joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a2780
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x40], esi
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x44]
call fcn.18011a1e0
xor r9d, r9d
mov r8d, edi
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
test eax, eax
je 0x1800a281f
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180015970
nop
jmp 0x1800a281f
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180119820
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800a6750
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rsi, rdx
mov ebx, r12d
mov edi, r12d
call fcn.1800a5cd0
mov rcx, rsi
test eax, eax
je 0x1800a678c
call fcn.1800a5d40
mov rbp, rax
jmp 0x1800a67b0
call fcn.1800a5d40
mov rsi, rax
test rax, rax
je 0x1800a6857
mov rcx, rax
call fcn.1800a5f20
mov rcx, rsi
mov rbp, rax
call fcn.18011a0d4
test rbp, rbp
je 0x1800a6857
call fcn.1800a5cd0
test eax, eax
je 0x1800a6800
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1800a67e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x1800a683a
inc ebx
cmp ebx, 5
jge 0x1800a683a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800a67c2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1800a6826
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x1800a683a
inc ebx
cmp ebx, 5
jge 0x1800a683a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800a6800
mov rcx, rbp
call fcn.18011a0d4
cmp esi, 0xffffffff
jne 0x1800a684c
cmp edi, 2
je 0x1800a6852
mov r12d, 0xa0a
mov eax, r12d
jmp 0x1800a685c
mov eax, 7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1800acab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x1800acaf1
cmp byte [rdx], r10b
je 0x1800acae9
inc rbx
cmp byte [rbx], r10b
jne 0x1800acae1
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x1800acc2d
mov qword [rsp + 0x40], r14
lea r14, [0x18018aba0]
nop dword [rax]
cmp edi, 2
jge 0x1800acb1e
mov r9d, edi
xor r9d, 1
jmp 0x1800acb21
mov r9d, edi
test rbp, rbp
je 0x1800acb84
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x1800acb6f
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x1800acb6f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1800acb50
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x1800acc01
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x1800acbda
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x1800acbcf
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1800acbb0
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x1800acbdc
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.1800a5b70
test rax, rax
je 0x1800acbfe
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x1800acc0c
jmp 0x1800acc01
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x1800acb10
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x1800acc14
Function at 0x1800acc40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x1800acc78
cmp byte [rdx], r9b
je 0x1800acc70
inc rbx
cmp byte [rbx], r9b
jne 0x1800acc68
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x1800acd9c
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x18018aba0]
nop dword [rax]
cmp edi, 2
jge 0x1800accac
mov eax, edi
xor eax, 1
jmp 0x1800accae
mov eax, edi
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x1800acd04
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x1800accef
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x1800accef
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1800accd0
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x1800acd71
cmp qword [r10 + 0x30], 0
je 0x1800acd4a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x1800acd3f
nop word [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1800acd20
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x1800acd4c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.1800a5b70
test rax, rax
je 0x1800acd6e
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x1800acd7c
jmp 0x1800acd71
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x1800acca0
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x1800acd89

Function at 0x1800adeb0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x1800adecf
cmp byte [rdx], 0
je 0x1800adec8
inc rax
cmp byte [rax], 0
jne 0x1800adec0
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.1800a5c40
Function at 0x1800b2890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x1800b28c4
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180205808]
test rax, rax
je 0x1800b28d2
call rax
shl ebx, 4
mov ecx, ebx
call fcn.1800b1cf0
mov rcx, qword [0x180205810]
mov rbx, rax
test rcx, rcx
je 0x1800b28ed
call rcx
test rbx, rbx
je 0x1800b28b7
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.1800a4cd0
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x1801fc880]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call fcn.18011a1e0
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x1800b2a03
mov qword [rsp + 0x30], rbp
lea rbp, [0x18018aba0]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x1800b297e
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x1800b2960
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x1800b29d6
mov eax, dword [r9]
test eax, eax
je 0x1800b299e
mov rcx, qword [r9 + 8]
jmp 0x1800b29a1
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x1800b29d6
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800b29cc
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x1800b29f2
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x1800b29f2
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x1800b29ea
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x1800b2950
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1800b2a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x18018aba0]
test r10d, r10d
je 0x1800b2a89
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x1800b2a7f
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x1800b2a60
xor edx, edx
div r10d
mov r13d, edx
jmp 0x1800b2a8c
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.1800a5b70
mov r11, rax
test rax, rax
je 0x1800b2b2f
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x1800b2b1f
mov rax, qword [rax + 8]
test rax, rax
je 0x1800b2ac8
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x1800b2acf
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x1800b2adf
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800b2b01
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x1800b2aff
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.1800a4cd0
add dword [rbx + 4], 0xffffffff
jne 0x1800b2b27
mov rcx, rbx
call fcn.1800a5aa0
mov rax, rdi
jmp 0x1800b2bf6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x1800b2bf6
test r12, r12
je 0x1800b2bf4
mov ecx, 0x28
call fcn.1800b1cf0
mov rdi, rax
test rax, rax
jne 0x1800b2b52
mov rax, r12
jmp 0x1800b2bf6
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x1800b2bb4
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1800b2bb4
add edx, edx
mov rcx, rbx
call fcn.1800b2890
test eax, eax
je 0x1800b2bb4
xor eax, eax
test esi, esi
jle 0x1800b2bad
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x1800b2b90
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800b2bd4
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.1800a5b00
jmp 0x1800b2bf4
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x1800b2be8
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1800b7460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800b75be
test rdx, rdx
je 0x1800b75be
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x1800b752b
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x1800b752b
xor cl, dl
test cl, 0x10
jne 0x1800b752b
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x1800b752b
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.1800b7460
test eax, eax
jne 0x1800b752b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1800b7460
test eax, eax
jne 0x1800b752b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.1800ac840
test eax, eax
jne 0x1800b752b
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x1800b752b
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x1800b752b
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x1800b753b
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x1800b752b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x1800b7577
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x1800b7577
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800b7577
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x1800b752b
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1800b752b
call fcn.1800a5010
test eax, eax
je 0x1800b7577
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x1800b759d
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x1800b75b1
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x1800b752b
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1800bc100
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.1800bbf80
test eax, eax
jne 0x1800bc322
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.1800a5cd0
test eax, eax
je 0x1800bc1cc
xor esi, esi
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov rcx, rdi
add rcx, rcx
call fcn.18011a114
mov rbx, rax
test rax, rax
je 0x1800bc22e
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1800bc276
mov rcx, rbx
call fcn.18011a0d4
mov rbx, rsi
jmp 0x1800bc276
xor esi, esi
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call fcn.18011a114
mov rdi, rax
test rax, rax
je 0x1800bc22e
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1800bc263
mov rcx, rdi
call fcn.18011a0d4
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180119820
add rsp, 0x168
ret
mov rcx, rdi
call fcn.1800a5f20
mov rcx, rdi
mov rbx, rax
call fcn.18011a0d4
test rbx, rbx
je 0x1800bc22e
call fcn.1800a5cd0
test eax, eax
je 0x1800bc2cb
cmp word [rbx], 0
mov rax, rbx
je 0x1800bc2a5
nop dword [rax]
cmp word [rax], 0x5c
je 0x1800bc2a2
add rax, 2
cmp word [rax], 0
jne 0x1800bc290
jmp 0x1800bc2a5
mov word [rax], si
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edi, eax
jmp 0x1800bc309
cmp byte [rbx], 0
mov rax, rbx
je 0x1800bc2e5
cmp byte [rax], 0x5c
je 0x1800bc2e2
inc rax
cmp byte [rax], 0
jne 0x1800bc2d3
jmp 0x1800bc2e5
mov byte [rax], 0
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edi, eax
mov rcx, rbx
call fcn.18011a0d4
test edi, edi
je 0x1800bc22e
mov eax, dword [rsp + 0x34]
jmp 0x1800bc233
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180119820
add rsp, 0x168
ret
Function at 0x1800c4ea0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x180209280]
mov qword [0x180209280], rax
mov qword [0x180209288], rax
mov qword [0x180209290], rax
mov qword [0x180209298], rax
mov qword [0x1802092a0], rax
mov qword [0x1802092a8], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.1800f9a90
test eax, eax
jne 0x1800c4f95
mov qword [rsp + 0x20], rbx
cmp dword [0x1801fc854], eax
jne 0x1800c4efb
xor ebx, ebx
jmp 0x1800c4f17
mov ecx, 2
call qword [0x1801fc8b8]
mov rbx, rax
test rax, rax
je 0x1800c4f17
mov rcx, rax
call qword [0x1801fc8c8]
mov rcx, qword [0x180205800]
lea r9, [0x1801fcc50]
cmp rcx, r9
jne 0x1800c4f33
mov rcx, qword [0x1801fcc60]
jmp 0x1800c4f6d
test rcx, rcx
je 0x1800c4f6d
cmp qword [rcx + 0x10], 0
lea rax, [rcx + 0x10]
mov rdx, rcx
je 0x1800c4f5c
mov r8, qword [rax]
cmp r8, r9
je 0x1800c4f5c
cmp qword [r8 + 0x10], 0
lea rax, [r8 + 0x10]
mov rdx, r8
jne 0x1800c4f46
cmp qword [rdx + 0x10], r9
jne 0x1800c4f6d
mov rax, qword [0x1801fcc60]
mov qword [rdx + 0x10], rax
mov qword [0x1801fcc60], rcx
mov qword [0x180205800], r9
test rbx, rbx
je 0x1800c4f89
mov rcx, rbx
call qword [0x1801fc8d8]
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800ec390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rbp, r8
mov r8, rcx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x20], r15d
mov r14d, dword [rcx]
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov edi, r15d
mov esi, r15d
mov r12, r15
test r14d, r14d
jle 0x1800ec559
nop word [rax + rax]
cmp esi, dword [rbp + 8]
jg 0x1800ec54c
mov rbx, qword [r13]
cmp byte [rbx], 0x98
jne 0x1800ec54c
cmp dword [rbx + 0x30], r9d
jne 0x1800ec54c
mov rdx, rbx
mov rcx, r8
call fcn.1800e5d40
mov rdx, rax
test rax, rax
jne 0x1800ec42c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
cmp qword [rbp], r15
je 0x1800ec463
cmp esi, dword [rbp + 8]
jge 0x1800ec463
mov rax, qword [rbp + 0x10]
mov r9d, dword [rax + r12*4]
mov rax, qword [rbp + 0x20]
cmp r9d, dword [rax + 8]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rbp + 0x48]
movzx r10d, byte [rax + r12]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + r12*8]
jmp 0x1800ec46d
mov r8, qword [rdx]
or r9d, 0xffffffff
mov r10d, r15d
movsx eax, word [rbx + 0x34]
cmp eax, r9d
jne 0x1800ec516
mov rdx, qword [rdx]
lea rbx, [0x18018aba0]
movzx ecx, byte [rdx]
test cl, cl
je 0x1800ec4ad
nop dword [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x1800ec4ad
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1800ec490
movzx eax, byte [r8]
movzx ecx, byte [rax + rbx]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbx]
cmp eax, ecx
jne 0x1800ec516
movzx eax, byte [r13 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp r12, rcx
jle 0x1800ec4e1
cmp eax, dword [rsp + 0x20]
jne 0x1800ec590
jmp 0x1800ec4e5
mov dword [rsp + 0x20], eax
inc edi
add r13, 0x20
test r9d, r9d
jns 0x1800ec523
mov r9d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov r8d, edi
call fcn.1800b96a0
test eax, eax
jne 0x1800ec523
mov edi, r14d
jmp 0x1800ec523
movsxd rax, dword [rsp + 0x98]
cmp r12, rax
jge 0x1800ec53f
mov r9d, dword [rsp + 0x88]
inc esi
inc r12
cmp edi, r14d
jge 0x1800ec54c
mov r8, qword [rsp + 0x70]
jmp 0x1800ec3f0
cmp esi, dword [rbp + 8]
jne 0x1800ec590
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r15d
mov rax, qword [rsp + 0xa0]
setne r15b
cmp edi, r14d
mov dword [rax], r15d
jl 0x1800ec579
mov eax, 1
jmp 0x1800ec592
cmp byte [rbp + 0x2c], 0
je 0x1800ec590
cmp esi, dword [rbp + 8]
jne 0x1800ec590
mov r8d, edi
call fcn.1800b96a0
test eax, eax
je 0x1800ec572
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801139c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r13, qword [rcx + 0x18]
mov r15, qword [rcx]
mov eax, r8d
mov r12, rdx
mov r14, rcx
test rdx, rdx
je 0x180113bf5
mov qword [r11 - 0x28], rdi
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
xor edi, edi
nop
cmp eax, 0x63
jne 0x180113a0d
movzx edx, byte [r12 + 1]
jmp 0x180113a10
movzx edx, al
mov byte [r14 + 0x1e1], dl
movzx ecx, byte [r12]
sub ecx, 0x69
je 0x180113b19
sub ecx, 1
je 0x180113ae8
cmp ecx, 1
je 0x180113a90
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r15
call fcn.1800be070
lea r8, [rsp + 0x30]
mov rcx, r14
mov rdx, rax
mov byte [rsp + 0x30], 4
mov dword [rsp + 0x34], edi
mov rbx, rax
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], edi
call fcn.180106fd0
test rbx, rbx
je 0x180113b79
mov rdx, rbx
mov rcx, r15
call fcn.1800ae690
mov rdx, rbx
mov rcx, r15
call fcn.1800a4d80
jmp 0x180113b79
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.1800c7c80
mov rdx, qword [r12 + 0x30]
movzx edi, byte [r14 + 0x1e1]
xor r8d, r8d
mov rcx, r15
mov rsi, rax
call fcn.1800b69e0
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c2f50
mov r9, rsi
mov r8, rbx
mov rcx, r14
mov rdx, rax
mov dword [rsp + 0x20], edi
call fcn.180110e20
xor edi, edi
jmp 0x180113b79
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.1800c7c80
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c2f50
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.180114650
jmp 0x180113b79
movzx ebp, dl
mov rdx, qword [r12 + 0x38]
mov rcx, r15
call fcn.1800b6b10
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r15
mov rsi, rax
call fcn.1800be070
mov rdx, qword [r12 + 0x30]
xor r8d, r8d
mov rcx, r15
mov rdi, rax
call fcn.1800b69e0
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c2f50
mov r9, rdi
mov r8, rbx
mov rcx, r14
mov rdx, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
call fcn.18010c410
xor edi, edi
cmp byte [r12], 0x74
je 0x180113bc9
movsxd rbx, dword [r13 + 0x18]
cmp dword [r13 + 0x1c], ebx
jg 0x180113b96
mov rcx, r13
call fcn.1800b5710
test eax, eax
jne 0x180113bc9
mov rax, qword [r13 + 0x20]
inc dword [r13 + 0x18]
lea rcx, [rbx + rbx*2]
mov byte [rax + rcx*8], 0x3a
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], edi
mov dword [rax + rcx*8 + 8], edi
mov dword [rax + rcx*8 + 0xc], edi
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], 0
mov byte [r13 + 0xa2], 0
mov r12, qword [r12 + 0x40]
mov eax, dword [rsp + 0x80]
test r12, r12
jne 0x180113a00
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
ret