joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov sil, byte [rdx + 0x100]
mov bpl, byte [rdx + 0x101]
xor r11d, r11d
mov rdi, r9
mov rbx, r8
mov r10, rdx
test r9, r9
je 0x180049df5
nop word [rax + rax]
movzx eax, sil
movzx ecx, bpl
inc eax
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r8d, al
mov esi, eax
add r8, r10
movzx eax, byte [r8]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r9d, al
mov ebp, eax
add r9, r10
cmp r8, r9
je 0x180049dbb
movzx ecx, byte [r9]
movzx edx, byte [r8]
mov byte [r8], cl
mov byte [r9], dl
movzx ecx, byte [r8]
movzx eax, byte [r9]
inc r11
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx ecx, al
movzx eax, byte [rcx + r10]
xor byte [r11 + rbx - 1], al
cmp r11, rdi
jne 0x180049d70
mov byte [r10 + 0x100], sil
mov byte [r10 + 0x101], bpl
jmp 0x180049e03
mov byte [rdx + 0x100], sil
mov byte [rdx + 0x101], bpl
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x18004a140
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x18004a16e
nop dword [rax]
cmp byte [rcx + r9 - 1], 0x3d
jne 0x18004a16e
sub r9, 1
jne 0x18004a160
mov rbx, r9
xor r11d, r11d
and r9d, 3
shr rbx, 2
mov r8, r11
lea rsi, [0x18012db40]
test rbx, rbx
je 0x18004a206
nop dword [rax + rax]
movsx rax, byte [r10 + r8]
add r11, 3
add r8, 4
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 3]
movzx ecx, byte [rax + rsi]
shl dl, 2
sar cl, 4
and cl, 3
or dl, cl
mov byte [rdi + r11 - 3], dl
movsx rax, byte [r10 + r8 - 2]
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 3]
movzx ecx, byte [rax + rsi]
sar dl, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [rdi + r11 - 2], dl
movsx rax, byte [r10 + r8 - 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r10 + r8 - 2]
movzx ecx, byte [rax + rsi]
and dl, 0x3f
shl cl, 6
or dl, cl
sub rbx, 1
mov byte [rdi + r11 - 1], dl
jne 0x18004a190
sub r9, 2
je 0x18004a25a
cmp r9, 1
jne 0x18004a27c
movsx rax, byte [r8 + r10 + 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10]
movzx ecx, byte [rax + rsi]
sar dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [r11 + rdi], dl
movsx rax, byte [r8 + r10 + 2]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10 + 1]
movzx ecx, byte [rax + rsi]
sar dl, 2
shl cl, 4
and dl, 0xf
or dl, cl
mov byte [r11 + rdi + 1], dl
jmp 0x18004a27c
movsx rax, byte [r8 + r10 + 1]
movzx edx, byte [rax + rsi]
movsx rax, byte [r8 + r10]
movzx ecx, byte [rax + rsi]
sar dl, 4
shl cl, 2
and dl, 3
or dl, cl
mov byte [r11 + rdi], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18004a2a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x18004a2d2
lea rax, [rcx + rdx*2 - 2]
cmp word [rax], 0x3d
jne 0x18004a2d2
sub rax, 2
sub r9, 1
jne 0x18004a2c2
mov r8, r9
xor ebx, ebx
and r9d, 3
shr r8, 2
mov r11, rbx
lea rbp, [0x18012dc40]
test r8, r8
je 0x18004a382
mov qword [rsp + 0x30], rsi
lea r11, [r8*4]
lea rsi, [rcx + 2]
nop word [rax + rax]
movzx eax, word [rsi]
add rbx, 3
add rsi, 8
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 0xa]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [rdi + rbx - 3], dl
movzx eax, word [rsi - 6]
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 8]
movzx ecx, byte [rbp + rax*2]
shr dl, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [rdi + rbx - 2], dl
movzx eax, word [rsi - 4]
movzx edx, byte [rbp + rax*2]
movzx eax, word [rsi - 6]
movzx ecx, byte [rbp + rax*2]
and dl, 0x3f
shl cl, 6
or dl, cl
sub r8, 1
mov byte [rdi + rbx - 1], dl
jne 0x18004a310
mov rsi, qword [rsp + 0x30]
sub r9, 2
je 0x18004a3d8
cmp r9, 1
jne 0x18004a3fb
movzx eax, word [r10 + r11*2 + 2]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [rbx + rdi], dl
movzx eax, word [r10 + r11*2 + 4]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2 + 2]
movzx ecx, byte [rbp + rax*2]
shr dl, 2
shl cl, 4
and dl, 0xf
or dl, cl
mov byte [rbx + rdi + 1], dl
jmp 0x18004a3fb
movzx eax, word [r10 + r11*2 + 2]
movzx edx, byte [rbp + rax*2]
movzx eax, word [r10 + r11*2]
movzx ecx, byte [rbp + rax*2]
shr dl, 4
shl cl, 2
and dl, 3
or dl, cl
mov byte [rbx + rdi], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18004f740
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x58]
mov rbx, r9
mov qword [rsp + 0x38], rcx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, r10
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18004f794
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x60
pop rbx
ret

Function at 0x18004f7e0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x180175020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov r10, r8
mov rax, rdx
mov rdi, qword [rsp + 0xb0]
lea rcx, [r11 - 0x30]
mov qword [r11 - 0x48], rcx
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x50], rcx
xor ecx, ecx
mov qword [r11 - 0x58], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, r10
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18004f85d
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x18004f8b0
mov rax, qword [rdi + 0x18]
cmp qword [rdi + 0x20], 8
jb 0x18004f86e
mov rcx, qword [rdi + 8]
jmp 0x18004f872
lea rcx, [rdi + 8]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800e9aa0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x18004f8d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rbp, r9
mov rdi, r8
mov rsi, rdx
mov dword [rsp + 0x30], 0x9c40
lea rax, [r11 - 0x48]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
add rcx, 2
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18004f979
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
xor al, al
jmp 0x18004f9d4
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
test rbx, rbx
je 0x18004f999
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
nop
lea rax, [rsp + 0x48]
cmp rbp, rax
je 0x18004f9be
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18004f9f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov r10, rdx
mov rax, r8
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rcx
mov rcx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18004fa41
xor al, al
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x18004fb50
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ecx, 0x13880
mov rdi, r9
mov rsi, r8
mov rbp, rdx
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
cmp qword [rdi], 0
mov rbx, rax
jne 0x18004fb9f
mov rcx, qword [rbp]
mov r9d, 8
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18004fbcf
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rdi]
mov r9d, 0x9c3f
mov edx, dword [rsi]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x18004fbe0
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], 0
test rbx, rbx
je 0x18004fbdc
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
xor al, al
jmp 0x18004fc03
test eax, eax
jne 0x18004fbcf
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
inc dword [rsi]
test rbx, rbx
je 0x18004fc01
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18004fe70
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov r9d, 0xf003f
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18004febb
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret

Function at 0x18004fee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x38]
mov rdi, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov r9d, 1
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x18004ffad
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x30], 0x9c40
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
movsxd r11, dword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
add r11, 2
mov eax, 2
mul r11
cmovo rax, rcx
mov rcx, rax
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r11, rbx
sub rdi, rbx
movzx eax, word [r11]
add r11, 2
mov word [rdi + r11 - 2], ax
test ax, ax
jne 0x18004ff80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180067a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x180067a44
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180179480]
test rax, rax
je 0x180067a52
call rax
shl ebx, 4
mov ecx, ebx
call fcn.180063e30
mov rcx, qword [0x180179488]
mov rbx, rax
test rcx, rcx
je 0x180067a6d
call rcx
test rbx, rbx
je 0x180067a37
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.1800641a0
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x180175690]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call sub.MSVCR90.dll_memset
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x180067b83
mov qword [rsp + 0x30], rbp
lea rbp, [0x180129d60]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x180067afe
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x180067ae0
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x180067b56
mov eax, dword [r9]
test eax, eax
je 0x180067b1e
mov rcx, qword [r9 + 8]
jmp 0x180067b21
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x180067b56
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x180067b4c
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x180067b72
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x180067b72
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x180067b6a
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x180067ad0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180067d00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x180129d60]
test r10d, r10d
je 0x180067d69
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x180067d5f
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x180067d40
xor edx, edx
div r10d
mov r13d, edx
jmp 0x180067d6c
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.180067ba0
mov r11, rax
test rax, rax
je 0x180067e0f
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x180067dff
mov rax, qword [rax + 8]
test rax, rax
je 0x180067da8
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x180067daf
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x180067dbf
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x180067de1
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x180067ddf
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.1800641a0
add dword [rbx + 4], 0xffffffff
jne 0x180067e07
mov rcx, rbx
call fcn.180067940
mov rax, rdi
jmp 0x180067ed6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x180067ed6
test r12, r12
je 0x180067ed4
mov ecx, 0x28
call fcn.180063e30
mov rdi, rax
test rax, rax
jne 0x180067e32
mov rax, r12
jmp 0x180067ed6
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x180067e94
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x180067e94
add edx, edx
mov rcx, rbx
call fcn.180067a10
test eax, eax
je 0x180067e94
xor eax, eax
test esi, esi
jle 0x180067e8d
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x180067e70
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x180067eb4
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.1800679a0
jmp 0x180067ed4
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x180067ec8
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x180069dc0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rsi, rdx
mov ebx, r12d
mov edi, r12d
call fcn.180067f00
mov rcx, rsi
test eax, eax
je 0x180069dfc
call fcn.180067f70
mov rbp, rax
jmp 0x180069e21
call fcn.180067f70
mov rsi, rax
test rax, rax
je 0x180069ec8
mov rcx, rax
call fcn.180068150
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.MSVCR90.dll_free]
test rbp, rbp
je 0x180069ec8
call fcn.180067f00
test eax, eax
je 0x180069e70
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x180069e59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x180069eaa
inc ebx
cmp ebx, 5
jge 0x180069eaa
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180069e33
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x180069e96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x180069eaa
inc ebx
cmp ebx, 5
jge 0x180069eaa
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180069e70
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_free]
cmp esi, 0xffffffff
jne 0x180069ebd
cmp edi, 2
je 0x180069ec3
mov r12d, 0xa0a
mov eax, r12d
jmp 0x180069ecd
mov eax, 7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18006a1c0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x180175020]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.18006a030
test eax, eax
jne 0x18006a382
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.180067f00
xor esi, esi
test eax, eax
je 0x18006a22e
lea rcx, [rsp + 0x40]
call fcn.180067f70
mov rbx, rax
jmp 0x18006a2d9
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call qword [sym.imp.MSVCR90.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18006a290
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18006a2c5
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_free]
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800e9aa0
add rsp, 0x168
ret
mov rcx, rdi
call fcn.180068150
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCR90.dll_free]
test rbx, rbx
je 0x18006a290
call fcn.180067f00
test eax, eax
je 0x18006a32a
mov rax, rbx
cmp word [rbx], si
je 0x18006a304
nop
cmp word [rax], 0x5c
je 0x18006a301
add rax, 2
cmp word [rax], si
jne 0x18006a2f0
jmp 0x18006a304
mov word [rax], si
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edi, eax
jmp 0x18006a368
mov rax, rbx
cmp byte [rbx], sil
je 0x18006a344
cmp byte [rax], 0x5c
je 0x18006a341
inc rax
cmp byte [rax], sil
jne 0x18006a332
jmp 0x18006a344
mov byte [rax], sil
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_free]
test edi, edi
je 0x18006a290
mov eax, dword [rsp + 0x34]
jmp 0x18006a295
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800e9aa0
add rsp, 0x168
ret
Function at 0x18009a080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18009a1de
test rdx, rdx
je 0x18009a1de
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x18009a14b
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x18009a14b
xor cl, dl
test cl, 0x10
jne 0x18009a14b
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x18009a14b
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.18009a080
test eax, eax
jne 0x18009a14b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.18009a080
test eax, eax
jne 0x18009a14b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.18009a200
test eax, eax
jne 0x18009a14b
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x18009a14b
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x18009a14b
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x18009a15b
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x18009a14b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x18009a197
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x18009a197
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18009a197
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x18009a14b
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x18009a14b
call fcn.180066d70
test eax, eax
je 0x18009a197
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x18009a1bd
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x18009a1d1
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x18009a14b
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret