joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180206260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180e681c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
mov ebp, r8d
mov rdi, rcx
mov rbx, rdx
lea rcx, [rdx + 0xc88]
mov r8d, 0x264
xor edx, edx
xor esi, esi
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.180281510
cmp ebp, 0x132
mov dword [rbx], ebp
mov eax, 7
mov ecx, 0xa
cmove eax, ecx
mov dword [rbx + 0x84], eax
test ebp, ebp
jle 0x1802062f4
mov rcx, rdi
mov edx, ebp
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
and eax, 0xf
inc dword [rsp + rax*4 + 0x20]
sub rdx, 1
jne 0x1802062e0
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], esi
sub r8, rbx
mov dword [rbx + 0x44], esi
lea r9, [rsp + 0x24]
mov dword [rbx + 4], esi
sub r9, rbx
lea rdx, [rbx + 8]
mov ecx, 0xf
nop word [rax + rax]
add esi, dword [r9 + rdx - 8]
lea rdx, [rdx + 4]
mov eax, esi
add esi, esi
shl eax, cl
dec ecx
mov dword [rdx - 4], eax
mov eax, dword [r8 + rdx - 0xc]
add eax, dword [rdx + 0x38]
mov dword [rdx + 0x3c], eax
test ecx, ecx
jg 0x180206320
movups xmm0, xmmword [rbx + 0x44]
xor r8d, r8d
movups xmm1, xmmword [rbx + 0x54]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x64]
movups xmm1, xmmword [rbx + 0x74]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
test ebp, ebp
jle 0x1802063a0
nop
movzx eax, byte [rdi]
and al, 0xf
jbe 0x180206395
movzx eax, al
lea rdx, [rsp + 0x20]
movsxd rcx, dword [rdx + rax*4]
lea rdx, [rdx + rax*4]
lea eax, [rcx + 1]
mov word [rbx + rcx*2 + 0xc88], r8w
mov dword [rdx], eax
inc r8d
inc rdi
cmp r8d, ebp
jl 0x180206370
mov ecx, dword [rbx + 0x84]
mov eax, 1
mov edx, eax
xor r11d, r11d
shl rdx, cl
movsxd rdi, edx
test edx, edx
jle 0x180206445
xor r9d, r9d
mov r10d, 0x488
nop word [rax + rax]
mov ecx, 0x10
mov r8d, r11d
sub ecx, dword [rbx + 0x84]
shl r8d, cl
cmp eax, 0x10
jge 0x1802063f7
movsxd rcx, eax
cmp r8d, dword [rbx + rcx*4 + 4]
jl 0x1802063f7
inc eax
cmp eax, 0x10
jl 0x1802063e6
movsxd rdx, eax
mov ecx, 0x10
mov byte [rbx + r9 + 0x88], al
sub ecx, eax
sub r8d, dword [rbx + rdx*4]
and edx, 0xf
sar r8d, cl
add r8d, dword [rbx + rdx*4 + 0x44]
cmp eax, 0x10
jge 0x18020642f
cmp r8d, ebp
jge 0x18020642f
movsxd rcx, r8d
movzx edx, word [rbx + rcx*2 + 0xc88]
jmp 0x180206431
xor edx, edx
mov word [rbx + r10], dx
inc r11d
add r10, 2
inc r9
cmp r9, rdi
jl 0x1802063d0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18024b290
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18020e220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx r8d, byte [rcx]
mov r9, rcx
test r8b, r8b
jns 0x18020e2db
movzx r11d, r8b
and r11b, 0x40
movzx eax, r11b
movzx ecx, r11b
neg al
sbb rax, rax
neg cl
movzx ecx, r8b
sbb r10b, r10b
or r8b, 0x80
and cl, 0x7f
movzx r8d, r8b
test r11b, r11b
movzx ecx, cl
cmove r8d, ecx
cmp rdx, 8
jbe 0x18020e286
nop dword [rax]
dec rdx
cmp r8b, r10b
jne 0x18020e2c5
movzx r8d, byte [r9 + 1]
inc r9
cmp rdx, 8
ja 0x18020e270
xor r10b, r8b
jl 0x18020e2c5
sub rdx, 1
je 0x18020e2b9
nop dword [rax]
nop word [rax + rax]
shl rax, 8
lea r9, [r9 + 1]
movzx ecx, r8b
movzx r8d, byte [r9]
or rax, rcx
sub rdx, 1
jne 0x18020e2a0
shl rax, 8
movzx ecx, r8b
or rax, rcx
ret
xor eax, eax
movabs rcx, 0x7fffffffffffffff
test r11b, r11b
setne al
add rax, rcx
ret
mov r8d, 8
jmp fcn.18020e2f0
Function at 0x180213300
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r9
cmp r8, rax
mov rsi, rdx
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x1802133a5
mov qword [rsp + 0x30], rbp
sub rsi, r9
mov ebp, eax
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x50]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x50], cl
mov ecx, dword [rbx]
not ecx
call fcn.180242340
not eax
lea rdx, [rsp + 0x40]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x40], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.180242340
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x180213332
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180215bf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov ebx, 0xffffffff
mov rdi, rdx
cmp r8, rbx
cmovbe rbx, r8
test ecx, ecx
jns 0x180215c28
call fcn.180252670
mov dword [rax], 9
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x180215cca
call fcn.1802655f0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180215cbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x180215c7f
call fcn.180252670
mov dword [rax], 0xb
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, 0x6d
je 0x180215cca
cmp eax, 5
jne 0x180215ca4
call fcn.180252670
mov dword [rax], 9
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.180215830
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x180216280
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rdx
test ecx, ecx
jns 0x1802162a3
call fcn.180252670
mov dword [rax], 9
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
mov ebx, 0xffffffff
cmp r8, rbx
cmovbe ebx, r8d
call fcn.1802655f0
mov rcx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x180216312
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180216300
call fcn.180252670
mov dword [rax], 9
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.180215830
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18021ee60
Capabilities:
Hash data using sha256

Disassembly:
mov r8, rcx
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm0
mov qword [rcx + 0x80], rax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
xor ecx, 0x6a09e667
mov dword [r8], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
xor ecx, 0xbb67ae85
mov dword [r8 + 4], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
xor ecx, 0x3c6ef372
mov dword [r8 + 8], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
xor ecx, 0xa54ff53a
mov dword [r8 + 0xc], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
xor ecx, 0x510e527f
mov dword [r8 + 0x10], ecx
movzx ecx, byte [rdx + 0x17]
movzx eax, byte [rdx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
xor ecx, 0x9b05688c
mov dword [r8 + 0x14], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
xor ecx, 0x1f83d9ab
mov dword [r8 + 0x18], ecx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
xor ecx, 0x5be0cd19
mov dword [r8 + 0x1c], ecx
movzx eax, byte [rdx]
mov qword [r8 + 0x78], rax
xor eax, eax
ret
Function at 0x18022e060
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x180e7bf48], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x18022e0c0
movdqa xmm0, xmmword [0x1803693f0]
movdqa xmm1, xmmword [0x1803693e0]
movdqa xmmword [0x180e7bf50], xmm0
movdqa xmm0, xmmword [0x1803693c0]
movdqa xmmword [0x180e7bf60], xmm1
movdqa xmm1, xmmword [0x1803693d0]
movdqa xmmword [0x180e7bf70], xmm0
movdqa xmmword [0x180e7bf80], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.180281510
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
mov qword [rbx + 0x110], 0
mov byte [rbx + 0x118], 0
shl edi, 0x10
mov dword [rax], 0x6a09e667
mov rax, qword [rbx + 0xf8]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbx + 0xf8]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbx + 0xf8]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbx + 0xf8]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbx + 0xf8]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbx + 0xf8]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbx + 0xf8]
mov dword [rax + 0x1c], 0x5be0cd19
mov rax, qword [rbx + 0xf8]
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x18022e390
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
add rcx, 0xa20
mov r8d, 0x200
call fcn.180281510
xor ebp, ebp
lea rcx, [rdi + 0x900]
xor edx, edx
mov qword [rdi + 0xc20], rbp
lea r8d, [rbp + 1]
call fcn.18022e060
mov esi, ebp
lea rbx, [rdi + 0xf8]
nop
cmp dword [0x180e7bf48], 2
jl 0x18022e429
movdqa xmm0, xmmword [0x1803693f0]
movdqa xmm1, xmmword [0x1803693e0]
movdqa xmmword [0x180e7bf50], xmm0
movdqa xmm0, xmmword [0x1803693c0]
movdqa xmmword [0x180e7bf60], xmm1
movdqa xmm1, xmmword [0x1803693d0]
movdqa xmmword [0x180e7bf70], xmm0
movdqa xmmword [0x180e7bf80], xmm1
lea rcx, [rbx - 0xf8]
xor edx, edx
mov r8d, 0xf0
call fcn.180281510
mov rax, qword [rbx]
mov qword [rbx + 0x18], rbp
mov byte [rbx + 0x20], bpl
mov dword [rax], 0x6a09e667
mov rax, qword [rbx]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbx]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbx]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbx]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbx]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbx]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbx]
mov dword [rax + 0x1c], 0x5be0cd19
mov rax, qword [rbx]
xor dword [rax], 0x2080020
mov rax, qword [rbx]
xor dword [rax + 8], esi
inc esi
mov rax, qword [rbx]
add rbx, 0x120
xor dword [rax + 0xc], 0x20000000
cmp esi, 8
jb 0x18022e3e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov byte [rdi + 0xa18], 1
mov byte [rdi + 0x8f8], 1
add rsp, 0x20
pop rdi
ret
Function at 0x18022ed40
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18022ed6b
lea r10, [0x180e7bf90]
nop dword [rax]
movzx r9d, byte [rdx]
lea rdx, [rdx + 1]
movzx eax, cl
xor r9, rax
shr ecx, 8
xor ecx, dword [r10 + r9*4]
sub r8, 1
jne 0x18022ed50
mov eax, ecx
ret

Function at 0x18022ef20
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
cmp dword [rcx + 0x208], 0
mov rbp, r8
mov r14, rdx
mov rbx, rcx
jne 0x18022eff7
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], r15
xor r15d, r15d
mov edi, r15d
cmp dword [rcx], r15d
jbe 0x18022efed
mov qword [rsp + 0x58], rsi
nop dword [rax]
lea rax, [rsp + 0x50]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x18022f0d0]
mov edx, 0x10000
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x18022efbc
lea rdx, [0x180369420]
lea rcx, [0x180e7bf30]
call fcn.18021f700
lea rcx, [0x180e7bf30]
call fcn.180154550
lea edx, [rsi + 2]
lea rcx, [0x180e7bf30]
call fcn.18021f6b0
mov ecx, edi
mov qword [rbx + rcx*8 + 8], rsi
inc dword [rbx + 0x208]
mov edx, dword [0x180e7df94]
test edx, edx
je 0x18022efde
mov rcx, qword [rbx + rcx*8 + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc edi
cmp edi, dword [rbx]
jb 0x18022ef60
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
cmp dword [rbx + 0x20c], 0x40
jb 0x18022f008
mov rcx, rbx
call fcn.18022f1d0
mov eax, dword [rbx + 0x610]
add rax, 0x21
add rax, rax
mov qword [rbx + rax*8], r14
mov eax, dword [rbx + 0x610]
add rax, rax
mov qword [rbx + rax*8 + 0x218], rbp
mov eax, dword [rbx + 0x610]
inc eax
and eax, 0x3f
inc dword [rbx + 0x20c]
mov dword [rbx + 0x610], eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x1802302d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x20]
mov rdi, rdx
mov rbx, rcx
lea rsi, [r8*8]
and r8d, 0x3f
mov byte [r8 + rcx + 0x28], 0x80
inc r8d
cmp r8d, 0x38
je 0x18023034f
jbe 0x180230333
cmp r8d, 0x40
jae 0x180230328
mov eax, r8d
add rcx, 0x28
add rcx, rax
xor edx, edx
mov eax, 0x40
sub eax, r8d
mov r8d, eax
call fcn.180281510
mov rcx, rbx
call fcn.1802304e0
xor r8d, r8d
mov ecx, r8d
mov eax, 0x38
sub eax, r8d
add rcx, 0x28
mov r8d, eax
add rcx, rbx
xor edx, edx
call fcn.180281510
mov rax, rsi
mov rcx, rbx
shr rax, 0x20
bswap eax
bswap esi
mov dword [rbx + 0x60], eax
mov dword [rbx + 0x64], esi
call fcn.1802304e0
mov eax, dword [rbx]
mov rsi, qword [rsp + 0x38]
bswap eax
mov dword [rdi], eax
mov eax, dword [rbx + 4]
bswap eax
mov dword [rdi + 4], eax
mov eax, dword [rbx + 8]
bswap eax
mov dword [rdi + 8], eax
mov eax, dword [rbx + 0xc]
bswap eax
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 0x10]
bswap eax
mov dword [rdi + 0x10], eax
mov eax, dword [rbx + 0x14]
bswap eax
mov dword [rdi + 0x14], eax
mov eax, dword [rbx + 0x18]
bswap eax
mov dword [rdi + 0x18], eax
mov eax, dword [rbx + 0x1c]
bswap eax
mov dword [rdi + 0x1c], eax
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x20], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180230400
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x20], 0
ret
Function at 0x180231f00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
xor r10b, r10b
mov eax, 1
mov rdi, r9
mov r11, rdx
lea ecx, [rbx - 1]
cmp r8d, eax
jbe 0x180231fbd
cmp ecx, 0x20
jb 0x180231fa0
and ecx, 0x1f
mov r8d, ebx
sub r8d, ecx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [rax + rax]
mov ecx, eax
movdqu xmm0, xmmword [rcx + rdx]
lea ecx, [rax + 0x10]
add eax, 0x20
pxor xmm2, xmm0
movdqu xmm0, xmmword [rcx + rdx]
pxor xmm1, xmm0
cmp eax, r8d
jb 0x180231f40
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd r10d, xmm1
cmp eax, ebx
jae 0x180231fbd
mov edx, eax
mov ecx, ebx
add rdx, r11
sub ecx, eax
mov eax, ecx
nop dword [rax + rax]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
sub rax, 1
jne 0x180231fb0
cmp r10b, byte [r11]
jne 0x18023200a
mov r8, rbx
mov rdx, r11
mov ecx, 0xffffffff
call fcn.18022ed40
lea r8, [0x180e67340]
not eax
mov rcx, r8
xor edx, edx
cmp dword [rcx + 4], eax
jne 0x180231fe9
cmp dword [rcx], ebx
je 0x180231fff
inc edx
add rcx, 0xc
cmp edx, 6
jb 0x180231fe0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rdx + rdx*2]
mov eax, dword [r8 + rcx*4 + 8]
mov dword [rdi], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180232160
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1038
call fcn.18024b3f0
sub rsp, rax
mov rax, qword [0x180e681c0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r8d, 0x800
lea rdx, [rsp + 0x20]
call fcn.180230b00
xor eax, eax
lea rcx, [rsp + 0x20]
cmp word [rsp + 0x20], ax
cmove rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1802321c9
cmp eax, 5
je 0x1802321c9
xor al, al
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.18024b290
add rsp, 0x1038
ret
mov al, 1
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.18024b290
add rsp, 0x1038
ret
Function at 0x180232910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
lea rdi, [0x180369840]
mov r11, rdx
mov r10, rcx
not r8d
cmp rdx, 8
jbe 0x180232a14
mov qword [rsp + 0x10], rbx
test cl, 7
je 0x18023295f
nop word [rax + rax]
movzx eax, byte [r10]
dec r11
movzx ecx, r8b
inc r10
xor rcx, rax
shr r8d, 8
xor r8d, dword [rdi + rcx*4]
test r10b, 7
jne 0x180232940
mov rbx, r11
and r11d, 7
and rbx, 0xfffffffffffffff8
add rbx, r10
cmp r10, rbx
jae 0x180232a0f
nop word [rax + rax]
xor r8d, dword [r10]
mov r9d, dword [r10 + 4]
add r10, 8
mov edx, r8d
mov eax, r8d
shr rax, 0x10
movzx r8d, al
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, r9d
shr rax, 0x10
mov r8d, dword [rdi + r8*4 + 0x1400]
xor r8d, dword [rdi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r9d
shr rax, 8
xor r8d, dword [rdi + rcx*4 + 0x400]
movzx ecx, al
mov eax, edx
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x800]
xor r8d, dword [rdi + rax*4 + 0x1000]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rax*4]
movzx eax, dl
xor r8d, dword [rdi + rax*4 + 0x1c00]
movzx eax, r9b
xor r8d, dword [rdi + rax*4 + 0xc00]
cmp r10, rbx
jb 0x180232980
mov rbx, qword [rsp + 0x10]
test r11, r11
je 0x180232a3d
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [rdi + rcx*4]
sub r11, 1
jne 0x180232a20
not r8d
mov eax, r8d
pop rdi
ret

Function at 0x18023b520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x18036bb60]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x18023b5ef
mov qword [rsp + 0x10], rdi
test cl, 3
je 0x18023b56f
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
shr r8, 8
xor r8, qword [rsi + rcx*8]
test r11b, 3
jne 0x18023b550
mov rdi, rbx
and ebx, 3
and rdi, 0xfffffffffffffffc
add rdi, r11
cmp r11, rdi
jae 0x18023b5ea
nop dword [rax]
nop word [rax + rax]
mov r10d, dword [r11]
add r11, 4
mov eax, r8d
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [rsi + rdx*8 + 0x800]
xor r9, qword [rsi + rcx*8 + 0x1000]
xor r9, qword [rsi + rax*8]
movzx eax, r10b
xor r9, qword [rsi + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp r11, rdi
jb 0x18023b590
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x18023b61d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8, 8
xor r8, qword [rsi + rcx*8]
sub rbx, 1
jne 0x18023b600
mov rbx, qword [rsp + 0x18]
not r8
mov rax, r8
pop rsi
ret
Function at 0x180265b00
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1802659ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1802659ab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1802659ab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1802659ab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1802659ab
cmp dword [rcx + 0x84], 0xe
jbe 0x1802659ab
cmp dword [rcx + 0xf8], 0
je 0x1802659ab
mov ecx, ebx
call fcn.180265a5c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180265838
nop
cmp dword [rbp + 0x20], 0
je 0x1802659f9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180265a04
int3
xor r8d, r8d
xor edx, edx
jmp 0x18026593c
Function at 0x18026d7dc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x180e83470]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18026d833
cmp word [rdx], r13w
jne 0x18026d833
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18026d838
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18026d95d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18026d97e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18026d871
mov rdx, r9
mov word [rbx], cx
jmp 0x18026d898
cmp r9, r8
jae 0x18026d8a8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18026d852
jmp 0x18026d95d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18026d952
cmp dword [rsp + 0x80], esi
je 0x18026d952
lea r8, [0x180e83470]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18026d92a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18026d8fa
mov word [rbx], r13w
jmp 0x18026d95a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18026d907
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18026d95a
cmp word [rsp + 0x70], r13w
jne 0x18026d937
cmp rbx, r14
je 0x18026d8f4
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18026a3bc
cmp word [rsp + 0x70], r13w
je 0x18026d95d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x180e83470]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18026d957
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18026d95d