joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100402680
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
xor r8d, r8d
mov edx, 0x20019
mov ecx, 2
call dbg.find_key(int, unsigned int, int)
lea r12, [rsp + 0x38]
xor r8d, r8d
lea rsi, [rsp + 0x3c]
mov qword [rsp + 0x28], rsi
mov rdx, qword [0x10040a008]
mov r9, r12
mov qword [rsp + 0x20], 0
mov rcx, qword [0x10040a010]
mov rbx, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call rbx
test eax, eax
jne 0x1004028d1
mov eax, dword [rsp + 0x3c]
lea ecx, [rax + 1]
call sym.malloc
mov r9, r12
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, qword [0x10040a008]
mov r13, rax
mov rcx, qword [0x10040a010]
call rbx
mov r12d, eax
test eax, eax
jne 0x1004028ca
mov eax, dword [0x100404384]
cmp eax, 3
je 0x100402770
test eax, eax
je case.0x10040273b.0
cmp dword [rsp + 0x38], 0xb
ja case.0x10040273b.8
mov edx, dword [rsp + 0x38]
lea rcx, [0x100405f58]
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
call sym.__getreent
mov edx, dword [rsp + 0x3c]
mov r8d, 1
mov rcx, r13
mov r9, qword [rax + 0x10]
call sym.fwrite
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, dword [rsp + 0x3c]
lea rbx, str._02x_c
test eax, eax
je case.0x10040273b.8
nop
sub eax, 1
mov edx, r12d
mov rcx, rbx
cmp r12d, eax
movzx edx, byte [r13 + rdx]
sbb eax, eax
add r12d, 1
and eax, 0x16
lea r8d, [rax + 0xa]
call sym.printf
mov eax, dword [rsp + 0x3c]
cmp eax, r12d
ja 0x100402780
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
cmp eax, 2
je 0x10040288e
mov rdx, r13
lea rcx, str._ls_n
call sym.printf
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, dword [0x10040a028]
lea rcx, str.0x_016llx_n
mov rdx, qword [r13]
test eax, eax
lea rax, str._llu_n
cmove rcx, rax
call sym.printf
jmp case.0x10040273b.8
lea rbx, str._ls_n
test r13, r13
jne 0x100402840
jmp case.0x10040273b.8
mov rdx, r13
mov rcx, rbx
call sym.printf
mov rcx, r13
call sym.wcslen
lea r13, [r13 + rax*2 + 2]
cmp word [r13], 0
jne 0x100402828
jmp case.0x10040273b.8
mov edx, dword [r13]
bswap edx
mov ecx, dword [0x10040a028]
lea rax, [0x100405f3b]
test ecx, ecx
lea rcx, str.0x_08x_n
cmove rcx, rax
call sym.printf
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov edx, dword [r13]
jmp 0x100402856
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov r12, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call r12
lea ecx, [rax + 1]
mov rsi, rcx
call sym.malloc
mov rcx, r13
mov r8d, esi
mov rbx, rax
mov rdx, rax
call r12
mov rcx, r13
mov r13, rbx
call sym.free
jmp case.0x10040273b.1
mov ecx, eax
call dbg.Fail(unsigned int)
mov ecx, eax
call dbg.Fail(unsigned int)
nop
nop dword [rax]
Function at 0x1800a3478
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
ror r8w, cl
cmc
clc
sub ecx, ecx
mov r8b, 0xa1
lea r8d, [rdx + 1]
jmp 0x1801585cc
mov dword [rsp + 0x18], r8d
cmp ah, 0xa5
mov dword [rsp + 0x10], edx
cmp ch, 0xe8
cmp esp, edi
push rbp
shld bp, r13w, 0x4b
or bpl, r12b
cmc
mov rbp, rsp
cmc
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
cmp spl, r11b
mov qword [rsp + 0x60], rbx
mov ebx, ecx
jmp 0x180158607
test r8d, r8d
jmp 0x18015860f
jne 0x1801586a4
xor ecx, ecx
jmp 0x18015861c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x18015862a
je 0x1801586a4
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x18015863d
jne 0x1801586a4
movsxd rcx, dword [rax + 0x3c]
stc
cmc
cmp dil, 0x39
add rcx, rax
test r12b, 0xa9
cmp dword [rcx], 0x4550
jmp 0x18015865f
jne 0x1801586a4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x180158673
jne 0x1801586a4
cmp dword [rcx + 0x84], 0xe
jmp 0x180158685
jbe 0x1801586a4
cmp dword [rcx + 0xf8], 0
je 0x1801586a4
mov ecx, ebx
jmp 0x18015869f
call fcn.1801587fd
mov byte [rbp + 0x28], 0
cqo
mov cx, 0x343c
lea rax, [rbp + 0x18]
mov cx, r14w
movzx cx, sil
cqo
mov qword [rbp - 0x18], rax
movzx rcx, r8w
cwd
rdtsc
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
cdq
bswap ecx
mov r9b, r12b
lea rax, [rbp + 0x28]
movsx r8, r15w
movzx r8d, si
mov qword [rbp - 8], rax
mov eax, 2
not dh
mov dword [rbp - 0x2c], eax
xchg dl, r8b
mov dword [rbp - 0x28], eax
movsx dx, sil
lea r9, [rbp - 0x2c]
movsx edx, bp
movzx r8, r14w
cmovl cx, r10w
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
jmp 0x18015871d
call fcn.1801583c0
nop
cmp dword [rbp + 0x20], 0
jmp 0x18015872c
je 0x18015874e
mov rbx, qword [rsp + 0x60]
sal bpl, cl
add rsp, 0x50
movsx bp, r11b
jmp 0x18015874c
pop rbp
ret
mov ecx, ebx
call fcn.18015875b
int3

Function at 0x1800a4300
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x1800a0f7a
xor eax, eax
jmp 0x18009f11c
jb 0x18009f11c
inc r9d
stc
test r15w, 0x5efb
add rax, 0x28
test r15b, bpl
cmp r9d, r11d
jmp 0x18009cf2f
ret
movzx eax, word [r8 + 0x14]
sets r11b
shl r11w, cl
movzx r11d, word [r8 + 6]
test r8, r15
add rax, 0x18
lea rax, [rax + r8]
test r8w, 0x3e48
cmp r13b, bpl
test r11d, r11d
jmp 0x1800a0f74
je 0x18009cf35
mov edx, dword [rax + 0xc]
stc
cmp r10, rdx
jmp 0x1800abd25
movsxd r8, dword [rcx + 0x3c]
lahf
sub r9d, r9d
add r8, rcx
ror r10b, cl
rol r10w, 0x65
mov r10, rdx
jmp 0x1800a0302
jb 0x18009d81c
mov ecx, dword [rax + 8]
test r12b, 0x16
add ecx, edx
cmp r10, 0x397d25fa
stc
cmp r10, rcx
jmp 0x18009d816
Function at 0x1800ab385
Capabilities:
Parse pe header

Disassembly:
jne 0x1800abc67
movsxd rax, dword [rcx + 0x3c]
cmc
cmp r12w, 0x7874
add rax, rcx
cmp dword [rax], 0x4550
jmp 0x1800a9548
ret
jne 0x1800abc67
mov eax, 1
jmp 0x1800a182e
ret
jne 0x1800abc67
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jmp 0x1800a5378
mov eax, 0x5a4d
cmp r13, rdi
cmc
cmp word [rcx], ax
jmp 0x18009e323
xor eax, eax
jmp 0x1800a65f6
Function at 0x18014bb12
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsxd rcx, ecx
not ch
movzx ecx, r9w
lea rcx, [rsp + 0x30]
jmp 0x18014bb29
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
jmp 0x18014bb39
add rsp, 0x28
ret

Function at 0x18014ccbb
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
shrd r8d, r15d, 0xe
mov r8, rcx
rol rax, 0x5c
or ax, 0x7ffe
stc
mov eax, 0x5a4d
cmp word [0x180000000], ax
jmp 0x18014cce1
jne 0x18014cdea
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
clc
cmp dh, dh
test r15b, 0xec
lea rcx, [rcx + rdx]
jmp 0x18014cd0c
cmp dword [rcx], 0x4550
jmp 0x18014cd17
jne 0x18014cdea
mov eax, 0x20b
clc
cmp word [rcx + 0x18], ax
jmp 0x18014cd2c
jne 0x18014cdea
sub r8, rdx
bswap ax
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
cmp r15d, r8d
setns r9b
lea rdx, [rdx + rax]
sbb r9b, cl
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
test ebx, 0x490a1085
lea r9, [rdx + rcx*8]
cmp dil, 0x67
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x18014cd70
je 0x18014cdac
mov ecx, dword [rdx + 0xc]
test spl, al
cmp r8, rcx
jmp 0x18014cd84
jb 0x18014cd9e
mov eax, dword [rdx + 8]
add eax, ecx
stc
cmp r8, rax
jmp 0x18014cd98
jb 0x18014cdae
add rdx, 0x28
jmp 0x18014cda7
jmp 0x18014cd64
sub edx, edx
test rdx, rdx
jne 0x18014cdc3
sub al, al
jmp 0x18014cdbe
jmp 0x18014ce00
cmp dword [rdx + 0x24], 0
jmp 0x18014cdcc
jge 0x18014cdde
sub al, al
jmp 0x18014cdd9
jmp 0x18014ce00
mov al, 1
jmp 0x18014cde5
jmp 0x18014ce00
sub al, al
jmp 0x18014cdf1
jmp 0x18014ce00
add rsp, 0x18
jmp 0x18014ce09
ret
Function at 0x18014e1c5
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
ror bp, 0xe
mov rbp, rsp
cmovs rbx, r10
sub rsp, 0x20
and ax, 0x49b2
mov rax, qword [0x180094010]
xor bl, 0xa6
rcr bl, 0x6c
movabs rbx, 0x2b992ddfa232
cmc
cmp rax, rbx
jmp 0x18014e1fe
jne 0x18014e2e7
and qword [rbp + 0x18], 0
movzx rcx, di
mov cl, r13b
cmovs rcx, rsp
lea rcx, [rbp + 0x18]
jmp 0x18014e21d
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x18014e22c
mov qword [rbp + 0x10], rax
jmp 0x18014e235
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x18014e246
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
rol ch, 0xc7
sub rcx, 0xabe2594
not cl
lea rcx, [rbp + 0x20]
jmp 0x18014e263
xor qword [rbp + 0x10], rax
jmp 0x18014e26c
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
ror rcx, cl
or cl, dh
lea rcx, [rbp + 0x10]
stc
cmp bpl, 9
shl rax, 0x20
stc
test r12w, 0x7836
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
shld ebp, esp, 0xab
neg bpl
xor rax, rcx
bsr rbp, r8
movabs rcx, 0xffffffffffff
rcr bp, cl
shr bpl, cl
shld ebp, edi, 0x54
and rax, rcx
btr rbp, 0x2f
clc
movabs rcx, 0x2b992ddfa233
sub ebp, 0x7e1115c0
cmp rax, rbx
cmove rax, rcx
mov qword [0x180094010], rax
shr bx, cl
rol bpl, cl
dec bl
mov rbx, qword [rsp + 0x48]
movzx ebp, di
not rax
xadd bpl, bpl
cmp r8b, bpl
mov qword [0x180094008], rax
btr rbp, r14
xchg ebp, ebp
shrd rbp, r11, 0x30
add rsp, 0x20
movzx bp, r12b
cmovs rbp, r9
pop rbp
jmp 0x18014e31e
ret
Function at 0x18014e660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
rol r11b, 0x83
mov qword [rax + 0x10], rbp
test rcx, 0x2a7f6c91
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsx edi, r14w
adc rsi, r15
rcr bp, cl
push r14
mov r14, rbx
mov r11b, 0xe2
bsf r11, rbp
mov bl, byte [rcx]
sal bpl, 0x9e
movzx rsi, cx
mov r10w, bp
lea r10, [rcx + 1]
mov r11w, 0x3d2f
sub r11, 0x1b570b9c
mov byte [rdx], bl
test r10w, 0x448b
mov esi, r9d
and bpl, r11b
movsxd rdi, ecx
lea r14, [0x180000000]
mov rbp, r8
btr r11d, 0x72
rcr dil, cl
ror r11b, 0xac
mov r11, rdx
bt di, 0x92
sub rdi, r9
not edi
mov rdi, rcx
clc
test bl, 4
jmp 0x18014e6f2
je 0x18014e731
movzx ecx, byte [r10]
rcr ah, cl
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x7d8b0]
mov cl, byte [rcx + r14 + 0x7d8c0]
sub r10, rax
bts ax, sp
btc eax, 0xfb
mov al, 0x13
mov eax, dword [r10 - 4]
jmp 0x18014e728
shr eax, cl
mov dword [rdx + 4], eax
test sp, r8w
test bl, 8
jmp 0x18014e739
je 0x18014e750
mov eax, dword [r10]
cmc
stc
add r10, 4
clc
stc
cmp ch, 0xa9
mov dword [rdx + 8], eax
test bl, 0x10
jmp 0x18014e758
je 0x18014e77d
mov eax, dword [r10]
neg r8b
rol r8d, 0xa1
add r10, 4
and r8b, 0x9d
shl r8b, cl
mov dword [rdx + 0xc], eax
bt ax, bp
sal r8b, cl
movsxd rax, dword [r10]
not r8w
lea r8, [r10 + 4]
cmp ch, 0xe0
stc
xor r9d, r9d
stc
clc
cmp byte [rsp + 0x30], r9b
jne 0x18014e83a
test bl, 2
jmp 0x18014e7a4
je 0x18014e83a
lea rdx, [rax + rbp]
and ecx, r15d
xchg al, cl
btr ax, r15w
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x7d8b0]
add r10b, 0x31
mov cl, byte [rcx + r14 + 0x7d8c0]
sub r10w, 0x9a4
shl r10b, cl
sub rdx, rax
btr r10d, eax
clc
mov r10d, dword [rdx - 4]
test dl, ah
shr r10d, cl
test ebp, 0x45c17cc2
stc
mov dword [r11 + 0x10], r9d
test r10d, r10d
jmp 0x18014e800
je 0x18014e842
mov eax, dword [rdx]
mov ecx, dword [rdx + 4]
lea rdx, [rdx + 8]
clc
cmp eax, esi
je 0x18014e82c
inc r9d
test bh, bl
stc
cmp r9d, r10d
jb 0x18014e806
jmp 0x18014e842
mov dword [r11 + 0x10], ecx
jmp 0x18014e835
jmp 0x18014e842
mov dword [rdx + 0x10], eax
clc
stc
test cl, 0xe4
test bl, 1
je 0x18014e889
movzx ecx, byte [r8]
cmc
adc rsi, 0x2f8b7b42
and ecx, 0xf
adc ax, r10w
lahf
rcl bx, 0xd3
movsx rdx, byte [rcx + r14 + 0x7d8b0]
mov cl, byte [rcx + r14 + 0x7d8c0]
sub r8, rdx
mov edx, dword [r8 - 4]
ror ah, 0x53
shr edx, cl
mov dword [r11 + 0x14], edx
movsxd rbx, r10d
cbw
mov rbx, qword [rsp + 0x10]
cmp cl, al
xor bp, 0x76e1
sub r8, rdi
movzx rdi, ax
mov rbp, qword [rsp + 0x18]
not si
movsx r14d, r8w
mov esi, r14d
mov rax, r8
jmp 0x18014e8b6
mov rsi, qword [rsp + 0x20]
not r14w
mov r14b, 0x95
movsx di, r14b
mov rdi, qword [rsp + 0x28]
movzx r14, r9w
bswap r14
pop r14
jmp 0x18014e8da
ret
Function at 0x180150580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
mov al, ah
cwde
mov eax, edx
movsx rdi, r8w
mov rdi, rcx
movsx cx, sil
movsxd rcx, r9d
bswap ecx
mov rcx, r8
jmp 0x180150567
rep stosb byte [rdi], al
movsx rax, r14w
mov rax, r11
movzx di, spl
movzx rdi, si
pop rdi
jmp 0x18015057f
ret
mov r11, rcx
add r9b, 0x35
movzx edx, dl
movzx r9, r9w
movabs r9, 0x101010101010101
test ch, ch
cmp r8b, r13b
test r10w, 0x781a
imul r9, rdx
clc
cmp si, cx
cmp r8, 0x10
jmp 0x1801505b4
jbe 0x180150730
movq xmm0, r9
punpcklbw xmm0, xmm0
cmp r8, 0x80
jmp 0x1801505cf
ja 0x1801505da
jmp 0x180150686
test byte [0x1800962c8], 2
jne 0x180150548
movups xmmword [rcx], xmm0
sar r9, cl
xor r9b, r14b
add r8, rcx
sbb r9, rax
add rcx, 0x10
clc
and rcx, 0xfffffffffffffff0
xadd r9, r9
sub r8, rcx
mov r9, r8
test r8w, r13w
test r12, 0x12395961
stc
shr r9, 7
je 0x180150686
cmp r9, qword [0x180094028]
jmp 0x18015062b
ja 0x1801506e6
movaps xmmword [rcx], xmm0
test r14b, r8b
movaps xmmword [rcx + 0x10], xmm0
add rcx, 0x80
movaps xmmword [rcx - 0x60], xmm0
jmp 0x18015064b
movaps xmmword [rcx - 0x50], xmm0
jmp 0x180150654
dec r9
jmp 0x18015065c
movaps xmmword [rcx - 0x40], xmm0
jmp 0x180150665
movaps xmmword [rcx - 0x30], xmm0
jmp 0x18015066e
movaps xmmword [rcx - 0x20], xmm0
jmp 0x180150677
movapd xmmword [rcx - 0x10], xmm0
jne 0x180150631
and r8, 0x7f
mov r9, r8
stc
cmp r9d, r15d
shr r9, 4
jmp 0x180150696
je 0x1801506c9
nop dword [rax]
cmp r9w, 0x2300
movups xmmword [rcx], xmm0
cmp ch, 0x32
test r10b, r10b
add rcx, 0x10
jmp 0x1801506bb
dec r9
jmp 0x1801506c3
jne 0x1801506a9
and r8, 0xf
jmp 0x1801506d2
je 0x1801506e2
movups xmmword [rcx + r8 - 0x10], xmm0
movsx eax, r13w
mov rax, r11
ret
movntps xmmword [rcx], xmm0
movntps xmmword [rcx + 0x10], xmm0
add rcx, 0x80
jmp 0x1801506f9
movntps xmmword [rcx - 0x60], xmm0
movntps xmmword [rcx - 0x50], xmm0
dec r9
jmp 0x180150709
movntps xmmword [rcx - 0x40], xmm0
movntps xmmword [rcx - 0x30], xmm0
movntps xmmword [rcx - 0x20], xmm0
movntps xmmword [rcx - 0x10], xmm0
jne 0x1801506e6
sfence
and r8, 0x7f
jmp 0x18015072b
jmp 0x180150686
mov rdx, r9
add al, sil
shr r9d, 0xde
lea r9, [0x180000000]
bt eax, 0x7e
neg eax
mov eax, dword [r9 + r8*4 + 0x9b000]
cmp r9w, 0x48d7
add r9, rax
add rcx, r8
cmovle eax, r10d
mov rax, r11
jmp 0x180150767
push r9
ret

Function at 0x180156789
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
rol bx, 0xac
mov rbx, rcx
sal edx, cl
lea r9, [0x18007e8c0]
btr dx, 0x99
xor ecx, ecx
cwd
lea r8, [0x18007e8b8]
movsx dx, bpl
not dl
lea rdx, [0x18007d430]
jmp 0x1801567c2
call fcn.1801564f6
test rax, rax
jmp 0x1801567cf
je 0x1801567ef
mov rcx, rbx
or rbx, r9
sal rbx, cl
add rsp, 0x20
pop rbx
jmp 0x1801567e8
push qword [0x18007d288]
ret
add rsp, 0x20
bswap rbx
mov bl, 0x29
pop rbx
jmp 0x1801567fe
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x180156899
Capabilities:
Get thread local storage value

Disassembly:
push rbx
rcr bx, cl
sub rsp, 0x20
mov ebx, ecx
cqo
lea r9, [0x18007e8d0]
mov ecx, 2
movzx rdx, r14w
lea r8, [0x18007e8c8]
not edx
lea rdx, [0x18007d448]
jmp 0x1801568cb
call fcn.1801564f6
mov ecx, ebx
clc
test rax, rax
jmp 0x1801568db
je 0x1801568fb
add rsp, 0x20
xchg ebx, ebx
mov rbx, 0x71de219d
pop rbx
jmp 0x1801568f4
jmp qword [0x18007d288]
add rsp, 0x20
movzx ebx, si
bswap bx
pop rbx
jmp 0x18015690b
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180156912
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movsx r9, si
btr bx, 0x2e
rol r8, cl
push rdi
cmp ecx, 0x6613058a
movzx di, r8b
sub rsp, 0x20
mov rbx, rdx
xchg di, di
mov r9b, dil
movsxd rdx, eax
lea r9, [0x18007e8d8]
bswap dx
cwd
mov edi, ecx
cwd
movsx ecx, r8w
lea rdx, [0x18007d458]
mov ecx, 3
movsx r8w, r12b
lea r8, [0x18007e8d0]
jmp 0x180156970
call fcn.1801564f6
mov rdx, rbx
shl ecx, cl
mov ecx, edi
test rax, rax
je 0x180156990
call qword [0x18007d288]
jmp 0x180156996
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
dec dil
add rsp, 0x20
pop rdi
jmp 0x1801569a8
ret
Function at 0x18015ebef
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmc
test ah, al
mov qword [rax + 8], rbx
test r9b, 0x25
mov qword [rax + 0x10], rbp
cmp r12b, 0x74
jmp 0x18015ec0e
mov qword [rax + 0x18], rsi
clc
cmp dil, r11b
mov qword [rax + 0x20], rdi
cmp cx, r10w
push r14
stc
sub rsp, 0x40
jmp 0x18015ec2a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
cmp rdi, r8
stc
test rax, rax
jmp 0x18015ec41
jne 0x18015ec4e
xor eax, eax
jmp 0x18015ede7
mov rbp, rbx
cmp word [rax], si
je 0x18015ec98
or rax, 0xffffffffffffffff
jmp 0x18015ec63
inc rax
stc
cmp word [rbp + rax*2], si
jmp 0x18015ec71
jne 0x18015ec63
lea rbp, [rbp + rax*2]
test cx, 0x7d0d
add rbp, 2
clc
cmp dl, r15b
cmp word [rbp], si
jmp 0x18015ec92
jne 0x18015ec5a
mov qword [rsp + 0x38], rsi
bts r8, rax
sub rbp, rbx
shr r8, 0xa6
sar r8w, 0xc1
movzx r8, di
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
inc r9d
movzx r9, si
mov r8, rbx
sal r9b, 0x69
mov r9d, ebp
mov dword [rsp + 0x28], esi
cmp r11b, cl
cmc
sub edx, edx
stc
test si, r10w
mov qword [rsp + 0x20], rsi
cmp r12b, 0xbc
stc
sub ecx, ecx
jmp 0x18015ecee
call fcn.18015e9d2
movsxd r14, eax
cmp ax, 0x7509
cmc
test eax, eax
jmp 0x18015ed02
jne 0x18015ed16
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18015ec47
mov rcx, r14
call fcn.18015b4eb
mov rdi, rax
stc
test rax, rax
jmp 0x18015ed2a
jne 0x18015ed41
sub ecx, ecx
jmp 0x18015ed37
call fcn.18015b867
jmp 0x18015ed08
mov qword [rsp + 0x38], rsi
shl r9d, cl
btr r8w, cx
mov r9d, ebp
shl r8b, 0x33
and r8b, 0xea
or r8, rdi
mov qword [rsp + 0x30], rsi
sbb r8w, 0x2404
bts r8w, cx
cmp dil, 0x8d
mov r8, rbx
test si, r13w
mov dword [rsp + 0x28], r14d
xor edx, edx
cmp r8d, esp
cmc
clc
xor ecx, ecx
jmp 0x18015ed8a
mov qword [rsp + 0x20], rdi
jmp 0x18015ed94
call fcn.18015e9d2
test eax, eax
jmp 0x18015eda0
jne 0x18015edb3
mov rcx, rdi
call fcn.18015b867
jmp 0x18015edcd
xor ecx, ecx
jmp 0x18015edba
call fcn.18015b867
mov rsi, rdi
bswap cx
movzx cx, r14b
mov rcx, r8
mov rcx, rbx
jmp 0x18015edd5
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
dec edi
btr rsi, rdx
sar bx, cl
mov rbx, qword [rsp + 0x50]
bt rbp, 0
movzx bp, bl
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmc
shrd r14, rsp, 0x25
rol rdi, 0xb
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp 0x18015ee19
ret
Function at 0x180160662
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
ror rcx, 0xa
rcl rcx, cl
mov qword [rsp + 0x20], r9
and cx, r12w
mov cx, 0x5da2
btr ecx, 0x13
push rsi
sub sil, dl
sal ch, 0xf9
push rdi
rcr sil, cl
adc si, 0x14cd
bt di, bx
push r14
shrd rdi, r13, 0x6d
shl rcx, cl
or ecx, r15d
sub rsp, 0x60
mov rdi, r9
cmove si, ax
xchg sil, sil
mov rsi, r8
not ch
mov ecx, dword [rdx]
call fcn.1800a1104
nop
shl bl, cl
mov rbx, qword [0x180096e78]
bt r14w, si
xadd al, r14b
and r14, rdx
movsxd rax, dword [0x180096e70]
btr r14w, r15w
lea r14, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
clc
cmp rbx, r14
jmp 0x1801606ee
je 0x180160813
mov rax, qword [rbx]
xor rdx, rcx
mov qword [rsp + 0x20], rax
stc
btr dx, 0xf2
test bh, bh
mov rdx, qword [rsi]
jmp 0x180160717
test rax, rax
je 0x180160773
mov ecx, dword [rax + 0x14]
movsx ax, r14b
nop
mov eax, ecx
shr eax, 0xd
clc
and al, 1
jmp 0x180160736
je 0x180160773
mov eax, ecx
stc
and al, 3
test rax, 0x39ae3a75
cmp al, 2
jmp 0x18016074e
jne 0x180160762
test cl, 0xc0
jmp 0x18016075c
jne 0x18016077c
bt ecx, 0xb
jmp 0x18016076b
jb 0x18016077c
inc dword [rdx]
add rbx, 8
jmp 0x1801606e0
mov rdx, qword [rsi + 0x10]
movzx cx, dh
xchg r8w, ax
mov rcx, qword [rsi + 8]
movsxd r9, r10d
mov rax, qword [rsi]
movzx r9d, r12w
lea r8, [rsp + 0x20]
movzx r9d, dx
mov qword [rsp + 0x40], r8
movsx r8d, dx
mov qword [rsp + 0x48], rax
movsxd rax, r12d
mov qword [rsp + 0x50], rcx
xchg r8d, r9d
mov qword [rsp + 0x58], rdx
rdtsc
cmovns r9w, di
movsxd rdx, r11d
mov rax, qword [rsp + 0x20]
jmp 0x1801607d0
mov qword [rsp + 0x28], rax
movzx rdx, r10w
cwd
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x40]
movsx cx, dh
setbe cl
lea rdx, [rsp + 0x30]
not ecx
movsx cx, ch
lea rcx, [rsp + 0x88]
jmp 0x180160809
call fcn.1801604f5
jmp 0x180160773
mov ecx, dword [rdi]
jmp 0x18016081a
call fcn.1800a7598
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
movsxd r14, r12d
pop r14
pop rdi
pop rsi
jmp 0x180160837
ret
Function at 0x180164fd8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
lahf
setp al
mov al, 0x93
mov qword [rsp + 0x18], rbp
nop
movsxd rax, r8d
push rsi
bswap eax
mov al, bh
mov ah, 0
push rdi
xchg al, ah
cbw
push r14
mov eax, 0x1450
jmp 0x180165006
call fcn.180168895
sub rsp, rax
cmc
mov rax, qword [0x180094010]
add sil, al
shld rbp, r9, 0xcf
xor rax, rsp
dec rbp
bswap bp
mov qword [rsp + 0x1440], rax
add r14, 0x507a4c12
lahf
setg r10b
movsxd r10, edx
sbb r14d, r8d
lahf
mov rdi, rcx
mov rax, r10
mov ebp, r9d
or sil, al
sar rax, 6
movsxd rsi, r14d
shl si, cl
sar cx, 0xa6
lea rcx, [0x180096a40]
shl rdx, 0xdd
sal r14, 0x5f
not r14b
and r10d, 0x3f
lea rbp, [rbp + r8]
sal dx, cl
mov rsi, r8
shr r14w, 0xa1
cmovne r14w, r11w
movzx dx, ah
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
cmc
cmp r9w, bp
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
cmp r12b, 0x4a
cmp r8, rbp
jmp 0x1801650b2
jae 0x1801651a1
lea rbx, [rsp + 0x40]
jmp 0x1801650c2
cmp rsi, rbp
jmp 0x1801650ca
jae 0x18016511e
mov al, byte [rsi]
jmp 0x1801650d7
inc rsi
stc
clc
cmp al, 0xa
jmp 0x1801650e3
jne 0x1801650f7
inc dword [rdi + 8]
jmp 0x1801650f1
mov byte [rbx], 0xd
inc rbx
mov byte [rbx], al
inc rbx
or rax, 0x4766765a
movsx rax, bp
lea rax, [rsp + 0x143f]
clc
cmp rbx, rax
jmp 0x180165118
jb 0x1801650c2
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
ror r9, cl
inc ch
sub ebx, eax
movsx r8w, al
jmp 0x18016513d
lea r9, [rsp + 0x30]
not rcx
xchg dl, ch
mov ch, 0xb5
mov r8d, ebx
mov cx, ax
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x18016515d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180165196
mov eax, dword [rsp + 0x30]
clc
cmp al, bpl
add dword [rdi + 4], eax
jmp 0x18016517b
cmp eax, ebx
jb 0x1801651a1
cmp rsi, rbp
jmp 0x18016518b
jb 0x1801650b8
jmp 0x1801651a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
cmp al, spl
mov rax, rdi
movzx ecx, sp
cmc
shr ch, cl
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1801651ba
call fcn.18014c161
lea r11, [rsp + 0x1450]
bswap rbp
cmovae r14w, r11w
movsx rsi, ax
mov rbx, qword [r11 + 0x20]
movzx rdi, ax
jmp 0x1801651e0
mov rbp, qword [r11 + 0x30]
jmp 0x1801651ed
mov rsp, r11
movsx edi, dx
jmp 0x1801651f8
pop r14
pop rdi
mov si, 0x130c
jmp 0x180165208
pop rsi
jmp 0x18016520e
ret