joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050080
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180141b28], ebp
je 0x1800500d7
cmp rbx, 0x20
jae 0x1800500c0
xor ecx, ecx
jmp 0x1800500c2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180141b28], ebp
jne 0x1800500b6
cmp qword [0x180141b30], r15
je 0x1800501d3
test rdi, rdi
jne 0x1800500f7
mov ecx, esi
call fcn.18004fa40
mov ebp, eax
jmp 0x1800501d8
mov ecx, dword [0x18014247c]
mov ebx, r15d
test ecx, ecx
je 0x18005011f
mov r8, qword [0x180142470]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180050129
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180050110
mov ebp, 4
jmp 0x1800501d8
cmp ebx, 0xffffffff
je 0x18005011f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800501ca
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18004f780
mov edx, esi
mov ecx, ebx
call fcn.18004f930
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800501d8
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800501b4
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800501aa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180050180
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180141b30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800501d8
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800501d8
mov ebp, 2
xchg dword [0x180141b28], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180052930
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov ebx, edx
mov rdi, rcx
test edx, edx
jne 0x180052958
call fcn.1800527a0
mov r8, rsi
mov edx, ebx
mov rcx, rdi
call fcn.1800d77f0
test eax, eax
je 0x180052a19
cmp ebx, 1
jne 0x180052a5d
xor ecx, ecx
call fcn.180073720
mov qword [0x180141db0], rax
test rax, rax
je 0x180052a19
movabs rax, 0xd6cb8248a6ccd101
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0x958c58434540b289
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x396810444eb372fc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0x374c07797228bb5e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
call fcn.180052a70
mov rcx, rax
call fcn.180073720
test rax, rax
je 0x180052a19
mov rcx, rdi
call fcn.180050ca0
test al, al
jne 0x180052a30
call fcn.1800527a0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800d7380
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
lea r8, [0x1800528e0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180052a5d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180052a1b

Function at 0x1800536d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rcx, qword [0x180141f10]
mov rbx, rdx
movzx eax, word [rcx + 0x50]
cmp eax, 0xffff
je 0x180053776
mov rdi, qword [rcx + 0x40]
movabs rbp, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
mov r11d, eax
add r11, r11
mov r10, qword [rdi + r11*8]
test r10, r10
je 0x180053769
mov r9, qword [r10]
mov r8, rbp
mov rax, r9
cmp byte [r9], 0
je 0x180053738
nop
inc rax
cmp byte [rax], 0
jne 0x180053730
mov edx, 0
sub rax, r9
je 0x180053764
nop dword [rax]
nop word [rax + rax]
movsx rcx, byte [r9 + rdx]
inc rdx
xor r8, rcx
imul r8, rsi
cmp rdx, rax
jb 0x180053750
cmp r8, rbx
je 0x18005378d
movzx eax, word [rdi + r11*8 + 0xa]
cmp eax, 0xffff
jne 0x180053711
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov rax, r10
jmp 0x180053778
Function at 0x180059590
Capabilities:
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rbp + 0x47], rax
call fcn.180073720
mov rcx, rax
test rax, rax
je 0x1800597c7
movabs rax, 0xb8f1e74ac7c8a32c
mov qword [rsp + 0xe8], rbx
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x29]
mov rax, qword [rbp - 0x49]
movabs rbx, 0xd6b8823ea6add16f
mov qword [rbp - 0x29], rax
movabs rax, 0x958c3b562341d784
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
mov qword [rsp + 0xf0], rdi
movabs rdi, 0x95e958374533b2f0
mov qword [rbp - 0x49], rdi
mov rax, qword [rbp - 0x49]
vmovdqu xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x31], rax
vpxor xmm1, xmm0, xmmword [rbp - 0x39]
vmovdqu xmmword [rbp - 0x29], xmm1
call fcn.180073a00
mov rcx, rax
test rax, rax
jne 0x1800597af
mov dl, 3
call fcn.180072d40
movabs rax, 0xa298e65bcac4b009
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x49], rax
movabs rcx, 0x244a7feb7efe3474
mov rax, qword [rbp - 0x49]
mov r8d, edx
mov qword [rbp - 0x19], rax
movabs rax, 0xd6cb78432054929f
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0x4d6a59453afc17e3
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x176e621a134ec957
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0x2051e1471afccc62
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rdi
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x1f], rax
movabs rax, 0x390410204e9d7291
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x27], rax
movabs rax, 0x374c07797228bb32
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x2f], rax
movabs rax, 0x202292226898a803
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x37], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
vmovdqu xmm0, xmmword [rbp - 0x19]
vpxor xmm3, xmm0, xmmword [rbp + 0x17]
vmovdqu xmm0, xmmword [rbp - 9]
vmovdqu xmm2, xmmword [rbp + 7]
vpxor xmm1, xmm0, xmmword [rbp + 0x27]
mov qword [rbp + 0x3f], rax
lea rax, [rbp - 0x19]
vpxor xmm0, xmm2, xmmword [rbp + 0x37]
vmovq rcx, xmm3
vmovdqu xmmword [rbp + 7], xmm0
vmovdqu xmmword [rbp - 0x19], xmm3
vmovdqu xmmword [rbp - 9], xmm1
test cl, cl
je 0x18005978b
nop dword [rax + rax]
inc rax
mov r8, rax
cmp byte [rax], 0
jne 0x180059780
mov rcx, qword [0x180141318]
sub r8d, edx
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x1800597b7
mov eax, dword [rax + 3]
mov rax, qword [rax + rcx + 7]
mov rbx, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800d7380
add rsp, 0xd0
pop rbp
ret
Function at 0x180064f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [0x1801423b8]
mov rbx, rcx
shl rax, 5
mov rdi, r8
add rax, qword [0x1801414b8]
cmp qword [rax + 0x10], 8
lea rcx, [rax + 0x18]
jbe 0x180064fb2
mov rcx, qword [rcx]
cmp byte [rcx], 0
je 0x1800651de
mov rax, qword [0x180141f08]
cmp byte [rax + 0x40], 0
jne 0x1800651de
mov ecx, dword [rdx + 0x64]
call qword [0x1801422d0]
cmp byte [0x1801422ac], 0
mov rax, qword [rbx + 0x50]
je 0x180064ff6
or rax, 2
mov byte [0x1801422ac], 0
mov qword [rbx + 0x50], rax
jmp 0x1800651de
test al, 2
je 0x1800651de
mov ecx, dword [0x180141ae8]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1801422b0], ecx
jle 0x18006518f
lea rcx, [0x1801422b0]
call fcn.1800d7590
cmp dword [0x1801422b0], 0xffffffff
jne 0x18006518f
movabs rcx, 0x73efd1b1808ddeb2
movabs rax, 0xf451dd7512e20f00
mov qword [rsp + 0x20], rax
movabs r9, 0xcbf29ce484222325
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x55025bae763fdf84
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0xc47e71b3b9440efb
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movabs rax, 0x9a14b80673a05043
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0xa6f65830f4bb6f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
movabs rax, 0xc47e02d4d828489d
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
vmovdqu xmm0, xmmword [rsp + 0x30]
vpxor xmm2, xmm0, xmmword [rsp + 0x50]
vmovdqu xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
vpxor xmm1, xmm0, xmmword [rsp + 0x60]
vmovq rcx, xmm2
vmovdqu xmmword [rsp + 0x40], xmm1
vmovdqu xmmword [rsp + 0x30], xmm2
test cl, cl
je 0x180065140
inc rax
cmp byte [rax], 0
jne 0x180065138
lea rcx, [rsp + 0x30]
mov r8d, 0
sub rax, rcx
je 0x180065175
movabs r10, 0x100000001b3
nop word [rax + rax]
movsx rdx, byte [rsp + r8 + 0x30]
inc r8
xor r9, rdx
imul r9, r10
cmp r8, rax
jb 0x180065160
mov rcx, r9
call fcn.18006e5c0
lea rcx, [0x1801422b0]
mov dword [0x1801422a0], eax
call fcn.1800d7524
mov eax, dword [0x1801422a0]
test byte [rax + rdi], 1
je 0x1800651a4
mov byte [0x1801422ac], 1
jmp 0x1800651de
mov rax, qword [0x1801423c0]
mov r8, qword [0x1801422c8]
shl rax, 5
add rax, qword [0x1801414b8]
cmp qword [rax + 0x10], 8
lea rdi, [rax + 0x18]
jbe 0x1800651cb
mov rdi, qword [rdi]
mov edx, 0x64
xor ecx, ecx
call r8
cmp eax, dword [rdi]
jg 0x1800651de
and qword [rbx + 0x50], 0xfffffffffffffffd
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800d7380
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x180069ab0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x18
movsxd rsi, dword [rsp + 0x58]
mov r11, rdx
mov qword [rsp + 0x30], rbx
mov r10, rcx
mov qword [rsp + 0x38], rdi
mov rbp, rdx
lea rdi, [r8 - 1]
mov qword [rsp + 0x40], r12
sar rdi, 1
mov rbx, rdx
mov qword [rsp + 8], r14
mov r14, r8
cmp rdx, rdi
jge 0x180069b64
mov qword [rsp + 0x10], r13
mov r13d, 0x30
mov qword [rsp], r15
nop word [rax + rax]
lea rdx, [rbx + rbx]
lea rax, [rdx + rdx*2]
lea r8, [r10 + rax*8]
vmovss xmm0, dword [rsi + r8 + 0x30]
vcomiss xmm0, dword [rsi + r8 + 0x18]
lea rax, [r11 + r11*2]
seta cl
movzx ebx, cl
xor rbx, 1
inc rbx
add rbx, rdx
mov edx, 0x18
test cl, cl
mov r11, rbx
cmove rdx, r13
vmovups xmm0, xmmword [rdx + r8]
vmovups xmmword [r10 + rax*8], xmm0
vmovsd xmm1, qword [rdx + r8 + 0x10]
vmovsd qword [r10 + rax*8 + 0x10], xmm1
cmp rbx, rdi
jl 0x180069b00
mov r15, qword [rsp]
mov r13, qword [rsp + 0x10]
cmp rbx, rdi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jne 0x180069ba0
test r14b, 1
jne 0x180069ba0
lea rax, [r11 + r11*2]
lea rcx, [r14 + r14*2]
vmovups xmm0, xmmword [r10 + rcx*8 - 0x18]
vmovups xmmword [r10 + rax*8], xmm0
vmovsd xmm1, qword [r10 + rcx*8 - 8]
vmovsd qword [r10 + rax*8 + 0x10], xmm1
lea r11, [r14 - 1]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
cmp rbp, r11
jge 0x180069c03
movsxd r8, dword [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
lea rcx, [r11 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*2]
lea rax, [rsi + rdx*8]
vmovss xmm0, dword [rax + r10]
vcomiss xmm0, dword [r8 + r9]
jbe 0x180069c03
lea rax, [r11 + r11*2]
mov r11, rcx
vmovups xmm0, xmmword [r10 + rdx*8]
vmovups xmmword [r10 + rax*8], xmm0
vmovsd xmm1, qword [r10 + rdx*8 + 0x10]
vmovsd qword [r10 + rax*8 + 0x10], xmm1
cmp rbp, rcx
jl 0x180069bc0
vmovups xmm0, xmmword [r9]
lea rax, [r11 + r11*2]
vmovups xmmword [r10 + rax*8], xmm0
vmovsd xmm1, qword [r9 + 0x10]
vmovsd qword [r10 + rax*8 + 0x10], xmm1
add rsp, 0x18
pop rsi
pop rbp
ret
Function at 0x18006e5c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x180141d78]
mov rbx, rcx
mov rcx, qword [0x180141d80]
cmp rax, rcx
je 0x18006e60c
cmp qword [rax], rbx
je 0x18006e5ff
add rax, 0x10
cmp rax, rcx
jne 0x18006e5f1
cmp rax, rcx
je 0x18006e60c
mov eax, dword [rax + 8]
jmp 0x18006e7f6
mov dl, 3
mov qword [rsp + 0xc8], rdi
call fcn.180072d40
mov rdi, rax
lea rdx, [rsp + 0x40]
movabs rax, 0xb437560a0cf72273
mov r8d, edx
mov qword [rsp + 0x30], rax
movabs rax, 0x8b4c8f74ac055121
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0x85e65d4999d0f151
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0x6d893b2d864b4bba
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0x1ac980c3e770900e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xd2f5b95e2325bfca
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0xc017326f609e4315
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0xe46ceb1ac563714e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0xea807d3dfca39737
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
movabs rax, 0x4ded5748ef2d6bc8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x88], rax
movabs rax, 0x69a8e8e38f04f979
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x90], rax
movabs rax, 0xd2f5b95e230585a2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
vmovdqu xmm0, xmmword [rsp + 0x40]
vpxor xmm3, xmm0, xmmword [rsp + 0x70]
vmovdqu xmm0, xmmword [rsp + 0x50]
vmovdqu xmm2, xmmword [rsp + 0x60]
vpxor xmm1, xmm0, xmmword [rsp + 0x80]
mov qword [rsp + 0x98], rax
vpxor xmm0, xmm2, xmmword [rsp + 0x90]
vmovq rax, xmm3
vmovdqu xmmword [rsp + 0x60], xmm0
vmovdqu xmmword [rsp + 0x40], xmm3
vmovdqu xmmword [rsp + 0x50], xmm1
test al, al
je 0x18006e7bb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x18006e7b0
mov rcx, qword [0x180141318]
sub r8d, edx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
or word [rdi + 8], 6
mov rdx, rbx
mov rcx, rdi
call fcn.18006e850
mov rdi, qword [rsp + 0xc8]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800d7380
add rsp, 0xb0
pop rbx
ret
Function at 0x18006e850
Capabilities:
Encrypt data using rc4 ksa
Write file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r9, rdx
xor r11d, r11d
movzx edx, word [rcx + 8]
mov rbx, rcx
mov eax, 0xa
test dl, 4
je 0x18006e891
mov r8d, 0x10
lea r11, [0x1801301b4]
jmp 0x18006e8b3
test dl, 0x10
je 0x18006e89e
mov r8d, 8
jmp 0x18006e8b3
mov r8, rax
test dl, 0x20
je 0x18006e8b6
mov r8d, 2
lea r11, [0x1801301b8]
mov eax, r8d
mov byte [rsp + 0x72], 0
lea rcx, [rsp + 0x72]
test r9, r9
jne 0x18006e8d4
lea rcx, [rsp + 0x71]
mov byte [rsp + 0x71], 0x30
jmp 0x18006ea1f
lea r10, [0x180000000]
cmp eax, 0xa
jne 0x18006e983
cmp r9, 0x64
jb 0x18006e949
mov qword [rsp + 0xa0], rdi
movabs rdi, 0x47ae147ae147ae15
nop dword [rax]
mov r8, r9
mov rax, rdi
mul r9
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 6
imul rax, r8, 0x64
sub r9, rax
movzx eax, byte [r10 + r9*2 + 0xfc181]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r10 + r9*2 + 0xfc180]
mov r9, r8
mov byte [rcx], al
cmp r8, 0x64
jae 0x18006e900
mov rdi, qword [rsp + 0xa0]
dec rcx
mov rdx, rcx
cmp r9, 0xa
jae 0x18006e965
movzx eax, byte [r9 + r10 + 0x12fd78]
mov byte [rcx], al
jmp 0x18006ea1f
movzx eax, byte [r10 + r9*2 + 0xfc180]
dec rcx
mov byte [rcx], al
movzx eax, byte [r10 + r9*2 + 0xfc181]
mov byte [rdx], al
jmp 0x18006ea1f
cmp eax, 0x10
jne 0x18006ea01
cmp r9, 0x100
jb 0x18006e9cd
nop dword [rax]
nop word [rax + rax]
movzx eax, r9b
shr r9, 8
lea rdx, [rax*2 + 0xfbf70]
movzx eax, byte [rdx + r10 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [rdx + r10]
mov byte [rcx], al
cmp r9, 0x100
jae 0x18006e9a0
dec rcx
mov rdx, rcx
cmp r9, 0x10
jae 0x18006e9e6
movzx eax, byte [r9 + r10 + 0x12fd78]
mov byte [rcx], al
jmp 0x18006ea1f
movzx eax, byte [r10 + r9*2 + 0xfbf70]
dec rcx
mov byte [rcx], al
movzx eax, byte [r10 + r9*2 + 0xfbf71]
mov byte [rdx], al
jmp 0x18006ea1f
xor edx, edx
mov rax, r9
div r8
dec rcx
mov r9, rax
movzx eax, byte [rdx + r10 + 0x12fd78]
mov byte [rcx], al
test r9, r9
jne 0x18006ea01
test r11, r11
je 0x18006ea3c
test byte [rbx + 8], 2
je 0x18006ea3c
movzx eax, byte [r11 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r11]
mov byte [rcx], al
lea r8, [rsp + 0x72]
mov qword [rsp + 0x20], 0
sub r8d, ecx
mov rdx, rcx
mov rcx, qword [0x180141318]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d7380
add rsp, 0x90
pop rbx
ret
Function at 0x18006ea80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r8d, ecx
test r9d, r9d
je 0x18006ea95
lea eax, [r9 - 2]
cmp eax, 0x22
jbe 0x18006ea95
mov rax, rdx
ret
mov r11d, r8d
mov byte [rdx + 0x40], 0
mov eax, r8d
shr r11d, 0x1f
neg eax
lea rcx, [rdx + 0x40]
test r11b, r11b
cmovne r8d, eax
test r8d, r8d
jne 0x18006eabf
dec rcx
mov rax, rcx
mov byte [rcx], 0x30
ret
cmp r9d, 0xa
jne 0x18006eb55
lea r9, [0x1800fc180]
cmp r8d, 0x64
jb 0x18006eb10
nop word [rax + rax]
mov eax, 0x51eb851f
mul r8d
shr edx, 5
imul eax, edx, 0x64
sub r8d, eax
add r8d, r8d
movzx eax, byte [r8 + r9 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r8 + r9]
mov r8d, edx
mov byte [rcx], al
cmp edx, 0x64
jae 0x18006eae0
dec rcx
cmp r8d, 0xa
jae 0x18006eb2a
mov eax, r8d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
movzx eax, byte [rax + r10]
jmp 0x18006eb40
lea eax, [r8 + r8]
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx], al
dec rcx
movzx eax, byte [rdx + r9]
mov byte [rcx], al
test r11b, r11b
je 0x18006ebf9
dec rcx
mov rax, rcx
mov byte [rcx], 0x2d
ret
cmp r9d, 0x10
jne 0x18006ebd0
lea r9, [0x1800fbf70]
cmp r8d, 0x100
jb 0x18006eb99
nop dword [rax + rax]
movzx eax, r8b
add eax, eax
shr r8d, 8
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [rdx + r9]
mov byte [rcx], al
cmp r8d, 0x100
jae 0x18006eb70
dec rcx
cmp r8d, 0x10
jae 0x18006ebb4
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
movzx eax, byte [r8 + r10]
mov byte [rcx], al
mov rax, rcx
ret
lea eax, [r8 + r8]
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx], al
dec rcx
movzx eax, byte [rdx + r9]
mov byte [rcx], al
mov rax, rcx
ret
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
nop word [rax + rax]
xor edx, edx
mov eax, r8d
div r9d
dec rcx
mov r8d, eax
movzx edx, byte [rdx + r10]
mov byte [rcx], dl
test eax, eax
jne 0x18006ebe0
mov rax, rcx
ret
Function at 0x18006f6c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edx, dword [0x180141ae8]
mov rbx, rcx
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180142454], edx
jle 0x18006f86f
lea rcx, [0x180142454]
call fcn.1800d7590
cmp dword [0x180142454], 0xffffffff
jne 0x18006f86f
movabs rcx, 0x4ded5748ef2d6bc8
movabs rax, 0xae52571c01dc1c56
mov qword [rsp + 0x20], rax
movabs r9, 0xcbf29ce484222325
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xbb01d537bc17183a
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0x87f533509dc6c35e
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movabs rax, 0xc017326f609e4315
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0xe46ceb1ac563714e
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
movabs rax, 0xea807d3dfca39737
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
vmovdqu xmm0, xmmword [rsp + 0x30]
vpxor xmm2, xmm0, xmmword [rsp + 0x50]
vmovdqu xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
vpxor xmm1, xmm0, xmmword [rsp + 0x60]
vmovq rcx, xmm2
vmovdqu xmmword [rsp + 0x40], xmm1
vmovdqu xmmword [rsp + 0x30], xmm2
test cl, cl
je 0x18006f81d
inc rax
cmp byte [rax], 0
jne 0x18006f815
lea rcx, [rsp + 0x30]
mov r8d, 0
sub rax, rcx
je 0x18006f855
movabs r10, 0x100000001b3
nop word [rax + rax]
movsx rdx, byte [rsp + r8 + 0x30]
inc r8
xor r9, rdx
imul r9, r10
cmp r8, rax
jb 0x18006f840
mov rcx, r9
call fcn.18006e5c0
lea rcx, [0x180142454]
mov dword [0x18014244c], eax
call fcn.1800d7524
mov eax, dword [0x18014244c]
movzx eax, byte [rax + rbx]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800d7380
add rsp, 0x80
pop rbx
ret
Function at 0x180072d40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor esi, esi
movzx ecx, dl
mov word [0x180141478], si
mov edi, esi
sub ecx, 1
je 0x180072d93
sub ecx, 1
je 0x180072d8a
cmp ecx, 1
jne 0x180072d9a
lea rdi, str._error_
jmp 0x180072d9a
lea rdi, str._warning_
jmp 0x180072d9a
lea rdi, str._info_
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
movzx ebx, byte [0x180141470]
lea r9, [rsp + 0x38]
lea r8, str._n__d__m__Y__T_
mov edx, 0x20
lea rcx, [rsp + 0x60]
call fcn.180054c20
mov rcx, qword [0x180141318]
lea rdx, [rsp + 0x60]
sub rax, rbx
mov qword [rsp + 0x20], rsi
add rdx, rbx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x80]
test rdi, rdi
je 0x180072e42
movzx eax, byte [rdi]
lea r8, [rsp + 0x80]
test al, al
je 0x180072e3f
sub rdi, r8
mov byte [r8], al
inc r8
movzx eax, byte [rdi + r8]
test al, al
jne 0x180072e30
mov byte [r8], sil
cmp byte [rsp + 0x80], sil
je 0x180072e74
mov rcx, qword [0x180141318]
lea rax, [rsp + 0x80]
sub r8d, eax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [0x180141470], sil
lea rax, [0x180141470]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1800d7380
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret