joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406bc918
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406bca9f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406bc949
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bc92f
add dl, dl
jne 0x1406bc956
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bc9b6
xor eax, eax
add dl, dl
jne 0x1406bc965
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bca6d
add dl, dl
jne 0x1406bc976
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bc983
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bc990
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bc99d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406bc9aa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406bc93e
mov eax, 1
add dl, dl
jne 0x1406bc9c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bc9d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bc9bb
sub eax, ebx
mov ebx, 1
jne 0x1406bca0c
mov ecx, 1
add dl, dl
jne 0x1406bc9ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406bc9fb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bc9e3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bc93e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406bca28
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406bca35
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bca1d
cmp eax, 0x7d00
jae 0x1406bca5b
cmp eax, 0x500
jb 0x1406bca56
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bc93e
cmp eax, 0x7f
ja 0x1406bca5e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bc93e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406bca92
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406bc93e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18000ce00
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000ce30
xor eax, eax
jmp 0x18000cef3
mov rbp, rbx
cmp word [rax], si
je 0x18000ce55
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000ce3c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000ce38
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000cd20
movsxd r14, eax
test eax, eax
jne 0x18000ce93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000ce29
mov rcx, r14
call fcn.18000b2b8
mov rdi, rax
test rax, rax
jne 0x18000ceac
xor ecx, ecx
call fcn.18000b318
jmp 0x18000ce88
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000cd20
test eax, eax
jne 0x18000cedd
mov rcx, rdi
call fcn.18000b318
jmp 0x18000cee7
xor ecx, ecx
call fcn.18000b318
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180012514
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x18001258c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x18001258c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x18001258c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180012580
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x18001259e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x18001256e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x18001258e

Function at 0x180012ad0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180012af8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180012af8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000446c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400044b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400044b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400044b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400044b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400044b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400044b8
xor al, al
add rsp, 0x28
ret
Function at 0x1800010a8
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18003f3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x1800010e5
xor al, al
jmp 0x180001123
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800010f6
xor al, al
jmp 0x180001123
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x18000111d
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x18000111d
mov al, 1
jmp 0x180001123
xor al, al
jmp 0x180001123
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180031ce0
add rsp, 0x60
pop rbx
ret

Function at 0x18000126c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18003f3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
mov esi, 0x10000
test rax, rax
je 0x18000134a
sub rbx, rax
add rbx, rsi
jmp 0x18000134a
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1800012c7
add rbx, 0x8000000
jmp 0x18000134a
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001353
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], esi
jne 0x180001331
cmp rcx, rsi
jb 0x180001331
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180001355
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x180001353
jmp 0x1800012a4
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x18000134a
mov rax, rsi
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x1800012ac
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180031ce0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180001374
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18003f3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x180001461
mov esi, 0x10000
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1800013d5
sub rbx, 0x8000000
jmp 0x180001458
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001461
cmp dword [rsp + 0x40], esi
jne 0x18000143c
cmp qword [rsp + 0x38], rsi
jb 0x18000143c
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180001463
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x180001461
sub rbx, rsi
jmp 0x180001458
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1800013ba
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180031ce0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180001558
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea r8, [rsp + 0x48]
mov rbp, rcx
lea rdx, [rsp + 0x50]
call fcn.180001138
mov rax, qword [0x180043f30]
xor ebx, ebx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdx, qword [0x180043f40]
test rax, rax
jne 0x1800015a4
test rdx, rdx
je 0x1800015ba
mov rax, rdx
mov qword [0x180043f30], rdx
cmp qword [rax + 0x10], rbx
je 0x1800015ba
cmp qword [rax + 0x10], rsi
jb 0x1800015ba
cmp qword [rax + 0x10], rdi
jbe 0x180001661
mov qword [0x180043f30], rdx
mov rax, rdx
test rdx, rdx
je 0x1800015f9
mov rcx, rdx
test rdx, rdx
je 0x1800015e3
cmp qword [rcx + 0x10], rbx
je 0x1800015e3
cmp qword [rcx + 0x10], rsi
jb 0x1800015e3
cmp qword [rcx + 0x10], rdi
jbe 0x180001661
mov rax, qword [rax + 8]
mov qword [0x180043f30], rax
mov rcx, rax
mov rdx, rax
test rax, rax
jne 0x1800015cc
movzx eax, bp
mov r8, rdi
sub rbp, rax
mov rdx, rsi
mov rcx, rbp
call fcn.180001484
test rax, rax
je 0x18000168d
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
mov qword [rax + 0x10], rbx
mov r8d, 0x2a7
mov rcx, qword [0x180043f40]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x180043f40], rax
mov qword [0x180043f30], rax
mov qword [rdx], rbx
mov rbx, rcx
sub rcx, 0x60
lea rdx, [rdx - 0x60]
sub r8, 1
jne 0x180001649
mov qword [rax + 0x10], rbx
mov rbx, qword [rax + 0x10]
cmp rbx, rsi
jb 0x18000168d
cmp rbx, rdi
ja 0x18000168d
mov rcx, qword [rbx + 0x48]
mov edx, 0xcc
mov qword [rax + 0x10], rcx
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call sub.VCRUNTIME140.dll_memset
mov rax, rbx
jmp 0x18000168f
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000173c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18003f3c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
cmp dword [0x180043f2c], ebx
jne 0x1800017cb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180043f2c], ecx
jne 0x1800017cb
mov rdi, qword [0x180043f40]
mov qword [0x180043f50], rbx
mov qword [0x180043f48], rbx
mov qword [0x180043f38], rbx
jmp 0x1800017b2
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800017b9
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x180001791
jmp 0x1800017c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180043f28], ebx
mov eax, ebx
jmp 0x1800017d0
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180031ce0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800017e8
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18003f3c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180043f2c], eax
je 0x180001819
mov eax, 0x10dd
jmp 0x1800018dc
mov rdi, qword [0x180043f50]
test rdi, rdi
je 0x180001890
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x20]
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
movzx edx, byte [rax + 0x3e]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [rdi + 8], 0
jne 0x180001878
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x180001878
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x60]
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
and rdx, 0xffffffffffff0000
mov rax, qword [rdx + 0x10]
mov qword [rbx + 0x48], rax
mov qword [rdx + 0x10], rbx
and qword [rdi + 0x20], 0
mov rbx, qword [rdi]
mov edx, 0x30
mov rcx, rdi
call fcn.180031d3c
mov rdi, rbx
test rbx, rbx
jne 0x180001825
and qword [0x180043f50], 0
call fcn.1800011f4
mov rdi, qword [0x180043f48]
test rdi, rdi
je 0x1800018cb
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rdi]
mov edx, 0x10
mov rcx, rdi
call fcn.180031d3c
mov rdi, rbx
test rbx, rbx
jne 0x1800018a9
and qword [0x180043f48], 0
and dword [0x180043f2c], 0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180031ce0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180002910
Capabilities:
Decompress data using quicklz

Disassembly:
lea eax, [r8 + 0x100000]
cmp eax, 0x1fffff
ja 0x180002971
mov eax, r8d
mov ecx, r8d
shl ecx, 4
shr eax, 1
xor eax, edx
and eax, 0x7ff
xor eax, edx
mov edx, r8d
xor ecx, eax
shl edx, 6
and ecx, 0x3f0000
xor ecx, eax
xor edx, ecx
and edx, 0x4000000
xor edx, ecx
mov ecx, r8d
shr ecx, 5
xor ecx, edx
shr r8d, 8
and ecx, 0x2000
xor ecx, edx
xor r8d, ecx
and r8d, 0x800
xor r8d, ecx
mov eax, r8d
ret
xor eax, eax
ret
Function at 0x180004cf8
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp byte [0x1800405f6], bl
je 0x180004d26
movsxd rcx, dword [0x1800405f8]
lea rax, [0x1800363b0]
mov ecx, dword [rax + rcx*4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov cl, 1
test ax, ax
jne 0x180004d28
mov cl, bl
call fcn.1800047ac
mov rcx, qword [0x180040648]
call fcn.1800046b4
test al, al
je 0x180004dc6
mov r10, qword [0x180040670]
mov rcx, r10
call fcn.1800046b4
test al, al
je 0x180004dc6
cmp byte [0x1800405f3], bl
setne cl
call fcn.180004c00
cmp byte [0x1800405f4], bl
je 0x180004d73
mov cl, 1
call fcn.180004b7c
jmp 0x180004daa
mov al, byte [0x18004057d]
test al, al
jne 0x180004d96
movups xmm0, xmmword [r10 + 0x968]
mov al, 1
mov byte [0x18004057d], al
movups xmmword [0x180043fd0], xmm0
jmp 0x180004d9d
movups xmm0, xmmword [0x180043fd0]
test al, al
je 0x180004daa
movdqu xmmword [r10 + 0x968], xmm0
cmp byte [0x1800405f5], bl
je 0x180004dbf
mov dword [r10 + 0x628], 0x40a00000
jmp 0x180004dc6
mov dword [r10 + 0x628], ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1800067c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.18002dee0
xor edi, edi
mov dword [rbp - 0x40], 0x92f792ea
mov word [rbp - 0x2c], di
mov ecx, edi
mov dword [rbp - 0x3c], 0x929392f1
mov dword [rbp - 0x38], 0x92d79293
mov dword [rbp - 0x34], 0x92c0928d
mov dword [rbp - 0x30], 0x92ca92c9
mov byte [rbp - 0x2a], 1
movzx eax, cx
mov edx, 0x6d63
sub ax, dx
xor word [rbp + rcx*2 - 0x40], ax
inc rcx
cmp rcx, 0xa
jb 0x18000680a
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2a], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
test rax, rax
je 0x18000688d
movdqa xmm0, xmmword [0x18003a7d0]
mov rcx, rdi
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0xd1dbfdd4
mov dword [rbp - 0x14], 0x100d7c5
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x16
jb 0x180006857
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x11], dil
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180043f70], rax
test rax, rax
jne 0x180006973
mov al, dil
jmp 0x180006890
mov al, byte [rbp + 0x10]
test al, al
jne 0x180006973
movdqa xmm0, xmmword [0x18003a790]
mov rcx, rdi
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x100cac8
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x12
jb 0x1800068af
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2d], dil
lea rcx, [rbp - 0x28]
call fcn.180008fa0
mov rbx, rax
mov dword [rbp - 0x50], 0xceedffca
mov rcx, rdi
mov dword [rbp - 0x4c], 0xc4ccc8
mov byte [rbp - 0x48], 1
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x1800068e8
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
mov byte [rbp - 0x48], dil
jbe 0x180006909
mov rdx, qword [rbx]
xor r9d, r9d
lea r8, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movups xmm0, xmmword [rbx + 0x10]
movups xmm1, xmmword [rbx]
mov qword [rbx + 0x10], rdi
psrldq xmm0, 8
movq rdx, xmm0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
cmp rdx, 0xf
jbe 0x180006973
inc rdx
movq rcx, xmm1
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000696e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000696e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180031d3c
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000a2d8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x1800440b4], 0
lea rsi, [0x1800440b0]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x18000a33f
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x18000a30d
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x18000a305
not ebx
mov edx, ebx
test edi, edi
jle 0x18000a361
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x18000a347
jmp 0x18000a39b
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x18000a39b
mov r9b, 0x23
cmp r8b, r9b
jne 0x18000a380
cmp byte [r10], r9b
jne 0x18000a380
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x18000a36f
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret

Function at 0x18000abd8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov rdi, r8
test r8, r8
je 0x18000abff
and dword [r8], 0
call fcn.18000aab4
mov rbx, rax
test rax, rax
je 0x18000ace5
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000acdc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd r14, eax
cmp r14d, 0xffffffff
je 0x18000acdc
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000acdc
mov r8, qword [0x18003f5c8]
lea eax, [r14 + rbp]
movsxd rcx, eax
inc dword [r8 + 0x354]
mov r8, qword [r8 + 0xf0]
call r8
mov rsi, rax
test rax, rax
je 0x18000acdc
mov r9, rbx
mov r8, r14
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r14
je 0x18000acb4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18003f5c8]
mov rcx, rsi
dec dword [rax + 0x354]
call qword [rax + 0xf8]
jmp 0x18000ace5
test ebp, ebp
jle 0x18000acc6
mov r8, rbp
lea rcx, [r14 + rsi]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x18000acd7
mov dword [rdi], r14d
mov rax, rsi
jmp 0x18000ace7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180025704
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x1800258f5
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x1800257a6
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x1800257c8
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x18003a760]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x1800258e8
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x180025816
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x18002581a
mov edx, dword [rax + r12]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.180021818
mov edx, eax
mov rcx, rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.180023710
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x1c]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x20]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x180025805
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x180025754
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret