18004a6cc
movsx rax, byte [r8 + r10 + 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10]
movzx ecx, byte [rax + rsi]
sar dl, 4
shl cl, 2
and dl, 3
or dl, cl
mov byte [r11 + rdi], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18004a6f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x18004a722
lea rax, [rcx + rdx*2 - 2]
cmp word [rax], 0x3d
jne 0x18004a722
sub rax, 2
sub r9, 1
jne 0x18004a712
mov r8, r9
xor ebx, ebx
and r9d, 3
shr r8, 2
mov r11, rbx
lea rbp, [0x18012ec40]
test r8, r8
je 0x18004a7d2
mov qword [rsp + 0x30], rsi
lea r11, [r8*4]
lea rsi, [rcx + 2]
nop word [rax + rax]
movzx eax, word [rsi]
add rbx, 3
add rsi, 8
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 0xa]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [rdi + rbx - 3], dl
movzx eax, word [rsi - 6]
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 8]
movzx ecx, byte [rbp + rax*2]
shr dl, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [rdi + rbx - 2], dl
movzx eax, word [rsi - 4]
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 6]
movzx ecx, byte [rbp + rax*2]
and dl, 0x3f
shl cl, 6
or dl, cl
sub r8, 1
mov byte [rdi + rbx - 1], dl
jne 0x18004a760
mov rsi, qword [rsp + 0x30]
sub r9, 2
je 0x18004a828
cmp r9, 1
jne 0x18004a84b
movzx eax, word [r10 + r11*2 + 2]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [rbx + rdi], dl
movzx eax, word [r10 + r11*2 + 4]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2 + 2]
movzx ecx, byte [rbp + rax*2]
shr dl, 2
shl cl, 4
and dl, 0xf
or dl, cl
mov byte [rbx + rdi + 1], dl
jmp 0x18004a84b
movzx eax, word [r10 + r11*2 + 2]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
shl cl, 2
and dl, 3
or dl, cl
mov byte [rbx + rdi], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18004fb90
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x58]
mov rbx, r9
mov qword [rsp + 0x38], rcx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, r10
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18004fbe4
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x60
pop rbx
ret

Function at 0x18004fc30
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x180176020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov r10, r8
mov rax, rdx
mov rdi, qword [rsp + 0xb0]
lea rcx, [r11 - 0x30]
mov qword [r11 - 0x48], rcx
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x50], rcx
xor ecx, ecx
mov qword [r11 - 0x58], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, r10
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18004fcad
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x18004fd00
mov rax, qword [rdi + 0x18]
cmp qword [rdi + 0x20], 8
jb 0x18004fcbe
mov rcx, qword [rdi + 8]
jmp 0x18004fcc2
lea rcx, [rdi + 8]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800e9d70
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x18004fd20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rbp, r9
mov rdi, r8
mov rsi, rdx
mov dword [rsp + 0x30], 0x9c40
lea rax, [r11 - 0x48]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
add rcx, 2
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18004fdc9
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
xor al, al
jmp 0x18004fe24
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
test rbx, rbx
je 0x18004fde9
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
nop
lea rax, [rsp + 0x48]
cmp rbp, rax
je 0x18004fe0e
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18004fe40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov r10, rdx
mov rax, r8
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rcx
mov rcx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18004fe91
xor al, al
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x18004ffa0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ecx, 0x13880
mov rdi, r9
mov rsi, r8
mov rbp, rdx
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
cmp qword [rdi], 0
mov rbx, rax
jne 0x18004ffef
mov rcx, qword [rbp]
mov r9d, 8
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005001f
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rdi]
mov r9d, 0x9c3f
mov edx, dword [rsi]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x180050030
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], 0
test rbx, rbx
je 0x18005002c
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
xor al, al
jmp 0x180050053
test eax, eax
jne 0x18005001f
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
inc dword [rsi]
test rbx, rbx
je 0x180050051
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800502c0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov r9d, 0xf003f
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005030b
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret

Function at 0x180050330
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x38]
mov rdi, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov r9d, 1
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1800503fd
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x30], 0x9c40
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
movsxd r11, dword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
add r11, 2
mov eax, 2
mul r11
cmovo rax, rcx
mov rcx, rax
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r11, rbx
sub rdi, rbx
movzx eax, word [r11]
add r11, 2
mov word [rdi + r11 - 2], ax
test ax, ax
jne 0x1800503d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180067d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x180067d94
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18017a480]
test rax, rax
je 0x180067da2
call rax
shl ebx, 4
mov ecx, ebx
call fcn.180064180
mov rcx, qword [0x18017a488]
mov rbx, rax
test rcx, rcx
je 0x180067dbd
call rcx
test rbx, rbx
je 0x180067d87
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.1800644f0
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x180176690]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call sub.MSVCR90.dll_memset
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x180067ed3
mov qword [rsp + 0x30], rbp
lea rbp, [0x18012ad60]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x180067e4e
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x180067e30
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x180067ea6
mov eax, dword [r9]
test eax, eax
je 0x180067e6e
mov rcx, qword [r9 + 8]
jmp 0x180067e71
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x180067ea6
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x180067e9c
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x180067ec2
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x180067ec2
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x180067eba
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x180067e20
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180068050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x18012ad60]
test r10d, r10d
je 0x1800680b9
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x1800680af
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x180068090
xor edx, edx
div r10d
mov r13d, edx
jmp 0x1800680bc
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.180067ef0
mov r11, rax
test rax, rax
je 0x18006815f
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x18006814f
mov rax, qword [rax + 8]
test rax, rax
je 0x1800680f8
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x1800680ff
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x18006810f
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x180068131
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x18006812f
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.1800644f0
add dword [rbx + 4], 0xffffffff
jne 0x180068157
mov rcx, rbx
call fcn.180067c90
mov rax, rdi
jmp 0x180068226
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x180068226
test r12, r12
je 0x180068224
mov ecx, 0x28
call fcn.180064180
mov rdi, rax
test rax, rax
jne 0x180068182
mov rax, r12
jmp 0x180068226
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x1800681e4
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1800681e4
add edx, edx
mov rcx, rbx
call fcn.180067d60
test eax, eax
je 0x1800681e4
xor eax, eax
test esi, esi
jle 0x1800681dd
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x1800681c0
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x180068204
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.180067cf0
jmp 0x180068224
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x180068218
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x18006a110
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rsi, rdx
mov ebx, r12d
mov edi, r12d
call fcn.180068250
mov rcx, rsi
test eax, eax
je 0x18006a14c
call fcn.1800682c0
mov rbp, rax
jmp 0x18006a171
call fcn.1800682c0
mov rsi, rax
test rax, rax
je 0x18006a218
mov rcx, rax
call fcn.1800684a0
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.MSVCR90.dll_free]
test rbp, rbp
je 0x18006a218
call fcn.180068250
test eax, eax
je 0x18006a1c0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18006a1a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x18006a1fa
inc ebx
cmp ebx, 5
jge 0x18006a1fa
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006a183
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18006a1e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x18006a1fa
inc ebx
cmp ebx, 5
jge 0x18006a1fa
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006a1c0
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_free]
cmp esi, 0xffffffff
jne 0x18006a20d
cmp edi, 2
je 0x18006a213
mov r12d, 0xa0a
mov eax, r12d
jmp 0x18006a21d
mov eax, 7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18006a510
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x180176020]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.18006a380
test eax, eax
jne 0x18006a6d2
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.180068250
xor esi, esi
test eax, eax
je 0x18006a57e
lea rcx, [rsp + 0x40]
call fcn.1800682c0
mov rbx, rax
jmp 0x18006a629
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call qword [sym.imp.MSVCR90.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18006a5e0
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18006a615
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_free]
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800e9d70
add rsp, 0x168
ret
mov rcx, rdi
call fcn.1800684a0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCR90.dll_free]
test rbx, rbx
je 0x18006a5e0
call fcn.180068250
test eax, eax
je 0x18006a67a
mov rax, rbx
cmp word [rbx], si
je 0x18006a654
nop
cmp word [rax], 0x5c
je 0x18006a651
add rax, 2
cmp word [rax], si
jne 0x18006a640
jmp 0x18006a654
mov word [rax], si
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edi, eax
jmp 0x18006a6b8
mov rax, rbx
cmp byte [rbx], sil
je 0x18006a694
cmp byte [rax], 0x5c
je 0x18006a691
inc rax
cmp byte [rax], sil
jne 0x18006a682
jmp 0x18006a694
mov byte [rax], sil
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_free]
test edi, edi
je 0x18006a5e0
mov eax, dword [rsp + 0x34]
jmp 0x18006a5e5
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800e9d70
add rsp, 0x168
ret
Function at 0x18009a3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18009a52e
test rdx, rdx
je 0x18009a52e
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x18009a49b
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x18009a49b
xor cl, dl
test cl, 0x10
jne 0x18009a49b
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x18009a49b
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.18009a3d0
test eax, eax
jne 0x18009a49b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.18009a3d0
test eax, eax
jne 0x18009a49b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.18009a550
test eax, eax
jne 0x18009a49b
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x18009a49b
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x18009a49b
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x18009a4ab
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x18009a49b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x18009a4e7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x18009a4e7
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18009a4e7
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x18009a49b
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x18009a49b
call fcn.1800670c0
test eax, eax
je 0x18009a4e7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x18009a50d
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x18009a521
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x18009a49b
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret