joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180087cd0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov byte [rsp + 0x40], 1
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x180087d1f
xor al, al
jmp 0x180087ded
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180087d9f
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call fcn.180087cd0
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x180087d95
jmp 0x180087d9f
mov dword [rsp + 0x50], 0x104
jmp 0x180087d38
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x180087de8
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x180087dd7
mov dword [rsp + 0x44], 1
jmp 0x180087ddf
mov dword [rsp + 0x44], 0
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x280
pop rdi
ret
Function at 0x1800908a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov ebx, edx
mov r11, rcx
test rcx, rcx
je 0x1800908ff
test r8, r8
je 0x1800908ff
test r9, r9
je 0x1800908ff
xor r10d, r10d
test edx, edx
jle 0x1800908fb
mov qword [rsp + 0x10], rdi
sub r11, r8
mov edi, dword [rsp + 0x30]
nop dword [rax]
mov eax, r10d
lea r8, [r8 + 1]
cdq
inc r10d
idiv edi
movsxd rax, edx
movzx ecx, byte [rax + r9]
xor cl, byte [r11 + r8 - 1]
ror cl, 3
mov byte [r8 - 1], cl
cmp r10d, ebx
jl 0x1800908d0
mov rdi, qword [rsp + 0x10]
mov al, 1
pop rbx
ret
xor al, al
pop rbx
ret

Function at 0x180090910
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov ebx, edx
mov r11, rcx
test rcx, rcx
je 0x18009096c
test r8, r8
je 0x18009096c
test r9, r9
je 0x18009096c
xor r10d, r10d
test edx, edx
jle 0x180090968
mov qword [rsp + 0x10], rdi
sub r11, r8
mov edi, dword [rsp + 0x30]
nop dword [rax]
mov eax, r10d
lea r8, [r8 + 1]
cdq
inc r10d
idiv edi
movsxd rax, edx
movzx ecx, byte [rax + r9]
xor cl, byte [r11 + r8 - 1]
mov byte [r8 - 1], cl
cmp r10d, ebx
jl 0x180090940
mov rdi, qword [rsp + 0x10]
mov al, 1
pop rbx
ret
xor al, al
pop rbx
ret

Function at 0x180090970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov r10, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x1800909dc
test r8, r8
je 0x1800909dc
test r9, r9
je 0x1800909dc
xor r11d, r11d
test edx, edx
jle 0x1800909d3
mov qword [rsp + 0x10], rsi
sub rbx, r8
mov esi, dword [rsp + 0x30]
movzx r8d, byte [rbx + r10]
lea r10, [r10 + 1]
mov eax, r11d
rol r8b, 3
cdq
mov byte [r10 - 1], r8b
idiv esi
inc r11d
movsxd rax, edx
movzx ecx, byte [rax + r9]
xor cl, r8b
mov byte [r10 - 1], cl
cmp r11d, edi
jl 0x1800909a0
mov rsi, qword [rsp + 0x10]
mov al, 1
mov rbx, qword [rsp + 0x18]
pop rdi
ret
mov rbx, qword [rsp + 0x18]
xor al, al
pop rdi
ret
Function at 0x180093f70
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
xor r15d, r15d
mov qword [rbp - 0x50], r15
lea ecx, [r15 + 8]
call fcn.1802994e4
mov qword [rbp - 0x40], rax
mov r14, 0xffffffffffffffff
mov qword [rax], r14
mov qword [rbp - 0x50], rax
mov dword [rsp + 0x20], 3
lea r9d, [r15 + 1]
mov r8d, 0x80000000
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.18016bb70
test al, al
jne 0x180093ff3
xor sil, sil
jmp 0x1800940f4
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov edx, 0x19a8
lea rcx, [rbp - 0x30]
call fcn.18018c430
mov rdi, rax
mov rbx, qword [rbp - 0x50]
test rax, rax
je 0x180094079
mov dword [rbp - 0x38], r15d
test rbx, rbx
je 0x180094079
cmp qword [rbx], 0xffffffffffffffff
je 0x180094079
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x38]
mov r8d, 0x19a8
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180094079
cmp dword [rbp - 0x38], 0x19a8
jne 0x180094079
cmp dword [rdi], 0x20171109
jne 0x180094079
cmp dword [rdi + 0x10], 0
jle 0x180094079
mov sil, 1
jmp 0x18009407c
xor sil, sil
cmp qword [rbp - 0x28], 0
je 0x180094095
lea rcx, [rbp - 0x28]
call fcn.18003d460
mov rcx, r15
mov qword [rbp - 0x30], rcx
jmp 0x180094099
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x1800940b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x18], r15
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800940c1
call fcn.180299904
mov qword [rbp - 0x30], r15
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x1800940f8
mov eax, r14d
lock xadd dword [rdi + 8], eax
sub eax, 1
jne 0x1800940f4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], r14d
cmp r14d, 1
jne 0x1800940f4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x180094124
mov rcx, qword [rbx]
lea r8, [rcx - 1]
cmp r8, 0xfffffffffffffffd
ja 0x180094113
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r15
mov edx, 8
mov rcx, rbx
call fcn.180299904
mov qword [rbp - 0x50], r15
movzx eax, sil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18009a930
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x28], 0
mov ecx, 1
call fcn.1802994e4
mov rbx, rax
mov qword [rsp + 0x28], rax
mov byte [rax], 0
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x34]
call fcn.18029c350
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18009a9a5
cmp dword [rsp + 0x34], 6
setae al
mov byte [rbx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.1801e31c0
movzx ebx, al
lea rcx, [rsp + 0x28]
call fcn.1801e1f20
movzx eax, bl
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x160
pop rbx
ret
Function at 0x1800a5930
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15d, r8d
mov rbx, rdx
mov rsi, rcx
xor r12d, r12d
mov qword [rbp - 0x39], r12
lea ecx, [r12 + 8]
call fcn.1802994e4
mov qword [rbp - 0x21], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x20], 3
lea r9d, [r12 + 1]
mov r8d, 0x80000000
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.18016bb70
mov rbx, qword [rbp - 0x39]
test al, al
je 0x1800a5ad8
mov edi, r12d
test rbx, rbx
je 0x1800a59ed
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1800a59ed
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x1800a59de
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800a59ed
mov edi, dword [rbp - 0x21]
shl rdi, 0x20
mov rax, r14
add rdi, r14
jne 0x1800a59f6
test r15d, r15d
je 0x1800a5ad8
lea edx, [rdi + r15]
mov rcx, rsi
call fcn.1800a6c30
test al, al
je 0x1800a5ad8
xor eax, eax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
mov r15d, edi
mov edx, edi
lea rcx, [rbp - 0x19]
call fcn.18018c430
mov r14, rax
test rax, rax
je 0x1800a5aca
mov dword [rbp - 0x29], r12d
test rbx, rbx
je 0x1800a5ac2
cmp qword [rbx], 0xffffffffffffffff
je 0x1800a5ac2
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x29]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800a5ac2
cmp dword [rbp - 0x29], edi
jne 0x1800a5ac2
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
je 0x1800a5aca
xor eax, eax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
lea rdx, [rsi + 0xa0]
lea rcx, [rbp + 7]
call fcn.18017f5d0
nop
mov r8d, r15d
mov rdx, r14
mov rcx, rdi
call fcn.18029c510
mov dil, 1
lea rcx, [rbp + 7]
call fcn.18017f740
jmp 0x1800a5acd
mov rcx, rsi
call fcn.1800a6db0
xor dil, dil
lea rcx, [rbp - 0x19]
call fcn.18018c390
jmp 0x1800a5adb
xor dil, dil
test rbx, rbx
je 0x1800a5b07
mov rcx, qword [rbx]
lea r8, [rcx - 1]
cmp r8, 0xfffffffffffffffd
ja 0x1800a5af6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r12
mov edx, 8
mov rcx, rbx
call fcn.180299904
mov qword [rbp - 0x39], r12
movzx eax, dil
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800bdce0
Capabilities:
Copy file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15, r8
mov rbx, rdx
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x20], r12d
cmp qword [rdx + 0x10], rdi
je 0x1800bdf29
cmp qword [r8 + 0x10], rdi
je 0x1800bdf29
mov rcx, rdx
call fcn.1801dbe90
test al, al
je 0x1800bdf29
mov rcx, r15
call fcn.1801dbe90
test al, al
je 0x1800bdf29
lea edx, [r12 + 0x18]
lea rcx, [rbp - 0x79]
call fcn.18003df50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r12
lea rdx, [rbp - 0x79]
mov rcx, rbx
call fcn.1801dcda0
mov esi, r12d
mov rax, qword [rbp - 0x71]
mov rcx, qword [rbp - 0x79]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x1800bdf1c
mov ebx, r12d
lea r13d, [r12 + 1]
nop word [rax + rax]
lea rdx, [rbx + rcx]
lea rcx, [rbp - 0x21]
call fcn.180037a20
nop
cmp qword [rbp - 0x11], 0
je 0x1800bdef4
lea rdx, [rbp - 0x21]
lea rcx, [rsp + 0x30]
call fcn.1801dcc70
or edi, 1
mov dword [rsp + 0x20], edi
mov r8, rax
mov rdx, r15
lea rcx, [rbp - 1]
call fcn.18016fed0
nop
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x30]
call fcn.1800338a0
lea rcx, [rbp - 0x21]
call fcn.1801dbe90
test al, al
jne 0x1800bdeea
lea rcx, [rbp - 1]
call fcn.1801dbd90
test al, al
jne 0x1800bdeea
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rcx, qword [rbp - 0x21]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1800bdeea
xor r14b, r14b
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x21]
call fcn.1801f0cb0
movzx r14d, r14b
test al, al
cmovne r14d, r13d
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 1]
call fcn.1801f0cb0
test al, al
jne 0x1800bdeb0
test r14b, r14b
je 0x1800bded6
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rdx, qword [rbp - 0x61]
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
lea rcx, [rbp - 0x61]
call fcn.1800338a0
nop
lea rcx, [rbp - 0x41]
call fcn.1800338a0
nop
lea rcx, [rbp - 1]
call fcn.1800338a0
nop
lea rcx, [rbp - 0x21]
call fcn.1800338a0
inc rsi
add rbx, 0x20
mov rax, qword [rbp - 0x71]
mov rcx, qword [rbp - 0x79]
sub rax, rcx
sar rax, 5
cmp rsi, rax
jb 0x1800bddb0
lea rcx, [rbp - 0x79]
call fcn.180052e90
mov al, 1
jmp 0x1800bdf2b
xor al, al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800d0f30
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x38], 0
jne 0x1800d0f47
jmp 0x1800d0f98
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x38]
mov rax, qword [rax]
call qword [rax]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jl 0x1800d0f7e
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x1800d0f98
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x38]
mov rax, qword [rax]
mov dl, 1
call qword [rax + 0x18]
add rsp, 0x28
ret

Function at 0x1800e06f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [r8 - 1]
mov r15, r9
sar rbp, 1
mov r13, r8
mov rdi, rdx
mov rsi, rcx
mov r14, rdx
mov rbx, rdx
cmp rdx, rbp
jge 0x1800e0773
add rbx, rbx
lea rax, [rbx + 2]
imul rcx, rax, 0x5d8
add rcx, rsi
lea rdx, [rcx - 0x5d8]
call fcn.180108d30
movzx eax, al
mov r8d, 0x5d8
xor rax, 1
inc rax
add rbx, rax
imul rdx, rbx, 0x5d8
imul rcx, rdi, 0x5d8
add rdx, rsi
add rcx, rsi
call fcn.18029c510
mov rdi, rbx
cmp rbx, rbp
jl 0x1800e0722
cmp rbx, rbp
jne 0x1800e07a8
test r13b, 1
jne 0x1800e07a8
imul rdx, r13, 0x5d8
imul rcx, rdi, 0x5d8
add rdx, 0xfffffffffffffa28
mov r8d, 0x5d8
add rdx, rsi
add rcx, rsi
call fcn.18029c510
lea rdi, [r13 - 1]
cmp r14, rdi
jge 0x1800e07f0
nop dword [rax]
lea rbx, [rdi - 1]
mov rdx, r15
sar rbx, 1
imul rbp, rbx, 0x5d8
add rbp, rsi
mov rcx, rbp
call fcn.180108d30
test al, al
je 0x1800e07f0
imul rcx, rdi, 0x5d8
mov rdx, rbp
mov r8d, 0x5d8
add rcx, rsi
call fcn.18029c510
mov rdi, rbx
cmp r14, rbx
jl 0x1800e07b0
imul rcx, rdi, 0x5d8
mov rdx, r15
mov r8d, 0x5d8
add rcx, rsi
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.18029c510
Function at 0x1800f1d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
mov eax, 0x2b00
call fcn.18029a6b0
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x2b18], rbx
mov qword [rsp + 0x2b20], rsi
mov qword [rsp + 0x2b28], rdi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x2af0], rax
mov rsi, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
lea rbx, [rcx + 0x8548]
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x1800f1d9c
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f1d9c
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [rsi + 0x4af0]
cmp byte [rsi + 0x5a89], 0
je 0x1800f1f25
cmp dword [rsi + 0x5aa0], eax
jne 0x1800f1f25
mov r8d, 0x2abe
lea rdx, [rsi + 0x5a89]
lea rcx, [rsp + 0x30]
call fcn.18029c510
mov byte [rsi + 0x5a89], 0
test rbx, rbx
je 0x1800f1df1
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f1dec
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rdi
cmp byte [rsp + 0x46], 0
je 0x1800f1eb2
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x1800f1e1a
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f1e1a
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [rsi + 0x4af0]
cmp dword [rsi + 0x5aa0], eax
jne 0x1800f1f25
test rbx, rbx
je 0x1800f1e44
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f1e3f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x4b08]
mov dword [rsi + 0x4b04], eax
cmp byte [rsi + 0x5a88], 0
jne 0x1800f1f3d
mov r8, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
sub rdx, r8
sar rdx, 3
test rdx, rdx
je 0x1800f1ea4
mov rax, rdi
nop word [rax + rax]
mov rcx, qword [r8 + rax*8]
test rcx, rcx
je 0x1800f1e92
cmp dword [rcx + 0x80], 0xa
je 0x1800f1e9d
inc edi
mov eax, edi
cmp rax, rdx
jae 0x1800f1ea4
jmp 0x1800f1e80
mov byte [rcx + 0x3a2], 1
mov byte [rsi + 0x5a88], 1
mov al, 1
jmp 0x1800f1f3f
mov rcx, qword [rsi + 0x4aa8]
test rcx, rcx
je 0x1800f1f3d
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x58]
test al, al
jne 0x1800f1f3d
lea rdx, [rsp + 0x47]
lea rcx, [rsi + 0x4a38]
call fcn.180128400
test al, al
je 0x1800f1f3d
cmp byte [rsp + 0xcd], 0
jne 0x1800f1efb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x4b08]
mov dword [rsi + 0x4b04], eax
mov eax, dword [rsp + 0x41]
sub eax, dword [rsi + 0x5a84]
mov rcx, rsi
cmp eax, 0x12c
ja 0x1800f1f1a
mov dl, 1
call fcn.1800f1320
mov al, 1
jmp 0x1800f1f3f
xor edx, edx
call fcn.1800f1320
mov al, 1
jmp 0x1800f1f3f
test rbx, rbx
je 0x1800f1f3d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f1f38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rdi
xor al, al
mov rcx, qword [rsp + 0x2af0]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x2b00]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800f92b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1800f92d2
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdx]
mov rcx, rbx
mov qword [rsp + 0x30], rsi
call qword [rax + 0x30]
mov rdx, qword [rbx]
mov rcx, rbx
mov esi, eax
call qword [rdx + 0x28]
mov rdx, rax
test rax, rax
je 0x1800f9341
cmp byte [rdi + 0x28], 0
je 0x1800f930b
mov rsi, qword [rsp + 0x30]
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rax + 4], 0xff
jne 0x1800f9341
mov r8d, dword [rax + 8]
lea eax, [r8 + 0xff]
cmp eax, esi
ja 0x1800f9341
add rdx, 0xff
mov rcx, rdi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18016bf20
mov rsi, qword [rsp + 0x30]
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180105009
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
je 0x1801052a7
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x28], r8d
mov r12, rdx
mov rsi, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x100]
mov rbx, qword [rdi + 0x10]
cmp ebx, 2
jl 0x18010527d
cmp ebx, dword [r9 + 4]
jg 0x18010527d
mov eax, dword [r9]
add eax, ebx
lea edx, [rax*8 + 0x1248]
mov rax, qword [r12]
mov r8d, 8
mov rcx, r12
call qword [rax + 0x58]
mov r14, rax
test rax, rax
je 0x18010527d
cmp dword [rax], 0
jle 0x18010527d
cmp dword [rax + 4], 0
jle 0x18010527d
lea r13d, [rbx*4 + 8]
xor ebp, ebp
xor r15d, r15d
mov dword [rsp + 0x20], 0x7e0
mov dword [rsp + 0x24], 0x43e
nop word [rax + rax]
mov edx, dword [r14]
add edx, 0x1258
add edx, r15d
mov rax, qword [r12]
mov r8d, r13d
mov rcx, r12
call qword [rax + 0x58]
mov rbx, rax
test rax, rax
je 0x18010527d
mov ecx, dword [rax]
shr ecx, 7
and ecx, 0x3f
lea r10, [rax + 8]
test r10, r10
je 0x180105268
cmp ecx, dword [rdi + 0x10]
jne 0x180105268
xor eax, eax
mov edx, eax
test ecx, ecx
je 0x1801051b7
mov r11, qword [rdi + 0x18]
mov r9d, ecx
nop word [rax + rax]
movzx eax, word [r10 + rdx*2]
mov rcx, rdi
cmp r11, 8
jb 0x180105141
mov rcx, qword [rdi]
movzx r8d, word [rcx + rdx*2]
movzx ecx, ax
and cx, 0x1f
je 0x180105170
cmp cx, 0x18
jae 0x180105268
movzx eax, ax
and eax, 0x1f
lea rcx, [0x180000000]
mov rax, qword [rcx + rax*8 + 0x36a420]
jmp 0x18010519f
movzx ecx, ax
and cx, word [rsp + 0x20]
dec cx
cmp cx, word [rsp + 0x24]
ja 0x180105268
movzx eax, ax
shr rax, 5
and eax, 0x3f
lea rcx, [0x180000000]
mov rax, qword [rcx + rax*8 + 0x36a310]
cmp word [rax], r8w
jne 0x180105268
inc rdx
cmp rdx, r9
jl 0x180105130
xor eax, eax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x5c], 0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], ax
mov byte [rsp + 0x80], 0
mov qword [rsp + 0x40], rbx
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x5c], 1
mov rax, qword [rsi + 8]
cmp qword [rsi + 0x10], rax
je 0x180105223
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180101800
add qword [rsi + 8], 0x48
jmp 0x180105233
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.180101610
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rsp + 0x40]
cmp rdx, 0xbb8
jae 0x180105278
call fcn.1801003a0
inc ebp
add r15d, r13d
cmp ebp, dword [r14 + 4]
jge 0x18010527d
jmp 0x1801050d0
call fcn.1801003a0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18012e700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r8
movzx ebp, dl
mov rsi, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
add rcx, 0x70
lea rdx, [rsp + 0x40]
call fcn.18007d5d0
nop
cmp qword [rsp + 0x40], 0
je 0x18012e813
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movzx r8d, bpl
xor r8b, 1
lea rdx, [rsi + 8]
lea r9, [rsp + 0x50]
call qword [rax + 0x18]
test al, al
je 0x18012e808
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp rbx, rdi
je 0x18012e808
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18012e7ae
mov rdx, qword [rbx]
xor ecx, ecx
movzx eax, word [rdx]
cmp ax, 0x30
jb 0x18012e7e2
nop dword [rax]
cmp ax, 0x39
ja 0x18012e7e2
lea r8, [rcx + rcx*4]
movzx ecx, ax
lea rcx, [rcx + r8*2]
add rcx, 0xffffffffffffffd0
add rdx, 2
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x18012e7c0
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 1
movzx r9d, bpl
mov r8d, ecx
lea rdx, [rbx + 0x20]
mov rcx, rsi
call fcn.18012f040
add rbx, 0x40
cmp rbx, rdi
jne 0x18012e7a1
lea rcx, [rsp + 0x50]
call fcn.18012f180
nop
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x18012e849
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18012e849
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18012e849
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret