joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800772e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov rdx, qword [rcx + 0xe8]
test rdx, rdx
jne 0x180077336
mov rcx, qword [0x160]
mov rax, qword [rcx + 0x60]
cmp qword [rcx + 0x58], rax
je 0x1800774d3
mov rax, qword [rdx + 0x160]
mov rcx, qword [rax + 0x58]
cmp rcx, qword [rax + 0x60]
je 0x180077356
cmp byte [rcx + 4], 0
je 0x180077356
mov rsi, qword [rbx + 0xf8]
jmp 0x18007735d
mov rsi, qword [rbx + 0x100]
test rsi, rsi
je 0x1800774d3
mov edi, dword [r8 + 0xc]
sub edi, dword [r8 + 4]
mov rax, qword [rsi]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [rax + 0x30]
mov ecx, dword [rax]
mov edx, dword [r15 + 4]
mov eax, dword [r15 + 8]
mov dword [rbp - 0x20], eax
add eax, ecx
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], edx
lea eax, [rdx + rdi]
mov dword [rbp - 0x14], eax
mov rax, qword [rsi]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [rax + 0x30]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call fcn.180077200
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_CopyRect]
xor edi, edi
mov rax, rbx
nop dword [rax]
cmp byte [rax + 0x99], dil
jne 0x1800773ea
mov rax, qword [rax + 0xa8]
test rax, rax
jne 0x1800773d0
jmp 0x18007748d
test rax, rax
je 0x18007748d
mov rax, qword [rax + 0xe0]
mov r15, qword [rax]
test r15, r15
je 0x18007748d
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
lea rcx, [rbp - 0x28]
call fcn.18005e5f0
mov qword [rbp - 0x28], rax
xor ecx, ecx
xor edx, edx
nop dword [rax + rax]
add ecx, dword [rbx + 0xb4]
add edx, dword [rbx + 0xb8]
mov rbx, qword [rbx + 0xa8]
test rbx, rbx
jne 0x180077440
sub dword [rbp - 0x24], edx
sub dword [rbp - 0x28], ecx
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18007748d
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, 2
cmovne edi, eax
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x28], r14
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800774ae
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x48]
nop
mov rax, qword [rsi]
mov r9d, edi
lea r8, [rbp - 0x20]
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x28]
nop
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800774d3
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800789d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, rcx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x180078a1c
xor al, al
jmp 0x180078b71
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180078a15
xor bl, bl
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r15, rax
test rax, rax
je 0x180078b68
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbp, rax
mov qword [rsp + 0x50], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x180078a90
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.1800089e0
nop
mov rax, qword [r13 + 0x60]
cmp byte [rax + 0x11e], 0
je 0x180078af6
mov rbx, r12
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x180078af6
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
nop dword [rax]
lea rax, [rsp + 0x28]
cmp r14, 8
cmovae rax, rdi
movzx ecx, word [rax + rbx*2]
call fcn.1801da2a4
test eax, eax
je 0x180078b9c
inc rbx
cmp rbx, rsi
jb 0x180078ad0
mov bl, 1
lea rdx, [rsp + 0x28]
mov rcx, r13
call fcn.180078280
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp r14, 8
jb 0x180078b46
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180078b3e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180078ba3
mov rcx, rdi
call fcn.1801ccd54
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
test rbp, rbp
je 0x180078b68
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801ccd30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor bl, bl
jmp 0x180078b0f
call fcn.1801d1a6c
int3
Function at 0x180078c30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180078c7c
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x180078c83
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x180078d97
xor bl, bl
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.180078bb0
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180078d3c
lea rsi, [rax*2 + 2]
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
mov rdx, rsi
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x180078d3c
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x180078d02
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
xor bl, bl
jmp 0x180078d3c
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.1801ceec0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x180078d3a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor bl, bl
jmp 0x180078d3c
mov bl, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180078d81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180078d7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180078dba
call fcn.1801ccd54
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801ccd30
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1801d1a6c
int3
Function at 0x18008a3d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x11
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x18008a410
test rbx, rbx
je 0x18008a410
cmp dword [rbx + 8], 0x100
jne 0x18008a410
mov rax, qword [rbx + 0x10]
cmp rax, 0x4c
je 0x18008a420
add rax, 0xffffffffffffffb2
cmp rax, 1
jbe 0x18008a420
cmp dword [rbx + 8], 0x104
jne 0x18008a428
cmp qword [rbx + 0x10], 0x12
jne 0x18008a428
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x18008a510
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
movzx r10d, byte [rcx + 0x100]
mov r11, rdx
movzx ebx, byte [rcx + 0x101]
test r8d, r8d
je 0x18008a57d
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
nop word [rax + rax]
inc r10b
lea r11, [r11 + 1]
movzx r8d, r10b
movzx r9d, byte [r8 + rcx]
add bl, r9b
movzx edx, bl
movzx eax, byte [rdx + rcx]
mov byte [r8 + rcx], al
mov byte [rdx + rcx], r9b
add r9b, byte [r8 + rcx]
movzx eax, r9b
movzx edx, byte [rax + rcx]
xor byte [r11 - 1], dl
sub rdi, 1
jne 0x18008a540
mov rdi, qword [rsp + 0x10]
mov byte [rcx + 0x101], r10b
mov byte [rcx + 0x100], r10b
pop rbx
ret
Function at 0x1800916c0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x1800916fe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.18009aba0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x180091724
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x180091737
cmp qword [rsi + 0x18], 8
jb 0x18009173a
mov rsi, qword [rsi]
jmp 0x18009173a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x18009175e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18009175e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x180091785
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180091798
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.1801ccd54
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180093790
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.1801cd4e0
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.1801cf320
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1800937f7
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x150
pop rbx
ret
Function at 0x180097e20
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, VarUI4FromDisp
call fcn.1801cf320
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180097ea7
cmp dword [rsp + 0x44], 6
jb 0x180097ea7
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.180097c50
test al, al
je 0x180097ea7
cmp word [rbx], 0
jne 0x180097f11
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.180097c50
test al, al
je 0x180097edc
cmp word [rbx], 0
jne 0x180097f11
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.180097c50
test al, al
je 0x180097f15
cmp word [rbx], 0
je 0x180097f15
mov al, 1
jmp 0x180097f17
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x170
pop rbx
ret
Function at 0x18009a530
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
xor ebx, ebx
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov r14, r9
mov qword [rsp + 0x50], rdi
mov rsi, rdx
mov qword [rsp + 0x40], r15
mov edi, r8d
mov r15, rcx
mov ebp, ebx
jne 0x18009a575
mov ebx, 1
jmp 0x18009a5c6
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
mov rcx, qword [r15 + 0x20]
lea r9, [rsp + 0x30]
mov r8d, edi
mov dword [rsp + 0x30], ebx
cmp edi, r12d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
cmova r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
add ebp, ecx
test eax, eax
je 0x18009a5bc
test ecx, ecx
je 0x18009a5c1
add rsi, rcx
sub edi, ecx
jne 0x18009a580
jmp 0x18009a5c1
mov ebx, 1
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14, r14
je 0x18009a5df
mov dword [r14], ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret
Function at 0x18009b3e0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x18009b41d
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18009b430
mov al, 1
jmp 0x18009b4d7
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18009ba20
test al, al
je 0x18009b481
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18009b481
mov bl, 1
jmp 0x18009b483
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18009b4c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b4bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b4f4
call fcn.1801ccd54
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.1801d1a6c
int3

Function at 0x18009b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x18009b535
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18009b5df
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x18023af10]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18009ba20
test al, al
je 0x18009b58e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18009b5cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b5c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b5fe
call fcn.1801ccd54
movdqa xmm0, xmmword [0x18023af10]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1801d1a6c
int3
Function at 0x18009b960
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x20]
call fcn.1801cf320
cmp qword [rdi + 0x18], 8
jb 0x18009b9a2
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x18009b9ac
mov rbx, qword [rbx]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18009b9fc
xor eax, eax
mov r8, 0xffffffffffffffff
mov word [rsp + 0x22a], ax
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18009b9e0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800089e0
mov al, 1
jmp 0x18009b9fe
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x18009bda0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x18009bdfe
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18009bde9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18009bdfe
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x18009be00
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18009cea0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx]
test rdx, rdx
je 0x18009cfb7
cmp byte [rdx + 0x78], 0
je 0x18009cfb7
add rdx, 0x28
lea rcx, [r11 - 0x48]
call fcn.180009460
nop
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.180092e50
nop
mov rsi, qword [rsp + 0x70]
lea rdi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdi, qword [rsp + 0x60]
mov rcx, qword [rbx]
cmp qword [rcx + 0x18], 8
jb 0x18009cf2b
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18009cfa2
mov dword [rsp + 0x40], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.180009630
nop
lea rcx, [rsp + 0x50]
call fcn.1800094c0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801ccd30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18009d1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push r14
push r15
sub rsp, 0x10
mov r8d, dword [r9]
xor r15d, r15d
and r8d, 7
mov r12, r9
mov r14, rcx
mov r10d, r15d
cmp rdx, 5
jae 0x18009d220
xor eax, eax
add rsp, 0x10
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov qword [rsp + 8], rdi
lea rdi, [rdx - 4]
mov qword [rsp], r13
add rdi, r14
lea r13, [0x180000000]
nop dword [rax]
lea r9, [r10 + r14]
cmp r9, rdi
jae 0x18009d272
nop dword [rax]
movzx eax, byte [r9]
and al, 0xfe
cmp al, 0xe8
je 0x18009d272
inc r9
cmp r9, rdi
jb 0x18009d260
mov r10, r9
sub r10, r14
mov rax, r10
sub rax, rbp
cmp r9, rdi
jae 0x18009d39c
cmp rax, 3
jbe 0x18009d2b4
mov r8d, r15d
movzx ecx, byte [r9 + 4]
mov rbp, r10
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x18009d2f9
and r8d, 3
mov eax, 1
add r8d, r8d
or r8d, 1
add r10, rax
jmp 0x18009d250
lea ecx, [rax - 1]
shl r8d, cl
and r8d, 7
je 0x18009d290
cmp byte [r8 + r13 + 0x215388], r15b
je 0x18009d2e3
movzx eax, byte [r8 + r13 + 0x215380]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rcx + 4]
inc al
test al, 0xfe
jne 0x18009d290
and r8d, 3
mov rbp, r10
add r8d, r8d
or r8d, 1
inc r10
jmp 0x18009d250
movzx eax, cl
lea rsi, [r13 + 0x215380]
movzx ecx, byte [r9 + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [r9 + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [r9 + 1]
shl eax, 8
or eax, ecx
mov ecx, r8d
add rsi, rcx
nop word [rax + rax]
sub eax, r10d
lea ebx, [rax - 5]
test r8d, r8d
je 0x18009d36b
movzx r11d, byte [rsi]
mov ecx, 0x18
shl r11d, 3
mov edx, ebx
sub ecx, r11d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x18009d36b
mov ecx, 0x20
mov eax, 1
sub ecx, r11d
shl eax, cl
dec eax
xor eax, ebx
jmp 0x18009d330
add eax, 0xfffffffb
mov byte [r9 + 1], bl
shr eax, 0x18
and al, 1
neg al
mov byte [r9 + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [r9 + 3], al
mov eax, ebx
shr eax, 8
mov byte [r9 + 2], al
mov eax, 5
add r10, rax
jmp 0x18009d250
mov r13, qword [rsp]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp rax, 3
ja 0x18009d3c7
lea ecx, [rax - 1]
shl r8d, cl
and r8d, 7
mov r15d, r8d
mov dword [r12], r15d
mov rax, r10
add rsp, 0x10
pop r15
pop r14
pop r12
ret
Function at 0x1800a6bd0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov r11, rdx
shr r11, 2
mov rbx, rcx
mov r9d, r10d
mov r8d, r10d
test r11, r11
je 0x1800a6c1b
nop dword [rax]
imul eax, dword [rbx + r8*4], 0xcc9e2d51
inc r8
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r9d, ecx
rol r9d, 0xd
add r9d, 0xfaddaf14
lea r9d, [r9 + r9*4]
cmp r8, r11
jb 0x1800a6bf0
mov rax, rdx
and eax, 3
sub rax, 1
je 0x1800a6c49
sub rax, 1
je 0x1800a6c3d
cmp rax, 1
jne 0x1800a6c63
movzx r10d, byte [rbx + r11*4 + 2]
shl r10d, 0x10
movzx eax, byte [rbx + r11*4 + 1]
shl eax, 8
xor r10d, eax
movzx eax, byte [rbx + r11*4]
xor eax, r10d
imul ecx, eax, 0xcc9e2d51
rol ecx, 0xf
imul eax, ecx, 0x1b873593
xor r9d, eax
mov rbx, qword [rsp + 8]
xor edx, r9d
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret