joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003be0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov edi, esi
mov eax, dword [rbx]
test eax, eax
je 0x180003c0b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbx + 8]
cmp edx, eax
jne 0x180003c16
inc dword [rbx + 4]
jmp 0x180003c43
mov eax, 1
xchg dword [rbx], eax
test eax, eax
je 0x180003c2a
inc edi
test dil, 0x3f
jne 0x180003bf3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x180003bf3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 8], eax
mov dword [rbx + 4], 1
mov ebp, esi
mov rcx, rsi
lea rax, [rbx + 0x20]
nop dword [rax]
cmp qword [rax], rsi
je 0x180003c67
inc rcx
inc ebp
add rax, 8
cmp rcx, 0x100
jl 0x180003c50
cmp ebp, 0x100
jne 0x180003c8b
dec dword [rbx + 4]
mov eax, dword [rbx + 4]
jne 0x180003c7c
mov dword [rbx + 8], esi
xchg dword [rbx], esi
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [0x1800aea30]
lea rdi, [rbx + 0x828]
mov qword [rsp + 0x48], r12
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
cmp rcx, rax
je 0x180003cb4
call fcn.180086f78
mov r12, rsi
jmp 0x180003ce5
mov edx, 0xc0
mov rcx, r8
call fcn.180002f70
mov r12, rax
test rax, rax
je 0x180003ce5
test byte [rax - 8], 1
jne 0x180003cd5
test byte [rax - 0x10], 1
jne 0x180003ce5
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.18008c4a0
movsxd rax, ebp
mov qword [rbx + rax*8 + 0x20], r12
test r12, r12
jne 0x180003d03
dec dword [rbx + 4]
mov eax, dword [rbx + 4]
jne 0x180003cff
mov dword [rbx + 8], esi
xchg dword [rbx], esi
xor eax, eax
jmp 0x180003d52
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, esi
mov dword [r12 + 4], eax
cmp qword [rdi], rcx
je 0x180003d20
add rdi, 8
inc ecx
cmp qword [rdi], rsi
jne 0x180003d15
cdq
idiv ecx
mov dword [r12], edx
dec dword [rbx + 4]
mov eax, dword [rbx + 4]
jne 0x180003d34
mov dword [rbx + 8], esi
xchg dword [rbx], esi
lea ecx, [rbp + 1]
movsxd rdx, ecx
mov ecx, dword [rbx + 0x820]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x180003d4f
call fcn.180086f78
mov rax, r12
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003f40
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800aea30]
mov rsi, rcx
test rax, rax
jne 0x180003f63
call section..text
xor edi, edi
mov ebx, edi
nop word [rax + rax]
mov eax, dword [0x1800af7a8]
test eax, eax
je 0x180003f96
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11d, eax
mov eax, dword [0x1800af7b0]
cmp eax, r11d
jne 0x180003fa5
inc dword [0x1800af7ac]
jmp 0x180003fda
mov eax, 1
xchg dword [0x1800af7a8], eax
test eax, eax
je 0x180003fb8
inc ebx
test bl, 0x3f
jne 0x180003f70
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x180003f70
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800af7ac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800af7b0], eax
mov dword [0x1800af7ac], 1
cmp dword [rsi + 0x18], edi
jne 0x180004019
xor eax, eax
mov qword [rsi], rax
mov dword [rsi + 8], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rsi + 0x820], eax
cmp eax, 0xffffffff
je 0x180004048
xor ecx, ecx
call fcn.180002dc0
mov qword [rsi + 0x828], rax
test rax, rax
je 0x180004048
mov qword [rax + 0x398], rsi
mov dword [rsi + 0x18], 0x10
dec dword [0x1800af7ac]
mov ecx, dword [0x1800af7ac]
jne 0x180004033
mov dword [0x1800af7b0], edi
xchg dword [0x1800af7a8], edi
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call fcn.180086f78
mov rcx, rsi
call fcn.180003b70
mov rcx, qword [rsi + 0x828]
test rcx, rcx
je 0x18000406d
call fcn.180002e70
mov qword [rsi + 0x828], rdi
mov ecx, dword [rsi + 0x820]
test ecx, ecx
je 0x18000408c
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x180004086
call fcn.180086f78
mov dword [rsi + 0x820], edi
dec dword [0x1800af7ac]
mov eax, dword [0x1800af7ac]
jne 0x1800040a6
mov dword [0x1800af7b0], edi
xchg dword [0x1800af7a8], edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1800043e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x30
mov eax, 0x18
mov r12, rdx
mov rdi, rcx
cmp rdx, rax
cmovb r12, rax
mov qword [rsp + 0x58], r12
test rcx, rcx
jne 0x18000441c
cmp dword [0x1800aea78], ecx
lea rdi, [0x1800aea60]
jne 0x18000441c
mov rcx, rdi
call fcn.180003f40
mov ecx, dword [rdi + 0x820]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebp, ebp
test eax, eax
jle 0x180004443
cdqe
mov rsi, qword [rdi + rax*8 + 0x18]
mov ebx, dword [rsi]
jmp 0x180004474
jne 0x180004494
mov rcx, rdi
call fcn.180003be0
mov rsi, rax
test rax, rax
jne 0x180004472
mov ecx, dword [rdi + 0x820]
or rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x18000446e
call fcn.180086f78
mov ebx, ebp
jmp 0x18000449d
mov ebx, dword [rax]
cmp r12, 0x2000
ja 0x18000449d
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180003d70
test rax, rax
je 0x18000449d
jmp 0x180004534
or rbx, 0xffffffffffffffff
mov rsi, rbp
sub ebx, eax
movsxd rax, ebx
mov dword [rsp + 0x50], ebx
mov rbx, qword [rdi + rax*8 + 0x828]
mov eax, dword [rbx + 0x36c]
test eax, eax
je 0x1800044ce
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [rbx + 0x374]
cmp ecx, eax
jne 0x1800044f5
inc dword [rbx + 0x370]
jmp 0x18000450d
mov eax, 1
xchg dword [rbx + 0x36c], eax
test eax, eax
jne 0x1800044f5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x374], eax
mov dword [rbx + 0x370], 1
jmp 0x18000450d
mov r9, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, rdi
call fcn.1800040c0
mov rbx, rax
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.180002f70
dec dword [rbx + 0x370]
mov ecx, dword [rbx + 0x370]
jne 0x180004534
mov dword [rbx + 0x374], ebp
xchg dword [rbx + 0x36c], ebp
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r12
pop rdi
pop rbp
ret
Function at 0x180004550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
jne 0x180004574
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.1800043e0
mov eax, 0x18
mov qword [rsp + 0x40], rsi
lea rsi, [0x1800aea60]
cmp rdx, rax
cmovb rbx, rax
cmp dword [0x1800aea78], 0
mov qword [rsp + 0x38], rbx
jne 0x1800045a2
mov rcx, rsi
call fcn.180003f40
mov ecx, dword [0x1800af280]
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jle 0x1800045e4
cdqe
mov rbp, qword [rsi + rax*8 + 0x18]
test rbp, rbp
je 0x18000460f
test rbx, rbx
je 0x18000460f
cmp rbx, 0x2000
ja 0x18000460f
mov rbx, qword [rdi - 8]
test bl, 2
je 0x180004639
and rbx, 0xfffffffffffffff8
sub rbx, 0x10
jmp 0x18000463b
jne 0x18000460f
mov rcx, rsi
call fcn.180003be0
mov rbp, rax
test rax, rax
jne 0x1800045c3
mov ecx, dword [0x1800af280]
or rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x18000460f
call fcn.180086f78
mov r9, qword [0x1800aea30]
mov rcx, qword [rdi - 8]
mov rax, qword [0x1800aea30]
and rcx, 0xfffffffffffffff8
xor r9, qword [rcx + rdi - 0x10]
cmp qword [r9 + 0x40], rax
je 0x18000468a
call fcn.180086f78
xor esi, esi
jmp 0x18000469d
xor ebx, ebx
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.180003d70
mov rsi, rax
test rax, rax
je 0x18000460f
mov r8, qword [rsp + 0x38]
mov rdx, rdi
mov rcx, rax
cmp rbx, r8
cmovb r8, rbx
call fcn.180087310
cmp rbx, 0x2000
ja 0x180004680
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.180003e70
jmp 0x18000469d
mov rcx, rdi
call fcn.180003360
jmp 0x18000469d
mov r8, qword [rsp + 0x38]
mov rdx, rdi
mov rcx, r9
call fcn.1800029b0
mov rsi, rax
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800046c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1800aea78], 0
mov rbx, rcx
lea rdi, [0x1800aea60]
jne 0x1800046e5
mov rcx, rdi
call fcn.180003f40
mov ecx, dword [0x1800af280]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jle 0x1800046fe
cdqe
mov rdi, qword [rdi + rax*8 + 0x18]
jmp 0x18000472d
jne 0x18000472b
mov rcx, rdi
call fcn.180003be0
mov rdi, rax
test rax, rax
jne 0x18000472d
mov ecx, dword [0x1800af280]
or rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x18000472d
call fcn.180086f78
jmp 0x18000472d
xor edi, edi
test rbx, rbx
je 0x180004746
mov r8, qword [rbx - 8]
test r8b, 2
je 0x180004746
and r8, 0xfffffffffffffff8
sub r8, 0x10
jmp 0x180004749
xor r8d, r8d
test rbx, rbx
je 0x180004771
test rdi, rdi
je 0x180004771
cmp r8, 0x2010
ja 0x180004771
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180003e70
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180003360
Function at 0x18000aad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x18000ab04
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1800af808]
test rax, rax
je 0x18000ab12
call rax
shl ebx, 4
mov ecx, ebx
call fcn.180007030
mov rcx, qword [0x1800af810]
mov rbx, rax
test rcx, rcx
je 0x18000ab2d
call rcx
test rbx, rbx
je 0x18000aaf7
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call sym.sqlite3.dll_sqlite3_free
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x1800ac420]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call fcn.18008c4a0
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x18000ac43
mov qword [rsp + 0x30], rbp
lea rbp, [0x180097ae0]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x18000abbe
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x18000aba0
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x18000ac16
mov eax, dword [r9]
test eax, eax
je 0x18000abde
mov rcx, qword [r9 + 8]
jmp 0x18000abe1
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x18000ac16
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x18000ac0c
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x18000ac32
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x18000ac32
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x18000ac2a
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x18000ab90
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18000adc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x180097ae0]
test r10d, r10d
je 0x18000ae29
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x18000ae1f
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x18000ae00
xor edx, edx
div r10d
mov r13d, edx
jmp 0x18000ae2c
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.18000ac60
mov r11, rax
test rax, rax
je 0x18000aece
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x18000aebe
mov rax, qword [rax + 8]
test rax, rax
je 0x18000ae68
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x18000ae6f
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x18000ae7f
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x18000aea1
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x18000ae9f
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call sym.sqlite3.dll_sqlite3_free
dec dword [rbx + 4]
jne 0x18000aec6
mov rcx, rbx
call fcn.18000a990
mov rax, rdi
jmp 0x18000af96
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x18000af96
test r12, r12
je 0x18000af94
mov ecx, 0x28
call fcn.180007030
mov rdi, rax
test rax, rax
jne 0x18000aef1
mov rax, r12
jmp 0x18000af96
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x18000af54
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x18000af54
add edx, edx
mov rcx, rbx
call fcn.18000aad0
test eax, eax
je 0x18000af54
xor eax, eax
test esi, esi
jle 0x18000af4d
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x18000af30
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x18000af74
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.18000aa60
jmp 0x18000af94
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x18000af88
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x18000c6d0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x388
lea r9, [rsp + 0x30]
mov r8d, 0x104
mov dword [rsp + 0x3a8], 0x200
call fcn.18000c550
test eax, eax
jne 0x18000c92e
mov eax, dword [0x1800af81c]
mov qword [rsp + 0x398], rsi
xor esi, esi
test eax, eax
jne 0x18000c73c
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x140], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x150], 2
mov eax, esi
sete al
inc eax
mov dword [0x1800af81c], eax
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x390], rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x380], rdi
lea r8, [rsp + 0x30]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rsi
cmp eax, 2
jne 0x18000c7bc
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
movsxd rdi, eax
mov rdx, rdi
add rdx, rdx
call fcn.1800043e0
mov rbx, rax
test rax, rax
je 0x18000c805
lea r8, [rsp + 0x30]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18000c83a
mov rcx, rbx
call fcn.1800046c0
mov rbx, rsi
jmp 0x18000c83a
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
add rdx, rdx
call fcn.1800043e0
mov rdi, rax
test rax, rax
je 0x18000c805
lea r8, [rsp + 0x30]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
test eax, eax
jne 0x18000c82a
call fcn.1800046c0
mov eax, 0x200
mov rbx, qword [rsp + 0x390]
mov rdi, qword [rsp + 0x380]
mov rsi, qword [rsp + 0x398]
add rsp, 0x388
ret
call fcn.18000b1a0
mov rcx, rdi
mov rbx, rax
call fcn.1800046c0
test rbx, rbx
je 0x18000c805
mov eax, dword [0x1800af81c]
test eax, eax
jne 0x18000c877
lea rcx, [rsp + 0x260]
mov dword [rsp + 0x260], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x270], 2
mov eax, esi
sete al
inc eax
mov dword [0x1800af81c], eax
cmp eax, 2
mov rax, rbx
jne 0x18000c8c8
cmp word [rbx], si
je 0x18000c898
cmp word [rax], 0x5c
je 0x18000c895
add rax, 2
cmp word [rax], si
jne 0x18000c884
jmp 0x18000c898
mov word [rax], si
lea rax, [rsp + 0x3a0]
lea r9, [rsp + 0x3a0]
lea r8, [rsp + 0x3a8]
lea rdx, [rsp + 0x3a0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x18000c910
cmp byte [rbx], sil
je 0x18000c8e2
nop dword [rax]
cmp byte [rax], 0x5c
je 0x18000c8df
inc rax
cmp byte [rax], sil
jne 0x18000c8d0
jmp 0x18000c8e2
mov byte [rax], sil
lea rax, [rsp + 0x3a0]
lea r9, [rsp + 0x3a0]
lea r8, [rsp + 0x3a8]
lea rdx, [rsp + 0x3a0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov rcx, rbx
mov edi, eax
call fcn.1800046c0
test edi, edi
je 0x18000c805
mov eax, dword [rsp + 0x3a8]
jmp 0x18000c80a
mov eax, dword [rsp + 0x3a8]
add rsp, 0x388
ret
Function at 0x180037520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800376ac
test rdx, rdx
je 0x1800376ac
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x18003769a
movzx ecx, word [rdi + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x18003769a
xor cl, dl
test cl, 0x10
jne 0x18003769a
movzx eax, byte [rdi]
cmp byte [rbx], al
jne 0x18003769a
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rbx + 0x10]
call fcn.180037520
test eax, eax
je 0x18003769a
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rbx + 0x18]
call fcn.180037520
test eax, eax
je 0x18003769a
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x180037612
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x18003760d
mov edx, dword [rax]
cmp edx, dword [rcx]
jne 0x180037650
xor esi, esi
test edx, edx
jle 0x180037619
mov ebp, esi
nop dword [rax]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax + rbp]
mov rax, qword [rdi + 0x20]
mov rdx, qword [rax + 0x10]
mov rdx, qword [rdx + rbp]
call fcn.180037520
test eax, eax
je 0x180037650
mov rax, qword [rbx + 0x20]
inc esi
add rbp, 0x20
cmp esi, dword [rax]
jl 0x1800375e0
jmp 0x180037619
test rax, rax
jne 0x180037650
cmp qword [rdi + 0x20], 0
jne 0x180037650
mov eax, dword [rdi + 0x30]
cmp dword [rbx + 0x30], eax
jne 0x180037650
movzx eax, word [rdi + 0x34]
cmp word [rbx + 0x34], ax
jne 0x180037650
movzx eax, word [rbx + 2]
mov edx, 0x400
and ax, dx
cmp ax, dx
jne 0x180037667
movzx eax, word [rdi + 2]
and ax, dx
cmp ax, dx
jne 0x180037650
mov eax, dword [rdi + 8]
cmp dword [rbx + 8], eax
je 0x180037693
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp byte [rbx], 0x98
je 0x180037693
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180037693
movzx eax, word [rdi + 2]
and ax, dx
cmp ax, dx
je 0x180037650
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180037650
call fcn.180009df0
test eax, eax
jne 0x180037650
mov eax, 1
jmp 0x180037652
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor esi, esi
cmp rdx, rcx
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18003cba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x18003cbe1
cmp byte [rdx], r10b
je 0x18003cbd9
inc rbx
cmp byte [rbx], r10b
jne 0x18003cbd1
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x18003cd0d
mov qword [rsp + 0x40], r14
lea r14, [0x180097ae0]
nop dword [rax]
mov r9d, edi
cmp edi, 2
jge 0x18003cc0c
xor r9d, 1
test rbp, rbp
je 0x18003cc65
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x18003cc50
nop dword [rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x18003cc50
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18003cc30
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x18003cce1
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x18003ccba
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x18003ccaf
nop dword [rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x18003cc90
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x18003ccbc
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.18000ac60
test rax, rax
je 0x18003ccde
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x18003ccec
jmp 0x18003cce1
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x18003cc00
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x18003ccf4
Function at 0x18003cdf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x18003ce28
cmp byte [rdx], r9b
je 0x18003ce20
inc rbx
cmp byte [rbx], r9b
jne 0x18003ce18
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x18003cf4c
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x180097ae0]
nop dword [rax]
mov eax, edi
cmp edi, 2
jge 0x18003ce5a
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x18003ceb5
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x18003cea0
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x18003cea0
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18003ce80
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x18003cf21
cmp qword [r10 + 0x30], 0
je 0x18003cefa
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x18003ceef
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x18003ced0
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x18003cefc
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.18000ac60
test rax, rax
je 0x18003cf1e
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x18003cf2c
jmp 0x18003cf21
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x18003ce50
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x18003cf39