joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800583f8
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbx + 0x1188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18005844d
xor esi, esi
jmp 0x180058550
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea edi, [rsi + 1]
mov r8d, edi
mov edx, 0x80000000
mov rcx, qword [rbx + 0x1190]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18005848f
mov esi, edi
jmp 0x180058550
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, esi
jne 0x1800584b4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
jmp 0x180058550
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, r12
call fcn.1800d04fc
mov rdi, rax
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1800d7640
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x44]
mov r8d, r12d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], sil
lea r9, [rsp + 0x50]
mov r8d, r12d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1800cf794
lea rdx, str.9504f314a1b1cfa33732c84c6c070267
lea rcx, [rsp + 0x50]
call fcn.180058684
cmp eax, esi
setne sil
cmp qword [rsp + 0x70], 0x10
jb 0x180058550
mov rcx, qword [rsp + 0x58]
call fcn.1800d1290
mov eax, esi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180058578
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov r8, qword [rcx + 0x60]
mov rsi, rcx
lea rdx, str._t_t_tInstalling_entry__s...
lea rcx, [0x18015f578]
call fcn.1800098e8
mov r11, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r11 + reloc.WS2_32.dll_htonl]
mov rbx, qword [0x1801624c8]
lea r8, [0x180123dd0]
mov rcx, rbx
mov edx, WSAGetLastError
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18005865f
lea rdx, [rsp + 0x60]
mov r8, rax
mov rcx, rbx
call fcn.18006626c
mov rdi, rax
test rax, rax
je 0x18005865f
and qword [rsp + 0x30], 0
mov rcx, qword [rsi + 0x1190]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005865f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x60]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18005d694
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x18005d701
cmp dword [rcx + 0x30], 0
jne 0x18005d6be
call fcn.18006c7b0
mov rbx, qword [rdi]
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x18005d6fd
mov rcx, rbx
call fcn.18006c7b0
nop
cmp qword [rbx + 0x28], 0x10
jb 0x18005d6e4
mov rcx, qword [rbx + 0x10]
call fcn.1800d1290
mov qword [rbx + 0x28], reloc.WS2_32.dll_ntohs
and qword [rbx + 0x20], 0
mov byte [rbx + 0x10], 0
mov rcx, rbx
call fcn.1800d1290
and qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov rax, rcx
mov r9, qword [rdi + 8]
sub r9, rcx
movzx edx, word [rax]
movzx r8d, word [rax + r9]
sub edx, r8d
jne 0x18005d725
add rax, 2
test r8d, r8d
jne 0x18005d70f
test edx, edx
je 0x18005d72f
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180065e4c
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x860
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rdi, r9
mov rbp, r8
mov rsi, rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], r9
mov r12, qword [rsp + 0x8b0]
xor ebx, ebx
mov rax, qword [rdx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3ff
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x180065ee3
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, r12
call fcn.180003e28
jmp 0x180065ee8
mov ebx, 0x80004005
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
lea r13, [0x18015f758]
or r12d, 0xffffffff
cmp rcx, r13
je 0x180065f1a
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180065f1a
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
nop
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
cmp rcx, r13
je 0x180065f43
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180065f43
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.1800d1434
nop
mov rax, qword [rdi]
add rax, 0xfffffffffffffff4
cmp rax, r13
je 0x180065f69
mov ecx, r12d
lock xadd dword [rax], ecx
add ecx, r12d
test ecx, ecx
jg 0x180065f69
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, ebx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1800d12b0
mov rbx, qword [rsp + 0x890]
add rsp, 0x860
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18006626c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, rdx
mov rdx, r8
mov rbx, r8
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
jne 0x1800662a3
xor eax, eax
jmp 0x1800662f4
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x18006629f
mov rcx, rsi
call fcn.1800d04fc
mov r8, rsi
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1800d7640
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8, rsi
mov rcx, rdi
mov rdx, rax
call fcn.1800d47b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [r12], esi
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x180066490
Capabilities:
Get disk information

Disassembly:
push rdi
mov eax, 0x30a0
call fcn.1800f12f0
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x30b0], rbx
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x3090], rax
lea rcx, [0x18010d194]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x18010d194]
mov edx, eax
lea rdi, [0x180163340]
mov rcx, rdi
call fcn.180003e28
lea rdx, [0x180129478]
lea rcx, [rsp + 0x48]
call fcn.1800041c0
nop
mov r8d, 0x104
mov dword [rsp + 0x38], r8d
lea rax, [rsp + 0x2e80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x2c70]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x18006655d
lea rcx, str.0000000000_0000_0000_0000_00000000
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.0000000000_0000_0000_0000_00000000
mov edx, eax
mov rcx, rdi
call fcn.180003e28
jmp 0x180066571
mov r8d, dword [rsp + 0x40]
lea rdx, [0x1801294c8]
mov rcx, rdi
call fcn.180008f64
mov dword [rsp + 0x44], 0x2c00
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x70]
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov r11, qword [0x18015f768]
mov qword [rsp + 0x50], r11
movzx eax, byte [rsp + 0x20d]
movzx edx, byte [rsp + 0x20c]
movzx r10d, byte [rsp + 0x20b]
movzx r11d, byte [rsp + 0x20a]
movzx r9d, byte [rsp + 0x209]
movzx r8d, byte [rsp + 0x208]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
lea rdx, str._02X_02X_02X_02X_02X_02X
lea rcx, [rsp + 0x50]
call fcn.180008f64
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov edx, dword [rbx - 8]
mov rcx, rdi
call fcn.180008324
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x180066624
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180066624
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180066643
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180066643
call fcn.1800d1434
mov rcx, qword [rsp + 0x3090]
xor rcx, rsp
call fcn.1800d12b0
mov rbx, qword [rsp + 0x30b0]
add rsp, 0x30a0
pop rdi
ret
Function at 0x180066cf4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
cmp edx, 0x103
jne 0x180066d67
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x20]
and qword [rsp + 0x20], 0
test rcx, rcx
je 0x180066d8e
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
lea rdx, [0x180109d00]
call qword [rax]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180066d8e
and qword [rsp + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
call qword [rax + 0x90]
lea rcx, str._______________________NAVIGATE_COMPLETE______________________
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180066d8e
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, 0x107
jne 0x180066d7c
lea rcx, str._______________________WINDOWS_CLOSES______________________
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebx, 0x67
jne 0x180066d8e
lea rcx, str._______________________WINDOWS_QUIT______________________
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x180068ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x44]
mov rdi, rcx
mov edx, dword [rdi + 0x94]
mov ebx, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub ebx, dword [rdi + 0x9c]
lea ecx, [rbp + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x180068f58
mov rcx, qword [rdi + 0x50]
mov r8, rbp
lea rdx, [rcx + rbp]
call fcn.1800d47b0
mov r9d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebp
sub dword [rdi + 0x94], ebp
sub dword [rdi + 0x84], ebp
lea r8, [rax + r9*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x180068f0b
mov rax, qword [rdi + 0x60]
mov r9d, ebp
lea r8, [rax + rbp*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x180068f36
add ebx, ebp
mov rsi, qword [rdi]
cmp dword [rsi + 8], 0
je 0x18006903a
mov eax, dword [rdi + 0x94]
mov r13d, dword [rdi + 0x9c]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rdi + 0x50]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x180068fe3
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x180068fac
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.18006b244
jmp 0x180068fc8
cmp ecx, 2
jne 0x180068fcb
mov rdx, qword [rsi]
test rdx, rdx
jne 0x180068fbd
xor eax, eax
jmp 0x180068fc8
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.18006b51c
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call fcn.1800d47b0
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rdi + 0x9c], r12d
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x180069024
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x18006903a
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x180068ebe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x180075764
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x20
cmp dword [rcx], 0
mov rdi, r9
mov ebp, r8d
mov r12, rdx
mov rbx, rcx
lea r15, [0x18010f840]
je 0x1800757c9
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x1800757c0
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r15]
mov ecx, eax
shl ecx, 3
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x1800757a3
xor edx, edx
div dword [rbx]
mov r13d, edx
jmp 0x1800757cc
xor r13d, r13d
mov r9d, r13d
mov r8d, ebp
mov rdx, r12
mov rcx, rbx
call fcn.18007566c
mov r11, rax
test rax, rax
je 0x18007585f
mov rsi, qword [rax + 0x10]
test rdi, rdi
jne 0x18007584f
mov rax, qword [rax + 8]
test rax, rax
je 0x1800757ff
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x180075806
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x180075816
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
cmp qword [rbx + 0x10], 0
je 0x180075837
mov ecx, r13d
shl rcx, 4
add rcx, qword [rbx + 0x10]
cmp qword [rcx + 8], r11
jne 0x180075835
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.180072998
add dword [rbx + 4], 0xffffffff
jne 0x180075857
mov rcx, rbx
call fcn.1800754a8
jmp 0x180075857
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov rax, rsi
jmp 0x1800758f5
test rdi, rdi
je 0x1800758f3
mov ecx, 0x28
call fcn.180072630
mov rsi, rax
test rax, rax
jne 0x18007587f
mov rax, rdi
jmp 0x1800758f5
mov qword [rax + 0x18], r12
mov dword [rax + 0x20], ebp
mov qword [rax + 0x10], rdi
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x1800758d2
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1800758d2
add edx, edx
mov rcx, rbx
call fcn.180075568
test eax, eax
je 0x1800758d2
xor eax, eax
jmp 0x1800758c7
movzx ecx, byte [r12]
inc r12
movzx edx, byte [rcx + r15]
mov ecx, eax
shl ecx, 3
xor edx, ecx
xor eax, edx
dec ebp
test ebp, ebp
jg 0x1800758af
xor edx, edx
div dword [rbx]
mov r13d, edx
cmp qword [rbx + 0x10], 0
mov r8, rsi
mov rcx, rbx
je 0x1800758ec
mov edx, r13d
shl rdx, 4
add rdx, qword [rbx + 0x10]
jmp 0x1800758ee
xor edx, edx
call fcn.180075500
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r13
pop r12
ret

Function at 0x180075db8
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rax, rdx
mov rdi, rcx
cmp dword [rcx + 0x38], ebx
je 0x180075de1
movsxd r8, dword [rcx + 0x38]
lea rax, [r8 + rdx - 1]
cqo
idiv r8
imul rax, r8
mov rdx, rax
call fcn.180075c00
cmp eax, ebx
jne 0x180075e04
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
jne 0x180075e09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x1c], eax
mov ebx, 0x60a
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180075e48
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180075e87
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180075e87
mov dword [rbx + 0x1c], eax
mov eax, 0x70a
jmp 0x180075e97
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rdi
xor eax, eax
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180076c10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x350
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov r9, qword [0x180162710]
mov rbx, rdx
test r9, r9
je 0x180076c5e
lea r8, [0x18012a978]
lea rdx, [rsp + 0x20]
mov ecx, 0xe6
call fcn.18007402c
jmp 0x180076cf7
call fcn.180075914
mov ecx, 0xe6
test eax, eax
je 0x180076cb9
lea rdx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x130]
call fcn.180075a08
mov rdi, rax
test rax, rax
jne 0x180076cd6
mov eax, 7
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x130]
call fcn.180075b4c
jmp 0x180076c87
lea r8, [0x18012a978]
lea rdx, [rsp + 0x20]
mov r9, rax
mov ecx, 0xe6
call fcn.18007402c
mov rcx, rdi
call fcn.1800d2264
mov r8b, byte [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
test r8b, r8b
je 0x180076d13
inc rcx
cmp byte [rcx], 0
jne 0x180076d0b
sub ecx, eax
lea rax, str.etilqs_
mov edi, 0x3fffffff
mov rdx, rax
and ecx, edi
inc rdx
cmp byte [rdx], 0
jne 0x180076d26
sub edx, eax
and edx, edi
lea ecx, [rdx + rcx + 0x11]
cmp ecx, 0x105
jl 0x180076d48
mov eax, 1
jmp 0x180076c94
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
test r8b, r8b
je 0x180076d5f
inc rax
cmp byte [rax], 0
jne 0x180076d57
sub eax, ecx
and eax, edi
movsxd rcx, eax
je 0x180076d7a
lea rax, [rsp + 0x20]
cmp byte [rax + rcx - 1], 0x5c
jne 0x180076d7a
sub rcx, 1
jne 0x180076d6d
mov byte [rsp + rcx + 0x20], 0
lea r9, [rsp + 0x20]
lea r8, str._setilqs_
mov rdx, rbx
mov ecx, 0xf4
call fcn.18007402c
mov r11, rbx
test rbx, rbx
je 0x180076db4
cmp byte [rbx], 0
je 0x180076dae
inc r11
cmp byte [r11], 0
jne 0x180076da5
sub r11d, ebx
and r11d, edi
movsxd rdi, r11d
mov esi, reloc.WS2_32.dll_ntohs
lea rdx, [rbx + rdi]
mov ecx, esi
call fcn.1800741a8
movzx ecx, byte [rbx + rdi]
movabs rax, 0x842108421084211
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov al, byte [rcx + rax]
mov byte [rbx + rdi], al
inc rdi
sub rsi, 1
jne 0x180076dc7
mov byte [rbx + rdi], sil
xor eax, eax
jmp 0x180076c94
Function at 0x1800770e0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rcx, rdx
mov edi, ebx
mov esi, ebx
call fcn.180076bbc
mov r13, rax
cmp rax, rbx
jne 0x180077117
lea eax, [rbx + 7]
jmp 0x1800771b0
call fcn.180075914
cmp eax, ebx
je 0x18007715b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x180077147
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x180077196
inc edi
cmp edi, 5
jge 0x180077196
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180077120
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x180077182
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x180077196
inc edi
cmp edi, 5
jge 0x180077196
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18007715b
mov rcx, r13
call fcn.1800d2264
cmp r12d, 0xffffffff
jne 0x1800771a9
cmp esi, 2
je 0x1800771ae
mov ebx, 0xa0a
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop r13
ret

Function at 0x1800773d4
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov esi, 0x200
mov r8d, 0x104
mov dword [rsp + 0x34], esi
call fcn.1800772b8
xor ebp, ebp
cmp eax, ebp
jne 0x1800774be
lea rcx, [rsp + 0x40]
call fcn.180076bbc
mov rbx, rax
cmp rax, rbp
je 0x1800774c2
call fcn.180075914
cmp eax, ebp
mov rax, rbx
je 0x180077477
cmp word [rbx], bp
je 0x180077453
cmp word [rax], 0x5c
je 0x180077450
add rax, 2
cmp word [rax], bp
jne 0x18007743f
jmp 0x180077453
mov word [rax], bp
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1800774b0
cmp byte [rbx], bpl
je 0x18007748e
cmp byte [rax], 0x5c
je 0x18007748b
inc rax
cmp byte [rax], bpl
jne 0x18007747c
jmp 0x18007748e
mov byte [rax], bpl
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov rcx, rbx
mov edi, eax
call fcn.1800d2264
cmp edi, ebp
je 0x1800774c2
mov esi, dword [rsp + 0x34]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800d12b0
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x180099fa4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x18009a0d2
cmp rdx, rsi
je 0x18009a0d2
movzx eax, word [rcx + 2]
mov edx, 0x800
and ax, dx
cmp ax, dx
je 0x18009a06e
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, dx
cmp ax, dx
je 0x18009a06e
xor cl, byte [rdi + 2]
test cl, 0x10
jne 0x18009a06e
mov al, byte [rbx]
cmp byte [rdi], al
jne 0x18009a06e
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.180099fa4
cmp eax, esi
jne 0x18009a06e
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.180099fa4
cmp eax, esi
jne 0x18009a06e
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.18009a0f0
cmp eax, esi
jne 0x18009a06e
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x18009a06e
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x18009a06e
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x18009a075
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x18009a06e
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x18009a0a1
mov eax, 2
jmp 0x18009a0dd
cmp byte [rdi], 0x98
je 0x18009a0a1
mov rcx, qword [rdi + 8]
cmp rcx, rsi
je 0x18009a0a1
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x18009a06e
mov rdx, qword [rbx + 8]
cmp rdx, rsi
je 0x18009a06e
call fcn.180074aac
cmp eax, esi
jne 0x18009a06e
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x18009a0be
mov eax, 1
jmp 0x18009a0dd
cmp r10w, si
je 0x18009a0ce
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x18009a06e
xor eax, eax
jmp 0x18009a0dd
sub rbx, rcx
neg rbx
sbb eax, eax
and eax, 2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800a5170
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx]
xor edx, edx
mov rax, r9
cmp r9, rdx
je 0x1800a5193
cmp byte [r9], dl
je 0x1800a5189
inc rax
cmp byte [rax], dl
jne 0x1800a5182
sub eax, r9d
and eax, 0x3fffffff
mov edx, eax
mov rcx, qword [rcx + 0x78]
mov r8d, edx
mov rdx, r9
add rcx, 0x50
jmp fcn.1800756ec