joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140109bd0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140109bdd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140109bed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140109bd5
lea eax, [rcx + 1]
jmp 0x140109bfb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140109c0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140109bf4
sub eax, 3
jb 0x140109c2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140109c7d
sar eax, 1
movsxd rbp, eax
jb 0x140109c64
jmp 0x140109c3c
add ebx, ebx
jne 0x140109c3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140109c64
inc ecx
add ebx, ebx
jne 0x140109c4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140109c64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140109c5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140109c4c
add ecx, 2
jmp 0x140109c69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140109b92
jmp 0x140109bdd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2f400
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140109cc9
cmp rsi, rcx
jae 0x140109cd1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140109cb0
cmp al, 0x8f
ja 0x140109cb0
cmp byte [rsi - 2], 0xf
je 0x140109cb6
sub al, 0xe8
cmp al, 1
ja 0x140109c9a
cmp rsi, rcx
jae 0x140109cd1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140109ca0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140109cd1
lodsb al, byte [rsi]
jmp 0x140109cb0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x107000]
mov eax, dword [rdi]
or eax, eax
je 0x140109d3a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1092cc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140109cde
jns 0x140109d13
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140109d1d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140109d34
mov qword [rbx], rax
add rbx, 8
jmp 0x140109cfe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140109d74
cmp al, 0xef
ja 0x140109d66
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140109d46
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140109d55
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140109dc8
sub rsp, 0xffffffffffffff80
jmp 0x14000e440
Function at 0x1400289e4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c2f4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c2f4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028b34
cmp rax, 0xffffffffffffffff
je 0x140028b34
xor edi, edi
test rbp, rbp
jle 0x140028adf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001ec08
mov rbx, rax
test rax, rax
jne 0x140028a6c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028ad5
mov edx, 0x8000
mov ecx, r14d
call fcn.140019c58
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cfd0
cmp eax, 0xffffffff
je 0x140028ab5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028a7c
mov edx, r15d
mov ecx, r14d
call fcn.140019c58
jmp 0x140028ad5
cmp byte [rsi + 0x38], dil
je 0x140028acc
cmp dword [rsi + 0x34], 5
jne 0x140028acc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028ad5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a9b8
jmp 0x140028b48
jns 0x140028b48
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c2f4
cmp rax, 0xffffffffffffffff
jne 0x140028b00
cmp byte [rsi + 0x30], dil
je 0x140028b48
mov edi, dword [rsi + 0x2c]
jmp 0x140028b48
mov ecx, r14d
call fcn.14001878c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028b48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028b48
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028b41
mov eax, dword [rsi + 0x2c]
jmp 0x140028b46
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c2f4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029c40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029c68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029c68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180498b14
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
mov qword [rsp + 8], 0xffffffffdd0e8497
push 0x7f1427b3
lea rsp, [rsp + 0x18]
je 0x180498ba5
mov eax, 0x1020ad8a
lea r8, [rax*8 + 0x30d2f39]
inc r8w
lea r8, [0x180471018]
Function at 0x1400044e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000452a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000452a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000452a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000452a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000452a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000452c
xor al, al
add rsp, 0x28
ret
Function at 0x345854390
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3468f4750]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3458543b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3458543b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3458543b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x34585440d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x345854404
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x3458543b0
add rax, 0x28
cmp rax, r9
jne 0x3458543f0
xor eax, eax
ret

Function at 0x345854410
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3468f4750]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x34585442f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x345854438
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x34585442f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x3458544d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3468f4750]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x3458544ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x3458544f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140f55770
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f5577a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f557a3
pop rbp
sub rbp, 0x33
sub rbp, 0xf55770
sub rsp, 0x20
jmp 0x140f557c2
mov rax, 0xf55770
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x7e5a4c24
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f557e1
jmp 0x140f557f8
add byte [rax], al
idiv dword [rsi + rax*2 - 0x325293a9]
insb byte [rdi], dx
lodsd eax, dword [rsi]
int 0xaf
scasd eax, dword [rdi]
lodsd eax, dword [rsi]
sbb byte [rsp], ah
and al, 0x6c
movsd dword [rdi], dword [rsi]
in eax, 0x2c
and eax, 0x256c2424
int 0x6c
jrcxz 0x140f557f2
and esp, dword [rsp]
and al, 0x6c
jrcxz 0x140f557fb
or al, 0x24
and al, 0x24
insb byte [rdi], dx
rol esi, cl
insb byte [rdi], dx
and eax, 0x28a5afe5
and al, 0x24
and al, 0x6c
and eax, 0x6c7474cc
pushfq
in al, 0xb2
add ah, byte [rsp]
and al, 0x24
and al, 0x6c
popfq
mov esp, esp
invalid
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
invalid
wait
jns 0x14003f69b
scasb al, byte [rdi]
mov ebx, 0x3352c62a
jp 0x14003f5ef
ret
pop rdi
movabs al, byte [0xd1c370a835e811da]
push rcx
invalid
jo 0x14003f68b
and byte [rax + 0x55], bl
and al, 0x4e
invalid
outsd dx, dword [rsi]
or eax, 0xed2d3bda
out 0x51, al
add ecx, dword [rsi]
insd dword [rdi], dx
cwde
sbb al, 0xe3
js 0x14003f6a9
mov esi, 0x874f89e4
invalid
in al, 0x89
xchg r12, r10
push rbp
and dword [rdi + rbx*4], 0xfffffff6
invalid
mov eax, 0x2c8382c0
adc ebx, dword es:[rbp + 0x3e9cd1f0]
int 0xde
int 0xde
ficom word [rsi]
enter 0xfffffffffffff89f, 0x66
invalid
retf
adc byte [rcx + rdx], dl
mov dl, 0xe2
cmc
ret 0x14cb
Function at 0x18001ca00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov rbx, rcx
xor ecx, ecx
mov dword [rbx], ecx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x38], rcx
mov qword [rbx + 0x40], rcx
mov rax, qword [0x180132530]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], 0xffffffffffffffff
mov qword [rbx + 0x58], rcx
mov qword [rbx + 0x60], rcx
mov qword [rbx + 0x68], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x60], eax
mov ecx, eax
call fcn.1800db3b8
mov qword [rbx + 0x68], rax
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x18007afd0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebp, edx
mov r12d, r9d
mov r13d, r8d
mov rsi, rcx
cmp qword [rcx + rbp*8 + 0x3d0], 0
jne 0x18007afff
mov edx, ebp
call fcn.18007b1b0
mov r15, qword [rsi + rbp*8 + 0x3d0]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
test r15, r15
je 0x18007b101
mov dword [rsp + 0x20], r12d
lea rdx, [rsp + 0x20]
mov eax, 0x1505
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
imul eax, eax, 0x21
xor eax, ecx
lea rcx, [rsp + 0x24]
cmp rdx, rcx
jb 0x18007b030
xor edx, edx
div dword [r15 + 0x20]
mov rax, qword [r15 + 0x18]
movsxd rcx, edx
movsxd rdx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x18007b16a
mov rax, qword [r15]
lea rcx, [rdx + rdx*2]
mov edi, dword [rax + rcx*4 + 8]
lea rbx, [rax + rcx*4]
test rbx, rbx
je 0x18007b16a
lea r14, [rbp*4]
add r14, rbp
add r14, r14
nop word [rax + rax]
mov rax, qword [rsi + r14*8 + 0x558]
lea rcx, [rsi + 0x558]
mov edx, dword [rbx]
lea r8, [rsp + 0x60]
lea rcx, [rcx + r14*8]
mov rax, qword [rax + 0xa8]
call qword [0x180102408]
test eax, eax
js 0x18007b17a
mov r9, qword [rsp + 0x60]
mov r8d, r13d
mov edx, ebp
mov rcx, rsi
call fcn.180078a40
cmp eax, r12d
je 0x18007b0f3
cmp edi, 0xffffffff
je 0x18007b16a
movsxd rax, edi
lea rcx, [rax + rax*2]
mov rax, qword [r15]
mov edi, dword [rax + rcx*4 + 8]
lea rbx, [rax + rcx*4]
jmp 0x18007b090
mov rax, qword [rsp + 0x80]
mov ecx, dword [rbx]
mov dword [rax], ecx
jmp 0x18007b178
mov ebx, 1
cmp dword [rsi + rbp*4 + 0x20], ebx
jb 0x18007b16a
lea rdi, [rbp*4]
add rdi, rbp
add rdi, rdi
nop word [rax + rax]
mov rax, qword [rsi + rdi*8 + 0x558]
lea rcx, [rsi + 0x558]
lea r8, [rsp + 0x60]
mov edx, ebx
lea rcx, [rcx + rdi*8]
mov rax, qword [rax + 0xa8]
call qword [0x180102408]
test eax, eax
js 0x18007b17a
mov r9, qword [rsp + 0x60]
mov r8d, r13d
mov edx, ebp
mov rcx, rsi
call fcn.180078a40
cmp eax, r12d
je 0x18007b197
inc ebx
cmp ebx, dword [rsi + rbp*4 + 0x20]
jbe 0x18007b120
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
xor eax, eax
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov rax, qword [rsp + 0x80]
mov dword [rax], ebx
jmp 0x18007b178
Function at 0x18007b1b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13d, edx
mov rbp, rcx
xor ebx, ebx
lea rax, [rcx + 0x3d0]
lea rax, [rax + r13*8]
mov qword [rsp + 0xa8], rax
cmp qword [rax], rbx
jne 0x18007b38f
mov r15d, dword [rcx + r13*4 + 0x20]
cmp r15d, 0x18
jbe 0x18007b38f
lea ecx, [rbx + 0x28]
call fcn.1800db3c0
mov r14, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0x10
mov eax, 0xc
mov word [r14 + 0x14], ax
mov byte [r14 + 0x16], 1
mov qword [r14 + 0x18], rbx
mov qword [r14 + 0x20], rbx
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], ebx
mov esi, 1
mov dword [rsp + 0x40], esi
mov eax, ebx
mov edx, 4
cmp dword [rbp + 0x1748], esi
cmove eax, edx
lea rcx, [0x18010d228]
movsxd rbx, dword [rax + rcx]
mov eax, edx
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800db3b8
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], ebx
lea r8, [rbx*4]
lea edx, [rsi - 2]
mov rcx, rax
call fcn.1800dd740
lea rdi, [r13*4]
add rdi, r13
add rdi, rdi
mov r12d, dword [rsp + 0xa0]
nop dword [rax]
mov rax, qword [rbp + rdi*8 + 0x558]
lea r8, [rsp + 0x90]
mov edx, esi
lea rcx, [rbp + 0x558]
lea rcx, [rcx + rdi*8]
mov rax, qword [rax + 0xa8]
call qword [0x180102408]
mov ebx, eax
test eax, eax
js 0x18007b381
mov r9, qword [rsp + 0x90]
mov r8d, r12d
mov edx, r13d
mov rcx, rbp
call fcn.180078a40
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x20]
mov edx, 0x1505
nop dword [rax + rax]
imul edx, edx, 0x21
movzx eax, byte [rcx]
xor edx, eax
inc rcx
lea rax, [rsp + 0x24]
cmp rcx, rax
jb 0x18007b310
mov rcx, r14
call fcn.18007e720
test rax, rax
je 0x18007b36c
mov dword [rax], esi
inc esi
cmp esi, r15d
jbe 0x18007b2b0
xor eax, eax
mov rcx, qword [rsp + 0xa8]
lock cmpxchg qword [rcx], r14
mov eax, dword [rsp + 0x40]
mov edi, 0
cmove eax, edi
mov dword [rsp + 0x40], eax
test eax, eax
je 0x18007b38f
mov rcx, r14
call fcn.180070280
jmp 0x18007b38b
mov rcx, r14
call fcn.180070280
xor edi, edi
mov dword [rsp + 0x40], edi
mov eax, 0x8007000e
jmp 0x18007b391
mov rcx, r14
call fcn.180070280
xor edi, edi
mov dword [rsp + 0x40], edi
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007b3b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov edi, edx
mov r15d, r9d
mov ebp, r8d
mov rbx, rcx
mov r14, qword [rcx + rdi*8 + 0x3d0]
test r14, r14
jne 0x18007b3e7
mov edx, edi
call fcn.18007b1b0
jmp 0x18007b474
lea rcx, [rdi + rdi*4]
mov qword [rsp + 0x58], rsi
shl rcx, 4
lea r8, [rsp + 0x50]
add rcx, 0x558
mov edx, r15d
add rcx, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
call qword [0x180102408]
mov esi, eax
test eax, eax
js 0x18007b46f
mov r9, qword [rsp + 0x50]
mov r8d, ebp
mov edx, edi
mov rcx, rbx
call fcn.180078a40
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x20]
mov edx, 0x1505
nop dword [rax]
movzx eax, byte [r8]
inc r8
imul edx, edx, 0x21
xor edx, eax
lea rax, [rsp + 0x24]
cmp r8, rax
jb 0x18007b440
mov rcx, r14
call fcn.18007e720
test rax, rax
jne 0x18007b46a
mov eax, 0x8007000e
jmp 0x18007b46f
mov dword [rax], r15d
mov eax, esi
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18007c3e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rsi
push r12
push r13
push r15
sub rsp, 0x58
cmp qword [rcx + 0x3c8], 0
mov r13, r9
mov r15, r8
mov r12d, edx
mov rsi, rcx
jne 0x18007c407
call fcn.18007bdc0
mov r10, qword [rsi + 0x3c8]
test r10, r10
je 0x18007c53a
mov ecx, 0x1505
mov dword [rsp + 0x40], r12d
mov r8d, ecx
lea rdx, [rsp + 0x40]
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
imul r8d, r8d, 0x21
xor r8d, eax
lea rax, [rsp + 0x44]
cmp rdx, rax
jb 0x18007c430
movsx eax, byte [r15]
mov rdx, r15
test eax, eax
je 0x18007c462
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
xor ecx, eax
movsx eax, byte [rdx]
test eax, eax
jne 0x18007c452
lea eax, [rcx + r8]
mov qword [rsp + 0x80], rbx
xor edx, edx
mov qword [rsp + 0x88], rbp
div dword [r10 + 0x20]
mov rax, qword [r10 + 0x18]
movsxd rcx, edx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x50], r14
movsxd rdx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x18007c533
mov rbx, rdx
shl rbx, 4
add rbx, qword [r10]
mov edi, dword [rbx + 0xc]
je 0x18007c533
mov r14, qword [rsp + 0xa8]
mov ebp, dword [rsp + 0xa0]
nop
mov r8d, dword [rbx + 4]
mov r9d, r12d
mov edx, dword [rbx]
mov rcx, rsi
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
call fcn.18007c550
test eax, eax
jne 0x18007c4ea
mov eax, dword [rbx]
cmp eax, dword [r14]
jne 0x18007c505
cmp edi, 0xffffffff
je 0x18007c533
mov rax, qword [rsi + 0x3c8]
movsxd rbx, edi
shl rbx, 4
add rbx, qword [rax]
mov edi, dword [rbx + 0xc]
jmp 0x18007c4c0
mov dword [r14], eax
xor eax, eax
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x50]
add rsp, 0x58
pop r15
pop r13
pop r12
pop rsi
ret
mov eax, 1
jmp 0x18007c50a
mov eax, 2
add rsp, 0x58
pop r15
pop r13
pop r12
pop rsi
ret
Function at 0x180083710
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
movzx eax, byte [rcx + 8]
mov rbx, rcx
and al, 0xf4
mov qword [rcx + 0x18], 0xffffffffffffffff
or al, 4
mov dword [rcx + 4], 1
mov byte [rcx + 8], al
xor eax, eax
cmp dword [0x180132548], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x58], rax
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x60], rax
mov dword [rcx], eax
jne 0x18008378d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
mov eax, ecx
neg eax
mov dword [0x180132548], ecx
and eax, 0x3fff
add eax, ecx
mov dword [0x18013253c], eax
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1800846b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov r8d, dword [rcx + 0x58]
mov rbx, rcx
test r8d, r8d
je 0x18008473e
mov eax, dword [rcx + 0x48]
mov rdx, qword [rcx + 0x50]
dec eax
cmp eax, 5
ja case.default.0x1800846e4
lea r9, [0x180000000]
cdqe
mov ecx, dword [r9 + rax*4 + 0x84754]
add rcx, r9
jmp rcx
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne case.default.0x1800846e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180084714
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.18008dee0
jmp 0x180084733
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x180102408]
test eax, eax
js 0x180084740
mov dword [rbx + 0x58], 0
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0x8000ffff
add rsp, 0x30
pop rbx
ret

Function at 0x180084770
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x48]
lea r10, [rsp + 0x40]
xor ebx, ebx
mov r11, rcx
test r9, r9
cmovne r10, r9
dec eax
cmp eax, 5
ja case.default.0x1800847a5
lea r9, [0x180000000]
cdqe
mov ecx, dword [r9 + rax*4 + 0x84808]
add rcx, r9
jmp rcx
mov rcx, qword [r11 + 0x18]
mov r9, r10
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne case.default.0x1800847a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1800847cf
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.18008dee0
mov ebx, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [r11 + 0x10]
mov r9, r10
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x180102408]
mov ebx, eax
add rsp, 0x30
pop rbx
ret
mov ebx, 0x8000ffff
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x180084820
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov eax, dword [rcx + 0x48]
lea r10, [rsp + 0x40]
test r9, r9
cmovne r10, r9
cmp eax, 1
je 0x180084856
cmp eax, 6
je 0x180084856
mov rcx, qword [rcx + 0x10]
mov r9, r10
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x180102408]
add rsp, 0x38
ret
mov rcx, qword [rcx + 0x18]
mov r9, r10
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180084877
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180084889
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.18008dee0
add rsp, 0x38
ret