joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ca920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rbp + 0x40], rax
movdqa xmm0, xmmword [0x1801b2330]
lea r10d, [rcx*8]
movdqa xmm1, xmmword [0x1801b2340]
xor r11d, r11d
movdqa xmmword [rbp - 0x30], xmm0
mov eax, 0xf79e
movdqa xmm0, xmmword [0x1801b2360]
mov ebx, ecx
movdqa xmmword [rbp - 0x20], xmm1
or r10d, 7
movdqa xmm1, xmmword [str.usthaeoy]
mov ecx, 0x64
movdqa xmmword [rbp - 0x10], xmm0
mov r9d, r11d
movdqa xmm0, xmmword [0x1801b2350]
movdqa xmmword [rbp], xmm1
movdqa xmm1, xmmword [0x1801b2320]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm1
mov dword [rsp], 0x7050000
mov dword [rsp + 4], 0x7430738
mov dword [rsp + 8], 0x7880763
mov dword [rsp + 0xc], 0x7cb0794
mov dword [rsp + 0x10], 0x7f807e8
mov dword [rsp + 0x14], 0x83e080c
mov dword [rsp + 0x18], 0x89e0878
mov dword [rsp + 0x1c], 0x8ee08d8
mov dword [rsp + 0x20], 0x94f0928
mov dword [rsp + 0x24], 0x9b809a8
mov dword [rsp + 0x28], 0xa2409d4
mov dword [rsp + 0x2c], 0xaac0a6c
mov dword [rsp + 0x30], 0xb1a0ade
mov dword [rsp + 0x34], 0xb8a0b4e
mov dword [rsp + 0x38], 0xbb80ba8
mov dword [rsp + 0x3c], 0xd080bd4
mov dword [rsp + 0x40], 0xe700d80
mov dword [rsp + 0x44], 0xe900e80
mov dword [rsp + 0x48], 0xf380ea0
mov dword [rsp + 0x4c], 0xf580f48
mov dword [rsp + 0x50], 0xfa80f80
mov dword [rsp + 0x54], 0x100a0fc8
mov dword [rsp + 0x58], 0x104a102a
mov dword [rsp + 0x5c], 0x108a106a
mov dword [rsp + 0x60], 0x10c810aa
mov dword [rsp + 0x64], 0x10f810d8
mov dword [rsp + 0x68], 0x11481138
mov dword [rsp + 0x6c], 0x11981178
mov dword [rsp + 0x70], 0x18361804
mov dword [rsp + 0x74], 0x18881878
mov dword [rsp + 0x78], 0x191d18d8
mov dword [rsp + 0x7c], 0x19811969
mov dword [rbp - 0x80], 0xf01cf008
mov dword [rbp - 0x7c], 0xf098f05e
mov dword [rbp - 0x78], 0xf0f8f0ca
mov dword [rbp - 0x74], 0xf11ef108
mov dword [rbp - 0x70], 0xf168f158
mov dword [rbp - 0x6c], 0xf1b8f18c
mov dword [rbp - 0x68], 0xf1fcf1da
mov dword [rbp - 0x64], 0xf2aaf22e
mov dword [rbp - 0x60], 0xf2f8f2ca
mov dword [rbp - 0x5c], 0xf35ef30a
mov dword [rbp - 0x58], 0xf3eaf39c
mov dword [rbp - 0x54], 0xf448f40e
mov dword [rbp - 0x50], 0xf478f45a
mov dword [rbp - 0x4c], 0xf4b0f48c
mov dword [rbp - 0x48], 0xf4c0f4b8
mov dword [rbp - 0x44], 0xf50af4c8
mov dword [rbp - 0x40], 0xf64af5cc
mov dword [rbp - 0x3c], 0xf72af66a
mov word [rbp - 0x38], ax
mov dword [rbp + 0x30], 0x756f6965
mov byte [rbp + 0x34], 0x79
nop dword [rax + rax]
lea eax, [r9 + rcx]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx r8d, word [rsp + rdx*2]
lea edx, [rax + 1]
cmp r10d, r8d
cmovb edx, r9d
mov r9d, edx
lea edx, [rax - 1]
cmovb eax, r11d
cmovb ecx, edx
movsxd r11, eax
cmp ecx, r9d
jge 0x1800cab40
movzx eax, word [rsp + r11*2]
mov ecx, eax
and eax, 7
shr ecx, 3
add ecx, eax
mov eax, ebx
cmp ebx, ecx
jg 0x1800cab8b
movsx eax, byte [rbp + r11 - 0x30]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rbp
ret
Function at 0x1800cf980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rcx + 0x1c8]
mov r10, rcx
test rax, rax
cmovne r10, rax
mov rax, qword [r10 + 0x280]
test rax, rax
je 0x1800cf9ae
cmp qword [rax], rdx
jne 0x1800cf9a8
cmp dword [rax + 0x18], r9d
je 0x1800cf9b3
mov rax, qword [rax + 8]
jmp 0x1800cf998
jmp fcn.18007ef30
ret
Function at 0x1800e2380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, 0x40
shl rax, 4
mov rbx, rcx
cmp rax, 0x400
cmovbe edi, edx
cmp edi, dword [rcx]
je 0x1800e2556
mov rax, qword [0x1801ee5f0]
test rax, rax
je 0x1800e23bc
call rax
mov ecx, edi
shl rcx, 4
call fcn.18011da50
mov rcx, qword [0x1801ee5f8]
mov rsi, rax
test rcx, rcx
je 0x1800e23d8
call rcx
test rsi, rsi
je 0x1800e2556
mov rdi, qword [rbx + 0x10]
test rdi, rdi
je 0x1800e2445
cmp dword [0x1801e5920], 0
je 0x1800e243c
mov rcx, qword [0x1801ee840]
test rcx, rcx
je 0x1800e2405
call qword [0x1801e59a8]
mov rcx, rdi
call qword [0x1801e5960]
dec qword [0x1801ee598]
mov rcx, rdi
movsxd rdx, eax
sub qword [0x1801ee550], rdx
call qword [0x1801e5950]
mov rcx, qword [0x1801ee840]
test rcx, rcx
je 0x1800e2445
call qword [0x1801e59b8]
jmp 0x1800e2445
mov rcx, rdi
call qword [0x1801e5950]
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [0x1801e5960]
movsxd rdi, eax
xor edx, edx
shr rdi, 4
mov rcx, rsi
mov r8d, edi
shl r8, 4
mov dword [rbx], edi
call fcn.180162c50
mov rcx, qword [rbx + 8]
xor r10d, r10d
mov qword [rbx + 8], r10
test rcx, rcx
je 0x1800e2541
lea r11, [0x1801a59b0]
nop word [rax + rax]
mov r9, qword [rcx + 0x18]
mov eax, r10d
movzx edx, byte [r9]
test dl, dl
je 0x1800e24c1
nop
movzx edx, dl
lea r9, [r9 + 1]
movzx r8d, byte [rdx + r11]
lea edx, [rax*8]
xor r8d, edx
movzx edx, byte [r9]
xor eax, r8d
test dl, dl
jne 0x1800e24a0
mov r9, qword [rcx]
xor edx, edx
div edi
mov r8d, edx
shl r8, 4
add r8, rsi
je 0x1800e2519
mov eax, dword [r8]
test eax, eax
je 0x1800e24e1
mov rdx, qword [r8 + 8]
jmp 0x1800e24e4
mov rdx, r10
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x1800e2519
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x1800e250f
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x1800e2535
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x1800e2535
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x1800e252d
mov qword [rax + 8], rcx
mov qword [rcx + 8], r10
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x1800e2490
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fef70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800ff12c
test rdx, rdx
je 0x1800ff12c
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, dword [rcx + 4]
bt ebp, 0xa
jae 0x1800fefe9
and esi, dword [rcx + 4]
bt esi, 0xa
jae 0x1800ff0f4
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1800ff0f4
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x1800ff031
cmp r8b, 0x5f
jne 0x1800ff009
mov rcx, qword [rcx + 0x10]
mov r8d, r14d
call fcn.1800fef70
cmp eax, 2
jl 0x1800ff02a
cmp byte [rbx], 0x5f
jne 0x1800ff0f4
mov rdx, qword [rbx + 0x10]
mov r8d, r14d
mov rcx, rdi
call fcn.1800fef70
cmp eax, 2
jge 0x1800ff0f4
mov eax, 1
jmp 0x1800fefce
lea eax, [r8 + 0x68]
test al, 0xfd
je 0x1800ff063
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800ff063
mov r9, qword [rdx + 8]
cmp r8b, 0x97
jne 0x1800ff0fe
mov rdx, r9
mov rcx, rax
call fcn.180130290
test eax, eax
jne 0x1800ff0f4
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x1800ff0f4
bt ebp, 0xe
jb 0x1800fefcc
bt ebp, 0xb
jb 0x1800ff0f4
mov rdx, qword [rbx + 0x10]
mov r8d, r14d
mov rcx, qword [rdi + 0x10]
call fcn.1800fef70
test eax, eax
jne 0x1800ff0f4
mov rdx, qword [rbx + 0x18]
mov r8d, r14d
mov rcx, qword [rdi + 0x18]
call fcn.1800fef70
test eax, eax
jne 0x1800ff0f4
mov rdx, qword [rbx + 0x20]
mov r8d, r14d
mov rcx, qword [rdi + 0x20]
call fcn.1800ffdc0
test eax, eax
jne 0x1800ff0f4
bt ebp, 0xd
jb 0x1800fefcc
cmp byte [rdi], 0x61
je 0x1800fefcc
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1800ff0f4
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x1800fefcc
cmp ecx, r14d
jne 0x1800ff0f4
test eax, eax
js 0x1800fefcc
mov eax, 2
jmp 0x1800fefce
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1800ff114
inc rax
test ecx, ecx
jne 0x1800ff101
test edx, edx
je 0x1800ff063
xor eax, eax
cmp r8b, 0x5f
setne al
inc eax
jmp 0x1800fefce
xor eax, eax
mov ecx, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmove ecx, eax
mov eax, ecx
add rsp, 0x20
pop r14
ret
Function at 0x1801010b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x180101186
mov qword [rsp + 0x48], r14
lea r14, [0x1801a59b0]
nop
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
movsxd r10, eax
shl r10, 5
add r10, qword [rsi + 0x20]
mov r11, qword [r10 + 0x18]
test rdi, rdi
je 0x180101142
mov r10, qword [r10]
mov rax, rdi
movzx r8d, byte [rdi]
movzx ecx, byte [r10]
movzx edx, byte [rcx + r14]
movzx ecx, byte [r8 + r14]
cmp ecx, edx
jne 0x180101166
sub r10, rdi
nop
test r8b, r8b
je 0x180101142
movzx ecx, byte [r10 + rax + 1]
inc rax
movzx edx, byte [rcx + r14]
movzx r8d, byte [rax]
movzx ecx, byte [r8 + r14]
cmp ecx, edx
je 0x180101120
jmp 0x180101166
lea rcx, [r11 + 0x20]
mov rdx, rbp
lea r8, [rsp + 0x40]
call fcn.180087a00
test rax, rax
je 0x180101163
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x180101171
jmp 0x180101166
xor r9d, r9d
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1801010e0
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x50]
mov rax, r9
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x1801011a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r11d, r11d
lea r14, [0x1801a59b0]
cmp byte [rcx + 0x298], 3
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
jae 0x18010120b
test rdx, rdx
je 0x18010120b
mov r9, rdx
movzx edx, byte [rdx]
movzx eax, byte [rdx + r14]
sub eax, 0x73
jne 0x18010120b
lea r8, str.sqlite_user
sub r8, r9
test dl, dl
je 0x180101282
movzx eax, byte [r8 + r9 + 1]
inc r9
movzx ecx, byte [rax + r14]
movzx edx, byte [r9]
movzx eax, byte [rdx + r14]
sub eax, ecx
je 0x1801011e8
mov qword [rsp + 0x48], rbx
xor ebx, ebx
cmp dword [rdi + 0x28], ebx
jle 0x1801012d5
nop dword [rax + rax]
mov r9d, ebx
xor r9d, 1
cmp ebx, 2
cmovge r9d, ebx
test rsi, rsi
je 0x180101296
mov rcx, qword [rdi + 0x20]
mov rax, rsi
movzx r8d, byte [rsi]
movsxd rdx, r9d
shl rdx, 5
mov r10, qword [rdx + rcx]
movzx ecx, byte [r10]
movzx edx, byte [rcx + r14]
movzx ecx, byte [r8 + r14]
cmp ecx, edx
jne 0x1801012ca
sub r10, rsi
nop
test r8b, r8b
je 0x180101296
movzx ecx, byte [r10 + rax + 1]
inc rax
movzx edx, byte [rcx + r14]
movzx r8d, byte [rax]
movzx ecx, byte [r8 + r14]
cmp ecx, edx
je 0x180101260
jmp 0x1801012ca
test eax, eax
jne 0x18010120b
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rdi + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.180087a00
test rax, rax
je 0x1801012c7
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1801012d5
jmp 0x1801012ca
xor r11d, r11d
inc ebx
cmp ebx, dword [rdi + 0x28]
jl 0x180101220
mov rbx, qword [rsp + 0x48]
mov rax, r11
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180115480
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [rsp + 0x70]
xor esi, esi
movsxd rdi, r9d
mov r12d, edx
mov r14, r8
mov rdx, rcx
mov r8d, r12d
mov dword [r15], esi
test rcx, rcx
je 0x1801155c5
lea eax, [rdi - 1]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r13
lea r10d, [rsi + 0xd]
movsxd r9, eax
test eax, eax
js 0x1801154e8
nop word [rax + rax]
movsx ecx, byte [r9 + r14]
lea eax, [r10*8]
xor ecx, eax
xor r10d, ecx
sub r9, 1
jns 0x1801154d0
lea ecx, [r10*8]
mov eax, r10d
xor rcx, r8
xor rcx, rax
and ecx, 0x1ff
mov rbx, qword [rdx + rcx*8]
lea r13, [rdx + rcx*8]
test rbx, rbx
je 0x180115536
nop dword [rax]
cmp dword [rbx + 0xc], r12d
jne 0x18011552d
cmp dword [rbx + 8], edi
jne 0x18011552d
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, r14
call fcn.1801624a0
test eax, eax
je 0x18011554c
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180115510
mov qword [rsp + 0x58], rbp
lea ebp, [rdi + 0x18]
call fcn.18014a870
test eax, eax
je 0x180115555
mov rbx, rsi
jmp 0x180115571
mov dword [r15], 1
jmp 0x1801155bb
test ebp, ebp
jg 0x18011555e
mov rbx, rsi
jmp 0x180115571
movsxd r15, ebp
mov rcx, r15
call fcn.18011da50
mov rbx, rax
test rax, rax
jne 0x18011557f
test ebp, ebp
jle 0x18011557c
mov esi, 7
jmp 0x18011558c
movsxd r15, ebp
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.180162c50
mov rbp, qword [rsp + 0x58]
test rbx, rbx
je 0x1801155bb
lea rcx, [rbx + 0x18]
mov dword [rbx + 8], edi
mov r8, rdi
mov qword [rbx], rcx
mov rdx, r14
mov dword [rbx + 0xc], r12d
call fcn.1801625a0
mov rax, qword [r13]
mov qword [rbx + 0x10], rax
mov qword [r13], rbx
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
mov eax, esi
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1801155e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
cmp ecx, 0x80
jge 0x180115602
lea edx, [rcx - 0x41]
cmp edx, 0x19
lea eax, [rcx + 0x20]
cmova eax, ecx
add rsp, 0x20
pop rbx
ret
cmp ecx, 0x10000
jge 0x1801156b9
xor r10d, r10d
mov qword [rsp + 0x30], rdi
mov r9d, 0xa2
lea rdi, [0x180000000]
lea r11d, [r10 - 1]
nop word [rax + rax]
lea eax, [r10 + r9]
mov r8d, ecx
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx edx, word [rdi + rdx*4 + 0x1a3ec0]
sub r8d, edx
mov edx, eax
cmovs edx, r11d
test r8d, r8d
movsxd r11, edx
lea edx, [rax + 1]
cmovs edx, r10d
dec eax
test r8d, r8d
mov r10d, edx
cmovs r9d, eax
cmp r9d, edx
jge 0x180115630
lea r8, [r11*4 + 0x1a3ec0]
movzx edx, word [r8 + rdi]
movzx eax, byte [r8 + rdi + 3]
add eax, edx
cmp ecx, eax
jge 0x1801156a6
movzx eax, byte [r8 + rdi + 2]
xor edx, ecx
and edx, eax
test dl, 1
jne 0x1801156a6
shr rax, 1
movzx eax, word [rdi + rax*2 + 0x1a9510]
add eax, ecx
movzx ecx, ax
mov rdi, qword [rsp + 0x30]
test ebx, ebx
je 0x1801156c7
add rsp, 0x20
pop rbx
jmp fcn.1800ca920
lea eax, [rcx - 0x10400]
cmp eax, 0x27
lea eax, [rcx + 0x28]
jbe 0x1801156c9
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x180133050
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
movzx esi, byte [rcx + 0x298]
mov rdi, rdx
mov byte [rcx + 0x298], 3
lea rdx, str.main
mov byte [r8], 0
mov r14, r8
mov rbx, rcx
call fcn.18014db70
test eax, eax
jne 0x180133099
mov byte [r14], 3
jmp 0x180133154
cmp qword [rbx + 0x2a8], 0
jne 0x1801330ae
mov byte [r14], 1
xor eax, eax
jmp 0x180133154
mov r8, rdi
lea rdx, str.SELECT_pwsqlite_crypt__1_pw___isAdmin_FROM___w_.sqlite_user_WHERE_uname_2
mov rcx, rbx
call fcn.1801331d0
mov rdi, rax
test rax, rax
jne 0x1801330d0
lea eax, [rdi + 7]
jmp 0x180133154
mov r9d, dword [rbx + 0x29c]
mov edx, 1
mov r8, qword [rbx + 0x2a0]
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.180066590
mov r8, qword [rbx + 0x2a8]
mov r9d, 0xffffffff
mov byte [rsp + 0x28], 1
mov rcx, rdi
mov qword [rsp + 0x20], 0
lea edx, [r9 + 3]
call fcn.180079ec0
mov rcx, rdi
call fcn.180067080
cmp eax, 0x64
jne 0x180133147
xor edx, edx
mov rcx, rdi
call fcn.180067a00
test eax, eax
je 0x180133147
mov edx, 1
mov rcx, rdi
call fcn.180067a00
add al, 2
jmp 0x180133149
mov al, 1
mov rcx, rdi
mov byte [r14], al
call fcn.1800681f0
mov rdi, qword [rsp + 0x50]
mov byte [rbx + 0x298], sil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
Function at 0x18014bc30
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
xor eax, eax
movzx ecx, byte [rcx]
test cl, cl
je 0x18014bc71
lea r10, [0x1801a59b0]
nop dword [rax]
nop word [rax + rax]
movzx edx, cl
lea r9, [r9 + 1]
lea ecx, [rax*8]
movzx r8d, byte [rdx + r10]
xor r8d, ecx
movzx ecx, byte [r9]
xor eax, r8d
test cl, cl
jne 0x18014bc50
ret
Function at 0x180151470
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.18011da50
mov rbx, rax
test rax, rax
jne 0x1801514ae
lea eax, [rbx + 7]
jmp 0x180151530
cmp dword [0x1801e5924], 0
je 0x180151502
mov rax, qword [0x1801e5ac0]
test rax, rax
je 0x1801514ce
mov ecx, 0xc8
call rax
test eax, eax
jne 0x180151502
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x180130560]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.180176a38
mov qword [rbx], rax
test rax, rax
jne 0x180151512
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x18015152b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180173f64
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x180173f41
call fcn.180174ca4
mov dword [rax], socket
call fcn.180166c28
or eax, 0xffffffff
jmp 0x180173f5e
sub dword [rcx + 0x10], 1
jns 0x180173f50
add rsp, 0x28
jmp fcn.18018c900
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x180173f20

Function at 0x180176684
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180160840
sub rsp, rax
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180188a34
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1801766d3
mov rax, rbp
jmp 0x1801767db
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1ef8a0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18018ced0
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x1ef8a0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1801767d7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801767d7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18018ced0
test rax, rax
js 0x1801767d7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1801767d7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1801767c9
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x1801767c9
cmp byte [rcx], 0xd
jne 0x1801767af
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1801767be
cmp byte [rcx + 1], 0xa
jne 0x1801767be
inc rcx
jmp 0x1801767be
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x1ead80]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180176791
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1801767db
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18017793c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x1801b46e8]
mov rbp, rcx
call fcn.18018ddd8
xor edi, edi
test rax, rax
je 0x180177a22
mov ebx, edi
call fcn.180174ca4
mov r14d, dword [rax]
call fcn.180174ca4
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.18018dd24
mov rsi, rax
test rax, rax
je 0x1801779b3
call fcn.180174ca4
mov dword [rax], r14d
jmp 0x1801779dd
call fcn.180174ca4
cmp dword [rax], 0x22
jne 0x180177a1a
call fcn.180174ca4
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.18018dd24
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x180177a1a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1801779e1
cmp rax, 3
je 0x1801779fc
mov rcx, rsi
call fcn.180177898
test al, al
je 0x180177a0d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x180177a0d
mov dil, 1
mov rcx, rbx
call fcn.18016e17c
mov al, dil
jmp 0x180177a24
mov rcx, rbx
call fcn.18016e17c
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18015fd80
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1801823e4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1801ef8a0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x180182442
cmp word [rdx], r12w
jne 0x180182442
or byte [rax + r8*8 + 0x38], cl
jmp 0x180182448
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1801825a3
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x18018257e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x180182481
mov rcx, r9
jmp 0x1801824a4
cmp r9, rdx
jae 0x1801824bb
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x180182465
jmp 0x1801825a3
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180182578
cmp dword [rsp + 0x80], edi
je 0x180182578
mov rdx, r14
lea r11, [0x1801ef8a0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x180182551
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x180182524
mov word [rbx], r12w
jmp 0x18018259f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x18018252d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x18018259f
cmp word [rsp + 0x70], r12w
jne 0x18018255e
cmp rbx, rsi
je 0x18018251e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.18018ced8
cmp word [rsp + 0x70], r12w
je 0x1801825a3
mov word [rbx], r13w
jmp 0x18018259f
lea r11, [0x1801ef8a0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18018259b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1801825a3
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18018ba4c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18018ba6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180174c18
or eax, 0xffffffff
jmp 0x18018ba6e
xor eax, eax
add rsp, 0x28
ret