joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001f570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov dword [rcx + 0x3c], 0x20
mov dword [rcx + 0x68], 1
mov dword [rcx + 0x60], 4
lea r8, [rcx + 0x84]
mov qword [rcx + 0x40], rdx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x64], edx
mov dword [rcx + 0x6c], edx
nop dword [rax]
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
add r8, 4
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x18001f5a0
repz ret

Function at 0x180020b70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x180020c90
add rcx, 0x48
call fcn.180028770
test eax, eax
je 0x180020bb0
mov eax, 0xc
jmp 0x180020c92
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rbx + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x180020be4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x180020ba6
lea rcx, [rbx + 0x20]
call fcn.1800286e0
test eax, eax
jne 0x180020ba6
lea rcx, [rbx + 0x28]
call fcn.1800286e0
test eax, eax
jne 0x180020ba6
lea rcx, [rbx + 0x30]
mov r8d, edi
mov edx, edi
call fcn.180028730
test eax, eax
jne 0x180020ba6
xor r9d, r9d
mov r8d, edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x180020c41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x180020ba6
lea rax, [rsp + 0x40]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rbx + 4], 1
call fcn.180059504
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x180020c8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x180020ba6
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800242e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
add edx, edx
shr ecx, 7
shr rax, 8
movzx r10d, word [rbx + rax*2]
and ecx, 1
neg ecx
shr r10, 4
sar rcx, 4
and ecx, 0x7f
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1800242f0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret
Function at 0x180024330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, edx
xor r11d, r11d
mov rdi, r9
mov rsi, rcx
mov ebx, 0x100
bts r10d, 8
nop word [rax + rax]
add r8d, r8d
mov r9d, r10d
mov ecx, r10d
shr ecx, 7
shr r9d, 8
mov eax, ebx
and ecx, 1
and eax, r8d
add r10d, r10d
neg ecx
add eax, ebx
sar rcx, 4
add r9d, eax
movzx edx, word [rsi + r9*2]
and ecx, 0x7f
shr rdx, 4
xor rdx, rcx
mov ecx, r10d
add r11d, dword [rdi + rdx*4]
xor ecx, r8d
not ecx
and ebx, ecx
cmp r10d, 0x10000
jb 0x180024360
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, r11d
ret

Function at 0x1800246c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
movzx r10d, word [rcx]
mov r12d, r8d
movzx r8d, word [rcx + 2]
mov rax, r10
mov r15, r9
shr rax, 4
xor r10, 0x7f0
mov r13d, edx
mov ebp, dword [r11 + rax*4]
mov rax, r8
shr r10, 4
mov r9d, dword [r11 + r10*4]
shr rax, 4
xor r8, 0x7f0
mov eax, dword [r11 + rax*4]
shr r8, 4
mov rbx, rcx
lea r14d, [r9 + rax]
mov eax, dword [r11 + r8*4]
mov rsi, r15
add eax, r9d
xor r9d, r9d
mov dword [rsp + 0x48], eax
nop dword [rax + rax]
cmp r9d, r12d
jae 0x1800248a6
mov r8d, r9d
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x180024792
lea edi, [r13*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 4]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x180024761
lea eax, [r10 + rbp]
inc r9d
add rsi, 4
mov dword [rsi - 4], eax
cmp r9d, 8
jb 0x180024740
movsxd rax, r9d
cmp r9d, 0x10
jae 0x18002482a
lea esi, [r9 - 8]
lea rbp, [r15 + rax*4]
cmp r9d, r12d
jae 0x1800248a6
mov r8d, esi
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x180024814
lea edi, [r13*8]
nop dword [rax + rax]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 0x104]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1800247e0
lea eax, [r10 + r14]
inc r9d
add rbp, 4
mov dword [rbp - 4], eax
inc esi
cmp r9d, 0x10
jb 0x1800247b7
movsxd rax, r9d
cmp r9d, r12d
jae 0x1800248a6
mov ebp, dword [rsp + 0x48]
sub r12d, r9d
lea r10d, [r9 - 0x10]
mov esi, r12d
lea rdi, [r15 + rax*4]
nop word [rax + rax]
mov r8d, r10d
xor r9d, r9d
bts r8d, 8
cmp r8d, 1
je 0x180024892
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
movzx edx, word [rbx + rax*2 + 0x204]
neg ecx
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x180024861
lea eax, [r9 + rbp]
add rdi, 4
inc r10d
sub rsi, 1
mov dword [rdi - 4], eax
jne 0x180024850
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x180026cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rsi, rcx
xor r8d, r8d
lea r9, [rcx + 0x33e14]
nop dword [rax]
xor r10d, r10d
mov ebx, r8d
mov r11d, 1
lea edi, [r10 + 4]
mov eax, r11d
mov edx, ebx
add r11d, r11d
movzx ecx, word [rsi + rax*2 + 0x344bc]
and edx, 1
shr ebx, 1
mov eax, edx
shr rcx, 4
or r11d, edx
neg eax
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r10d, dword [rsi + rcx*4 + 0x32764]
sub edi, 1
jne 0x180026ce0
inc r8d
mov dword [r9], r10d
add r9, 4
cmp r8d, 0x10
jb 0x180026cd0
mov rbx, qword [rsp + 8]
mov dword [rsi + 0x33e54], edi
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180026d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov r14d, 4
mov r10, rcx
lea rbx, [rcx + 0x30768]
mov r8d, r14d
lea r9, [rsp + 0x10]
nop word [rax + rax]
movzx edx, byte [rbx]
xor r11d, r11d
mov ebp, r8d
mov esi, edx
mov eax, edx
lea edi, [r11 + 1]
and eax, 1
shr esi, 1
mov r12, rdx
dec esi
or eax, 2
mov ecx, esi
shl eax, cl
sub ebp, eax
movsxd r13, eax
test esi, esi
je 0x180026deb
nop dword [rax + rax]
mov eax, edi
mov edx, ebp
add edi, edi
sub rax, r12
and edx, 1
shr ebp, 1
add rax, r13
or edi, edx
movzx ecx, word [r10 + rax*2 + 0x343d6]
mov eax, edx
neg eax
shr rcx, 4
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r11d, dword [r10 + rcx*4 + 0x32764]
sub esi, 1
jne 0x180026db0
inc r8d
mov dword [r9], r11d
inc rbx
add r9, r14
cmp r8d, 0x80
jb 0x180026d80
lea rbp, [rsp]
lea rdi, [r10 + 0x33214]
lea rsi, [r10 + 0x341d8]
sub rbp, r10
lea r12, [r10 + 0x3361c]
sub rbp, 0x33614
xor r11d, r11d
cmp dword [r10 + 0x33e58], r11d
jbe 0x180026e94
mov rbx, rdi
nop word [rax + rax]
mov r8d, r11d
xor r9d, r9d
or r8d, 0x40
cmp r8d, 1
je 0x180026e81
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
movzx edx, word [rsi + rax*2]
neg ecx
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [r10 + rdx*4 + 0x32764]
cmp r8d, 1
jne 0x180026e50
mov dword [rbx], r9d
inc r11d
add rbx, 4
cmp r11d, dword [r10 + 0x33e58]
jb 0x180026e40
mov edx, 0xe
cmp dword [r10 + 0x33e58], edx
jbe 0x180026ecc
lea rcx, [rdi + 0x38]
nop word [rax + rax]
mov eax, edx
inc edx
add rcx, 4
shr eax, 1
sub eax, 5
shl eax, 4
add dword [rcx - 4], eax
cmp edx, dword [r10 + 0x33e58]
jb 0x180026eb0
mov eax, dword [rdi]
lea r8, [r10 + 0x30768]
lea rdx, [r12 + 8]
mov dword [r12 - 8], eax
mov eax, dword [rdi + 4]
mov r9d, 0x7c
mov dword [r12 - 4], eax
mov eax, dword [rdi + 8]
mov dword [r12], eax
mov eax, dword [rdi + 0xc]
mov dword [r12 + 4], eax
nop dword [rax]
movzx eax, byte [r8]
add rdx, 4
inc r8
mov ecx, dword [rdi + rax*4]
add ecx, dword [rdx + rbp - 4]
sub r9, 1
mov dword [rdx - 4], ecx
jne 0x180026f00
sub rsi, 0xffffffffffffff80
add rdi, 0x100
sub rbp, 0x200
add r12, 0x200
sub r14, 1
jne 0x180026e23
lea r11, [rsp + 0x200]
mov dword [r10 + 0x3d5d0], r14d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180028790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
push rdi
push r13
push r14
push r15
sub rsp, 8
mov r10d, dword [r9]
xor r14d, r14d
mov edi, r8d
and r10d, 7
mov r13, rcx
mov r11, r14
cmp rdx, 5
jae 0x1800287c7
xor eax, eax
add rsp, 8
pop r15
pop r14
pop r13
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp], r12
mov r12d, dword [rsp + 0x50]
add edi, 5
or rsi, 0xffffffffffffffff
lea rbx, [rcx + rdx - 4]
lea r15, [0x180000000]
lea r8, [r11 + r13]
cmp r8, rbx
jae 0x180028812
nop dword [rax + rax]
movzx eax, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x180028812
inc r8
cmp r8, rbx
jb 0x180028800
mov r11, r8
sub r11, r13
cmp r8, rbx
jae 0x18002893f
mov rax, r11
sub rax, rsi
cmp rax, 3
jbe 0x180028850
mov r10d, r14d
movzx eax, byte [r8 + 4]
mov rsi, r11
test al, al
je 0x180028897
cmp al, 0xff
je 0x180028897
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1800287f2
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x180028830
movzx eax, byte [r10 + r15 + 0x7c628]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + 4]
cmp byte [r10 + r15 + 0x7c620], r14b
je 0x180028881
test al, al
je 0x180028881
cmp al, 0xff
jne 0x180028830
and r10d, 3
mov rsi, r11
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1800287f2
movzx r9d, al
movzx eax, byte [r8 + 3]
movsxd rbp, r10d
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 2]
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 1]
shl r9d, 8
or r9d, eax
test r12d, r12d
je 0x1800288cf
lea edx, [r11 + r9]
add edx, edi
jmp 0x1800288d7
mov edx, r9d
sub edx, r11d
sub edx, edi
test r10d, r10d
je 0x180028911
movzx r9d, byte [r15 + rbp + 0x7c628]
mov eax, edx
shl r9d, 3
neg r9d
lea ecx, [r9 + 0x18]
shr eax, cl
test al, al
je 0x1800288fc
cmp al, 0xff
jne 0x180028911
lea ecx, [r9 + 0x20]
mov r9d, 1
shl r9d, cl
dec r9d
xor r9d, edx
jmp 0x1800288c2
mov eax, edx
mov byte [r8 + 1], dl
shr eax, 0x18
and al, 1
dec al
not al
mov byte [r8 + 4], al
mov eax, edx
shr eax, 0x10
mov byte [r8 + 3], al
mov eax, edx
shr eax, 8
add r11, 5
mov byte [r8 + 2], al
jmp 0x1800287f2
mov r12, qword [rsp]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rax, r11
sub rax, rsi
mov rsi, qword [rsp + 0x40]
cmp rax, 3
ja 0x18002896b
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
mov r14d, r10d
mov r15, qword [rsp + 0x48]
mov rax, r11
mov dword [r15], r14d
add rsp, 8
pop r15
pop r14
pop r13
pop rdi
ret
Function at 0x180033410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rcx
mov ecx, dword [rcx]
cmp ecx, 8
jle 0x180033469
and ecx, 1
je 0x18003342f
mov eax, dword [r9 + 0x10]
add eax, eax
sub eax, dword [r9 + 0x14]
jmp 0x18003343c
mov eax, dword [r9 + 0x10]
lea eax, [rax + rax*2]
sub eax, dword [r9 + 0x14]
sar eax, 1
mov edx, dword [r9 + 0x10]
mov dword [r9 + 0x10], eax
mov dword [r9 + 0x14], edx
test ecx, ecx
je 0x180033459
add eax, eax
sub eax, edx
mov dword [r9 + 0x14], eax
add rsp, 8
ret
lea eax, [rax + rax*2]
sub eax, edx
sar eax, 1
mov dword [r9 + 0x14], eax
add rsp, 8
ret
cmp ecx, 1
jle 0x1800334cb
mov eax, ecx
xor r10d, r10d
mov qword [rsp], rbx
cdq
lea r11d, [rcx - 1]
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x1800334c7
nop word [rax + rax]
and r11d, 7
and r10d, 7
movsxd r8, r11d
movsxd rdx, r10d
dec r11d
mov ecx, dword [r9 + r8*4 + 0x10]
inc r10d
xor dword [r9 + rdx*4 + 0x10], ecx
mov ecx, dword [r9 + rdx*4 + 0x10]
xor dword [r9 + r8*4 + 0x10], ecx
mov eax, dword [r9 + r8*4 + 0x10]
xor dword [r9 + rdx*4 + 0x10], eax
sub ebx, 1
jne 0x180033490
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x180036080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rcx
mov ecx, dword [rcx]
cmp ecx, 8
jle 0x180036117
and ecx, 1
je 0x1800360ad
mov edx, dword [r9 + 0x10]
mov eax, dword [r9 + 0x30]
add edx, edx
add eax, eax
sub edx, dword [r9 + 0x14]
sub eax, dword [r9 + 0x34]
jmp 0x1800360c7
mov eax, dword [r9 + 0x10]
lea edx, [rax + rax*2]
mov eax, dword [r9 + 0x30]
sub edx, dword [r9 + 0x14]
lea eax, [rax + rax*2]
sub eax, dword [r9 + 0x34]
sar edx, 1
sar eax, 1
mov r8d, dword [r9 + 0x10]
mov r10d, dword [r9 + 0x30]
mov dword [r9 + 0x10], edx
mov dword [r9 + 0x14], r8d
mov dword [r9 + 0x34], r10d
mov dword [r9 + 0x30], eax
test ecx, ecx
je 0x1800360fa
add edx, edx
add eax, eax
sub edx, r8d
sub eax, r10d
mov dword [r9 + 0x34], eax
mov dword [r9 + 0x14], edx
add rsp, 8
ret
lea edx, [rdx + rdx*2]
lea eax, [rax + rax*2]
sub edx, r8d
sub eax, r10d
sar edx, 1
sar eax, 1
mov dword [r9 + 0x34], eax
mov dword [r9 + 0x14], edx
add rsp, 8
ret
cmp ecx, 1
jle 0x18003618b
mov eax, ecx
xor r10d, r10d
mov qword [rsp], rbx
cdq
lea r11d, [rcx - 1]
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x180036187
and r11d, 7
and r10d, 7
movsxd r8, r11d
movsxd rdx, r10d
dec r11d
mov ecx, dword [r9 + r8*4 + 0x10]
inc r10d
xor dword [r9 + rdx*4 + 0x10], ecx
mov ecx, dword [r9 + rdx*4 + 0x10]
xor dword [r9 + r8*4 + 0x10], ecx
mov eax, dword [r9 + r8*4 + 0x10]
xor dword [r9 + rdx*4 + 0x10], eax
mov eax, dword [r9 + r8*4 + 0x30]
xor dword [r9 + rdx*4 + 0x30], eax
mov eax, dword [r9 + rdx*4 + 0x30]
xor dword [r9 + r8*4 + 0x30], eax
mov eax, dword [r9 + r8*4 + 0x30]
xor dword [r9 + rdx*4 + 0x30], eax
sub ebx, 1
jne 0x180036132
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x18003b430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 8
mov qword [rsp + 0x20], rbp
xor ebp, ebp
mov qword [rsp + 0x30], r12
mov ebx, ebp
or r11d, 0xffffffff
mov qword [rsp + 0x38], r13
mov qword [rsp], r14
mov r10, rcx
mov esi, ebp
mov byte [rcx + 0x16f], bl
mov byte [rcx + 0x16e], bl
mov byte [rcx + 0x16d], bl
mov byte [rcx + 0x16c], bl
mov r14d, r11d
mov r9d, ebp
mov r12, rdx
mov r13d, r8d
test r8d, r8d
je 0x18003b4db
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov edi, dword [r12]
lea eax, [r14 + r14*2]
dec r13d
movzx ecx, di
add ecx, eax
mov eax, edi
sar eax, 0x10
lea r14d, [rcx + rcx*2]
movzx eax, ax
add r14d, eax
test edi, edi
jns 0x18003b4b9
mov eax, edi
not eax
jmp 0x18003b4bb
mov eax, edi
or ebp, eax
mov eax, edi
and r11d, edi
and eax, 1
or esi, edi
add r12, 4
neg eax
xor eax, edi
or ebx, eax
test r13d, r13d
jne 0x18003b490
mov rdi, qword [rsp + 0x28]
and dword [r10 + 0x18], 0xff83ffff
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov eax, dword [r10 + 0x18]
mov dword [r10 + 0xc8], r14d
mov r14, qword [rsp]
test ebp, ebp
je 0x18003b50d
add eax, 0x40000
shr ebp, 1
jne 0x18003b500
mov dword [r10 + 0x18], eax
mov eax, dword [r10 + 0x18]
mov rbp, qword [rsp + 0x20]
test eax, 0x7c0000
jne 0x18003b52e
btr eax, 8
mov dword [r10 + 0x18], eax
xor eax, eax
add rsp, 8
pop rsi
pop rbx
ret
test sil, 1
jne 0x18003b55f
xor ecx, ecx
nop word [rax + rax]
shr esi, 1
add eax, 0xfffc0000
inc cl
inc r9d
test sil, 1
je 0x18003b540
mov byte [r10 + 0x16d], cl
mov dword [r10 + 0x18], eax
jmp 0x18003b5bc
test r11b, 1
je 0x18003b590
xor ecx, ecx
nop word [rax + rax]
shr r11d, 1
add eax, 0xfffc0000
inc cl
inc r9d
test r11b, 1
jne 0x18003b570
mov byte [r10 + 0x16e], cl
mov dword [r10 + 0x18], eax
jmp 0x18003b5bc
test bl, 2
jne 0x18003b5bc
xor ecx, ecx
nop word [rax + rax]
shr ebx, 1
add eax, 0xfffc0000
inc cl
inc r9d
test bl, 2
je 0x18003b5a0
mov byte [r10 + 0x16f], cl
mov dword [r10 + 0x18], eax
mov r11d, dword [r10 + 0x18]
mov ecx, r11d
shr ecx, 0x12
mov eax, ecx
and eax, 0x1f
cmp al, 0x17
jbe 0x18003b5f4
and cl, 0x1f
and r11d, 0xff83ffff
sub cl, 0x17
movzx eax, cl
add r9d, eax
add r11d, 0x5c0000
mov byte [r10 + 0x16c], al
mov dword [r10 + 0x18], r11d
test r9d, r9d
je 0x18003b620
or dword [r10 + 0x18], 0x100
test r8d, r8d
je 0x18003b620
nop word [rax + rax]
mov ecx, r9d
add rdx, 4
sar dword [rdx - 4], cl
sub r8d, 1
jne 0x18003b610
movzx eax, byte [r10 + 0x16c]
add rsp, 8
pop rsi
pop rbx
ret
Function at 0x180049990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor edi, edi
mov ebx, r8d
mov r10d, edx
mov r11, rcx
test edx, edx
je 0x180049a81
lea rsi, [0x180000000]
nop dword [rax]
mov eax, dword [r11]
dec r10d
add r11, 4
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
mov eax, r8d
shr eax, 9
add r8d, eax
cmp r8d, 0x100
jae 0x180049a0e
movsx edx, byte [r8 + rsi + 0x737a0]
mov ecx, 9
sub ecx, edx
shl edx, 8
shl r8d, cl
add edi, edx
movzx eax, r8b
movzx ecx, byte [rax + rsi + 0x738a0]
add edi, ecx
jmp 0x180049a78
mov eax, r8d
cmp r8d, 0x10000
jae 0x180049a2b
shr rax, 8
movsx edx, byte [rax + rsi + 0x737a0]
add edx, 8
jmp 0x180049a54
cmp r8d, 0x1000000
jae 0x180049a45
shr rax, 0x10
movsx edx, byte [rax + rsi + 0x737a0]
add edx, 0x10
jmp 0x180049a54
shr rax, 0x18
movsx edx, byte [rax + rsi + 0x737a0]
add edx, 0x18
lea ecx, [rdx - 9]
shl edx, 8
mov r9d, r8d
shr r9, cl
movzx eax, r9b
movzx ecx, byte [rax + rsi + 0x738a0]
add ecx, edx
add edi, ecx
test ebx, ebx
je 0x180049a78
cmp ecx, ebx
jge 0x180049a93
test r10d, r10d
jne 0x1800499c0
mov eax, edi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
or eax, 0xffffffff
ret
Function at 0x18004df90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
cmp dword [rcx + 0x24], 2
jne 0x18004dff9
cmp dword [rcx + 0x20], 1
jne 0x18004dff9
mov rdi, qword [rcx]
cmp byte [rdi], 0
jne 0x18004dff9
mov eax, dword [rdi + 0x1c]
mov dword [rcx + 0x28], eax
mov byte [rdi + 0x20], 0
movsxd rdx, dword [rdi + 0x1c]
mov rcx, qword [rdi + 8]
call fcn.180059a20
mov qword [rdi + 8], rax
mov qword [rbx + 0x18], rax
call fcn.18005a310
movsxd r8, dword [rbx + 0x28]
lea r9, [rax + 0x30]
mov edx, 1
mov rcx, qword [rbx + 0x18]
call fcn.18005aa44
cmp dword [rbx + 0x24], 0
jne 0x18004e025
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18004e06a
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x18004e06a
mov r8d, dword [rbx + 0x58]
test r8d, r8d
je 0x18004e06a
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
jmp 0x18004e06a
cmp dword [rbx + 0x20], 0
jne 0x18004e04a
cmp byte [rbx + 0x10], 0
je 0x18004e03a
mov rcx, qword [rbx + 0x18]
call fcn.1800597d8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18004e06a
call fcn.18005821c
jmp 0x18004e06a
mov rdi, qword [rbx]
test rdi, rdi
je 0x18004e06a
cmp byte [rdi + 0x20], 0
je 0x18004e061
mov rcx, qword [rdi + 8]
call fcn.1800597d8
mov rcx, rdi
call fcn.18005821c
nop
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x18004e080
call fcn.180058a10
mov qword [rbx + 0x50], 0
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18004e090
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18004e09f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18004e2a0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov rdi, rcx
cmp dword [rcx + 0x20], 0
jne 0x18004e3d5
mov ecx, 0x28
call fcn.180058910
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18004e311
mov dword [rax + 0x14], 0x10000
mov dword [rax + 0x1c], 0
mov byte [rax], 0
mov byte [rax + 0x20], 1
mov dword [rax + 0x10], 0x10000
mov ecx, 0x10000
call fcn.180059818
mov qword [rbx + 8], rax
test rax, rax
jne 0x18004e313
mov byte [rbx], 1
jmp 0x18004e313
xor ebx, ebx
mov edx, 1
mov ecx, 0x100000
call fcn.18005b054
mov rbp, rax
test rax, rax
je 0x18004e37d
call fcn.18005a310
mov r9, rax
mov edx, 1
mov r8d, 0x100000
mov rcx, rbp
call fcn.18005a850
test eax, eax
jle 0x18004e37d
nop dword [rax]
mov r8d, eax
mov rdx, rbp
mov rcx, rbx
call fcn.18004de00
call fcn.18005a310
mov r9, rax
mov edx, 1
mov r8d, 0x100000
mov rcx, rbp
call fcn.18005a850
test eax, eax
jg 0x18004e350
cmp byte [rbx], 0
je 0x18004e393
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x28], 0
jmp 0x18004e3b2
mov byte [rbx + 0x20], 0
movsxd rdx, dword [rbx + 0x1c]
mov rcx, qword [rbx + 8]
call fcn.180059a20
mov qword [rbx + 8], rax
mov qword [rdi + 0x18], rax
mov eax, dword [rbx + 0x1c]
mov dword [rdi + 0x28], eax
cmp byte [rbx + 0x20], 0
je 0x18004e3c1
mov rcx, qword [rbx + 8]
call fcn.1800597d8
mov rcx, rbx
call fcn.18005821c
mov rcx, rbp
call fcn.1800597d8
mov byte [rdi + 0x10], 1
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.18004e1e0
Function at 0x18005bd0b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18008b590]
jne 0x18005825a
rol rcx, 0x10
test cx, 0xffff
jne 0x180058256
repz ret
ror rcx, 0x10
jmp 0x18005bc64
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18008e030]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18008e128]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005bce9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18008e030]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18005bd0b
mov rax, qword [rsp + 0x88]
mov qword [0x18008e128], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18008e0c8], rax
mov rax, qword [0x18008e128]
mov qword [0x18008dfa0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18008e0b0], rax
mov dword [0x18008df90], 0xc0000409
mov dword [0x18008df94], 1
mov rax, qword [0x18008b590]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18008b598]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18008e028], eax
mov ecx, 1
call fcn.18005ce48
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800706c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18008e028], 0
jne 0x18005bd92
mov ecx, 1
call fcn.18005ce48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret