joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18019d750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r14, rcx
mov rsi, r8
mov r8, rdx
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rcx, r9
mov rdi, r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
lea rbp, [rdx*4]
sub rcx, 1
je 0x18019d79e
cmp rcx, 1
jne 0x18019d7a2
inc rbp
add rbp, 2
cmp r8, rbp
ja 0x18019d7c0
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
xor edx, edx
mov qword [rsp + 0x10], rbx
mov ebx, edx
test r9, r9
je 0x18019d912
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
shl edx, 8
dec rdi
add edx, eax
add ebx, 8
cmp ebx, 6
jb 0x18019d88b
nop dword [rax + rax]
add ebx, 0xfffffffa
mov r11d, edx
mov ecx, ebx
shr r11d, cl
and r11d, 0x3f
mov r9d, r11d
mov eax, r11d
xor r9d, 0x3e
xor eax, 0x3f
neg r9d
neg eax
shr r9d, 8
lea ecx, [r11 - 0x3e]
shr eax, 8
lea r8d, [r11 - 0x34]
not r9b
shr ecx, 8
and r9b, 0xfb
shr r8d, 8
not al
lea r10d, [r11 - 0x1a]
or r9b, al
shr r10d, 8
lea eax, [r11 - 4]
and r9b, 0x2f
and cl, al
movzx eax, r8b
not al
and cl, al
movzx eax, r10b
or r9b, cl
not al
lea ecx, [r11 + 0x47]
add r11b, 0x41
and cl, al
and r11b, r10b
and cl, r8b
or r9b, cl
or r9b, r11b
mov byte [r14], r9b
inc r14
cmp ebx, 6
jae 0x18019d800
test rdi, rdi
jne 0x18019d7e0
test ebx, ebx
je 0x18019d912
mov ecx, 6
sub ecx, ebx
shl edx, cl
and edx, 0x3f
mov r9d, edx
mov eax, edx
xor r9d, 0x3e
xor eax, 0x3f
neg r9d
neg eax
shr r9d, 8
lea ecx, [rdx - 0x3e]
shr eax, 8
lea r8d, [rdx - 0x34]
not r9b
shr ecx, 8
and r9b, 0xfb
shr r8d, 8
not al
lea r10d, [rdx - 0x1a]
or r9b, al
shr r10d, 8
lea eax, [rdx - 4]
and r9b, 0x2f
and cl, al
movzx eax, r8b
not al
and cl, al
movzx eax, r10b
or r9b, cl
not al
lea ecx, [rdx + 0x47]
add dl, 0x41
and cl, al
and dl, r10b
and cl, r8b
or r9b, cl
or r9b, dl
mov byte [r14], r9b
inc r14
mov rbx, qword [rsp + 0x10]
mov rax, rbp
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov byte [r14], 0
pop r14
ret
Function at 0x18019e2a0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x18019e2e2
xor r9d, r9d
cmp r8, rdx
jb 0x18019e2e2
mov r8d, 0x80
lea rax, [rcx + r9*8]
sub rdx, rcx
sub r8, r9
nop dword [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x18019e2d0
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x18019e2f0
ret

Function at 0x1801a0580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x1b0]
lea rdi, [rcx + 0xdd4]
mov rsi, rcx
add al, 0x13
movzx ecx, al
xor bl, bl
xor edx, edx
mov ebp, dword [rsi + 0x1c0]
sub ebp, ecx
lea r10d, [rbp - 3]
test r10d, r10d
je 0x1801a0691
cmp r10d, 0x20
jb 0x1801a066e
movdqa xmm3, xmmword [0x1800591e0]
mov r9d, r10d
and r9d, 0xffffffe0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov r8d, reloc.WS2_32.dll_select
nop word [rax + rax]
lea eax, [r8 - 0x10]
add edx, 0x20
movdqu xmm0, xmmword [rax + rdi]
mov eax, r8d
add r8d, 0x20
pandn xmm0, xmm3
por xmm2, xmm0
movdqu xmm0, xmmword [rax + rdi]
pandn xmm0, xmm3
por xmm1, xmm0
cmp edx, r9d
jb 0x1801a0600
por xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
por xmm1, xmm0
movd ebx, xmm1
cmp edx, r10d
jae 0x1801a0691
lea eax, [rdx + 2]
mov ecx, r10d
add rax, rdi
sub ecx, edx
mov edx, ecx
nop dword [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
not cl
or bl, cl
sub rdx, 1
jne 0x1801a0680
movzx eax, byte [rdi + 1]
lea ecx, [r10 + 2]
xor al, 1
lea r8, [rsp + 0x20]
or al, byte [rcx + rdi]
mov edx, reloc.WS2_32.dll_send
or al, byte [rdi]
lea rcx, [0x1800708f0]
or bl, al
call fcn.18015bdb0
movzx r9d, byte [rsi + 0x1b0]
lea rdx, [rsp + 0x20]
add byte [rsp + 0x21], r9b
movzx ecx, r9b
shr cl, 4
movzx eax, r9b
dec cl
mov byte [rsp + 0x32], r9b
and al, 4
mov r8d, reloc.WS2_32.dll_send
or cl, al
mov byte [rsp + 0x2e], cl
mov ecx, ebp
add rcx, rdi
call fcn.18015bca0
movzx r8d, byte [rsi + 0x1b0]
lea ecx, [rbp + 0x13]
mov rdx, qword [rsi + 0x1a8]
add rcx, rdi
or bl, al
call fcn.18015bca0
or al, bl
neg al
sbb eax, eax
and eax, 8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1801a1d40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1801a1d7f
test rdx, rdx
je 0x1801a1d7f
xor eax, eax
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.180117af0
mov qword [rbx], rax
neg rax
sbb eax, eax
neg eax
dec eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
Function at 0x1801a2430
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1801a252d
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1801a250a
xorps xmm0, xmm0
mov byte [rsp + 0x20], dil
xor edx, edx
mov word [rsp + 0x21], pe_nt_image_headers64
mov r8d, 0xf0
mov byte [rsp + 0x23], 1
movups xmmword [rsp + 0x32], xmm0
mov dword [rsp + 0x24], 0
movups xmmword [rsp + 0x42], xmm0
mov word [rsp + 0x30], 0
call fcn.18020be10
movaps xmm0, xmmword [0x180070420]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x180070430]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x180070440]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x180070450]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1801a2532
mov edx, 0xf0
call fcn.18019d930
cmp byte [rbx + 0xe8], 0
je 0x1801a2525
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x1801a51f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx eax, byte [rcx + 0x218]
mov rsi, rdx
lea rdx, [rcx + 0x158]
movzx edi, r8b
movzx r8d, byte [rcx + 0x219]
add rdx, rax
mov rbx, rcx
call fcn.180135b10
movzx ecx, byte [rbx + 0x218]
xor al, al
test cl, cl
je 0x1801a5262
nop dword [rax]
nop dword [rax + rax]
movzx edx, al
inc al
movzx ecx, byte [rdx + rbx + 0xd8]
xor cl, 0x5c
mov byte [rdx + rbx + 0x158], cl
movzx ecx, byte [rbx + 0x218]
cmp al, cl
jb 0x1801a5240
movzx eax, byte [rbx + 0x219]
lea rdx, [rbx + 0x158]
movzx r8d, cl
mov r9, rsi
add r8d, eax
mov byte [rsp + 0x20], dil
mov rcx, rbx
call fcn.180135b70
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1801a53a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xor al, al
mov rbx, rcx
cmp byte [rcx + 0x218], al
jbe 0x1801a53e2
nop dword [rax]
nop word [rax + rax]
movzx r8d, al
inc al
movzx edx, byte [r8 + rcx + 0xd8]
xor dl, 0x36
mov byte [r8 + rcx + 0x158], dl
cmp al, byte [rcx + 0x218]
jb 0x1801a53c0
call fcn.180135c20
movzx r8d, byte [rbx + 0x218]
lea rdx, [rbx + 0x158]
mov rcx, rbx
call fcn.180135c40
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1801a67f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
movd xmm3, ecx
pshufd xmm3, xmm3, 0
mov r11d, ecx
test r9d, r9d
je 0x180199ab6
mov qword [rsp], rbx
cmp r9d, 4
jb 0x180199a7a
lea eax, [r9 - 1]
lea rbx, [r8 + rax*4]
lea rax, [rdx + rax*4]
cmp r8, rax
ja 0x180199a2c
cmp rbx, rdx
jae 0x180199a7a
mov ecx, r9d
and ecx, 0xfffffffc
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + r10*4]
movdqu xmm2, xmmword [rdx + r10*4]
movdqa xmm1, xmm3
pxor xmm2, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [r8 + r10*4], xmm1
pxor xmm1, xmm2
movdqu xmmword [rdx + r10*4], xmm1
add r10d, 4
cmp r10d, ecx
jb 0x180199a40
cmp r10d, r9d
jae 0x180199ab2
sub r8, rdx
lea rax, [rdx + r10*4]
sub r9d, r10d
mov edx, r9d
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
mov ecx, dword [rax]
lea rax, [rax + 4]
and ecx, r11d
xor dword [r8 + rax - 4], ecx
mov ecx, dword [r8 + rax - 4]
xor dword [rax - 4], ecx
sub rdx, 1
jne 0x180199a90
mov rbx, qword [rsp]
add rsp, 8
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, r9d
mov ebx, r8d
mov r9d, r8d
mov rdi, rdx
mov r8, qword [rdx + 8]
mov rsi, rcx
mov rdx, qword [rcx + 8]
mov ecx, ebp
call 0x1801999f0
mov r8, qword [rdi + 0x10]
mov r9d, ebx
mov rdx, qword [rsi + 0x10]
mov ecx, ebp
call 0x1801999f0
mov r8, qword [rdi + 0x18]
mov r9d, ebx
mov rdx, qword [rsi + 0x18]
mov ecx, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1801999f0
Function at 0x1801a71a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r15
mov eax, dword [rdx]
mov r15, r8
mov dword [r8], eax
mov r12b, 4
mov eax, dword [rdx + 4]
mov dword [r8 + 4], eax
mov eax, dword [rdx + 8]
mov dword [r8 + 8], eax
mov eax, dword [rdx + 0xc]
movzx ebp, cl
shl ebp, 2
mov dword [r8 + 0xc], eax
cmp ebp, 4
jbe 0x1801a7353
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
nop dword [rax]
movzx eax, r12b
lea r14, [rax*4]
mov r11d, dword [r14 + rdx]
mov r10d, r11d
shr r10d, 0x10
xor r10d, r11d
mov r8d, r10d
shr r8d, 8
movzx eax, r8b
shr al, 6
and al, 1
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r8b
shr al, 7
movzx eax, al
shl r8b, 2
movzx r9d, cl
imul ecx, eax, 0x36
movzx eax, cl
xor r9d, eax
movzx eax, r8b
xor r9d, eax
movzx eax, r10b
shr al, 6
and al, 1
shl r9d, 8
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r10b
shr al, 7
movzx eax, al
shl r10b, 2
movzx r8d, cl
imul ecx, eax, 0x36
movzx eax, cl
xor r8d, eax
movzx eax, r10b
xor r8d, eax
or r9d, r8d
mov esi, r9d
shl esi, 0x10
or esi, r9d
xor esi, r11d
mov edi, esi
rol edi, 8
xor edi, esi
mov r8d, edi
mov r9d, edi
shr r8d, 0x18
mov r11d, edi
movzx eax, r8b
shr r9d, 0x10
shr al, 7
add r8b, r8b
movzx eax, al
mov ebx, edi
imul ecx, eax, 0x1b
movzx eax, r8b
shr r11d, 8
rol ebx, 0x10
movzx r10d, cl
xor r10d, eax
movzx eax, r9b
shr al, 7
add r9b, r9b
movzx eax, al
imul ecx, eax, 0x1b
shl r10d, 8
movzx eax, cl
xor r10d, eax
movzx eax, r9b
xor r10d, eax
movzx eax, r11b
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
shl r10d, 8
movzx eax, cl
xor r10d, eax
add r11b, r11b
movzx eax, r11b
inc r12b
xor r10d, eax
movzx eax, dil
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
shl r10d, 8
xor ebx, r10d
movzx eax, cl
xor ebx, eax
movzx eax, dil
add al, al
movzx ecx, al
xor ebx, ecx
movzx eax, r12b
xor ebx, edi
xor ebx, esi
mov dword [r14 + r15], ebx
cmp eax, ebp
jb 0x1801a71f0
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
movzx eax, r12b
movzx r8d, r12b
lea rcx, [rax*4]
mov eax, dword [rcx + rdx]
mov dword [rcx + r15], eax
lea eax, [r8 + 1]
mov ecx, eax
mov eax, dword [rdx + rax*4]
mov dword [r15 + rcx*4], eax
lea eax, [r8 + 2]
mov ecx, eax
mov eax, dword [rdx + rax*4]
mov dword [r15 + rcx*4], eax
lea eax, [r8 + 3]
mov ecx, eax
mov eax, dword [rdx + rax*4]
mov dword [r15 + rcx*4], eax
pop r15
pop r12
pop rbp
ret
Function at 0x1801ae410
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x58
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x1801ae4e6
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jae 0x1801ae4e6
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x68], rsi
lea r8, [0x180056640]
lea rdx, [0x180074038]
mov qword [rsp + 0x50], rdi
lea rcx, [0x180074044]
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
call qword [sym.imp.KERNEL32.dll_GetProfileStringA]
xor ebx, ebx
lea rsi, [0x18029cba0]
nop
movsxd rdi, ebx
mov r8, 0xffffffffffffffff
lea rcx, [rsi + rdi*8]
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x1801ae490
lea rdx, [rsp + 0x30]
call fcn.180221750
test eax, eax
je 0x1801ae4da
inc ebx
cmp ebx, 0x10
jb 0x1801ae480
mov dword [0x1802b1e2c], 0x809
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x58
ret
mov eax, dword [rsi + rdi*8 + 4]
mov dword [0x1802b1e2c], eax
jmp 0x1801ae4b9
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp ecx, 4
jne 0x1801ae53a
shr eax, 0xa
mov ecx, eax
sub ecx, 3
je 0x1801ae510
sub ecx, 1
je 0x1801ae533
cmp ecx, 1
jne 0x1801ae515
mov eax, 1
shl eax, 0xa
or eax, 4
mov dword [0x1802b1e2c], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x58
ret
mov eax, 2
jmp 0x1801ae515
bts ecx, 0xb
mov dword [0x1802b1e2c], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x58
ret
Function at 0x1801af430
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebp, ebp
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov ebx, 2
mov edi, ebp
cmp ecx, 0xa
ja case.0x1801af479.3
movsxd rax, ecx
lea rdx, section.__wibu05
mov ecx, dword [rdx + rax*4 + 0x15f5b4]
add rcx, rdx
jmp rcx
lea rdi, [0x180074118]
jmp case.0x1801af479.3
lea rdi, [0x180074150]
jmp 0x1801af4b8
lea rdi, [0x180074150]
jmp case.0x1801af479.3
lea rdi, [0x180074188]
jmp case.0x1801af479.3
lea rdi, [0x1800741c0]
jmp 0x1801af4b8
lea rdi, [0x1800741f8]
jmp 0x1801af4b8
lea rdi, [0x180074238]
mov ebx, 3
mov rcx, rbp
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0x30]
cmp ebx, 2
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
sete cl
mov rdx, rdi
add rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
jne 0x1801af52a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1801af591
cmp ebx, 3
jne 0x1801af58f
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
jne 0x1801af58f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r14
mov dword [rsp + 0x38], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
cmove ebp, dword [rsp + 0x38]
mov eax, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801af8b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r9d
mov rdi, r8
mov rsi, rcx
call fcn.1801af970
test eax, eax
je 0x1801af947
mov rcx, rdi
test ebx, ebx
je 0x1801af936
xor edx, edx
mov r8d, ebx
nop dword [rax]
mov rax, rdx
lea rcx, [rcx + 1]
and eax, 0x1f
inc rdx
movzx eax, byte [rax + rsi + 0x88]
add byte [rcx - 1], al
sub r8, 1
jne 0x1801af8e0
mov ecx, dword [rsi + 0x3c]
mov r8, rbx
mov eax, ecx
mov rdx, rdi
shr eax, 0x10
add ax, cx
nop
xor byte [rdx], al
lea rdx, [rdx + 1]
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
sub r8, 1
jne 0x1801af910
cmp dword [rbx + rdi - 4], 0
je 0x1801af959
mov dword [0x18029ccf4], 0x65
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1801af970
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, r9d
mov rsi, r8
mov rdi, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x28]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801af9b0
mov dword [0x18029ccf4], 0x65
jmp 0x1801af9e9
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801af9df
cmp dword [rsp + 0x30], ebx
jne 0x1801af9df
mov eax, 1
jmp 0x1801af9eb
mov dword [0x18029ccf4], 0x62
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801afa00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x4c]
lea r8, [rdx + 0x14]
mov byte [r8], al
lea r9, [rdx + 0x18]
mov eax, dword [rcx + 0x4c]
mov rbx, rcx
shr eax, 8
mov byte [rdx + 0x15], al
movzx eax, byte [rcx + 0x50]
mov byte [rdx + 0x16], al
mov eax, dword [rcx + 0x50]
shr eax, 8
mov byte [rdx + 0x17], al
movzx eax, byte [rcx + 0x60]
mov byte [r9], al
mov eax, dword [rcx + 0x60]
shr eax, 8
mov byte [rdx + 0x19], al
mov edx, 0x18
movzx eax, word [rcx + 0x50]
add ax, word [rcx + 0x4c]
nop dword [rax]
xor byte [r9], al
lea r9, [r9 + 1]
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
sub rdx, 1
jne 0x1801afa60
mov edx, dword [rbx + 0x6c]
mov r9d, 0x1c
add edx, 0x14
mov rcx, rbx
call fcn.1801b1b50
test eax, eax
je 0x1801afb26
cmp dword [rbx + 0x78], 0
mov al, 0xfa
jne 0x1801afaaf
movzx eax, byte [rbx + 0x5c]
mov edx, dword [rbx + 0x68]
xor r9d, r9d
mov rcx, qword [rbx + 0x28]
xor r8d, r8d
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801afad6
mov dword [0x18029ccf4], 0x65
jmp 0x1801afb26
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1801afb1c
cmp dword [rsp + 0x34], 1
jne 0x1801afb1c
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x40
pop rbx
ret
mov dword [0x18029ccf4], 0x61
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x40
pop rbx
ret
Function at 0x1801b0910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [0x18029cd68]
xor esi, esi
mov ecx, dword [rbx + 0x74]
lea r15, [rbx + 0x74]
call fcn.1801af250
mov r14, rax
test rax, rax
jne 0x1801b0b3c
mov edx, dword [rbx + 0x38]
test edx, edx
jne 0x1801b0964
mov dword [0x18029ccf4], 0xb
jmp 0x1801b0b3c
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x78], rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x1801b09f7
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b0b2b
cmp dword [rsp + 0x38], 4
jne 0x1801b0b2b
movzx eax, byte [rsp + 0x37]
xor r9d, r9d
mov edi, dword [rbx + 0x38]
xor r8d, r8d
shl ax, 8
movzx edx, ax
movzx eax, byte [rsp + 0x36]
or edx, eax
movzx eax, byte [rsp + 0x35]
shl edx, 0x10
shl ax, 8
movzx ecx, ax
movzx eax, byte [rsp + 0x34]
or edx, ecx
mov rcx, qword [rbx + 0x28]
or edx, eax
mov dword [rbx + 0x3c], edx
lea edx, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b0a06
mov dword [0x18029ccf4], 0x65
jmp 0x1801b0b35
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x38]
mov r8d, 2
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b0b2b
cmp dword [rsp + 0x38], 2
jne 0x1801b0b2b
movzx ecx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbp
call fcn.1801aebd0
mov rbp, rax
test rax, rax
je 0x1801b0b11
movzx r9d, word [rsp + 0x30]
lea edx, [rdi + 8]
mov r8, rax
mov rcx, rbx
call fcn.1801af8b0
test eax, eax
je 0x1801b0b11
movzx ecx, byte [rbp + 1]
lea rdi, [rbp + 2]
movzx eax, byte [rbp]
shl rcx, 8
or rcx, rax
lea rdi, [rdi + rcx*2]
movzx ecx, word [rsp + 0x30]
shr ecx, 1
call fcn.1801aebd0
mov rsi, rax
test rax, rax
je 0x1801b0b11
movzx ecx, byte [rdi]
mov rbx, rax
test cl, cl
je 0x1801b0ae2
movzx edx, cl
test cl, cl
je 0x1801b0ac2
lea rcx, [rdi + 6]
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 2]
mov byte [rbx], al
inc rbx
sub rdx, 1
jne 0x1801b0ab0
mov byte [rbx], 0x7c
inc rbx
movzx eax, byte [rdi]
lea rdi, [rdi + rax*2]
add rdi, 6
movzx ecx, byte [rdi]
test cl, cl
jne 0x1801b0aa4
cmp rbx, rsi
je 0x1801b0ae2
dec rbx
mov byte [rbx], 0
mov r8, r15
sub ebx, esi
mov edx, 0x2710
inc ebx
mov ecx, ebx
call fcn.1801aeb30
mov rdi, rax
test rax, rax
je 0x1801b0b11
movsxd r8, ebx
mov rdx, rsi
mov rcx, rax
call fcn.18020b760
mov r14, rdi
mov rcx, rsi
call fcn.18010fae0
mov rcx, rbp
call fcn.18010fae0
mov rbp, qword [rsp + 0x70]
mov rax, r14
jmp 0x1801b0b37
mov dword [0x18029ccf4], 0x62
xor eax, eax
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret