joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b6e8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14001037c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002b772
cmp byte [rbp - 0x21], r15b
je 0x14002b76d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14002b7a8
call fcn.14001e3f0
test eax, eax
jne 0x14002b794
cmp byte [rbp - 0x21], r15b
je 0x14002b78c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14002b7a8
cmp byte [rbp - 0x21], r15b
je 0x14002b7a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140018ef0
test eax, eax
jne 0x14002b848
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14001037c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14002b7e7
cmp byte [rbp - 0x21], r15b
je 0x14002b81c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14002b81c
call fcn.14001e3f0
test eax, eax
jne 0x14002b808
cmp byte [rbp - 0x21], r15b
je 0x14002b801
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14002b81c
cmp byte [rbp - 0x21], r15b
je 0x14002b819
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140018ef0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14002b848
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002b84b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14002b859
mov rcx, rdi
call fcn.14001d7ac
cmp byte [rbp + 0x3f], r15b
je 0x14002b868
mov rcx, qword [rbp + 0x27]
call fcn.14001d7ac
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14002d4d4
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rcx], 0
mov rax, r8
and qword [rcx + 8], 0
mov rdi, rdx
mov rdx, rax
mov dword [rcx + 0x50], 0x6a09e667
mov r8, r9
mov dword [rcx + 0x54], 0xbb67ae85
mov rbx, rcx
mov dword [rcx + 0x58], 0x3c6ef372
mov dword [rcx + 0x5c], 0xa54ff53a
mov dword [rcx + 0x60], 0x510e527f
mov dword [rcx + 0x64], 0x9b05688c
mov dword [rcx + 0x68], 0x1f83d9ab
mov dword [rcx + 0x6c], 0x5be0cd19
call fcn.14002d820
mov rdx, rdi
mov rcx, rbx
call fcn.14002d5cc
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140032620
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
call fcn.14000c2a0
mov eax, 0x79
mov dword [rsp + 0x30], 0x370016
lea rcx, [rsp + 0x30]
mov word [rsp + 0x48], ax
mov dword [rsp + 0x34], 0x230030
mov dword [rsp + 0x38], 0x17001f
mov dword [rsp + 0x3c], 0x130032
mov dword [rsp + 0x40], 0x160034
mov dword [rsp + 0x44], 0x19003f
call fcn.140001f6c
mov rcx, qword [rax]
call fcn.1400107ac
lea rcx, [rbp - 0x60]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400326b1
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x1400326bd
mov eax, 0x45
mov dword [rsp + 0x4a], 0x350006
lea rcx, [rsp + 0x4a]
mov word [rbp - 0x6a], ax
mov dword [rsp + 0x4e], 0x1001a
mov dword [rsp + 0x52], 0x390021
mov dword [rsp + 0x56], 0x2c0011
mov dword [rsp + 0x5a], 0x230016
mov dword [rsp + 0x5e], 0xf0037
mov dword [rsp + 0x62], 0xb0010
mov dword [rsp + 0x66], 0x210027
mov dword [rsp + 0x6a], 0x2b0014
mov dword [rsp + 0x6e], 0xe0014
mov dword [rsp + 0x72], 0xd0025
mov dword [rsp + 0x76], 0x250003
mov dword [rsp + 0x7a], 0x320024
mov dword [rsp + 0x7e], 0x380026
mov dword [rbp - 0x7e], 0x4002f
mov dword [rbp - 0x7a], 0x1b0021
mov dword [rbp - 0x76], 0x140039
mov dword [rbp - 0x72], 0x5005d
mov dword [rbp - 0x6e], 0x24003f
call fcn.1400023a0
lea rdx, [rbp - 0x60]
sub rdx, 2
lea rdx, [rdx + 2]
cmp word [rdx], 0
jne 0x14003277c
mov r8, qword [rax]
xor ecx, ecx
movzx eax, word [r8 + rcx*2]
mov word [rdx + rcx*2], ax
inc rcx
test ax, ax
jne 0x14003278b
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x1c001b
mov dword [rsp + 0x34], 0xe0020
mov dword [rsp + 0x38], 0x200032
mov dword [rsp + 0x3c], 0x20000b
mov dword [rsp + 0x40], 0x570036
call fcn.140002324
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, rbx
xor r8d, r8d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
Function at 0x140032d0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r10, rdx
mov r9, rcx
test rcx, rcx
je 0x140032d8d
test rdx, rdx
je 0x140032d8d
movsxd rax, dword [rcx + 0x3c]
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov edx, dword [r8 + 0x20]
add rdi, rcx
mov esi, dword [r8 + 0x24]
add rdx, rcx
mov ebp, dword [r8 + 0x18]
add rsi, rcx
xor ecx, ecx
test ebp, ebp
je 0x140032d8d
mov eax, dword [rdx]
mov rbx, r10
add rax, r9
sub rbx, rax
movzx r8d, byte [rax]
movzx r11d, byte [rax + rbx]
sub r8d, r11d
jne 0x140032d7e
inc rax
test r11d, r11d
jne 0x140032d68
test r8d, r8d
je 0x140032da4
inc ecx
add rdx, 4
cmp ecx, ebp
jb 0x140032d5d
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rsi + rcx*2]
mov eax, dword [rdi + rcx*4]
add rax, r9
jmp 0x140032d8f

Function at 0x140032f0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6b
mov dword [rbp - 0x20], 0x3d0011
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2c0021
mov dword [rbp - 0x18], 0x1a0016
mov dword [rbp - 0x14], 0x20020
mov dword [rbp - 0x10], 0x120023
call fcn.1400072ac
mov rcx, qword [rax]
call 0x140034160
mov qword [0x140062160], rax
lea rcx, [rbp - 0x20]
mov eax, 0x70
mov dword [rbp - 0x20], 0x3d0011
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2c0021
mov dword [rbp - 0x18], 0x1a0016
mov dword [rbp - 0x14], 0x710051
call fcn.140007230
mov rcx, qword [rax]
call 0x140034160
lea rcx, [rbp - 0x20]
mov qword [0x140062150], rax
mov dword [rbp - 0x20], 0xc0034
mov dword [rbp - 0x1c], 0xe0017
mov dword [rbp - 0x18], 0x56003f
call fcn.1400071b4
mov rcx, qword [rax]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140034160
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x14003419c
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000aa2c
test rax, rax
jne 0x1400341b3
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140034188
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400341a3
Function at 0x1400335c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r13, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140033637
movzx eax, word [r12 + rbx*2]
mov rdx, r13
mov ecx, dword [r15 + rbx*4]
add rcx, rsi
mov ebp, dword [r14 + rax*4]
add rbp, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140033656
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140033610
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbp
jmp 0x140033639
Function at 0x140033864
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x140062168]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x100009
mov dword [rbp - 0x1c], 0xe0016
mov dword [rbp - 0x18], 0x65003f
mov dword [rbp - 0x14], 0x6d0050
mov dword [rbp - 0x10], 0x3b0014
mov dword [rbp - 0xc], 0x580007
call fcn.140006b2c
mov rcx, qword [rax]
call rbx
mov rbx, qword [0x140062168]
lea rcx, [rbp - 0x20]
mov qword [0x140062148], rax
mov dword [rbp - 0x20], 0x11000d
mov dword [rbp - 0x1c], 0xb001d
mov dword [rbp - 0x18], 0x33003d
mov dword [rbp - 0x14], 0x6d0016
mov dword [rbp - 0x10], 0x3b0014
mov dword [rbp - 0xc], 0x580007
call fcn.140006b2c
mov rcx, qword [rax]
call rbx
movdqa xmm0, xmmword [0x1400443e0]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140062158], rax
mov word [rbp - 0x10], 0xf15
mov byte [rbp - 0xe], 0x48
call fcn.140007054
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xe161009
mov dword [rbp - 0x1c], 0x261a133f
mov dword [rbp - 0x18], 0x3d1f2213
mov word [rbp - 0x14], 0x652e
call fcn.140006c50
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x7071613
mov dword [rbp - 0x1c], 0x37073821
mov dword [rbp - 0x18], 0x360e273f
mov word [rbp - 0x14], 0x6538
call fcn.140006c50
mov rcx, qword [0x140062158]
mov rdx, qword [rax]
call fcn.140032d0c
movdqa xmm0, xmmword [0x140044350]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140062100], rax
mov byte [rbp - 0x10], 0x63
call fcn.140006fa8
mov rcx, qword [0x140062158]
mov rdx, qword [rax]
call fcn.140032d0c
movdqa xmm0, xmmword [0x140044370]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140062108], rax
mov dword [rbp - 0x10], 0x482d3407
call fcn.140006824
mov rcx, qword [0x140062158]
mov rdx, qword [rax]
call fcn.140032d0c
movdqa xmm0, xmmword [0x140044400]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400620f8], rax
mov byte [rbp - 0x10], 0x63
call fcn.140006fa8
mov rcx, qword [0x140062158]
mov rdx, qword [rax]
call fcn.140032d0c
movdqa xmm0, xmmword [0x140044450]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400620f0], rax
mov dword [rbp - 0x10], 0x926370a
mov byte [rbp - 0xc], 0x4a
call fcn.140006cfc
movdqa xmm0, xmmword [0x1400443a0]
movdqu xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], 0x190d
mov byte [rbp - 0xe], 0x48
call fcn.140007054
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140034160
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6b
mov dword [rbp - 0x20], 0x3d0011
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2c0021
mov dword [rbp - 0x18], 0x1a0016
mov dword [rbp - 0x14], 0x20020
mov dword [rbp - 0x10], 0x120023
call fcn.1400072ac
mov rcx, qword [rax]
call 0x140034160
mov qword [0x140062160], rax
lea rcx, [rbp - 0x20]
mov eax, 0x70
mov dword [rbp - 0x20], 0x3d0011
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2c0021
mov dword [rbp - 0x18], 0x1a0016
mov dword [rbp - 0x14], 0x710051
call fcn.140007230
mov rcx, qword [rax]
call 0x140034160
lea rcx, [rbp - 0x20]
mov qword [0x140062150], rax
mov dword [rbp - 0x20], 0xc0034
mov dword [rbp - 0x1c], 0xe0017
mov dword [rbp - 0x18], 0x56003f
call fcn.1400071b4
mov rcx, qword [rax]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140034160
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x14003419c
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000aa2c
test rax, rax
jne 0x1400341b3
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140034188
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400341a3
Function at 0x18000303c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.18002a340
xor edi, edi
mov dword [rbp - 0x40], 0x23e123f0
mov word [rbp - 0x2c], di
mov ecx, edi
mov dword [rbp - 0x3c], 0x23b923e7
mov dword [rbp - 0x38], 0x23f923b9
mov dword [rbp - 0x34], 0x23ea23a3
mov dword [rbp - 0x30], 0x23fc23e3
mov byte [rbp - 0x2a], 1
mov eax, 0x2387
add eax, ecx
xor word [rbp + rcx*2 - 0x40], ax
inc rcx
cmp rcx, 0xa
jb 0x180003082
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2a], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
test rax, rax
je 0x180003101
movdqa xmm0, xmmword [0x180036710]
mov rcx, rdi
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0xfbedcbee
mov dword [rbp - 0x14], 0x100f9ef
lea eax, [rcx - 0x79]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x16
jb 0x1800030cb
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x11], dil
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18003fdf8], rax
test rax, rax
jne 0x1800031e7
mov al, dil
jmp 0x180003104
mov al, byte [rbp + 0x10]
test al, al
jne 0x1800031e7
movdqa xmm0, xmmword [0x180036720]
mov rcx, rdi
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x100fcf2
lea eax, [rcx - 0x79]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x12
jb 0x180003123
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2d], dil
lea rcx, [rbp - 0x28]
call fcn.180005778
mov rbx, rax
mov dword [rbp - 0x50], 0xe4fbe9d0
mov rcx, rdi
mov dword [rbp - 0x4c], 0xeae2e2
mov byte [rbp - 0x48], 1
lea eax, [rcx - 0x79]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x18000315c
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov byte [rbp - 0x48], dil
jb 0x18000317d
mov rdx, qword [rbx]
xor r9d, r9d
lea r8, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movups xmm0, xmmword [rbx + 0x10]
movups xmm1, xmmword [rbx]
mov qword [rbx + 0x10], rdi
psrldq xmm0, 8
movq rdx, xmm0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
cmp rdx, 0x10
jb 0x1800031e7
inc rdx
movq rcx, xmm1
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800031e2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800031e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18002e1dc
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180006a94
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x18003ff34], 0
lea rsi, [0x18003ff30]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x180006afb
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x180006ac9
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x180006ac1
not ebx
mov edx, ebx
test edi, edi
jle 0x180006b1d
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x180006b03
jmp 0x180006b57
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x180006b57
mov r9b, 0x23
cmp r8b, r9b
jne 0x180006b3c
cmp byte [r10], r9b
jne 0x180006b3c
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x180006b2b
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180007394
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.180007270
mov rbx, rax
test rax, rax
je 0x18000746b
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180007462
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x180007462
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180007462
mov r8, qword [0x18003b530]
lea eax, [rsi + 1]
movsxd rcx, eax
inc dword [r8 + 0x354]
mov r8, qword [r8 + 0xf0]
call r8
mov rdi, rax
test rax, rax
je 0x180007462
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x180007452
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18003b530]
mov rcx, rdi
dec dword [rax + 0x354]
call qword [rax + 0xf8]
jmp 0x18000746b
xor eax, eax
mov byte [rsi + rdi], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, rdi
jmp 0x18000746d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180021ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x180021ed1
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, pe_nt_image_headers64
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x180021d82
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x180021da4
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x1800366b0]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x180021ec4
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x180021df2
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x180021df6
mov edx, dword [rax + r12]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.18001de08
mov edx, eax
mov rcx, rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.18001fcec
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x1c]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x20]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x180021de1
mov r11d, pe_nt_image_headers64
add rbx, 0x28
sub rdi, r8
jne 0x180021d30
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret