joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005a800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18005a875
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18005a875
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18005a865
nop
cmp rbx, rcx
jae 0x18005a875
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18005a850
cmp rbx, rcx
jae 0x18005a875
cmp word [rbx], 0
je 0x18005a875
mov rax, rbx
jmp 0x18005a877
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18005abf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov edi, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18005ac0d
test ebx, ebx
je 0x18005ac24
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x18005ac1f
cmp ebx, 1
je 0x18005ac24
cmp ebx, 2
jne 0x18005ac31
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x180066090
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x1800660f0
mov r8, qword [rcx]
test r8, r8
je 0x1800660f0
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x1800660b0
test ecx, ecx
je 0x1800660ed
mov r9d, ecx
lea r10, [0x180091660]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x1800660d0
not eax
ret
xor eax, eax
ret

Function at 0x1800666f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x1800666fd
xor eax, eax
jmp 0x180066776
mov r9, qword [rcx]
test r9, r9
jne 0x180066709
xor eax, eax
jmp 0x180066776
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x180066716
xor eax, eax
jmp 0x180066776
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x180091660]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x180066740
cmp edx, eax
jae 0x18006676c
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x18006672d
not r8d
mov eax, r8d
jmp 0x180066776
add rsp, 0x18
ret
Function at 0x180076d70
Capabilities:
Create thread
Enumerate gui resources
Enumerate process modules
Log keystrokes via polling
Terminate process

Disassembly:
push rdi
sub rsp, 0x470
mov rdi, rcx
cmp edx, 1
jne 0x180076e91
lea rdx, [0x1800ca450]
mov qword [rsp + 0x480], rbx
lea rcx, [0x180076ea0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x1800ca3cc], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1800ca528], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180076e28
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x180076e28
nop word [rax + rax]
lea rdx, str.GameAssembly.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x180076e31
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x180076e00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180062d70
call fcn.1800636f0
call fcn.180064fd0
call fcn.18005f530
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x480]
test ax, ax
je 0x180076e72
cmp byte [0x1800ca399], 0
jne 0x180076e72
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
lea r8, [0x180076bb0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
add rsp, 0x470
pop rdi
ret
Function at 0x18007d180
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18007d3a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18007d287
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007d1e4
mov rax, qword [0x1800a3008]
cmp qword [rsp + 0x20], rax
ja 0x18007d1e4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007d1a6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18007d213
jmp 0x18007d287
cmp dword [rsp + 0x50], 0x10000
jne 0x18007d26a
cmp qword [rsp + 0x48], 0x10000
jb 0x18007d26a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007d258
mov rax, qword [rsp + 0x28]
jmp 0x18007d289
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007d282
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18007d3a0
mov qword [rsp + 0x20], rax
jmp 0x18007d1a6
xor eax, eax
add rsp, 0x68
ret

Function at 0x18007d290
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18007d3e0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18007d393
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007d2eb
mov rax, qword [0x1800a3008]
cmp qword [rsp + 0x20], rax
ja 0x18007d2eb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007d2ad
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18007d31a
jmp 0x18007d393
cmp dword [rsp + 0x50], 0x10000
jne 0x18007d371
cmp qword [rsp + 0x48], 0x10000
jb 0x18007d371
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007d35f
mov rax, qword [rsp + 0x28]
jmp 0x18007d395
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007d38e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18007d3e0
mov qword [rsp + 0x20], rax
jmp 0x18007d2ad
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007d430
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18007d9c0
mov qword [rsp + 0x28], 0
cmp qword [0x1800c9cc8], 0
jne 0x18007d478
cmp qword [0x1800c9cc0], 0
je 0x18007d478
mov rax, qword [0x1800c9cc0]
mov qword [0x1800c9cc8], rax
cmp qword [0x1800c9cc8], 0
je 0x18007d51e
mov rax, qword [0x1800c9cc8]
cmp qword [rax + 0x10], 0
je 0x18007d51e
mov rax, qword [0x1800c9cc8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007d51e
mov rax, qword [0x1800c9cc8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007d51e
mov rax, qword [0x1800c9cc8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18007d4e4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18007d4eb
xor eax, eax
jmp 0x18007d699
mov rax, qword [0x1800c9cc8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18007d699
mov rax, qword [0x1800c9cc0]
mov qword [0x1800c9cc8], rax
jmp 0x18007d540
mov rax, qword [0x1800c9cc8]
mov rax, qword [rax + 8]
mov qword [0x1800c9cc8], rax
cmp qword [0x1800c9cc8], 0
je 0x18007d58d
cmp qword [0x1800c9cc8], 0
je 0x18007d58b
mov rax, qword [0x1800c9cc8]
cmp qword [rax + 0x10], 0
je 0x18007d58b
mov rax, qword [0x1800c9cc8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007d58b
mov rax, qword [0x1800c9cc8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007d58b
jmp 0x18007d4bc
jmp 0x18007d52e
mov rcx, qword [rsp + 0x60]
call fcn.18007f5f0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18007d6a0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18007d697
mov rax, qword [rsp + 0x48]
mov qword [0x1800c9cc8], rax
mov rax, qword [0x1800c9cc8]
mov dword [rax], 0x52727464
mov rax, qword [0x1800c9cc8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800c9cc8]
mov rcx, qword [0x1800c9cc0]
mov qword [rax + 8], rcx
mov rax, qword [0x1800c9cc8]
mov qword [0x1800c9cc0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800c9cc8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18007d648
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18007d682
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18007d63e
mov rax, qword [0x1800c9cc8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18007d4bc
xor eax, eax
add rsp, 0x58
ret
Function at 0x180003c74
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov ecx, dword [rsp + 0x68]
lea edi, [r8 - 0x3aed]
mov ebp, dword [rsp + 0x78]
lea r11d, [r8 - 0x3b]
mov esi, dword [rsp + 0x70]
lea r14d, [r9 - 0x3b73]
mov rbx, rdx
add ebp, 0xfffffdf1
lea r8d, [rcx + 0xab]
add esi, 0xfffffbfb
lea eax, [r8 + 0x120]
lea edx, [rcx + 0x4b0]
cmp edx, eax
jle 0x180003e31
lea eax, [rdi + 0x3b1e]
cmp edx, eax
jle 0x180003dbe
mov rax, qword [rbx + 0x1c8]
xor edx, edx
mov r9d, 0x24ac
mov ecx, dword [rax + 0xd8]
and rcx, 0xfffffffffffffffc
xor rcx, r9
jbe 0x180003d87
mov r8d, edx
mov rax, qword [rbx + 0x1e0]
inc edx
mov rcx, qword [rbx + 0xd8]
add rcx, 0x3f0a
imul rax, rcx
mov qword [rbx + 0x1e0], rax
mov rax, qword [rbx + 0x190]
mov ecx, dword [rax + r8]
xor ecx, dword [rbx + 0x178]
mov rax, qword [rbx + 0x1a0]
mov dword [r8 + rax], ecx
lea r8, [r8 + 4]
mov rax, qword [rbx + 0xb8]
xor rax, 0x3b1e
add qword [rbx + 0x1e0], rax
mov eax, dword [rbx + 0x188]
add dword [rbx + 0x178], eax
mov rax, qword [rbx + 0x1c8]
mov ecx, dword [rax + 0xd8]
xor rcx, r9
movsxd rax, edx
shr rcx, 2
cmp rax, rcx
jb 0x180003d09
mov r8, qword [rbx + 0x48]
xor edx, edx
mov rcx, qword [rbx + 0x1e8]
mov qword [rbx + 0x140], 0x3a95
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rbx + 0xa0]
xor qword [rbx + 0xa8], 0x7716
mov dword [rbx + 0x1d0], eax
jmp 0x180003e31
imul eax, esi, 0x3a95
movsxd rcx, eax
cmp qword [rbx + 0xa8], rcx
je 0x180003e31
mov r10d, dword [rbx + 0x60]
and r8d, 0x3afd
mov ecx, dword [rbx + 0x110]
xor r10d, edx
and r11d, ebp
movsxd rax, ebp
movsxd rdx, r14d
sub ecx, 0x3b1e
lea r9d, [r8 + 0x3d3d]
mov dword [rsp + 0x20], r10d
mov r8d, r11d
xor rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, edi
lea eax, [rsi + 0x3b73]
cdqe
add qword [rbx + 0x1b0], rax
mov rax, qword [rbx + 0x110]
xor rax, qword [rbx + 0x1b0]
sub qword [rbx + 0x148], rax
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 0x3a44]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x180004cc0
Capabilities:
Create thread
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov eax, dword [rsp + 0x98]
lea ebp, [rdx - 0x3d0e]
mov edi, dword [rsp + 0x70]
lea r15d, [rcx - 0x3b1e]
mov esi, dword [rsp + 0xa8]
add edi, 0xfffffe80
mov rbx, qword [rsp + 0xa0]
add esi, 0xfffffdc7
lea edx, [rax - 0x5f]
lea r14d, [rax + 0x3be]
lea eax, [rdx - 0x7f]
cmp esi, eax
jge 0x180004e0d
mov rax, qword [rbx + 0xc8]
mov r10d, 0x46e
mov qword [rbx + 0xc0], rax
mov r8d, 0x3f59
mov r9, qword [rbx + 0x30]
mov esi, 0x3ed6
mov eax, dword [r9 + 0xe8]
add eax, r10d
cmp eax, r8d
jbe 0x180004d7e
mov rdx, qword [rbx + 0xe0]
mov rax, rdx
inc r8d
or rax, rsi
xor rdx, rax
movsxd rax, r8d
mov qword [rbx + 0xe0], rdx
mov ecx, dword [r9 + 0xe8]
add ecx, r10d
cmp rax, rcx
jb 0x180004d59
mov r8, qword [rbx + 0x98]
xor edx, edx
mov rcx, qword [rbx + 0x1e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x1b0]
mov rax, qword [rbx + 0x10]
add rax, 0x3d0e
add qword [rcx + 0x50], rax
mov rax, qword [rbx + 0xc0]
mov qword [rbx + 0x1d8], rax
mov rax, qword [rbx + 0x110]
add qword [rbx + 0xe0], rax
inc rax
mov qword [rbx + 0x110], rax
mov rax, qword [rbx + 0x30]
imul ecx, dword [rax + 0x120], 0x84e4c2ce
cmp ecx, esi
jg 0x180004df3
mov eax, 0x3ed7
sub eax, ecx
imul rcx, rax, 0xffffffffffffc383
add qword [rbx + 0x70], rcx
mov rax, qword [rbx + 0x80]
or qword [rax + 0x168], 0xdaf1777
add edi, 0x60
jmp 0x180004e99
mov r8, qword [rbx + 0xb8]
mov eax, r14d
mov r10, qword [rbx + 0x1c8]
and eax, ebp
sub eax, r14d
movsxd rcx, edi
or r10, rcx
movsxd r9, eax
movsxd rax, edx
sub edx, dword [rbx]
and r8, rax
and r8, rcx
mov qword [rsp + 0x20], r10
mov rcx, qword [rbx + 0xa8]
sub rcx, 0x3c7d
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rbx + 0x110]
movzx ecx, bp
movsxd rax, r15d
xor cx, si
xor rdx, rax
add rdx, qword [rbx + 0x1b8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, dword [rbx]
lea ecx, [r15 + 0x3a44]
xor edx, edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
imul eax, r14d, 0x3a95
add eax, ebp
movsxd rcx, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
lea eax, [rdi + 0x3fc]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180004eb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r8b, byte [rsp + 0x58]
mov r11, rdx
movsxd rbp, dword [0x18002f8c4]
mov r12, rcx
movsxd r13, dword [0x18002f944]
mov eax, 0xb55a0e59
imul dword [0x18002f910]
and r8b, 0x10
mov r10d, 0x83b
add edx, dword [0x18002f910]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [0x18002f900]
movsxd rdi, edx
mov ecx, dword [rax + 0x6a0]
mov rax, qword [0x18002f908]
add ecx, 0x12ca
movsxd rbx, ecx
movzx ecx, word [0x18002f8dc]
mov edx, dword [rax + rcx*4 + 0xc]
movzx eax, word [0x18002f8d8]
sub edx, 0x293
movsxd rcx, dword [0x18002f8c0]
mov word [rsp + 0x40], ax
mov eax, 0xb71
movsxd r14, edx
cmp ecx, eax
jge 0x180004fc7
sub eax, ecx
movzx r15d, r8b
mov esi, eax
mov r8, rcx
and byte [r12 + r11 + 2], 1
xor r10, r8
mov eax, dword [0x18002f8c4]
inc r8
movzx edx, word [0x18002f8dc]
add eax, 8
movsxd rcx, eax
mov rax, qword [rdi + rcx*8]
movsxd rcx, dword [0x18002f948]
and rax, rdx
and rax, qword [0x18002f8f8]
xor edx, edx
sub rax, r15
div rcx
xor edx, edx
mov dword [0x18002f948], eax
mov eax, 0x964
div qword [0x18002f8e0]
mov qword [0x18002f8e0], rdx
sub rsi, 1
jne 0x180004f6a
mov al, byte [0x18002f8b8]
sub al, r9b
and byte [r11 + r9], al
add r9, 2
movzx ecx, word [0x18002f93c]
movzx eax, word [rsp + 0x40]
lea r8d, [rax + rax*2]
mov eax, 0x18138fe5
mul ecx
shr edx, 7
imul eax, edx, 0x551
xor edx, edx
sub ecx, eax
movsxd rax, ecx
div qword [r13 + r8*8]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x82e02cfd0f76fd51
mov qword [r13 + r8*8], rdx
mov rcx, qword [rcx + rbx*8]
mul rcx
shr rdx, 0xa
imul rax, rdx, 0x7d3
sub rcx, rax
movsxd rax, dword [0x18002f8c0]
add rcx, qword [r13 + 0x2a90]
xor rbx, rcx
cmp qword [0x18002f8e8], rax
jne 0x18000509a
cmp r10, qword [rsp + 0x80]
jae 0x18000509a
add qword [rdi + 0x3f70], 0x7ee
xor edx, edx
mov eax, 0x132
div qword [rsp + 0x58]
mov eax, dword [0x18002f8c4]
sub edx, dword [0x18002f920]
and eax, 0x87d
sub edx, dword [0x18002f8c0]
mov dword [0x18002f8c0], edx
xor edx, edx
movzx ecx, byte [r11 + r9]
div ecx
mov byte [r11 + r9], dl
inc dword [0x18002f8c4]
jmp 0x1800050fa
movzx eax, word [0x18002f8dc]
mov ecx, 0xffff
add ax, cx
mov ecx, 0x1d90
mov word [0x18002f8dc], ax
movzx eax, ax
mov word [rax*2 + 0x1960], cx
mov rax, qword [0x18002f900]
mov cl, byte [rax + 0x1fb8]
xor cl, 0xa0
movzx eax, cl
movzx ecx, byte [rbp + 0x7f7]
imul ecx, eax
lea rax, [r11 + r9*2]
mov byte [rbp + 0x7f7], cl
mov cl, byte [0x18002f8dc]
or cl, byte [0x18002f93c]
xor cl, 0x6b
mov byte [r9 + rax], cl
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x50]
movzx eax, word [r14 + rax*2]
add eax, dword [rbx*8 + 0x1db0]
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180015d24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword [0x18002f8b8]
mov r14, rcx
mov esi, eax
mov r15, r9
dec rax
mov ecx, 0xffff
mov qword [0x18002f8b8], rax
mov r13, r8
mov rax, qword [rsp + 0x68]
mov edi, 0x881
movzx r10d, word [rax + 0xd5e8]
movzx eax, word [0x18002f93c]
add ax, cx
mov word [0x18002f93c], ax
mov rcx, qword [r14]
movzx r9d, ax
mov rax, qword [0x18002f8f0]
mov edx, dword [rax + rcx*4]
movsxd rax, dword [0x18002f948]
add edx, 0x1bcb
mov rcx, rax
movsxd r8, edx
mov qword [rsp + 0x60], r8
mov ebp, dword [r15 + rax*4]
add eax, 2
mov dword [0x18002f948], eax
movsxd rdx, eax
mov rax, qword [rdi]
mov rcx, qword [rcx + rax*8 + 0x60]
sub rcx, qword [r14 + rdx*8]
mov qword [r14 + rdx*8], rcx
mov rax, qword [0x18002f920]
movzx ecx, word [r8 + 0x542]
mov word [r8 + rax*2], cx
mov eax, dword [r15]
add eax, 0x27
movsxd rcx, eax
mov rax, qword [0x18002f918]
movsxd r8, dword [rax + rcx*8]
cmp r8d, 0x4cf
jge 0x180015f45
movzx r14d, r10w
lea eax, [r8 + r8*2]
movsxd r10, eax
lea rbx, [r8*8 + 0x301]
mov eax, r8d
shl r10, 3
shl eax, 2
movsxd rcx, eax
mov dword [rsp + 0x50], r14d
lea r11, [rcx*4]
add r11, r13
mov rax, qword [0x18002f8c8]
mov ecx, r14d
mov ebp, r8d
sub ecx, dword [r10 + rax]
mov eax, 0x8755c61d
sub ecx, dword [r11]
mov dword [r11], ecx
mov ecx, dword [0x18002f910]
or ecx, 0x824
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xf22
sub ecx, eax
movsxd rax, ecx
xor r9, rax
mov rax, qword [0x18002f8b8]
sub ebp, eax
mov qword [rsp + 0x68], r9
dec rax
mov qword [0x18002f8b8], rax
mov rax, qword [rdi]
add rdi, 8
lea rcx, [rax + rax*2]
mov dword [r13 + rcx*4], r8d
mov rax, qword [rdi]
mov r12d, dword [rdi + rax*8]
cmp r12d, r8d
jle 0x180015f24
mov r14, qword [rsp + 0x68]
mov eax, 0x46406b93
mov r13, qword [rsp + 0x60]
imul r8d
mov r9d, edx
sar r9d, 0xb
mov eax, r9d
shr eax, 0x1f
add r9d, eax
mov esi, dword [0x18002f8a0]
mov eax, 0x1d27
inc esi
movzx edx, r9w
imul edx, eax
movzx ecx, r8w
mov dword [0x18002f8a0], esi
and qword [rbx], r14
movsxd rax, dword [r15]
sub cx, dx
mov word [r13 + rax*2], cx
mov eax, r12d
mov rcx, qword [rdi]
cdq
idiv r8d
inc r12d
cdq
idiv r8d
movsxd rax, edx
xor qword [rdi + rcx*8], rax
cmp r12d, r8d
jg 0x180015ecb
mov r13, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x50]
mov r9, qword [rsp + 0x68]
inc r8d
add r10, 0x18
add r11, 0x10
add rbx, 8
cmp r8d, 0x4cf
jl 0x180015e31
mov r14, qword [rsp + 0x48]
movsxd rdx, dword [r15]
mov ecx, 0x6c4
sub rcx, qword [0x18002f8e0]
xor rcx, qword [0x18002f8b0]
sub rcx, qword [r14 + rdx*8]
mov qword [r14 + rdx*8], rcx
imul ecx, esi, 0x796
movsxd rdx, ecx
mov rcx, qword [0x18002f930]
imul rcx, rdx
xor edx, edx
mov qword [0x18002f930], rcx
mov ecx, ebp
and ecx, 0x1110
mov qword [0x18002f928], rcx
mov rax, qword [rdi + 0x7c60]
movsxd rcx, esi
div rcx
mov eax, edx
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180015fac
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12d, dword [rsp + 0xa8]
lea r15d, [r9 + 0x238]
mov r13d, dword [rsp + 0xd0]
lea r9d, [r8 - 0x3a95]
add r13d, 0xffffc503
lea r8d, [rcx - 0x186]
add r12d, 0xfffffe1b
mov dword [rsp + 0xa8], r8d
lea r14d, [r9 + 0x3b4c]
lea ebp, [rdx - 0x259]
lea eax, [r13 + 0x3cd2]
cmp r8d, eax
cmovge r14d, r9d
lea eax, [r14 + 0x131]
cmp r13d, eax
jg 0x18001613f
lea eax, [r15 - 0x397]
cmp r12d, eax
jge 0x18001606a
mov rdx, qword [rsp + 0xc8]
sub ebp, 0x120
mov rax, qword [rdx + 0x1c0]
mov ecx, dword [rax + 0xe8]
sub ecx, 0x3add
mov dword [rdx + 0x17c], ecx
jmp 0x18001613f
mov rsi, qword [rsp + 0xc8]
mov ecx, dword [rsi + 0x1c0]
imul ecx, r8d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [rsi + 0xd0]
xor eax, dword [rsi + 0x1b0]
mov ebx, dword [rsi + 0x38]
or eax, r13d
mov edi, dword [rsi + 0x170]
add r15d, eax
mov eax, dword [rsp + 0x70]
and edi, ebx
mov rcx, qword [rsi + 0x30]
add eax, 0x58
mov r10, qword [rsi + 0x1c8]
or ebx, r12d
movsxd rdx, dword [rsp + 0xa8]
sub r10, 0x3a44
or r10, qword [rsi + 0x68]
movsxd r11, ebp
add rcx, r11
imul r14d, r13d
mov qword [rsi + 0x1b0], rcx
and rdx, r11
mov ecx, 0x3f59
mov qword [rsp + 0x28], r10
movsxd r9, r15d
or r9, 0x3aed
imul r8d, r13d, 0x3f0a
xor edi, r14d
xor edi, eax
mov eax, ebp
or eax, ecx
xor edi, 0x3cd2
add ebx, eax
movsxd rax, edi
add ebx, dword [rsi + 0x18]
xor r9, rax
mov rax, qword [rsi + 0x70]
add ebx, r12d
or rax, rcx
mov dword [rsp + 0x20], ebx
imul rcx, rax, 0x3afd
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
and r15d, 0x3d0e
lea eax, [rdi + r15]
cdqe
add qword [rsi + 0x1b0], rax
mov rbx, qword [rsp + 0x60]
lea eax, [rbp - 0xab]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret