joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180198a60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
lea rax, [rdx + 0xf]
shr rax, 4
and ebp, 0xf
mov r14, r9
mov r15, r8
mov r13, rcx
test rax, rax
je 0x180198c23
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov qword [rsp + 0x58], r12
lea r12, [rax - 1]
test r12, r12
je 0x180198bd1
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
nop
movzx ecx, byte [r15]
mov rax, rbx
add rax, rax
lea rdx, [rcx + 4]
movups xmm0, xmmword [r13 + rax*8]
movzx eax, cl
shl rdx, 4
shr al, 3
add rcx, 3
dec al
shl rcx, 4
and al, 1
add rdx, r14
shl al, 3
add rcx, r14
movzx esi, al
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsi + 4]
shl r8, 4
add r8, r14
call fcn.180198c40
movzx ecx, byte [r15]
mov edi, esi
shl rdi, 4
add rdi, r14
lea rdx, [rcx + 3]
add rcx, 2
shl rcx, 4
shl rdx, 4
lea r8, [rdi + 0x30]
add rcx, r14
add rdx, r14
call fcn.180198c40
movzx eax, byte [r15]
lea r8, [rdi + 0x20]
lea r9d, [rax + rax]
lea eax, [r9 + 4]
lea rdx, [r14 + rax*8]
lea eax, [r9 + 2]
lea rcx, [r14 + rax*8]
call fcn.180198c40
movzx r9d, byte [r15]
lea r8, [rdi + 0x10]
lea eax, [r9*2 + 2]
lea rdx, [r14 + rax*8]
lea eax, [r9 + r9]
lea rcx, [r14 + rax*8]
call fcn.180198c40
movzx edx, byte [r15]
movq rax, xmm0
psrldq xmm0, 8
mov r8, rdi
lea ecx, [rdx + rdx]
add edx, edx
xor rax, qword [r14 + rcx*8]
mov qword [rsp + 0x30], rax
movq rax, xmm0
xor rax, qword [r14 + rdx*8 + 8]
mov qword [rsp + 0x38], rax
lea eax, [rdx + 8]
lea rdx, [rsp + 0x30]
lea rcx, [r14 + rax*8]
call fcn.180198c40
inc rbx
mov byte [r15], sil
cmp rbx, r12
jb 0x180198ac0
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x58]
shl rbx, 4
add rbx, r13
test rbp, rbp
je 0x180198c06
mov r8, rbp
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.18020b840
jmp 0x180198c0e
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov rdx, r14
mov rcx, r15
call fcn.180198780
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x78
pop r15
pop r14
pop r13
pop rbp
ret
Function at 0x180199120
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r8, qword [rdx + 0x30]
mov rdi, rcx
mov r10, qword [rdx]
mov r9, qword [rdx + 8]
mov r11, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x10], rbx
mov rbx, qword [rdx + 0x28]
shl rbx, 0x38
dec r8
cmp r8, 6
ja case.default.0x18019916a
mov qword [rsp + 0x18], rsi
lea rsi, section.__wibu05
mov ecx, dword [rsi + r8*4 + 0x14930c]
add rcx, rsi
mov rsi, qword [rsp + 0x18]
jmp rcx
movzx ecx, byte [rdx + 0x26]
shl rcx, 0x30
or rbx, rcx
movzx ecx, byte [rdx + 0x25]
shl rcx, 0x28
or rbx, rcx
movzx ecx, byte [rdx + 0x24]
shl rcx, 0x20
or rbx, rcx
movzx ecx, byte [rdx + 0x23]
shl rcx, 0x18
or rbx, rcx
movzx ecx, byte [rdx + 0x22]
shl rcx, 0x10
or rbx, rcx
movzx ecx, byte [rdx + 0x21]
shl rcx, 8
or rbx, rcx
movzx ecx, byte [rdx + 0x20]
or rbx, rcx
xor rax, rbx
mov ecx, 2
nop dword [rax]
add r10, r9
add r11, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r11
rol r10, 0x20
add r11, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r11
xor rax, r10
rol r11, 0x20
sub rcx, 1
jne 0x1801991c0
xor r10, rbx
mov r8d, 4
mov rbx, qword [rsp + 0x10]
xor r11, 0xee
mov ecx, r8d
nop
add r10, r9
add r11, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r11
rol r10, 0x20
add r11, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r11
xor rax, r10
rol r11, 0x20
sub rcx, 1
jne 0x180199210
mov rdx, rax
xor rdx, r11
xor rdx, r9
xor rdx, r10
mov ecx, edx
mov byte [rdi], dl
shr ecx, 8
mov byte [rdi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rdi + 2], cl
mov ecx, edx
shr ecx, 0x18
shr rdx, 0x20
mov byte [rdi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [rdi + 5], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rdi + 4], dl
shr edx, 0x18
mov byte [rdi + 6], cl
xor r9, 0xdd
mov byte [rdi + 7], dl
add r10, r9
add r11, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r11
rol r10, 0x20
add r11, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r11
xor rax, r10
rol r11, 0x20
sub r8, 1
jne 0x180199290
xor rax, r11
xor rax, r9
xor rax, r10
mov ecx, eax
mov byte [rdi + 8], al
shr ecx, 8
mov byte [rdi + 9], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rdi + 0xa], cl
mov ecx, eax
shr ecx, 0x18
shr rax, 0x20
mov byte [rdi + 0xb], cl
mov ecx, eax
shr ecx, 8
mov byte [rdi + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rdi + 0xc], al
shr eax, 0x18
mov byte [rdi + 0xf], al
mov byte [rdi + 0xe], cl
pop rdi
ret
Function at 0x180199430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
add qword [rcx + 0x28], r8
mov r12, r8
mov rax, qword [rcx + 0x30]
mov r14, rdx
mov rsi, qword [rcx]
mov r15, rcx
mov rdi, qword [rcx + 8]
mov rbp, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov r8, qword [rcx + 0x28]
test rax, rax
je 0x18019954d
add rcx, 0x20
mov r13d, 8
sub r13, rax
add rcx, rax
cmp r12, r13
jae 0x18019949f
mov r8, r12
call fcn.18020b840
add qword [r15 + 0x30], r12
jmp 0x180199631
mov r8, r13
call fcn.18020b840
movzx eax, byte [r15 + 0x26]
add r14, r13
movzx ecx, byte [r15 + 0x27]
sub r12, r13
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x25]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x24]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x23]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x22]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x21]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x20]
shl rcx, 8
or rcx, rax
mov eax, 2
xor rbx, rcx
nop
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rdi, 0x11
rol rbx, 0x15
xor rdi, rbp
xor rbx, rsi
rol rbp, 0x20
sub rax, 1
jne 0x180199510
mov r8, qword [r15 + 0x28]
xor rsi, rcx
and r8d, 7
mov rdx, r14
sub rdx, r8
mov qword [r15 + 0x30], r8
add rdx, r12
cmp r14, rdx
je 0x180199616
nop word [rax + rax]
movzx eax, byte [r14 + 6]
movzx ecx, byte [r14 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14]
shl rcx, 8
or rcx, rax
mov eax, 2
xor rbx, rcx
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rdi, 0x11
rol rbx, 0x15
xor rdi, rbp
xor rbx, rsi
rol rbp, 0x20
sub rax, 1
jne 0x1801995d0
xor rsi, rcx
add r14, 8
cmp r14, rdx
jne 0x180199570
lea rcx, [r15 + 0x20]
mov qword [r15], rsi
mov rdx, r14
mov qword [r15 + 8], rdi
mov qword [r15 + 0x10], rbp
mov qword [r15 + 0x18], rbx
call fcn.18020b840
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18019d830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r14, rcx
mov rsi, r8
mov r8, rdx
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rcx, r9
mov rdi, r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
lea rbp, [rdx*4]
sub rcx, 1
je 0x18019d87e
cmp rcx, 1
jne 0x18019d882
inc rbp
add rbp, 2
cmp r8, rbp
ja 0x18019d8a0
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
xor edx, edx
mov qword [rsp + 0x10], rbx
mov ebx, edx
test r9, r9
je 0x18019d9f2
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
shl edx, 8
dec rdi
add edx, eax
add ebx, 8
cmp ebx, 6
jb 0x18019d96b
nop dword [rax + rax]
add ebx, 0xfffffffa
mov r11d, edx
mov ecx, ebx
shr r11d, cl
and r11d, 0x3f
mov r9d, r11d
mov eax, r11d
xor r9d, 0x3e
xor eax, 0x3f
neg r9d
neg eax
shr r9d, 8
lea ecx, [r11 - 0x3e]
shr eax, 8
lea r8d, [r11 - 0x34]
not r9b
shr ecx, 8
and r9b, 0xfb
shr r8d, 8
not al
lea r10d, [r11 - 0x1a]
or r9b, al
shr r10d, 8
lea eax, [r11 - 4]
and r9b, 0x2f
and cl, al
movzx eax, r8b
not al
and cl, al
movzx eax, r10b
or r9b, cl
not al
lea ecx, [r11 + 0x47]
add r11b, 0x41
and cl, al
and r11b, r10b
and cl, r8b
or r9b, cl
or r9b, r11b
mov byte [r14], r9b
inc r14
cmp ebx, 6
jae 0x18019d8e0
test rdi, rdi
jne 0x18019d8c0
test ebx, ebx
je 0x18019d9f2
mov ecx, 6
sub ecx, ebx
shl edx, cl
and edx, 0x3f
mov r9d, edx
mov eax, edx
xor r9d, 0x3e
xor eax, 0x3f
neg r9d
neg eax
shr r9d, 8
lea ecx, [rdx - 0x3e]
shr eax, 8
lea r8d, [rdx - 0x34]
not r9b
shr ecx, 8
and r9b, 0xfb
shr r8d, 8
not al
lea r10d, [rdx - 0x1a]
or r9b, al
shr r10d, 8
lea eax, [rdx - 4]
and r9b, 0x2f
and cl, al
movzx eax, r8b
not al
and cl, al
movzx eax, r10b
or r9b, cl
not al
lea ecx, [rdx + 0x47]
add dl, 0x41
and cl, al
and dl, r10b
and cl, r8b
or r9b, cl
or r9b, dl
mov byte [r14], r9b
inc r14
mov rbx, qword [rsp + 0x10]
mov rax, rbp
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov byte [r14], 0
pop r14
ret
Function at 0x18019e380
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x18019e3c2
xor r9d, r9d
cmp r8, rdx
jb 0x18019e3c2
mov r8d, 0x80
lea rax, [rcx + r9*8]
sub rdx, rcx
sub r8, r9
nop dword [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x18019e3b0
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x18019e3d0
ret

Function at 0x1801a0660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x1b0]
lea rdi, [rcx + 0xdd4]
mov rsi, rcx
add al, 0x13
movzx ecx, al
xor bl, bl
xor edx, edx
mov ebp, dword [rsi + 0x1c0]
sub ebp, ecx
lea r10d, [rbp - 3]
test r10d, r10d
je 0x1801a0771
cmp r10d, 0x20
jb 0x1801a074e
movdqa xmm3, xmmword [0x1800591e0]
mov r9d, r10d
and r9d, 0xffffffe0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov r8d, reloc.WS2_32.dll_select
nop word [rax + rax]
lea eax, [r8 - 0x10]
add edx, 0x20
movdqu xmm0, xmmword [rax + rdi]
mov eax, r8d
add r8d, 0x20
pandn xmm0, xmm3
por xmm2, xmm0
movdqu xmm0, xmmword [rax + rdi]
pandn xmm0, xmm3
por xmm1, xmm0
cmp edx, r9d
jb 0x1801a06e0
por xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
por xmm1, xmm0
movd ebx, xmm1
cmp edx, r10d
jae 0x1801a0771
lea eax, [rdx + 2]
mov ecx, r10d
add rax, rdi
sub ecx, edx
mov edx, ecx
nop dword [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
not cl
or bl, cl
sub rdx, 1
jne 0x1801a0760
movzx eax, byte [rdi + 1]
lea ecx, [r10 + 2]
xor al, 1
lea r8, [rsp + 0x20]
or al, byte [rcx + rdi]
mov edx, reloc.WS2_32.dll_send
or al, byte [rdi]
lea rcx, [0x1800708f0]
or bl, al
call fcn.18015be90
movzx r9d, byte [rsi + 0x1b0]
lea rdx, [rsp + 0x20]
add byte [rsp + 0x21], r9b
movzx ecx, r9b
shr cl, 4
movzx eax, r9b
dec cl
mov byte [rsp + 0x32], r9b
and al, 4
mov r8d, reloc.WS2_32.dll_send
or cl, al
mov byte [rsp + 0x2e], cl
mov ecx, ebp
add rcx, rdi
call fcn.18015bd80
movzx r8d, byte [rsi + 0x1b0]
lea ecx, [rbp + 0x13]
mov rdx, qword [rsi + 0x1a8]
add rcx, rdi
or bl, al
call fcn.18015bd80
or al, bl
neg al
sbb eax, eax
and eax, 8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1801a1e20
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1801a1e5f
test rdx, rdx
je 0x1801a1e5f
xor eax, eax
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.180117bd0
mov qword [rbx], rax
neg rax
sbb eax, eax
neg eax
dec eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
Function at 0x1801a2510
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1801a260d
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1801a25ea
xorps xmm0, xmm0
mov byte [rsp + 0x20], dil
xor edx, edx
mov word [rsp + 0x21], pe_nt_image_headers64
mov r8d, 0xf0
mov byte [rsp + 0x23], 1
movups xmmword [rsp + 0x32], xmm0
mov dword [rsp + 0x24], 0
movups xmmword [rsp + 0x42], xmm0
mov word [rsp + 0x30], 0
call fcn.18020bef0
movaps xmm0, xmmword [0x180070420]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x180070430]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x180070440]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x180070450]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1801a2612
mov edx, 0xf0
call fcn.18019da10
cmp byte [rbx + 0xe8], 0
je 0x1801a2605
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x1801a52d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx eax, byte [rcx + 0x218]
mov rsi, rdx
lea rdx, [rcx + 0x158]
movzx edi, r8b
movzx r8d, byte [rcx + 0x219]
add rdx, rax
mov rbx, rcx
call fcn.180135bf0
movzx ecx, byte [rbx + 0x218]
xor al, al
test cl, cl
je 0x1801a5342
nop dword [rax]
nop dword [rax + rax]
movzx edx, al
inc al
movzx ecx, byte [rdx + rbx + 0xd8]
xor cl, 0x5c
mov byte [rdx + rbx + 0x158], cl
movzx ecx, byte [rbx + 0x218]
cmp al, cl
jb 0x1801a5320
movzx eax, byte [rbx + 0x219]
lea rdx, [rbx + 0x158]
movzx r8d, cl
mov r9, rsi
add r8d, eax
mov byte [rsp + 0x20], dil
mov rcx, rbx
call fcn.180135c50
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1801a5480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xor al, al
mov rbx, rcx
cmp byte [rcx + 0x218], al
jbe 0x1801a54c2
nop dword [rax]
nop word [rax + rax]
movzx r8d, al
inc al
movzx edx, byte [r8 + rcx + 0xd8]
xor dl, 0x36
mov byte [r8 + rcx + 0x158], dl
cmp al, byte [rcx + 0x218]
jb 0x1801a54a0
call fcn.180135d00
movzx r8d, byte [rbx + 0x218]
lea rdx, [rbx + 0x158]
mov rcx, rbx
call fcn.180135d20
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1801a68d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
movd xmm3, ecx
pshufd xmm3, xmm3, 0
mov r11d, ecx
test r9d, r9d
je 0x180199b96
mov qword [rsp], rbx
cmp r9d, 4
jb 0x180199b5a
lea eax, [r9 - 1]
lea rbx, [r8 + rax*4]
lea rax, [rdx + rax*4]
cmp r8, rax
ja 0x180199b0c
cmp rbx, rdx
jae 0x180199b5a
mov ecx, r9d
and ecx, 0xfffffffc
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + r10*4]
movdqu xmm2, xmmword [rdx + r10*4]
movdqa xmm1, xmm3
pxor xmm2, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [r8 + r10*4], xmm1
pxor xmm1, xmm2
movdqu xmmword [rdx + r10*4], xmm1
add r10d, 4
cmp r10d, ecx
jb 0x180199b20
cmp r10d, r9d
jae 0x180199b92
sub r8, rdx
lea rax, [rdx + r10*4]
sub r9d, r10d
mov edx, r9d
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
mov ecx, dword [rax]
lea rax, [rax + 4]
and ecx, r11d
xor dword [r8 + rax - 4], ecx
mov ecx, dword [r8 + rax - 4]
xor dword [rax - 4], ecx
sub rdx, 1
jne 0x180199b70
mov rbx, qword [rsp]
add rsp, 8
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, r9d
mov ebx, r8d
mov r9d, r8d
mov rdi, rdx
mov r8, qword [rdx + 8]
mov rsi, rcx
mov rdx, qword [rcx + 8]
mov ecx, ebp
call 0x180199ad0
mov r8, qword [rdi + 0x10]
mov r9d, ebx
mov rdx, qword [rsi + 0x10]
mov ecx, ebp
call 0x180199ad0
mov r8, qword [rdi + 0x18]
mov r9d, ebx
mov rdx, qword [rsi + 0x18]
mov ecx, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x180199ad0
Function at 0x1801a7280
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r15
mov eax, dword [rdx]
mov r15, r8
mov dword [r8], eax
mov r12b, 4
mov eax, dword [rdx + 4]
mov dword [r8 + 4], eax
mov eax, dword [rdx + 8]
mov dword [r8 + 8], eax
mov eax, dword [rdx + 0xc]
movzx ebp, cl
shl ebp, 2
mov dword [r8 + 0xc], eax
cmp ebp, 4
jbe 0x1801a7433
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
nop dword [rax]
movzx eax, r12b
lea r14, [rax*4]
mov r11d, dword [r14 + rdx]
mov r10d, r11d
shr r10d, 0x10
xor r10d, r11d
mov r8d, r10d
shr r8d, 8
movzx eax, r8b
shr al, 6
and al, 1
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r8b
shr al, 7
movzx eax, al
shl r8b, 2
movzx r9d, cl
imul ecx, eax, 0x36
movzx eax, cl
xor r9d, eax
movzx eax, r8b
xor r9d, eax
movzx eax, r10b
shr al, 6
and al, 1
shl r9d, 8
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r10b
shr al, 7
movzx eax, al
shl r10b, 2
movzx r8d, cl
imul ecx, eax, 0x36
movzx eax, cl
xor r8d, eax
movzx eax, r10b
xor r8d, eax
or r9d, r8d
mov esi, r9d
shl esi, 0x10
or esi, r9d
xor esi, r11d
mov edi, esi
rol edi, 8
xor edi, esi
mov r8d, edi
mov r9d, edi
shr r8d, 0x18
mov r11d, edi
movzx eax, r8b
shr r9d, 0x10
shr al, 7
add r8b, r8b
movzx eax, al
mov ebx, edi
imul ecx, eax, 0x1b
movzx eax, r8b
shr r11d, 8
rol ebx, 0x10
movzx r10d, cl
xor r10d, eax
movzx eax, r9b
shr al, 7
add r9b, r9b
movzx eax, al
imul ecx, eax, 0x1b
shl r10d, 8
movzx eax, cl
xor r10d, eax
movzx eax, r9b
xor r10d, eax
movzx eax, r11b
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
shl r10d, 8
movzx eax, cl
xor r10d, eax
add r11b, r11b
movzx eax, r11b
inc r12b
xor r10d, eax
movzx eax, dil
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
shl r10d, 8
xor ebx, r10d
movzx eax, cl
xor ebx, eax
movzx eax, dil
add al, al
movzx ecx, al
xor ebx, ecx
movzx eax, r12b
xor ebx, edi
xor ebx, esi
mov dword [r14 + r15], ebx
cmp eax, ebp
jb 0x1801a72d0
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
movzx eax, r12b
movzx r8d, r12b
lea rcx, [rax*4]
mov eax, dword [rcx + rdx]
mov dword [rcx + r15], eax
lea eax, [r8 + 1]
mov ecx, eax
mov eax, dword [rdx + rax*4]
mov dword [r15 + rcx*4], eax
lea eax, [r8 + 2]
mov ecx, eax
mov eax, dword [rdx + rax*4]
mov dword [r15 + rcx*4], eax
lea eax, [r8 + 3]
mov ecx, eax
mov eax, dword [rdx + rax*4]
mov dword [r15 + rcx*4], eax
pop r15
pop r12
pop rbp
ret
Function at 0x1801ae4f0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x58
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x1801ae5c6
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jae 0x1801ae5c6
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x68], rsi
lea r8, [0x180056640]
lea rdx, [0x180074038]
mov qword [rsp + 0x50], rdi
lea rcx, [0x180074044]
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
call qword [sym.imp.KERNEL32.dll_GetProfileStringA]
xor ebx, ebx
lea rsi, [0x18029cba0]
nop
movsxd rdi, ebx
mov r8, 0xffffffffffffffff
lea rcx, [rsi + rdi*8]
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x1801ae570
lea rdx, [rsp + 0x30]
call fcn.180221830
test eax, eax
je 0x1801ae5ba
inc ebx
cmp ebx, 0x10
jb 0x1801ae560
mov dword [0x1802b1e2c], 0x809
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x58
ret
mov eax, dword [rsi + rdi*8 + 4]
mov dword [0x1802b1e2c], eax
jmp 0x1801ae599
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp ecx, 4
jne 0x1801ae61a
shr eax, 0xa
mov ecx, eax
sub ecx, 3
je 0x1801ae5f0
sub ecx, 1
je 0x1801ae613
cmp ecx, 1
jne 0x1801ae5f5
mov eax, 1
shl eax, 0xa
or eax, 4
mov dword [0x1802b1e2c], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x58
ret
mov eax, 2
jmp 0x1801ae5f5
bts ecx, 0xb
mov dword [0x1802b1e2c], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x58
ret
Function at 0x1801af510
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebp, ebp
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov ebx, 2
mov edi, ebp
cmp ecx, 0xa
ja case.0x1801af559.3
movsxd rax, ecx
lea rdx, section.__wibu05
mov ecx, dword [rdx + rax*4 + 0x15f694]
add rcx, rdx
jmp rcx
lea rdi, [0x180074118]
jmp case.0x1801af559.3
lea rdi, [0x180074150]
jmp 0x1801af598
lea rdi, [0x180074150]
jmp case.0x1801af559.3
lea rdi, [0x180074188]
jmp case.0x1801af559.3
lea rdi, [0x1800741c0]
jmp 0x1801af598
lea rdi, [0x1800741f8]
jmp 0x1801af598
lea rdi, [0x180074238]
mov ebx, 3
mov rcx, rbp
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0x30]
cmp ebx, 2
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
sete cl
mov rdx, rdi
add rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
jne 0x1801af60a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1801af671
cmp ebx, 3
jne 0x1801af66f
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
jne 0x1801af66f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r14
mov dword [rsp + 0x38], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
cmove ebp, dword [rsp + 0x38]
mov eax, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret