joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800772f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov rdx, qword [rcx + 0xe8]
test rdx, rdx
jne 0x180077346
mov rcx, qword [0x160]
mov rax, qword [rcx + 0x60]
cmp qword [rcx + 0x58], rax
je 0x1800774e3
mov rax, qword [rdx + 0x160]
mov rcx, qword [rax + 0x58]
cmp rcx, qword [rax + 0x60]
je 0x180077366
cmp byte [rcx + 4], 0
je 0x180077366
mov rsi, qword [rbx + 0xf8]
jmp 0x18007736d
mov rsi, qword [rbx + 0x100]
test rsi, rsi
je 0x1800774e3
mov edi, dword [r8 + 0xc]
sub edi, dword [r8 + 4]
mov rax, qword [rsi]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [rax + 0x30]
mov ecx, dword [rax]
mov edx, dword [r15 + 4]
mov eax, dword [r15 + 8]
mov dword [rbp - 0x20], eax
add eax, ecx
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], edx
lea eax, [rdx + rdi]
mov dword [rbp - 0x14], eax
mov rax, qword [rsi]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [rax + 0x30]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call fcn.180077210
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_CopyRect]
xor edi, edi
mov rax, rbx
nop dword [rax]
cmp byte [rax + 0x99], dil
jne 0x1800773fa
mov rax, qword [rax + 0xa8]
test rax, rax
jne 0x1800773e0
jmp 0x18007749d
test rax, rax
je 0x18007749d
mov rax, qword [rax + 0xe0]
mov r15, qword [rax]
test r15, r15
je 0x18007749d
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
lea rcx, [rbp - 0x28]
call fcn.18005e600
mov qword [rbp - 0x28], rax
xor ecx, ecx
xor edx, edx
nop dword [rax + rax]
add ecx, dword [rbx + 0xb4]
add edx, dword [rbx + 0xb8]
mov rbx, qword [rbx + 0xa8]
test rbx, rbx
jne 0x180077450
sub dword [rbp - 0x24], edx
sub dword [rbp - 0x28], ecx
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18007749d
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, 2
cmovne edi, eax
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x28], r14
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800774be
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x48]
nop
mov rax, qword [rsi]
mov r9d, edi
lea r8, [rbp - 0x20]
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x28]
nop
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800774e3
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800789e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, rcx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x180078a2c
xor al, al
jmp 0x180078b81
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180078a25
xor bl, bl
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r15, rax
test rax, rax
je 0x180078b78
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbp, rax
mov qword [rsp + 0x50], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x180078aa0
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.1800089e0
nop
mov rax, qword [r13 + 0x60]
cmp byte [rax + 0x11e], 0
je 0x180078b06
mov rbx, r12
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x180078b06
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
nop dword [rax]
lea rax, [rsp + 0x28]
cmp r14, 8
cmovae rax, rdi
movzx ecx, word [rax + rbx*2]
call fcn.1801da2b4
test eax, eax
je 0x180078bac
inc rbx
cmp rbx, rsi
jb 0x180078ae0
mov bl, 1
lea rdx, [rsp + 0x28]
mov rcx, r13
call fcn.180078290
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp r14, 8
jb 0x180078b56
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180078b4e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180078bb3
mov rcx, rdi
call fcn.1801ccd64
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
test rbp, rbp
je 0x180078b78
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801ccd40
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor bl, bl
jmp 0x180078b1f
call fcn.1801d1a7c
int3
Function at 0x180078c40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180078c8c
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x180078c93
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x180078da7
xor bl, bl
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.180078bc0
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180078d4c
lea rsi, [rax*2 + 2]
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
mov rdx, rsi
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x180078d4c
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x180078d12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
xor bl, bl
jmp 0x180078d4c
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.1801ceed0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x180078d4a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor bl, bl
jmp 0x180078d4c
mov bl, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180078d91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180078d8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180078dca
call fcn.1801ccd64
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801ccd40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1801d1a7c
int3
Function at 0x18008a3e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x11
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x18008a420
test rbx, rbx
je 0x18008a420
cmp dword [rbx + 8], 0x100
jne 0x18008a420
mov rax, qword [rbx + 0x10]
cmp rax, 0x4c
je 0x18008a430
add rax, 0xffffffffffffffb2
cmp rax, 1
jbe 0x18008a430
cmp dword [rbx + 8], 0x104
jne 0x18008a438
cmp qword [rbx + 0x10], 0x12
jne 0x18008a438
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x18008a520
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
movzx r10d, byte [rcx + 0x100]
mov r11, rdx
movzx ebx, byte [rcx + 0x101]
test r8d, r8d
je 0x18008a58d
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
nop word [rax + rax]
inc r10b
lea r11, [r11 + 1]
movzx r8d, r10b
movzx r9d, byte [r8 + rcx]
add bl, r9b
movzx edx, bl
movzx eax, byte [rdx + rcx]
mov byte [r8 + rcx], al
mov byte [rdx + rcx], r9b
add r9b, byte [r8 + rcx]
movzx eax, r9b
movzx edx, byte [rax + rcx]
xor byte [r11 - 1], dl
sub rdi, 1
jne 0x18008a550
mov rdi, qword [rsp + 0x10]
mov byte [rcx + 0x101], r10b
mov byte [rcx + 0x100], r10b
pop rbx
ret
Function at 0x1800916d0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x18009170e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.18009abb0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x180091734
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x180091747
cmp qword [rsi + 0x18], 8
jb 0x18009174a
mov rsi, qword [rsi]
jmp 0x18009174a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x18009176e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18009176e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x180091795
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800917a8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.1801ccd64
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801ccd40
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800937a0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.1801cd4f0
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.1801cf330
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x180093807
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x150
pop rbx
ret
Function at 0x180097e30
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, VarUI4FromDisp
call fcn.1801cf330
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180097eb7
cmp dword [rsp + 0x44], 6
jb 0x180097eb7
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.180097c60
test al, al
je 0x180097eb7
cmp word [rbx], 0
jne 0x180097f21
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.180097c60
test al, al
je 0x180097eec
cmp word [rbx], 0
jne 0x180097f21
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.180097c60
test al, al
je 0x180097f25
cmp word [rbx], 0
je 0x180097f25
mov al, 1
jmp 0x180097f27
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x170
pop rbx
ret
Function at 0x18009a540
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
xor ebx, ebx
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov r14, r9
mov qword [rsp + 0x50], rdi
mov rsi, rdx
mov qword [rsp + 0x40], r15
mov edi, r8d
mov r15, rcx
mov ebp, ebx
jne 0x18009a585
mov ebx, 1
jmp 0x18009a5d6
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
mov rcx, qword [r15 + 0x20]
lea r9, [rsp + 0x30]
mov r8d, edi
mov dword [rsp + 0x30], ebx
cmp edi, r12d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
cmova r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
add ebp, ecx
test eax, eax
je 0x18009a5cc
test ecx, ecx
je 0x18009a5d1
add rsi, rcx
sub edi, ecx
jne 0x18009a590
jmp 0x18009a5d1
mov ebx, 1
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14, r14
je 0x18009a5ef
mov dword [r14], ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret
Function at 0x18009b3f0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x18009b42d
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18009b440
mov al, 1
jmp 0x18009b4e7
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18009ba30
test al, al
je 0x18009b491
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18009b491
mov bl, 1
jmp 0x18009b493
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18009b4d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b4cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b504
call fcn.1801ccd64
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd40
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.1801d1a7c
int3

Function at 0x18009b510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x18009b545
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18009b5ef
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x18023b310]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18009ba30
test al, al
je 0x18009b59e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18009b5dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b5d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b60e
call fcn.1801ccd64
movdqa xmm0, xmmword [0x18023b310]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd40
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1801d1a7c
int3
Function at 0x18009b970
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x20]
call fcn.1801cf330
cmp qword [rdi + 0x18], 8
jb 0x18009b9b2
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x18009b9bc
mov rbx, qword [rbx]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18009ba0c
xor eax, eax
mov r8, 0xffffffffffffffff
mov word [rsp + 0x22a], ax
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18009b9f0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800089e0
mov al, 1
jmp 0x18009ba0e
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x18009bdb0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x18009be0e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18009bdf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18009be0e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x18009be10
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801ccd40
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18009ceb0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx]
test rdx, rdx
je 0x18009cfc7
cmp byte [rdx + 0x78], 0
je 0x18009cfc7
add rdx, 0x28
lea rcx, [r11 - 0x48]
call fcn.180009460
nop
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.180092e60
nop
mov rsi, qword [rsp + 0x70]
lea rdi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdi, qword [rsp + 0x60]
mov rcx, qword [rbx]
cmp qword [rcx + 0x18], 8
jb 0x18009cf3b
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18009cfb2
mov dword [rsp + 0x40], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.180009630
nop
lea rcx, [rsp + 0x50]
call fcn.1800094c0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801ccd40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18009d200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push r14
push r15
sub rsp, 0x10
mov r8d, dword [r9]
xor r15d, r15d
and r8d, 7
mov r12, r9
mov r14, rcx
mov r10d, r15d
cmp rdx, 5
jae 0x18009d230
xor eax, eax
add rsp, 0x10
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov qword [rsp + 8], rdi
lea rdi, [rdx - 4]
mov qword [rsp], r13
add rdi, r14
lea r13, [0x180000000]
nop dword [rax]
lea r9, [r10 + r14]
cmp r9, rdi
jae 0x18009d282
nop dword [rax]
movzx eax, byte [r9]
and al, 0xfe
cmp al, 0xe8
je 0x18009d282
inc r9
cmp r9, rdi
jb 0x18009d270
mov r10, r9
sub r10, r14
mov rax, r10
sub rax, rbp
cmp r9, rdi
jae 0x18009d3ac
cmp rax, 3
jbe 0x18009d2c4
mov r8d, r15d
movzx ecx, byte [r9 + 4]
mov rbp, r10
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x18009d309
and r8d, 3
mov eax, 1
add r8d, r8d
or r8d, 1
add r10, rax
jmp 0x18009d260
lea ecx, [rax - 1]
shl r8d, cl
and r8d, 7
je 0x18009d2a0
cmp byte [r8 + r13 + 0x215380], r15b
je 0x18009d2f3
movzx eax, byte [r8 + r13 + 0x215388]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rcx + 4]
inc al
test al, 0xfe
jne 0x18009d2a0
and r8d, 3
mov rbp, r10
add r8d, r8d
or r8d, 1
inc r10
jmp 0x18009d260
movzx eax, cl
lea rsi, [r13 + 0x215388]
movzx ecx, byte [r9 + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [r9 + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [r9 + 1]
shl eax, 8
or eax, ecx
mov ecx, r8d
add rsi, rcx
nop word [rax + rax]
sub eax, r10d
lea ebx, [rax - 5]
test r8d, r8d
je 0x18009d37b
movzx r11d, byte [rsi]
mov ecx, 0x18
shl r11d, 3
mov edx, ebx
sub ecx, r11d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x18009d37b
mov ecx, 0x20
mov eax, 1
sub ecx, r11d
shl eax, cl
dec eax
xor eax, ebx
jmp 0x18009d340
add eax, 0xfffffffb
mov byte [r9 + 1], bl
shr eax, 0x18
and al, 1
neg al
mov byte [r9 + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [r9 + 3], al
mov eax, ebx
shr eax, 8
mov byte [r9 + 2], al
mov eax, 5
add r10, rax
jmp 0x18009d260
mov r13, qword [rsp]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp rax, 3
ja 0x18009d3d7
lea ecx, [rax - 1]
shl r8d, cl
and r8d, 7
mov r15d, r8d
mov dword [r12], r15d
mov rax, r10
add rsp, 0x10
pop r15
pop r14
pop r12
ret
Function at 0x1800a6be0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov r11, rdx
shr r11, 2
mov rbx, rcx
mov r9d, r10d
mov r8d, r10d
test r11, r11
je 0x1800a6c2b
nop dword [rax]
imul eax, dword [rbx + r8*4], 0xcc9e2d51
inc r8
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r9d, ecx
rol r9d, 0xd
add r9d, 0xfaddaf14
lea r9d, [r9 + r9*4]
cmp r8, r11
jb 0x1800a6c00
mov rax, rdx
and eax, 3
sub rax, 1
je 0x1800a6c59
sub rax, 1
je 0x1800a6c4d
cmp rax, 1
jne 0x1800a6c73
movzx r10d, byte [rbx + r11*4 + 2]
shl r10d, 0x10
movzx eax, byte [rbx + r11*4 + 1]
shl eax, 8
xor r10d, eax
movzx eax, byte [rbx + r11*4]
xor eax, r10d
imul ecx, eax, 0xcc9e2d51
rol ecx, 0xf
imul eax, ecx, 0x1b873593
xor r9d, eax
mov rbx, qword [rsp + 8]
xor edx, r9d
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret