joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006dda0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x18]
lea eax, [rdx - 0xc8]
xor edi, edi
mov esi, r8d
mov rbx, rcx
cmp eax, 0x64
jb 0x14006dddf
lea rdx, str.Couldnt_set_desired_mode
call fcn.140047320
lea eax, [rdi + 0x11]
jmp 0x14006df45
cmp edx, 0xc8
je 0x14006ddf6
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.140047410
cmp esi, 0x13
jne 0x14006de0b
mov rdx, rbp
mov rcx, rbx
call fcn.14006dca0
jmp 0x14006df41
cmp esi, 0x14
jne 0x14006df23
cmp byte [rbx + 0x718], 2
mov rbp, qword [rbx + 0x18]
jne 0x14006de88
mov rax, qword [rbx + 0x1b0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14006de88
xor r9d, r9d
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 3
xor edx, edx
call fcn.1400768e0
test eax, eax
jne 0x14006df41
mov rcx, qword [rsp + 0x40]
lea edx, [rsi + 0x1b]
call fcn.1400cc5f0
test rax, rax
je 0x14006de7d
mov rdi, qword [rsp + 0x40]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], 0
jmp 0x14006de88
mov rcx, qword [rsp + 0x40]
call qword [str.03_r_]
mov rdx, qword [rbx + 0x780]
test rdx, rdx
jne 0x14006dead
cmp byte [rbx + 0x1318], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x140105db8]
test rdi, rdi
mov r9, r8
lea rax, [0x140106c4c]
cmovne r9, rdi
lea rcx, [0x1401073c4]
cmovne r8, rax
call fcn.14004c4c0
mov rcx, rdi
mov rsi, rax
call qword [str.03_r_]
test rsi, rsi
jne 0x14006deeb
lea edi, [rsi + 0x1b]
jmp 0x14006df43
lea rdx, [rbp + 0x6d0]
mov r9, rsi
lea r8, [0x140105ec0]
mov rcx, rbx
call fcn.140082f70
mov rcx, rsi
mov edi, eax
call qword [str.03_r_]
test edi, edi
jne 0x14006df43
mov rcx, qword [rbx + 0x18]
mov dword [rcx + 0x7a0], 0x1f
jmp 0x14006df43
cmp esi, 0x15
jne 0x14006df2e
lea r8d, [rsi - 8]
jmp 0x14006df37
cmp esi, 0x16
jne 0x14006df43
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rbx
call fcn.14006d7b0
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14007ead0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x14014e110]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call case.0x14003b839.0
mov r13, rax
test rax, rax
jne 0x14007eb4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032110
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140047320
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [str.03_r_]
jmp 0x14007ed08
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14007ebc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032110
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140047320
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x14007ecf2
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14007ec0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032110
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140047320
mov ebx, Ordinal_79
jmp 0x14007ece6
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x14007ec3f
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.140047320
mov ebx, Ordinal_79
jmp 0x14007ecde
lea rcx, [rdi + 1]
call qword [str.P3_r_]
mov rbp, rax
test rax, rax
jne 0x14007ec59
lea ebx, [rax + 0x1b]
jmp 0x14007ecde
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x14007ecb8
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007ed2a
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14007ecaf
mov edi, esi
jmp 0x14007ecb1
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x14007ec70
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.14007e850
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [str.03_r_]
mov rcx, r13
call fcn.1400d3330
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ab460
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032110
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140047320
mov ebx, Ordinal_79
jmp 0x14007ecd6
Function at 0x140085c70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov r14, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [str.P3_r_]
mov rbx, rax
test rax, rax
jne 0x140085cb5
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x50], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x140085d00
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x140085d62
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x140085d20
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x140085da3
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1401120d0]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401120d1]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140085d70
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x140085dc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r12, r9
mov rcx, r8
mov r14, rdx
call fcn.14004a090
mov r8d, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x20]
add rcx, 0x18
mov r15d, eax
lea r9d, [r8 + r8]
add rcx, r9
call qword [str.P3_r_]
mov rbx, rax
test rax, rax
je 0x140085f66
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x58], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x60], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x140085e50
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x140085eb2
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x50], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x140085e70
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x140085ef3
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1401120d0]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401120d1]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140085ec0
mov rcx, qword [rsp + 0x70]
call fcn.14004a090
mov r9, qword [rbx]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, r12
call qword [r9 + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbx]
test rdi, rdi
jne 0x140085f22
mov edi, dword [rsi + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov r8d, dword [rsi + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rsi + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [str.03_r_]
mov rdi, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov eax, reloc.WLDAP32.dll_Ordinal_27
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret

Function at 0x140087770
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1400877d5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x140087780
ret
Function at 0x1400af310
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400af323
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400b97b8
lea rdx, [0x14014ad70]
lea rcx, [rsp + 0x20]
call fcn.1400cd5a4
int3

Function at 0x1400ba1ec
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140157c18]
xor edx, edx
jmp fcn.1400af310

Function at 0x1400bac0c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140157c18]
jmp fcn.1400af310

Function at 0x1400d3634
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400d34c7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d34c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d34c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d34c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d34c7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d34c7
cmp dword [rcx + 0xf8], 0
je 0x1400d34c7
mov ecx, ebx
call fcn.1400d3568
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400d3358
cmp dword [rbp + 0x20], 0
je 0x1400d3514
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400d351c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400d3460

Function at 0x1400f7334
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400f7354
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400d892c
or eax, 0xffffffff
jmp 0x1400f7356
xor eax, eax
add rsp, 0x28
ret
Function at 0x180001d00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rcx
test rdx, rdx
je 0x180001d6b
mov r13, rdx
xor esi, esi
mov r15d, 0xf0f0f0f1
lea r12, [0x18006cad0]
nop
mov eax, esi
imul rax, r15
shr rax, 0x24
mov ecx, eax
shl ecx, 4
add ecx, eax
mov eax, esi
sub eax, ecx
movzx edi, byte [r14 + rsi]
movsx ebx, byte [rax + r12]
mov ecx, ebx
call fcn.180015780
xor eax, ebx
and eax, edi
xor eax, ebx
mov byte [r13 + rsi], al
inc rsi
test al, al
jne 0x180001d30
mov r14, r13
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1800050b0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rsi, rdx
mov rdi, rcx
call fcn.1800416b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, 0x11eec9d6
call fcn.180010450
test eax, ebx
jne 0x18000514c
mov rcx, rdi
call fcn.1800416b0
mov dword [rsp + 0x20], 0x20
mov rcx, rax
mov edx, 0x120089
mov r8d, 1
mov r9d, 1
call fcn.18002ac40
cmp rax, 0xffffffffffffffff
je 0x18000514c
mov rdi, rax
lea rcx, [0x18005bc54]
call fcn.18002a820
lea rdx, [rbp - 8]
mov rcx, rdi
call rax
test eax, eax
je 0x180005144
mov ebx, dword [rbp - 8]
test rbx, rbx
je 0x180005159
cmp dword [rbp - 4], 0
jg 0x180005144
call fcn.180018850
cmp rax, rbx
jae 0x180005165
mov rcx, rdi
call fcn.180031b70
xor ebx, ebx
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.180041330
mov bl, 1
jmp 0x18000514e
mov edx, dword [rbp - 8]
mov rcx, rsi
call fcn.1800456a0
mov dword [rbp + 4], 0
mov rcx, rsi
call fcn.180040a40
mov rbx, rax
mov rcx, rsi
call fcn.1800416b0
lea rcx, [rbp + 4]
mov qword [rsp + 0x20], rcx
mov rcx, rdi
xor edx, edx
mov r8, rax
mov r9d, ebx
call fcn.18003b0f0
mov ebx, eax
test al, al
je 0x1800051c1
mov rcx, rsi
call fcn.180040a40
mov ecx, dword [rbp + 4]
cmp rax, rcx
je 0x1800051c1
mov rcx, rsi
call fcn.180041330
mov rcx, rdi
call fcn.180031b70
jmp 0x18000514e
Function at 0x180005a60
Capabilities:
Hash data via wincrypt

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov r15d, r8d
mov rdi, rdx
mov r14, rcx
mov qword [rbp - 0x10], 0
lea rcx, [0x18005aa80]
call fcn.18002a820
mov dword [rsp + 0x20], 0xf0000040
xor esi, esi
lea rcx, [rbp - 0x10]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call rax
test eax, eax
je 0x180005b76
mov qword [rbp - 8], 0
mov rbx, qword [rbp - 0x10]
lea rcx, [0x180059f80]
call fcn.18002a820
lea rcx, [rbp - 8]
mov qword [rsp + 0x20], rcx
xor esi, esi
mov rcx, rbx
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call rax
test eax, eax
je 0x180005b5f
mov dword [rbp + 4], reloc.WS2_32.dll_recv
mov rcx, qword [rbp - 8]
xor esi, esi
mov rdx, rdi
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, eax
call fcn.18003afb0
test al, 1
je 0x180005b4a
mov rsi, qword [rbp - 8]
lea rcx, [0x18005a9e8]
call fcn.18002a820
mov dword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov rcx, rsi
mov edx, 2
mov r8, r14
call rax
test eax, eax
je 0x180005b48
mov ecx, dword [rbp + 4]
call fcn.18003c2d0
mov esi, eax
jmp 0x180005b4a
xor esi, esi
mov rdi, qword [rbp - 8]
lea rcx, [0x18005be4c]
call fcn.18002a820
mov rcx, rdi
call rax
mov rdi, qword [rbp - 0x10]
lea rcx, [0x180059c44]
call fcn.18002a820
mov rcx, rdi
xor edx, edx
call rax
and sil, 1
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x180009840
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov word [rbp - 0x60], 0
mov rcx, 0xffffffffffffffff
call fcn.180037600
lea rcx, [rbp - 0x60]
mov edx, 0x104
test al, al
je 0x18000987b
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x180009881
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.180042cc0
mov rax, rsi
add rsp, 0x228
pop rsi
pop rbp
ret

Function at 0x18000c570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov dword [0x18006fd00], ecx
mov dword [0x180071a10], 1
mov ecx, 0x11eecbb6
call fcn.180010450
cmp eax, 2
jl 0x18000c5f6
lea rsi, [0x18006fd00]
nop word cs:[rax + rax]
mov ecx, dword [0x180071a10]
lea eax, [rcx - 1]
cdqe
mov edi, dword [rsi + rax*4]
call fcn.18001c890
cdqe
mov eax, dword [rsi + rax*4]
shr eax, 0x1e
xor eax, edi
imul eax, eax, 0x6c078965
movsxd rcx, dword [0x180071a10]
add eax, ecx
mov dword [rsi + rcx*4], eax
lea edi, [rcx + 1]
mov dword [0x180071a10], edi
mov ecx, 0x11eecbb6
call fcn.180010450
cmp edi, eax
jl 0x18000c5b0
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000fa70
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov r14, r8
mov r15, rdx
mov rbx, rcx
lea rsi, [rbp - 0x18]
mov rcx, rsi
call fcn.1800413b0
mov edx, 0x400
mov rcx, rsi
call fcn.180044390
mov rcx, rsi
call fcn.180040a40
mov rdi, rax
mov rcx, rsi
call fcn.1800416b0
mov rcx, rax
mov edx, edi
mov r8, r15
call rbx
mov esi, eax
test eax, eax
jle 0x18000fb06
lea rcx, [rbp - 0x18]
call fcn.1800416b0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov rcx, r14
mov rdx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000fb01
mov rcx, rbx
mov rdx, r15
mov r8, r14
call fcn.18000fa70
mov esi, eax
jmp 0x18000fb06
mov esi, 0xffffffff
lea rcx, [rbp - 0x18]
call fcn.180041280
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x180014530
Capabilities:
Resume thread

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx + 0x8a0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
add rsp, 0x20
pop rbp
ret

Function at 0x180014e20
Capabilities:
Move file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.180041aa0
test al, al
jne 0x180014e4f
lea rdi, [rbx + 0x10]
mov rcx, rdi
call fcn.180041aa0
test al, al
je 0x180014e53
xor esi, esi
jmp 0x180014ebd
call fcn.18004c9c0
mov edx, dword [rbx + 8]
mov rcx, rax
mov r8b, 1
mov r9d, 0x3e8
call fcn.180018ec0
mov rbx, rbp
mov rcx, rbx
mov rdx, rax
call fcn.180041080
mov rcx, rbx
call fcn.1800495f0
test al, al
je 0x180014eb3
mov rcx, rsi
call fcn.1800416b0
mov rsi, rax
mov rcx, rdi
call fcn.1800416b0
mov rcx, rax
mov rdx, rsi
mov r8d, recv
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
jmp 0x180014eb5
xor esi, esi
mov rcx, rbp
call fcn.18004a8a0
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x180014ed0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov edi, r8d
mov rsi, rcx
mov rcx, rdx
call fcn.1800416b0
mov rcx, rsi
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
je 0x180014f31
mov rsi, rax
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov ecx, eax
call fcn.180016c50
test al, 1
jne 0x180014f33
cmp edi, 0x80
je 0x180014f33
lea rcx, [0x18005aa98]
call fcn.18002a820
mov rcx, rsi
call rax
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180015c60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
test r8, r8
je 0x180015cfe
mov r13, r8
movzx ebx, byte [r8 + 0x100]
movzx r12d, byte [r8 + 0x101]
test edx, edx
je 0x180015cee
mov r14, rcx
mov r15d, edx
xor edi, edi
nop dword [rax]
mov ecx, 0x81544959
call fcn.180010450
inc bl
or al, 0x60
and al, bl
movzx ecx, al
movzx edx, byte [r13 + rcx]
add r12b, dl
movzx esi, r12b
movzx ebx, byte [r13 + rsi]
mov byte [r13 + rcx], bl
mov byte [r13 + rsi], dl
add dl, byte [r13 + rcx]
movzx ecx, dl
movzx ecx, byte [r13 + rcx]
xor byte [r14 + rdi], cl
inc rdi
mov ebx, eax
cmp r15, rdi
jne 0x180015ca0
jmp 0x180015cf0
mov eax, ebx
mov byte [r13 + 0x100], al
mov byte [r13 + 0x101], r12b
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x180016450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r15, r8
test edx, edx
jle 0x1800164c7
mov r14, rcx
mov esi, edx
xor ebx, ebx
lea r13, [0x18006cad0]
nop word [rax + rax]
mov rax, rbx
movabs rcx, 0xf0f0f0f0f0f0f0f1
mul rcx
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
mov rax, r13
sub rax, rdx
movzx r12d, byte [r14 + rbx]
movsx edi, byte [rax + rbx]
mov ecx, edi
call fcn.180015780
xor eax, edi
and eax, r12d
xor eax, edi
mov byte [r15 + rbx], al
inc rbx
cmp rsi, rbx
jne 0x180016480
mov rax, r15
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x18001b840
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
test edx, edx
je 0x18001b8a9
mov r12d, edx
mov r14, rcx
mov ebx, 0xffffffff
xor edi, edi
lea r15, [0x18006e1a0]
nop dword [rax]
mov r13d, ebx
shr r13d, 8
movsxd rdi, edi
movzx esi, byte [r14 + rdi]
xor esi, ebx
mov ecx, 0x11eec939
call fcn.180010450
and eax, esi
mov ebx, r13d
xor ebx, dword [r15 + rax*4]
mov ecx, 0x11eec9c7
call fcn.180010450
add edi, eax
cmp edi, r12d
jb 0x18001b870
not ebx
jmp 0x18001b8ab
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x18001ca40
Capabilities:
Clear file content

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov edx, dword [rcx + 0x28]
mov rcx, qword [rcx + 0x30]
xor edi, edi
xor r8d, r8d
call fcn.180021eb0
test al, al
je 0x18001ca74
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret