joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801005d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x180100796
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x180100733
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1800ff840
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801006d0
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180100796
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801c74b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180100cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x180100e8c
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x180100e28
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180080b20
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180100dc2
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180100e8c
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801c74b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801021a0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, gethostname
call fcn.1801c83e0
sub rsp, rax
cmp dword [0x1802f0a38], 0
jne 0x18010223b
lea rcx, [0x1802f08a0]
xor edx, edx
mov r8d, 0x198
mov dword [0x1802f0a38], 1
call fcn.1801c9e80
lea rdx, [0x1802f08a0]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18010223b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 9
lea r9, [0x1802e7e78]
lea ecx, [rdx - 7]
mov r8d, eax
mov dword [rsp + 0x20], 0x1db
call fcn.180004810
mov edx, reloc.WS2_32.dll_WSASetLastError
lea r9, [0x1802e7e90]
lea ecx, [rdx - 0x50]
lea r8d, [rdx + 0xa]
mov dword [rsp + 0x20], 0x1dc
call fcn.180004810
or eax, 0xffffffff
add rsp, 0x38
ret
mov eax, 1
add rsp, 0x38
ret

Function at 0x180102330
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, gethostbyname
call fcn.1801c83e0
sub rsp, rax
mov dword [rsp + 0x40], edx
lea r8, [rsp + 0x40]
movsxd rcx, ecx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x180102381
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 5
lea r9, [0x1802e7ea8]
lea ecx, [rdx - 3]
mov r8d, eax
mov dword [rsp + 0x20], 0x233
call fcn.180004810
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x30
pop rbx
ret

Function at 0x180102390
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, gethostbyname
call fcn.1801c83e0
sub rsp, rax
mov rsi, rdx
mov rbx, rcx
lea ebp, [rax - 0x2f]
call fcn.180102250
mov edi, eax
test eax, eax
jns 0x1801023e4
lea r9, [0x1802e7d50]
lea edx, [rbp + 0x69]
lea ecx, [rbp + 0x1f]
lea r8d, [rbp + 0x6b]
mov dword [rsp + 0x20], 0x7b
call fcn.180004810
jmp 0x1801024c5
call fcn.1801021a0
cmp eax, ebp
jne 0x1801024d9
test edi, edi
jle 0x1801023fc
mov eax, ebp
jmp 0x1801024e2
mov r9d, Ordinal_143
lea r8, [0x1802e7d68]
lea edx, [r9 - 0x78]
lea ecx, [rdx - 0xd]
call fcn.18000c760
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r11, rax
test rax, rax
jne 0x180102446
lea r9, [0x1802e7d80]
lea edx, [rax + 0x6a]
lea ecx, [rax + 0x20]
lea r8d, [rax + 0x66]
mov dword [rsp + 0x20], __WSAFDIsSet
call fcn.180004810
jmp 0x1801024a7
cmp word [rax + 0x10], 2
je 0x18010246f
mov edx, 0x6a
lea r9, [0x1802e7d98]
mov dword [rsp + 0x20], 0x99
lea ecx, [rdx - 0x4a]
lea r8d, [rdx + 1]
call fcn.180004810
jmp 0x1801024a7
mov rax, qword [rax + 0x18]
xor ebp, ebp
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [rsi], al
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax]
movzx eax, byte [rcx + 1]
mov byte [rsi + 1], al
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax]
movzx eax, byte [rcx + 2]
mov byte [rsi + 2], al
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax]
movzx eax, byte [rcx + 3]
mov byte [rsi + 3], al
mov edx, reloc.WS2_32.dll_shutdown
lea r8, [0x1802e7db0]
mov r9d, 0xa2
lea ecx, [rdx - 0xc]
call fcn.18000c760
test ebp, ebp
je 0x1801024dd
lea rdx, str.host
mov r8, rbx
mov ecx, 2
call fcn.180004bf0
xor eax, eax
jmp 0x1801024e2
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180107be9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180107de7
push rbp
mov eax, 0xe0
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.180082ab0
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.180082b10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.180080b20
mov rcx, r13
call fcn.180082ab0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.180082b10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.180080b20
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x180107c50
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1801c74b0
add rsp, 0xe0
pop rbp
repz ret
Function at 0x18010a710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x18010a8d6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x18010a873
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801094b0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x18010a810
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x18010a8d6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801c74b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18010cd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x18010cf56
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x18010cef3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.18010bc80
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x18010ce90
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x18010cf56
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801c74b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18010cf80
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x180247d00]
mov r8d, 0x1048
mov rdi, rcx
call fcn.1801c9a10
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x18010cfd0
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.18010bc80
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x18010d030
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.18010bc80
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x18010d060
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801112b0
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount
Delete file
Get file size
Get thread local storage value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x670
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rdi, rcx
mov rbx, rdx
add rcx, 0x220
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x54]
lea rcx, [rsp + 0xd0]
movzx r9d, word [rsp + 0x52]
mov edx, 0x190
movzx eax, word [rsp + 0x56]
movzx r10d, word [rsp + 0x50]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r8d
lea r8d, [rdx - 1]
mov dword [rsp + 0x28], r9d
lea r9, str._02u:_02u:_02u:_03u
mov dword [rsp + 0x20], r10d
call fcn.180110ee0
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x44]
call fcn.1801c9e80
mov ecx, dword [rdi + 0x24c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, eax
mov byte [rsp + rcx + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0xd0]
lea rcx, [rsp + 0x260]
mov dword [rsp + 0x20], eax
lea r8, str._s_0x_08X__s_s_r_n
mov edx, 0x3ff
call fcn.180114530
mov edx, dword [0x1802efab8]
mov ebp, eax
mov rcx, qword gs:[0x58]
mov eax, 4
mov rcx, qword [rcx + rdx*8]
mov edx, dword [rax + rcx]
cmp dword [0x1802f1314], edx
jle 0x1801113ef
lea rcx, [0x1802f1314]
call fcn.1801c7ad4
cmp dword [0x1802f1314], 0xffffffff
jne 0x1801113ef
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x1802f1314]
mov dword [0x1802f1310], eax
call fcn.1801c7a74
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov esi, eax
sub ecx, dword [0x1802f1310]
cmp ecx, 0x36ee80
jbe 0x180111473
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x100001
jb 0x18011146d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180111473
cmp word [rdi + 0x10], 0
je 0x180111473
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rdi + 0x10]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
mov dword [0x1802f1310], esi
test ebp, ebp
jle 0x1801114c5
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x1801114c5
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], ebp
je 0x1801114c5
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rdi + 0x220]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1801c74b0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1801232b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x5d0], 0
je 0x1801233a4
test rdx, rdx
je 0x1801233a4
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], ax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], ax
jne 0x180123304
lea rcx, [rsp + 0x28]
call fcn.1801142a0
nop
mov rbx, qword [rbx + 0x5d0]
cmp qword [rbx + 0x870], 0
je 0x18012339a
cmp qword [rsp + 0x38], 0
je 0x18012336c
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18012336c
test al, 0x10
jne 0x18012336c
mov byte [rbx + 0x95a], 0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
jmp 0x18012338d
cmp byte [rbx + 0x95a], 0
jne 0x18012339a
mov byte [rbx + 0x95a], 1
lea rdx, [rbx + 0x9d8]
cmp qword [rdx + 0x18], 8
jb 0x18012338d
mov rdx, qword [rdx]
mov rcx, qword [rbx + 0x870]
call fcn.180175870
nop
lea rcx, [rsp + 0x28]
call fcn.180114210
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801c74b0
add rsp, 0x50
pop rbx
ret