joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012b000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movzx eax, byte [rcx]
mov byte [rsp + 0x38], al
movdqu xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
mov rbp, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
cmp rbp, r15
je 0x18012b08c
mov rbx, r15
sub rbx, rbp
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800afe40
mov rsi, qword [rsp + 0x40]
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.18020b840
sub rsi, rbp
add rsi, r15
mov qword [rsp + 0x48], rsi
jmp 0x18012b091
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], 1
mov rdx, qword [rsp + 0x40]
mov eax, dword [r14 + 0x20]
not eax
add eax, eax
xor eax, dword [r14 + 0x20]
mov dword [rsp + 0x30], eax
sub rsi, rdx
je 0x18012b0d6
nop word [rax + rax]
mov rax, rdi
and eax, 3
movzx eax, byte [rsp + rax + 0x30]
xor byte [rdx + rdi], al
inc rdi
cmp rdi, rsi
jb 0x18012b0c0
mov rcx, qword [r13 + 0x38]
test rcx, rcx
je 0x18012b12c
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
sub rcx, rdi
xor eax, eax
rep stosb byte [rdi], al
lea rcx, [rsp + 0x38]
call fcn.1800b0070
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.1801e75e0
nop
int3

Function at 0x18012b6c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rbx, [rcx + 0xee4]
cmp byte [rbx], 0
jne 0x18012b7ba
xor esi, esi
mov qword [rsp + 0x30], rsi
call fcn.18012c8c0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800fd270
nop
cmp byte [rbx], sil
jne 0x18012b7b0
cmp qword [rdi + 0xee8], rsi
jne 0x18012b74b
lea ecx, [rsi + 8]
call fcn.1801e6190
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18012b744
xor ecx, ecx
mov qword [rax], rcx
mov rcx, rax
call fcn.1800fd230
mov rsi, rax
mov qword [rdi + 0xee8], rsi
mov qword [rsp + 0x20], rbx
mov byte [0x18029b160], 0xf0
mov rcx, rdi
call fcn.18013c9d0
test al, al
jne 0x18012b774
mov byte [rbx], 1
lea rcx, [rsp + 0x30]
call fcn.1800fd2c0
xor al, al
jmp 0x18012b7bc
jmp 0x18012b780
mov rcx, rdi
call fcn.18012b930
call fcn.18014beb0
test al, al
jne 0x18012b79d
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.18014aa10
mov rcx, rax
xor edx, edx
call fcn.18014bdb0
nop
mov byte [rbx], 1
lea rcx, [rsp + 0x30]
call fcn.1800fd2c0
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180135df0
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.180135e40
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x180135e32
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x180135e2c
add rsp, 0x30
pop rbx
ret
mov qword [rbx + 0x18], rax
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180141c90
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.1800b0a40
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x101
lea rcx, [rsp + 0x70]
call fcn.18020bef0
mov dword [rsp + 0x24], 0x101
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x180141da3
mov r8d, dword [rsp + 0x24]
dec r8d
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rdi, [0x1800567d8]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.1800f1680
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1800f2a40
nop
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180141da3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180141d9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180141e68
call fcn.1801e61d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800f88b0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], sendto
mov byte [rsp + 0x28], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180141dd0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180099770
nop
lea rcx, [rbx + 0x1d0]
lea rdx, [rsp + 0x28]
call fcn.180186650
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180141e34
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180141e2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180141e62
call fcn.1801e61d0
nop
lea rcx, [rsp + 0x50]
call fcn.180092860
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18010fa40
nop
call fcn.18010fa40
int3
Function at 0x180142b40
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x140
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx eax, byte [rcx + 0x2d0]
mov rsi, rcx
test al, al
jne 0x180142bfe
mov qword [r11 + 0x10], rbx
lea rcx, [rsp + 0x30]
mov qword [r11 + 0x18], rbp
xor edx, edx
xor ebp, ebp
mov qword [r11 + 0x20], rdi
mov r8d, pe_nt_image_headers64
movzx ebx, bp
call fcn.18020bef0
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea rcx, [0x18006c6c0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x180142be4
lea ecx, [rdi - 1]
cmp ecx, 0x1e
ja 0x180142be4
mov ecx, ebp
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6d0]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180142c17
cmp rcx, 8
jne 0x180142bd0
xor al, al
mov rbp, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x140
pop rsi
ret
mov rcx, rbp
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6d8]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180142c46
cmp rcx, 8
jne 0x180142c30
jmp 0x180142be4
mov rcx, rbp
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6e0]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180142c79
cmp rcx, 8
jne 0x180142c60
jmp 0x180142be4
mov r8d, 8
lea rdx, [0x18006c6e8]
lea rcx, [rsp + 0x30]
call fcn.180113f40
test eax, eax
jne 0x180142d0b
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
lea rdx, [0x18006c6f8]
lea rcx, [rsp + 0x30]
call fcn.180155940
cmp eax, 1
jne 0x180142cd9
mov eax, dword [rsp + 0x20]
inc eax
and eax, 0x800000ff
jge 0x180142cc9
dec eax
or eax, 0xffffff00
inc eax
cdqe
lea r8, [0x18006c210]
movzx ebx, byte [rax + r8]
jmp 0x180142d39
test edi, edi
je 0x180142d3e
lea rdx, [rsp + 0x30]
mov r9, rdi
lea r8, [0x18006c210]
nop dword [rax]
movsx rax, byte [rdx]
lea rdx, [rdx + 1]
movzx ecx, bx
xor rcx, rax
movzx ebx, byte [rcx + r8]
sub r9, 1
jne 0x180142cf0
jmp 0x180142d39
test edi, edi
je 0x180142d3e
lea rdx, [rsp + 0x30]
mov r9, rdi
lea r8, [0x18006c210]
nop
movsx rcx, byte [rdx]
lea rdx, [rdx + 1]
movzx eax, bx
xor rcx, rax
movzx ebx, byte [rcx + r8]
sub r9, 1
jne 0x180142d20
cmp bp, bx
jne 0x180142d43
mov ebx, 0xff
mov byte [rsi + 0x2d0], bl
movzx eax, bl
jmp 0x180142be6
Function at 0x180143dd0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov dword [rbp - 0x50], r12d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov qword [rbp - 0x38], r12
mov dword [rbp - 0x50], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180143eb9
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x2c], xmm0
mov qword [rbp - 0x1c], r12
mov dword [rbp - 0x30], 0x1c
lea rdx, [rbp - 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
mov rbx, qword [rbp - 0x40]
test eax, eax
je 0x180143eae
nop dword [rax]
cmp dword [rbp - 0x30], 0x10
jb 0x180143e97
cmp dword [rbp - 0x24], esi
jne 0x180143e97
cmp rbx, r12
je 0x180143e7f
mov eax, dword [rbp - 0x28]
mov dword [rbx], eax
add rbx, 4
mov qword [rbp - 0x40], rbx
jmp 0x180143e97
lea r8, [rbp - 0x28]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.18013eec0
mov r12, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
mov dword [rbp - 0x30], 0x1c
lea rdx, [rbp - 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180143e60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180143ebd
mov rbx, qword [rbp - 0x40]
mov rdi, qword [r14 + 8]
mov r10, qword [r14]
mov r11, qword [rbp - 0x48]
cmp r10, rdi
je 0x180143f6e
mov rax, r11
cmp r11, rbx
je 0x180143eed
mov ecx, dword [r10]
nop dword [rax]
cmp ecx, dword [rax]
je 0x180143f61
add rax, 4
cmp rax, rbx
jne 0x180143ee0
mov r8, qword [r15]
mov rax, qword [r8]
cmp rax, qword [r8 + 8]
je 0x180143f61
nop dword [rax]
lea rdx, [rax + 0x10]
mov ecx, dword [r10]
cmp dword [rax], ecx
jne 0x180143f54
mov r9, qword [r8 + 8]
cmp rdx, r9
je 0x180143f44
lea rax, [rdx - 0xc]
nop dword [rax + rax]
mov rcx, qword [rax + 0x14]
mov qword [rax + 4], rcx
movzx ecx, byte [rax + 0x10]
mov byte [rax], cl
mov ecx, dword [rdx]
mov dword [rax - 4], ecx
add rdx, 0x10
lea rax, [rax + 0x10]
cmp rdx, r9
jne 0x180143f20
mov r9, qword [r8 + 8]
lea rax, [r9 - 0x10]
mov qword [r8 + 8], rax
mov r8, qword [r15]
mov rax, qword [r8]
jmp 0x180143f57
mov rax, rdx
add rax, 0x10
cmp rax, qword [r8 + 8]
jne 0x180143f00
add r10, 4
cmp r10, rdi
jne 0x180143ed1
test r11, r11
je 0x180143fac
sub r12, r11
sar r12, 2
lea rdx, [r12*4]
mov rax, r11
cmp rdx, 0x1000
jb 0x180143fa3
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180143fd1
mov rcx, r11
call fcn.1801e61d0
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18010fa40
nop
int3
Function at 0x180149300
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x50], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call fcn.1800b0a40
nop
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
xor r8d, r8d
mov edx, 0x8000
lea rcx, [rbp - 0x40]
call fcn.1800998d0
lea rdi, [0x1800567d8]
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov r8d, dword [rbp - 0x30]
lea rcx, [0x18006c310]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1801493e1
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1800f8760
nop
mov qword [rbp - 0x48], rdi
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180149445
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801493d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180149486
call fcn.1801e61d0
nop
jmp 0x180149445
mov edx, eax
xor r8d, r8d
lea rcx, [rbp - 0x40]
call fcn.18009b5c0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.1800f2a40
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1800f8760
nop
mov qword [rbp - 0x48], rdi
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180149445
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18014943f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180149480
call fcn.1801e61d0
nop
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
lea rcx, [rbp - 0x20]
call fcn.180092860
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18010fa40
nop
call fcn.18010fa40
int3

Function at 0x18014beb0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x18029b2d0], 0xffffffff
jne 0x18014bf34
mov qword [rsp + 0x20], 0
call fcn.180150a40
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800fd270
nop
cmp dword [0x18029b2d0], 0xffffffff
je 0x18014bef7
mov bl, 1
jmp 0x18014bf04
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x18014bf24
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1800fd2c0
movzx eax, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x30
pop rbx
ret
mov dword [0x18029b2d0], eax
lea rcx, [rsp + 0x20]
call fcn.1800fd2c0
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x30
pop rbx
ret
Function at 0x180157190
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
imul ecx, edx, 0x3e8
mov eax, 0x51eb851f
movzx esi, r8b
xor bpl, bpl
mov r8d, 0x80000001
mul ecx
xor ecx, ecx
mov ebx, edx
xor edx, edx
shr ebx, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
je 0x180157279
mov r8d, 0x80000000
mov qword [rsp + 0x60], rdi
lea rdx, [0x18006c7d0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x18015726b
nop dword [rax]
xor eax, eax
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180157262
mov eax, dword [rsp + 0x24]
cmp eax, 2
je 0x18015724e
cmp eax, 4
je 0x18015725f
test sil, sil
jne 0x180157262
test ebx, ebx
je 0x180157262
dec ebx
mov ecx, 0x64
call sub.KERNEL32.dll_Sleep
cmp dword [rsp + 0x24], 4
jne 0x180157210
mov bpl, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
movzx eax, bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1801572a0
Capabilities:
Check if process is running under wine
Get file version info

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 8], 1
mov rbx, rcx
jne 0x1801572d5
movzx eax, byte [rcx + 9]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x70
pop rbx
ret
mov eax, dword [0x18006c77c]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x48]
movzx eax, word [0x18006c780]
mov word [rsp + 0x4c], ax
xor eax, eax
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
xor sil, sil
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x60], r14
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
mov r14d, 1
test eax, eax
je 0x1801573bb
mov ecx, eax
mov qword [rsp + 0x68], rdi
add ecx, 0x32
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.180113ab0
mov rdi, rax
test rax, rax
je 0x1801573b6
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov r9, rax
mov r8d, ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1801573ae
lea r9, [rsp + 0x44]
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, [0x18006c788]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1801573ae
cmp dword [rsp + 0x44], 0
je 0x1801573ae
mov rcx, qword [rsp + 0x30]
lea r8d, [r14 + 3]
lea rdx, [0x18006c7b0]
call fcn.180113f40
test eax, eax
movzx esi, sil
cmove esi, r14d
mov rcx, rdi
call fcn.18010fbc0
mov rdi, qword [rsp + 0x68]
lea rax, [rsp + 0x38]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x18006c7b8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x88]
test eax, eax
jne 0x180157407
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov byte [rbx + 8], 1
mov byte [rbx + 9], 1
jmp 0x18015741f
mov byte [rbx + 8], 1
cmp sil, 1
jne 0x18015741b
mov byte [rbx + 9], sil
movzx eax, sil
jmp 0x18015741f
movzx eax, byte [rbx + 9]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x70
pop rbx
ret
Function at 0x18015bd80
Capabilities:
Encode data using xor

Disassembly:
xor r10b, r10b
xor r9d, r9d
mov r11, rcx
test r8d, r8d
je 0x18015be54
cmp r8d, 0x20
jb 0x18015be25
mov r10d, r8d
xorps xmm3, xmm3
and r10d, 0xffffffe0
xorps xmm2, xmm2
nop dword [rax]
movdqu xmm0, xmmword [r9 + rdx]
lea eax, [r9 + 0x10]
movdqu xmm1, xmmword [r9 + rcx]
add r9d, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movdqu xmm1, xmmword [rax + rcx]
movdqu xmm0, xmmword [rax + rdx]
pxor xmm1, xmm0
por xmm2, xmm1
cmp r9d, r10d
jb 0x18015bdb0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd r10d, xmm2
cmp r9d, r8d
jae 0x18015be54
sub r11, rdx
mov eax, r9d
add rax, rdx
sub r8d, r9d
mov edx, r8d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r11 + rax]
xor cl, byte [rax]
lea rax, [rax + 1]
or r10b, cl
sub rdx, 1
jne 0x18015be40
movzx eax, r10b
ret

Function at 0x18015bf30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r10, rcx
test r8d, r8d
je 0x18015c011
cmp r8d, 0x40
jb 0x18015bfef
lea eax, [r8 - 1]
lea rcx, [rax + rdx]
add rax, r10
cmp rdx, rax
ja 0x18015bf66
cmp rcx, r10
jae 0x18015bfef
mov r9d, r8d
mov qword [rsp], rbx
and r9d, 0xffffffc0
mov ebx, 0x20
nop word [rax + rax]
movdqu xmm0, xmmword [r11 + rdx]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r11 + r10]
pxor xmm1, xmm0
movdqu xmmword [r11 + rdx], xmm1
add r11d, 0x40
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
cmp r11d, r9d
jb 0x18015bf80
mov rbx, qword [rsp]
cmp r11d, r8d
jae 0x18015c011
sub r10, rdx
mov eax, r11d
add rax, rdx
sub r8d, r11d
mov edx, r8d
nop
movzx ecx, byte [r10 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18015c000
add rsp, 8
ret
Function at 0x180167ba0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor sil, sil
mov r11, rdx
mov rbx, rcx
mov rbp, r8
mov dil, 1
test r8, r8
je 0x180167c09
nop dword [rax + rax]
movzx r9d, dil
lea r11, [r11 + 1]
inc dil
movzx r10d, byte [r9 + rbx]
add sil, r10b
movzx eax, sil
movzx ecx, byte [rax + rbx]
mov byte [r9 + rbx], cl
mov byte [rax + rbx], r10b
add r10b, byte [r9 + rbx]
movzx ecx, r10b
movzx edx, byte [rcx + rbx]
xor byte [r11 - 1], dl
sub r8, 1
jne 0x180167bd0
mov rbx, qword [rsp + 8]
mov rax, rbp
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180167cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd r8, dword [rcx]
mov r14, rdx
mov rdi, qword [rcx + 0x10]
mov rsi, r8
movzx eax, word [rdi + r8*4 + 0x10]
movzx ecx, word [rdi + r8*4 + 0x18]
movzx ebx, word [rdi + r8*4 + 0x14]
shl rbx, 0x10
or rbx, rax
mov eax, dword [rdx]
xor rbx, rax
movzx eax, word [rdi + r8*4 + 0x1c]
shl rax, 0x10
or rax, rcx
mov ecx, dword [rdx + 4]
xor rax, rcx
lea ecx, [r8 - 1]
xor rax, rbx
movsxd rbp, ecx
test ecx, ecx
js 0x180167dc7
nop word [rax + rax]
movzx r8d, word [rdi + rbp*4]
mov edx, eax
mov r9d, r8d
shr edx, 0x10
movzx ecx, dx
shr r9, 8
shr cx, 8
movzx r11d, cx
movzx ecx, dl
xor r9, r11
xor r9, rcx
movzx ecx, ax
shr cx, 8
xor cl, al
xor cl, r8b
inc cl
add cl, r9b
rol cl, 2
movzx r10d, cl
lea ecx, [r9 + r10]
rol cl, 2
movzx edx, cl
lea ecx, [rdx + 1]
add cl, r11b
rol cl, 2
movzx r8d, cl
shl r8, 8
or r8, rdx
shl r8, 8
or r8, r10
add r10b, al
shl r8, 8
rol r10b, 2
movzx ecx, r10b
or r8, rcx
xor r8, rbx
mov rbx, rax
sub rbp, 1
mov rax, r8
jns 0x180167d40
movzx ecx, word [rdi + rsi*4 + 8]
movzx edx, word [rdi + rsi*4 + 0xc]
mov rbp, qword [rsp + 0x18]
shl rdx, 0x10
or rdx, rcx
movzx ecx, word [rdi + rsi*4]
xor rdx, rax
xor rbx, rdx
movzx edx, word [rdi + rsi*4 + 4]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
shl edx, 0x10
or edx, ecx
mov dword [r14 + 4], ebx
mov rbx, qword [rsp + 0x10]
xor edx, eax
mov dword [r14], edx
pop r14
ret
Function at 0x180167e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, dword [rcx]
xor r8d, r8d
mov ebx, dword [rdx]
mov r11, rcx
mov ebp, dword [rdx + 4]
mov esi, r8d
cdq
sub eax, edx
sar eax, 1
add eax, 4
test eax, eax
jle 0x180167f08
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
nop word [rax + rax]
xor r8d, ebp
lea rdi, [rdi + 8]
mov eax, ebx
movzx ecx, bx
shr eax, 0x10
inc esi
movzx r9d, ax
movzx edx, al
shr cx, 8
xor cl, bl
shr r9, 8
xor rdx, r9
movzx eax, dl
xor al, r8b
inc al
add cl, al
movzx eax, r8w
shr ax, 8
rol cl, 2
movzx r10d, cl
xor al, r10b
shr r8d, 0x10
add al, dl
rol al, 2
movzx ecx, al
movzx eax, r8w
shr ax, 8
xor al, cl
inc al
add al, r9b
rol al, 2
movzx edx, al
shl edx, 8
or edx, ecx
shl edx, 8
or edx, r10d
xor r10b, r8b
add r10b, bl
shl edx, 8
rol r10b, 2
mov r8, rbx
movzx eax, r10b
mov rbx, rbp
or edx, eax
mov rax, qword [r11 + 0x10]
movzx ecx, dx
mov ebp, edx
mov dword [rdi + rax - 8], ecx
mov ecx, edx
mov rax, qword [r11 + 0x10]
shr ecx, 0x10
mov dword [rdi + rax - 4], ecx
mov eax, dword [r11]
cdq
sub eax, edx
sar eax, 1
add eax, 4
cmp esi, eax
jl 0x180167e50
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rsi
ret