joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008dbf0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14008dc61
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14008dc51
mov r9d, 1
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14008dc61
mov eax, 0xffffffe7
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
mov eax, 0xffffffe7
test ebx, ebx
mov rbx, qword [rsp + 0x40]
cmovne eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x14008dd30
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400c65e0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14008dd7a
call fcn.14002f78c
mov dword [rax], 0xf
call fcn.14002f76c
mov dword [rax], 0xd
call fcn.14002ba68
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140030de0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x14008dd85
lea eax, [rbx + 1]
jmp 0x14008dd67
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14008dd65
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14008dd67
Function at 0x140090770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
mov esi, dword [rcx + 0x4804]
lea r9, [0x1400b2870]
mov ebp, edx
mov r11, rcx
mov dword [rcx + rbp*4 + 0x4808], esi
lea r12, [r11 + 0x404]
movzx edx, word [rcx]
movzx ecx, word [rcx + 2]
mov eax, edx
shr rax, 4
xor rdx, 0x7f0
shr rdx, 4
movzx r14d, byte [rax + r9]
mov eax, ecx
movzx r8d, byte [rdx + r9]
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
mov dword [rsp + 0x38], r14d
movzx r15d, byte [rax + r9]
movzx r13d, byte [rcx + r9]
add r15d, r8d
imul rax, rbp, 0x440
add r13d, r8d
xor r9d, r9d
add r12, rax
test esi, esi
je 0x140090959
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov rdi, r12
cmp r9d, 8
jae 0x14009087f
xor r10d, r10d
lea r8d, [r9 + 8]
lea rbx, [rbp*8]
lea r14, [0x1400b2870]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x140090830
mov eax, dword [rsp + 0x38]
inc r9d
add eax, r10d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x140090808
jmp 0x14009094f
cmp r9d, esi
jae 0x14009094f
lea rdi, [r12 + r9*4]
lea r14, [0x1400b2870]
cmp r9d, 0x10
jae 0x1400908fc
xor r10d, r10d
lea rbx, [rbp*8]
mov r8d, r9d
nop word [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x1400908b0
lea eax, [r10 + r15]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x140090893
jmp 0x14009094f
lea rbx, [r12 + r9*4]
xor r10d, r10d
lea eax, [r9 + 0xf0]
nop word [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx r8d, word [r11 + rax*2 + 0x204]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
movzx ecx, byte [r8 + r14]
add r10d, ecx
cmp eax, 1
jne 0x140090910
lea eax, [r10 + r13]
inc r9d
mov dword [rbx], eax
add rbx, 4
cmp r9d, esi
jb 0x140090900
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x140091440
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov edx, edx
mov r10, rcx
mov dword [rcx], 0x4000400
mov r9d, 0x400
mov qword [rsp + 0x58], rdx
test rdx, rdx
je 0x1400914bd
lea rax, [rcx + 8]
mov ecx, edx
nop word [rax + rax]
mov dword [rax - 4], 0x4000400
mov dword [rax], 0x4000400
mov dword [rax + 4], 0x4000400
mov dword [rax + 8], 0x4000400
mov dword [rax + 0xfc], 0x4000400
mov dword [rax + 0x100], 0x4000400
mov dword [rax + 0x104], 0x4000400
mov dword [rax + 0x108], 0x4000400
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140091470
movzx eax, r9w
lea rdi, [r10 + 0x204]
mov ecx, 0x100
rep stosw word [rdi], ax
test r8b, r8b
jne 0x140091636
xor eax, eax
mov qword [rsp + 0x40], rax
test rdx, rdx
je 0x140091636
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rbp
lea rbp, [0x1400b2870]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r12
mov qword [rsp + 0x10], r13
mov qword [rsp + 8], r14
mov qword [rsp], r15
mov esi, dword [r10 + 0x4804]
lea rdi, [0x1400b2870]
mov r14d, eax
xor r8d, r8d
imul r12, r14, 0x440
mov dword [r10 + r14*4 + 0x4808], esi
movzx ecx, word [r10]
add r12, 0x404
mov eax, ecx
add r12, r10
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx ebp, byte [rax + rbp]
movzx edx, byte [rcx + rdi]
movzx ecx, word [r10 + 2]
mov eax, ecx
mov dword [rsp + 0x50], ebp
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx r15d, byte [rax + rdi]
movzx r13d, byte [rcx + rdi]
add r15d, edx
add r13d, edx
test esi, esi
je 0x1400915f5
mov rbx, r12
nop dword [rax]
cmp r8d, 8
jae 0x14009163c
xor r9d, r9d
lea edi, [r8 + 8]
lea r11, [r14*8]
lea rbp, [0x1400b2870]
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x1400915b0
mov eax, dword [rsp + 0x50]
inc r8d
add eax, r9d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x140091590
lea rbp, [0x1400b2870]
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
cmp rax, qword [rsp + 0x58]
jb 0x140091512
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp r8d, esi
jae 0x1400915f5
lea rbx, [r12 + r8*4]
lea rbp, [0x1400b2870]
nop dword [rax]
cmp r8d, 0x10
jae 0x1400916ae
xor r9d, r9d
lea r11, [r14*8]
mov edi, r8d
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x140091664
lea eax, [r9 + r15]
inc r8d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x140091650
jmp 0x1400915fc
lea r11, [r12 + r8*4]
xor r9d, r9d
lea eax, [r8 + 0xf0]
nop dword [rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx edi, word [r10 + rax*2 + 0x204]
and ecx, 0x7f
shr rdi, 4
xor rdi, rcx
movzx ecx, byte [rdi + rbp]
add r9d, ecx
cmp eax, 1
jne 0x1400916c0
lea eax, [r9 + r13]
inc r8d
mov dword [r11], eax
add r11, 4
cmp r8d, esi
jb 0x1400916b2
jmp 0x1400915fc
Function at 0x140095a60
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r10d, dword [rcx + 0xb94]
mov r11, rcx
mov ecx, 8
sub ecx, r10d
shr r8d, cl
mov ecx, r10d
mov eax, dword [r11 + 0xb98]
xor r10d, r10d
and eax, edx
shl eax, cl
mov ecx, dword [rsp + 0x38]
add r8d, eax
add ecx, 0x100
lea rdi, [r8 + r8*2]
shl rdi, 9
add rdi, r11
lea r11, [0x1400b2870]
test r9b, r9b
jne 0x140095ae6
nop dword [rax]
mov r8d, ecx
shr ecx, 1
and r8d, 1
neg r8d
shr r8, 4
movzx r9d, word [rdi + rcx*2 + 0xb9c]
and r8d, 0x7f
shr r9, 4
xor r9, r8
movzx edx, byte [r9 + r11]
add r10d, edx
cmp ecx, 1
jne 0x140095ab0
mov eax, r10d
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov r9d, 0x100
mov ebx, dword [rsp + 0x30]
nop word [rax + rax]
mov edx, ecx
add ebx, ebx
shr edx, 8
mov eax, r9d
and eax, ebx
add eax, r9d
add edx, eax
movzx r8d, word [rdi + rdx*2 + 0xb9c]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr r8, 4
neg edx
shr rdx, 4
and edx, 0x7f
xor r8, rdx
movzx eax, byte [r8 + r11]
add r10d, eax
mov eax, ebx
xor eax, ecx
not eax
and r9d, eax
cmp ecx, 0x10000
jb 0x140095b00
mov rbx, qword [rsp + 0x10]
mov eax, r10d
pop rdi
ret
Function at 0x140095b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov r14d, 4
lea rbx, [rcx + 0x10290]
mov ebp, r14d
lea rsi, [rcx + 0x10698]
mov r10, rcx
lea r15, [0x1400b2870]
xor edi, edi
nop dword [rax + rax]
mov eax, dword [r10 + 0x10e90]
xor r11d, r11d
test eax, eax
je 0x140095c07
nop
xor r9d, r9d
lea eax, [r11 + 0x40]
nop word [rax + rax]
mov edx, eax
shr eax, 1
and edx, 1
mov ecx, eax
add rcx, rdi
movzx r8d, word [r10 + rcx*2 + 0x6efc]
mov ecx, edx
neg ecx
shr r8, 4
shr rcx, 4
and ecx, 0x7f
xor r8, rcx
movzx ecx, byte [r8 + r15]
add r9d, ecx
cmp eax, 1
jne 0x140095bc0
mov dword [rbx + r11*4], r9d
inc r11d
mov eax, dword [r10 + 0x10e90]
cmp r11d, eax
jb 0x140095bb0
mov edx, 0xe
cmp eax, edx
jbe 0x140095c30
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
shr eax, 1
inc edx
shl eax, 4
sub eax, 0x50
add dword [rcx], eax
cmp edx, dword [r10 + 0x10e90]
jb 0x140095c10
nop dword [rax]
mov eax, dword [rbx]
add rdi, 0x40
mov dword [rsi - 8], eax
mov eax, dword [rbx + 4]
mov dword [rsi - 4], eax
mov eax, dword [rbx + 8]
mov dword [rsi], eax
mov eax, dword [rbx + 0xc]
add rbx, 0x100
mov dword [rsi + 4], eax
add rsi, 0x200
sub rbp, 1
jne 0x140095ba0
lea rdi, [r10 + 0x10aa0]
nop dword [rax]
cmp r14d, 4
ja 0x140095c7b
mov edx, r14d
jmp 0x140095c8d
bsr edx, r14d
mov eax, r14d
lea ecx, [rdx - 1]
shr eax, cl
and eax, 1
lea edx, [rax + rdx*2]
mov r9d, edx
mov r11d, edx
shr r9d, 1
mov eax, edx
and eax, 1
dec r9d
or eax, 2
mov ecx, r9d
shl eax, cl
mov ebx, r14d
sub ebx, eax
mov ebp, eax
xor r8d, r8d
lea esi, [r8 + 1]
mov eax, esi
mov edx, ebx
sub rax, r11
shr ebx, 1
add rax, rbp
and edx, 1
movzx ecx, word [r10 + rax*2 + 0x70fa]
lea esi, [rdx + rsi*2]
mov eax, edx
shr rcx, 4
neg eax
shr rax, 4
and eax, 0x7f
xor rcx, rax
movzx eax, byte [rcx + r15]
add r8d, eax
add r9d, 0xffffffff
jne 0x140095cb4
mov ecx, dword [r10 + r11*4 + 0x10290]
inc r14d
add ecx, r8d
mov dword [rdi - 0x400], ecx
mov ecx, dword [r10 + r11*4 + 0x10390]
add ecx, r8d
mov dword [rdi - 0x200], ecx
mov ecx, dword [r10 + r11*4 + 0x10490]
add ecx, r8d
mov dword [rdi], ecx
mov ecx, dword [r10 + r11*4 + 0x10590]
add ecx, r8d
mov dword [rdi + 0x200], ecx
add rdi, 4
cmp r14d, 0x80
jb 0x140095c70
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov dword [r10 + 0x10e94], r9d
pop r15
pop r14
ret
Function at 0x1400995f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1400ca5e4], 0
jne 0x1400996b5
mov byte [0x1400ca5e4], 1
lea r9, [0x1400ca600]
xor r8d, r8d
nop
mov ecx, r8d
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test r8b, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [r9 + r8*4], eax
inc r8
cmp r8, 0x100
jb 0x140099610
ret

Function at 0x140099778
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400997a8
xor eax, eax
jmp 0x14009986b
mov rbp, rbx
cmp word [rax], si
je 0x1400997cd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400997b4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400997b0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14005535c
movsxd r14, eax
test eax, eax
jne 0x14009980b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400997a1
mov rcx, r14
call fcn.14002bf08
mov rdi, rax
test rax, rax
jne 0x140099824
xor ecx, ecx
call fcn.14002becc
jmp 0x140099800
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14005535c
test eax, eax
jne 0x140099855
mov rcx, rdi
call fcn.14002becc
jmp 0x14009985f
xor ecx, ecx
call fcn.14002becc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140099888
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14009990f
mov rsi, rbx
cmp word [rax], bp
je 0x1400998ce
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400998b8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400998b4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14002bf08
mov rdi, rax
test rax, rax
je 0x1400998fc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001a650
mov rbp, rdi
xor ecx, ecx
call fcn.14002becc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180005370
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
mov rsi, r9
mov dword [rax + 0x18], r8d
mov rbx, rdx
mov dword [rax - 0x48], 0
mov rdi, rcx
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov r9d, 1
lea rcx, [rax - 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1800053e7
lea r9d, [rax + 1]
mov dword [rsp + 0x20], 8
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1800053e7
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov r8d, dword [rdi + 0x28]
lea rdx, [rdi + 8]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov r9d, 0x800000
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
cmp dword [rdi + 0x2c], r8d
jne 0x18000547b
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
jmp 0x180005493
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x80]
mov dword [rsi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180006760
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x30]
mov ebx, eax
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x1800067ad
mov ecx, 0x8007000e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r12 + 3]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180006809
mov rdi, rsi
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x30]
mov r15d, eax
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
mov rdi, r12
nop dword [rax]
call fcn.1800d8134
mov ebx, eax
call fcn.1800d8134
imul ebx, eax
mov dword [r14 + rdi*4], ebx
inc rdi
cmp rdi, 4
jl 0x180006830
mov ecx, 0x30
call fcn.1800d16c8
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180006870
mov rcx, rax
call fcn.1800052e0
mov rdi, rax
jmp 0x180006873
mov rdi, r12
mov dword [rsp + 0x80], r12d
mov rax, qword [rdi]
mov r9d, 0x10
mov r8, r14
lea edx, [r9 - 0xf]
mov rcx, rdi
call qword [rax + 0x10]
mov rax, qword [rdi]
lea r9, [rsp + 0x80]
mov r8d, r15d
mov rdx, rsi
mov rcx, rdi
call qword [rax + 8]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x88]
mov r8d, 0x10
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x88]
mov r8d, r15d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, r14
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
mov rdi, rsi
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180006f60
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc20
mov rax, qword [0x1801d7768]
xor rax, rsp
mov qword [rsp + 0xc10], rax
mov rsi, r8
lea rax, [rsp + 0x20]
mov r8d, 7
mov rdi, rcx
nop
lea rax, [rax + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x180006f90
movups xmm0, xmmword [rdx]
mov rcx, qword [rdx + 0x60]
mov r8d, 0x704
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
xor edx, edx
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm1
mov qword [rax + 0x60], rcx
lea rcx, [rsp + 0x50c]
call fcn.1800d4040
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_129.0.0.0_Safari_537.36_Edg_129.0.0.0
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x410]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x70]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
lea rcx, [rdi + 8]
mov dword [rdx + 0x78], eax
lea rdx, [rsp + 0x410]
call fcn.180008bc0
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 8]
test rsi, rsi
jne 0x1800070f1
xor r8d, r8d
jmp 0x1800070f4
mov r8, rsi
call fcn.180008440
test eax, eax
je 0x18000710f
lea rdx, [rdi + 0x3c]
lea rcx, [rdi + 8]
call fcn.180008700
mov eax, 1
mov rcx, qword [rsp + 0xc10]
xor rcx, rsp
call fcn.1800d1ba0
add rsp, 0xc20
pop rdi
pop rsi
pop rbx
ret
Function at 0x180007130
Capabilities:
Check for time delay via gettickcount

Disassembly:
add rcx, 8
jmp 0x1800083c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor esi, esi
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800083f8
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, 1
jne 0x18000840c
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000842c
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, 1
je 0x180008428
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xea60
ja 0x18000842c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800083e0
mov qword [rbx + 8], rsi
mov dword [rbx + 0x28], esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret