joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ba70
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x18005d060]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r14, rdx
mov r8, rdx
mov edx, 0x208
lea rcx, [rsp + 0x70]
call fcn.180027a94
lea r8, [0x180053ccc]
mov edx, 0x208
lea rcx, [rsp + 0x70]
call fcn.180027e4c
xor r13d, r13d
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], setsockopt
mov byte [rsp + 0x48], r13b
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x18000baf7
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18000f400
nop
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], setsockopt
mov byte [rsp + 0x28], 0
nop dword [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x18000bb30
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.18000f400
nop
mov rsi, qword [0x180060400]
test rsi, rsi
jne 0x18000bb79
lea ecx, [rsi + 0x18]
call fcn.18001ddec
mov rsi, rax
mov qword [rsp + 0x20], rax
mov byte [rax], 0x64
mov qword [rax + 8], r13
mov dword [rax + 0x10], r13d
mov qword [0x180060400], rax
mov dword [rsp + 0x20], r13d
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1800168e0
mov r15, rax
cmp dword [rsi + 0x10], 0
jne 0x18000bbb8
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov rcx, rsi
call fcn.1800167f0
mov r9d, r8d
mov r8, r15
lea rdx, [rsp + 0x48]
call fcn.180016d60
jmp 0x18000bc12
movsxd rbx, dword [rsi + 0x10]
mov r8, rbx
mov rdx, qword [rsi + 8]
mov rcx, r15
call fcn.180020770
test eax, eax
jne 0x18000bbfe
lea rdi, [rbx + r15]
mov ebx, dword [rsp + 0x20]
mov r8d, ebx
sub r8d, dword [rsi + 0x10]
mov rdx, rdi
mov rcx, rsi
call fcn.1800167f0
sub ebx, dword [rsi + 0x10]
mov r9d, ebx
mov r8, rdi
lea rdx, [rsp + 0x48]
call fcn.180016d60
jmp 0x18000bc12
lea rdx, [0x1800540c0]
call fcn.18001b000
mov rcx, rax
call fcn.18001b290
mov rcx, r15
call fcn.18001ddb8
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000bc58
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bc53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bceb
call fcn.18001ddb8
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], setsockopt
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000bca4
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bc9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bce5
call fcn.18001ddb8
mov rcx, r14
call fcn.180027934
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18001d7b0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.180024230
nop
call fcn.180024230
nop
int3
Function at 0x18000bd00
Capabilities:
Create directory
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor eax, eax
mov dword [rsp + 0x20], 0x18
mov ecx, 0x410
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
mov rdi, rdx
call fcn.18001de28
mov ecx, 0x410
mov r12, rax
call fcn.18001de28
mov ecx, 0x410
mov r15, rax
call fcn.18001de28
mov ecx, 0x410
mov r14, rax
call fcn.18001de28
mov ecx, 0x410
mov rbp, rax
call fcn.18001de28
mov rdx, r12
mov ecx, 0x208
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.18002751c
call fcn.1800274f0
mov r9d, eax
lea rdx, [0x180053c30]
mov r8, r12
mov rcx, r15
lea ebx, [rax + 1]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r9, [0x180053cd0]
mov r8, r15
lea rdx, [0x180053cb8]
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9d, ebx
lea rdx, str._s_d
mov r8, r14
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r9d, ebx
lea rdx, str._s_d
mov r8, r15
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r12
call fcn.18001ddb8
mov rcx, r15
call fcn.18001ddb8
mov rcx, r14
call fcn.18001ddb8
mov rcx, rbp
call fcn.18001ddb8
mov rcx, rsi
call fcn.18001ddb8
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x18000d7b0
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x5d8
mov rax, qword [0x18005d060]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
mov rbp, rdx
xor ecx, ecx
xor edx, edx
mov r15, r8
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
lea ecx, [rax + 1]
call fcn.18001de28
mov r14, rax
lea rdx, [rsp + 0x270]
xor eax, eax
mov rcx, rbp
mov qword [r14], rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x18000da56
test byte [rsp + 0x270], 0x10
jne 0x18000da56
mov qword [rsp + 0x600], rsi
mov rdx, r14
mov qword [rsp + 0x618], rdi
mov ecx, ebx
mov qword [rsp + 0x5d0], r12
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x18000d990
xor r12d, r12d
mov esi, r12d
cmp byte [r14], sil
je 0x18000d990
mov rdi, r14
nop word [rax + rax]
movsxd rbx, esi
lea rdx, [0x180053d20]
add rbx, r14
mov rcx, rbx
call fcn.180027d7c
test eax, eax
je 0x18000d980
lea rdx, [0x180053d24]
mov rcx, rbx
call fcn.180027d7c
test eax, eax
je 0x18000d980
mov dword [rsp + 0x38], r12d
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov qword [rsp + 0x28], r12
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x18000d980
mov eax, dword [rsp + 0x28c]
cmp dword [rsp + 0x44], eax
jne 0x18000d980
mov r8, rbx
mov dword [rsp + 0x40], r12d
mov edx, 4
lea rcx, [rsp + 0x40]
call fcn.180027a94
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r12b
jne 0x18000d8f7
dec rax
cmp rax, 4
jae 0x18000da5d
lea rcx, [0x180053d28]
mov byte [rsp + rax + 0x40], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x18000d980
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x20c
movups xmmword [rsp + 0x48], xmm0
call fcn.180020550
lea rdx, str.ZwQueryInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000d977
mov r9d, 0x20c
mov dword [rsp + 0x20], 9
lea r8, [rsp + 0x60]
mov rcx, rbp
lea rdx, [rsp + 0x48]
call rax
test eax, eax
je 0x18000d9d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rdi, 4
add esi, 4
cmp byte [rdi], r12b
jne 0x18000d860
mov rcx, r14
call fcn.18001ddb8
xor eax, eax
mov rdi, qword [rsp + 0x618]
mov rsi, qword [rsp + 0x600]
mov r12, qword [rsp + 0x5d0]
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.18001d7b0
add rsp, 0x5d8
pop r15
pop r14
pop rbp
pop rbx
ret
mov eax, dword [rsp + 0x60]
lea rcx, [rsp + 0x2b0]
shr rax, 1
xor edx, edx
mov r8d, 0x30c
mov word [rsp + rax*2 + 0x64], r12w
call fcn.180020550
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x64]
mov dword [rsp + 0x28], 0x30b
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rsp + 0x2b0]
mov edx, 0x410
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
mov rcx, r15
call fcn.180003740
mov eax, 1
jmp 0x18000d99a
xor eax, eax
jmp 0x18000d9b2
call fcn.18001df38
int3
Function at 0x1800136b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1800136bb
xor eax, eax
ret
lea r11, [0x180053200]
not ecx
cmp r8, 8
jb 0x18001378d
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1800136e0
test r8, r8
je 0x1800137bd
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1800137a0
not ecx
mov eax, ecx
ret
Function at 0x180013ae0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x180013be6
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
mov rax, rcx
test rcx, rcx
je 0x180013b27
cmp dword [rbx + 0x58], edi
jae 0x180013b27
call fcn.18001ddb8
mov qword [rbx + 0x50], 0
jmp 0x180013b2c
test rax, rax
jne 0x180013b3b
lea ecx, [rdi + rdi]
call fcn.18001de28
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbp, rdi
call fcn.18001fe80
test edi, edi
je 0x180013bdd
xor r11d, r11d
lea rsi, [0x180053200]
nop
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov r8d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x44]
mov r9d, r8d
mov ecx, edx
and r9d, 0xfffd
movsx r10, byte [r11 + rax - 1]
or r9d, 2
xor rcx, r10
shr edx, 8
movzx eax, cl
xor edx, dword [rsi + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
mov dword [rbx + 0x44], edx
inc eax
mov ecx, eax
shr rcx, 0x18
mov dword [rbx + 0x48], eax
movzx eax, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
mov dword [rbx + 0x4c], r8d
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rbp, 1
jne 0x180013b60
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x180013c36
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x180013c13
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.18001fe80
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180013c6d
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180013ea0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0xb8]
test rcx, rcx
je 0x180013f19
mov eax, dword [rdi + 0xc4]
mov esi, dword [rdi + 0xc0]
cmp eax, esi
jae 0x180013f69
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call fcn.18001fe80
mov ecx, dword [rdi + 0xa0]
mov rdx, rbp
add dword [rdi + 0xc4], esi
add dword [rdi + 0x9c], esi
mov r8d, esi
call fcn.1800136b0
mov dword [rdi + 0xa0], eax
mov eax, esi
jmp 0x180013f6b
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x180013f62
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180013f69
mov ebx, dword [rsp + 0x40]
mov rdx, rbp
add dword [rdi + 0x9c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0xa0]
call fcn.1800136b0
mov dword [rdi + 0xa0], eax
mov eax, ebx
jmp 0x180013f6b
mov dword [rdi + 0x24], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180015fc0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180016010
cmp dword [0x18005de84], 0
je 0x180016010
cmp qword [0x1800603f8], 0
jne 0x180016010
xor eax, eax
lea r8, [0x180015cf0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [0x1800603f8], rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180016020
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r8, rcx
mov edx, 0xff
lea rcx, str.127.0.0.1
mov esi, r9d
call fcn.180027000
xor eax, eax
mov dword [0x18005de7c], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x180015cf0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
mov dword [0x18005de80], edi
xor ecx, ecx
mov dword [0x18005de84], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [0x1800603f8], rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800160b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x180015cf0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
add rsp, 0x38
ret

Function at 0x1800167f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r9, rcx
xor edx, edx
test r8d, r8d
jle 0x1800168a4
cmp r8d, 0x40
jb 0x1800168a4
movsx eax, byte [rcx]
lea rcx, [r10 - 1]
movd xmm2, eax
punpcklbw xmm2, xmm2
movsxd rax, r8d
add rcx, rax
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp r10, r9
ja 0x180016837
cmp rcx, r9
jae 0x1800168a4
mov qword [rsp], rbx
movsxd r11, r8d
lea rcx, [r10 + 0x20]
and r11, 0xffffffffffffffc0
mov rbx, 0xffffffffffffffe0
sub rbx, r10
movdqu xmm0, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
add edx, 0x40
movdqa xmm1, xmm2
lea rax, [rbx + rcx]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x60], xmm0
movdqu xmm0, xmmword [rcx - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x30], xmm0
cmp rax, r11
jl 0x180016850
mov rbx, qword [rsp]
movsxd rcx, edx
movsxd rdx, r8d
cmp rcx, rdx
jge 0x1800168d0
lea rax, [rcx + r10]
sub rdx, rcx
nop word [rax + rax]
movzx ecx, byte [r9]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1800168c0
add rsp, 8
ret
Function at 0x180017040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, r8
xor ebx, ebx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov rdi, rcx
call fcn.1800168e0
movsxd r8, dword [rdi + 0x10]
mov rcx, rax
mov rdx, qword [rdi + 8]
mov rsi, rax
call fcn.180020770
test eax, eax
jne 0x1800170a3
lea rdx, [0x1800540a8]
call fcn.18001b000
mov rcx, rax
call fcn.18001b290
mov r9d, dword [rsp + 0x40]
mov r8, rsi
mov rdx, r15
call fcn.180016d60
jmp 0x1800171fa
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], r14
movsxd r14, dword [rsp + 0x40]
test r14d, r14d
jle 0x180017168
cmp r14d, 0x40
jb 0x180017168
movsx eax, byte [rdi]
movd xmm2, eax
lea eax, [r14 - 1]
punpcklbw xmm2, xmm2
cdqe
add rax, rsi
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp rsi, rdi
ja 0x1800170ec
cmp rax, rdi
jae 0x180017168
mov ecx, r14d
and ecx, 0x8000003f
jge 0x1800170fe
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, r14d
mov rdx, 0xffffffffffffffe0
sub eax, ecx
lea rcx, [rsi + 0x20]
movsxd r8, eax
sub rdx, rsi
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
add ebx, 0x40
lea rax, [rdx + rcx]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x60], xmm0
movdqu xmm0, xmmword [rcx - 0x50]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x50], xmm0
movdqu xmm1, xmmword [rcx - 0x40]
pxor xmm1, xmm2
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x30], xmm0
cmp rax, r8
jl 0x180017120
movsxd rcx, ebx
cmp rcx, r14
jge 0x18001718f
mov rdx, r14
lea rax, [rcx + rsi]
sub rdx, rcx
nop word [rax + rax]
movzx ecx, byte [rdi]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180017180
mov eax, dword [rdi + 0x10]
test eax, eax
jle 0x1800171e2
add eax, r14d
movsxd rcx, eax
call fcn.18001de28
movsxd r8, dword [rdi + 0x10]
mov rcx, rax
mov rdx, qword [rdi + 8]
mov rbx, rax
call fcn.18001fe80
movsxd rcx, dword [rdi + 0x10]
mov r8, r14
add rcx, rbx
mov rdx, rsi
call fcn.18001fe80
mov r9d, dword [rdi + 0x10]
mov r8, rbx
add r9d, r14d
mov rdx, r15
call fcn.180016d60
mov rcx, rbx
call fcn.18001ddb8
jmp 0x1800171f0
mov r9d, r14d
mov r8, rsi
mov rdx, r15
call fcn.180016d60
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
jmp fcn.18001ddb8

Function at 0x180033a0c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180033a2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800272bc
or eax, 0xffffffff
jmp 0x180033a2e
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000b840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000b8c0
cmp r11, r10
ja 0x14000b937
cmp r10, rdx
ja 0x14000b949
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14000b8c2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000b8a0
jmp 0x14000b924
ja 0x14000b8ca
mov r11, r10
cmp rax, r8
jne 0x14000b86e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000b900
mov rdi, r8
sub ecx, edx
jns 0x14000b91b
jmp 0x14000b926
cmp r8, rsi
je 0x14000b958
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000b926
xor al, 1
cmp rdi, rsi
jne 0x14000b8e0
jmp 0x14000b926
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, [0x14413c4b8]
mov rcx, r11
mov rdx, r10
call fcn.140037860
lea r8, [0x14413c4b8]
mov rcx, r10
call fcn.140037530
lea rcx, [0x14413c4a0]
call fcn.1400378d0
int3

Function at 0x14000cdb0
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov esi, edx
mov edi, ecx
call fcn.14000d920
test rax, rax
je 0x14000cde6
mov rax, rdx
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
mov word [rbp + 0x26], di
mov word [rbp + 0x24], si
test di, di
mov qword [rbp + 0x18], rdx
js 0x14000ce30
test si, si
js 0x14000cea4
mov rcx, qword [rdx + 0x10]
shl esi, 0x10
movzx edx, di
or edx, esi
call sub.KERNEL32.dll_SetConsoleCursorPosition
test eax, eax
je 0x14000cefc
mov rcx, qword [rbp + 0x18]
lock dec qword [rcx]
jne 0x14000cf21
call fcn.14000ca60
xor eax, eax
jmp 0x14000cddb
lea rax, [rbp + 0x26]
mov qword [rbp + 8], rax
lea rax, [0x14000c2f0]
mov qword [rbp + 0x10], rax
lea rax, [0x1441400d0]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 1
mov qword [rbp - 8], 0
lea rax, [rbp + 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 1
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
call fcn.1400080c0
lea rdx, [rbp - 0x40]
mov cl, 0x27
call fcn.14000c7d0
mov rcx, qword [rbp + 0x18]
lock dec qword [rcx]
jne 0x14000cddb
mov rsi, rax
call fcn.14000ca60
mov rax, rsi
jmp 0x14000cddb
lea rax, [rbp + 0x24]
mov qword [rbp + 8], rax
lea rax, [0x14000c2f0]
mov qword [rbp + 0x10], rax
lea rax, [0x144140078]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 1
mov qword [rbp - 8], 0
lea rax, [rbp + 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 1
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x28]
call fcn.1400080c0
lea rdx, [rbp - 0x58]
mov cl, 0x27
call fcn.14000c7d0
jmp 0x14000ce86
call sub.KERNEL32.dll_GetLastError
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x18]
lock dec qword [rcx]
jne 0x14000cddb
jmp 0x14000ce94
xor eax, eax
jmp 0x14000cddb
Function at 0x14000fdd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000fe12
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000fe1a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000fe2b
jmp 0x14000fe42
xor r10d, r10d
jmp 0x14000fecd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000fe42
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000fe59
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000fe79
add r11, r8
jmp 0x14000ffab
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000ff42
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000fef0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000ff60
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000ff72
jmp 0x14000ff8d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000ff8d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000ffa7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret