joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005b740
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x18013a080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
lea r9, [rsp + 0x20]
xor edx, edx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x18005b7ce
test rbx, rbx
je 0x18005b796
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x18005b780
test eax, eax
jns 0x18005b7ef
test rbx, rbx
je 0x18005b7f4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x18005b8f2
test rbx, rbx
jne 0x18005b7fb
xor eax, eax
jmp 0x18005b8f2
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x18005b8d2
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x18005b850
lea rcx, [rsp + 0x28]
call fcn.18005a420
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18005b870
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x18005b908
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18005b8c8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b8c3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b951
call fcn.1800e6490
inc edi
cmp edi, dword [rbx]
jb 0x18005b814
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800e63a0
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18005b95d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b958
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b958
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e6490
mov rax, rdi
jmp 0x18005b8e5
Function at 0x18005c0a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1040
call fcn.1800e71b0
sub rsp, rax
mov rax, qword [0x18013a080]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rdi, r9
mov rsi, qword [rsp + 0x1070]
mov rbp, qword [rsp + 0x1078]
xor ebx, ebx
test r9, r9
je 0x18005c1c7
mov ecx, dword [0x1801faecc]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1801fb8d8], ecx
jle 0x18005c14e
lea rcx, [0x1801fb8d8]
call fcn.1800e65b0
cmp dword [0x1801fb8d8], 0xffffffff
jne 0x18005c14e
xor r8d, r8d
lea rdx, str.RtlCopyMemory
lea rcx, [0x18011e2d8]
call fcn.180059e10
mov qword [0x1801fb780], rax
lea rcx, [0x1801fb8d8]
call fcn.1800e6544
mov qword [rsp + 0x20], 0x1000
mov r9, rdi
lea r8, [rsp + 0x30]
mov rdx, qword [0x1801fb780]
call fcn.18007c2f0
movsxd rax, dword [rsp + 0x6c]
lea rcx, [rsp + 0x30]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
mov r8d, ebx
movzx r9d, word [rcx + 6]
test r9d, r9d
je 0x18005c1c7
mov eax, r8d
lea rcx, [rax + rax*4]
lea rdx, [r10 + rcx*8]
cmp dword [rdx], 0x45474150
jne 0x18005c1bf
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x18005c1b0
cmp rax, 4
je 0x18005c205
inc r8d
cmp r8d, r9d
jb 0x18005c190
mov r8, rbx
mov r9d, ebx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
call fcn.18005bf30
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1800e63a0
lea r11, [rsp + 0x1040]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x18005c1c7
mov ecx, dword [rdx + 8]
lea r8, [rsp + 0x30]
add r8, rax
je 0x18005c1c7
test ecx, ecx
je 0x18005c1c7
mov ebx, ecx
lea rax, [rsp + 0x30]
sub r8, rax
add r8, rdi
jmp 0x18005c1ca
Function at 0x18005ee60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005eef7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005eef7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc68d0a72
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18005eef2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18005eed0
cmp r8d, 0xae922cc9
je 0x18005eefc
test r9d, r9d
jne 0x18005eeb0
mov rax, qword [rax]
jmp 0x18005ee80
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xfffffff5
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18005efa7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18005efa7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3c1da6ad
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x18005efa2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x18005ef80
cmp r8d, 0x9ad5c42d
je 0x18005efac
test r9d, r9d
jne 0x18005ef60
mov rcx, qword [rcx]
jmp 0x18005ef30
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 4
add rax, r10
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x30]
lea rax, [0x1800f96e6]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800723e0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18013a080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x238
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800724a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800724a7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd3483f15
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800724a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180072480
cmp r8d, 0x7b2b3f85
je 0x1800724ac
test r9d, r9d
jne 0x180072460
mov rax, qword [rax]
jmp 0x180072430
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
lea ecx, [rdx + 2]
call rax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180072514
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x180072544
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800724f0
mov rcx, rbx
call qword [0x1801fb208]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800e63a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [0x1801fb208]
mov eax, dword [rsp + 0x28]
jmp 0x18007251f

Function at 0x180072550
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx]
xor edx, edx
cmp qword [rcx + 8], r8
je 0x180072577
nop dword [rax + rax]
xor byte [r8 + rdx], 0xed
inc rdx
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
cmp rdx, rax
jb 0x180072560
ret
Function at 0x180077ff0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18013a080]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp edx, 1
jne 0x1800780bd
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x18011e564]
lea rcx, str.CONIN_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x18011e570]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov ecx, 8
call fcn.1800e6c44
lea rcx, [0x180072580]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18007fc00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800780e0
cmp dword [rsp + 0x38], 0
je 0x1800780d4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1800780d4
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800e63a0
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180078100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x180078123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x180078110
mov byte [rcx + 0x19], 0
ret

Function at 0x180078130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x180078153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x180078140
mov byte [rcx + 0x17], 0
ret

Function at 0x180078160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x180078183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x180078170
mov byte [rcx + 0x1b], 0
ret

Function at 0x180078190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x1800781b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x1800781a0
mov byte [rcx + 0x18], 0
ret

Function at 0x1800781c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x1800781e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x1800781d0
mov byte [rcx + 0x1a], 0
ret

Function at 0x1800781f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x180078213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x180078200
mov byte [rcx + 0x1d], 0
ret
Function at 0x180078220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x180078243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x180078230
mov byte [rcx + 0x10], 0
ret

Function at 0x180078250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x180078273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x180078260
mov byte [rcx + 0x14], 0
ret

Function at 0x180078280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1800782a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x180078290
mov byte [rcx + 0xa], 0
ret

Function at 0x1800782b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x1800782d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x1800782c0
mov byte [rcx + 0x13], 0
ret

Function at 0x1800782e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x180078303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x1800782f0
mov byte [rcx + 0x15], 0
ret

Function at 0x180078310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x180078333
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x180078320
mov byte [rcx + 0xe], 0
ret

Function at 0x180078340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x180078363
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x180078350
mov byte [rcx + 0x12], 0
ret

Function at 0x180078370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x180078393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x180078380
mov byte [rcx + 0xf], 0
ret

Function at 0x1800783a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1800783c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x1800783b0
mov byte [rcx + 0xd], 0
ret
Function at 0x1800789d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800789f8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180078a1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180078a20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180078a79
test ecx, ecx
jle 0x180078a59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180078a79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180078a79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180078aa0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180078ac2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180078ad8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180078af4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180078af6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180078b32
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180078bce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180078b6d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180078bae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180078bce
cmp rbx, rax
ja 0x180078b80
test rbx, rbx
je 0x180078bce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180079030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18013a080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18007905d
xor eax, eax
jmp 0x1800791c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180079097
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180079097
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800791c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800791bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800790da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180079105
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800791c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180079174
sub eax, 1
je 0x180079174
cmp eax, 2
jne 0x1800791bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800791c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800791a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800791bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800791c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800e63a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180079630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x1800797c3
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x1800797c3
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x1800796c9
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x1800797e7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1800796df
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x1800796df
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1800796f2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x18007973d
mov r9d, eax
cmp eax, 0x800
jae 0x18007970c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x18007973d
cmp eax, 0x10000
jae 0x180079726
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x18007973d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x1800797c3
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180079761
cmp r10d, 3
jae 0x18007976d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x18007979e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180079780
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x18007967e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x1800797d2
Function at 0x18007a4a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18013a080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18007a573
cmp byte [rcx + 0x71], 0
je 0x18007a573
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x18007a56f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18007a534
sub eax, 1
je 0x18007a538
cmp eax, 2
jne 0x18007a56f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800e63a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18007a566
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18007a56f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18007a51c
xor al, al
jmp 0x18007a51c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800e63a0
add rsp, 0x60
pop rbx
ret