joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004bff0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x180178f3c]
mov ebx, edi
test ecx, ecx
je 0x18004c12b
mov rax, qword [0x180178f30]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x18004c048
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18004c020
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18004c12b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.18004bd30
mov r8d, dword [0x180178f3c]
cmp ebx, r8d
jae 0x18004c0b8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180178f30]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x18004c0b1
mov edx, esi
mov ecx, ebx
call fcn.18004bee0
mov edi, eax
test eax, eax
jne 0x18004c0b8
mov r8d, dword [0x180178f3c]
inc ebx
cmp ebx, r8d
jb 0x18004c080
cmp qword [rsp + 0x20], 0
je 0x18004c12b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18004c117
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004c108
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18004c0e0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801784b0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18004c440
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov edi, 1
mov r14d, r15d
mov ebx, r15d
xor eax, eax
lock cmpxchg dword [0x1801784a8], edi
je 0x18004c489
cmp rbx, 0x20
jae 0x18004c472
xor ecx, ecx
jmp 0x18004c474
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1801784a8], edi
jne 0x18004c468
cmp qword [0x1801784b0], r14
mov qword [rsp + 0x60], r13
je 0x18004c61b
mov ecx, dword [0x180178f3c]
mov ebx, r15d
test ecx, ecx
je 0x18004c4c1
mov rdx, qword [0x180178f30]
mov rax, rdx
cmp qword [rax], r14
je 0x18004c4cc
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18004c4b2
mov r14d, 4
jmp 0x18004c621
cmp ebx, 0xffffffff
je 0x18004c4c1
mov eax, ebx
imul r13, rax, 0x38
test byte [rdx + r13 + 0x20], 2
je 0x18004c580
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18004bd30
xor edx, edx
mov ecx, ebx
call fcn.18004bee0
mov r14d, eax
cmp qword [rsp + 0x20], r15
je 0x18004c570
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18004c55c
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov ebp, eax
mov qword [rsp + 0x58], rsi
nop
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004c548
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x18004c520
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801784b0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
jne 0x18004c621
mov rdx, qword [0x180178f30]
mov rcx, qword [rdx + r13 + 0x10]
call fcn.18004b360
mov edx, dword [0x180178f3c]
dec edx
cmp ebx, edx
jae 0x18004c5cf
mov eax, edx
imul rcx, rax, 0x38
mov rax, qword [0x180178f30]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rax + r13], xmm0
movups xmm1, xmmword [rcx + rax + 0x10]
movups xmmword [rax + r13 + 0x10], xmm1
movups xmm0, xmmword [rcx + rax + 0x20]
movups xmmword [rax + r13 + 0x20], xmm0
movsd xmm1, qword [rcx + rax + 0x30]
movsd qword [rax + r13 + 0x30], xmm1
mov ecx, dword [0x180178f38]
mov eax, ecx
mov dword [0x180178f3c], edx
shr eax, 1
cmp eax, 0x20
jb 0x18004c621
cmp eax, edx
jb 0x18004c621
mov r8, qword [0x180178f30]
mov eax, ecx
mov rcx, qword [0x1801784b0]
xor edx, edx
shr rax, 1
imul r9, rax, 0x38
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18004c621
shr dword [0x180178f38], 1
mov qword [0x180178f30], rax
jmp 0x18004c621
mov r14d, 2
xchg dword [0x1801784a8], r15d
mov r13, qword [rsp + 0x60]
mov eax, r14d
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18004c640
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x1801784a8], ebp
je 0x18004c697
cmp rbx, 0x20
jae 0x18004c680
xor ecx, ecx
jmp 0x18004c682
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1801784a8], ebp
jne 0x18004c676
cmp qword [0x1801784b0], r15
je 0x18004c791
test rdi, rdi
jne 0x18004c6b7
mov ecx, esi
call fcn.18004bff0
mov ebp, eax
jmp 0x18004c796
mov ecx, dword [0x180178f3c]
mov ebx, r15d
test ecx, ecx
je 0x18004c6df
mov r8, qword [0x180178f30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x18004c6e9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18004c6d0
mov ebp, 4
jmp 0x18004c796
cmp ebx, 0xffffffff
je 0x18004c6df
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18004c788
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18004bd30
mov edx, esi
mov ecx, ebx
call fcn.18004bee0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18004c796
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18004c772
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18004c768
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x18004c740
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801784b0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18004c796
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x18004c796
mov ebp, 2
xchg dword [0x1801784a8], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18004f620
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180176040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov ebx, edx
mov rdi, rcx
test edx, edx
jne 0x18004f648
call fcn.18004f4a0
mov r8, rsi
mov edx, ebx
mov rcx, rdi
call fcn.1800d7430
test eax, eax
je 0x18004f709
cmp ebx, 1
jne 0x18004f74d
xor ecx, ecx
call fcn.1800730a0
mov qword [0x180178758], rax
test rax, rax
je 0x18004f709
movabs rax, 0x7967bbdf7b2d8973
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xd222e850e2d4293f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x74c158f39e911fea
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xd2e3f4ca9fc7f374
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
call fcn.18004f760
mov rcx, rax
call fcn.1800730a0
test rax, rax
je 0x18004f709
mov rcx, rdi
call fcn.18004d260
test al, al
jne 0x18004f720
call fcn.18004f4a0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800d6ea0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
lea r8, [0x18004f5d0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18004f74d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18004f70b
Function at 0x180054490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rcx, qword [0x1801788c0]
mov rbx, rdx
movzx eax, word [rcx + 0x50]
cmp eax, 0xffff
je 0x180054536
mov rdi, qword [rcx + 0x40]
movabs rbp, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
mov r11d, eax
add r11, r11
mov r10, qword [rdi + r11*8]
test r10, r10
je 0x180054529
mov r9, qword [r10]
mov r8, rbp
mov rax, r9
cmp byte [r9], 0
je 0x1800544f8
nop
inc rax
cmp byte [rax], 0
jne 0x1800544f0
mov edx, 0
sub rax, r9
je 0x180054524
nop dword [rax]
nop word [rax + rax]
movsx rcx, byte [rdx + r9]
inc rdx
xor r8, rcx
imul r8, rsi
cmp rdx, rax
jb 0x180054510
cmp r8, rbx
je 0x18005454d
movzx eax, word [rdi + r11*8 + 0xa]
cmp eax, 0xffff
jne 0x1800544d1
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov rax, r10
jmp 0x180054538
Function at 0x18005b3a0
Capabilities:
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x180176040]
xor rax, rsp
mov qword [rbp + 0x47], rax
call fcn.1800730a0
mov rcx, rax
test rax, rax
je 0x18005b5d7
movabs rax, 0x9cc573b6887e0c4c
mov qword [rsp + 0xe8], rbx
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x29]
mov rax, qword [rbp - 0x49]
movabs rbx, 0xf28c16c2e91b7e0f
mov qword [rbp - 0x29], rax
movabs rax, 0xe060dc5ae687b2d0
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
mov qword [rsp + 0xf0], rdi
movabs rdi, 0xe005bf3b80f5d7a4
mov qword [rbp - 0x49], rdi
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x31], rax
xorps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x29], xmm0
call fcn.180073380
mov rcx, rax
test rax, rax
jne 0x18005b5bf
mov dl, 3
call fcn.180071f90
movabs rax, 0x86ac72a785721f69
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x49], rax
movabs rcx, 0x2eefafc7bc3e0688
mov rax, qword [rbp - 0x49]
mov r8d, edx
mov qword [rbp - 0x19], rax
movabs rax, 0xa3279f4fe592f7cb
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0x2b0db9edb1dd1f5b
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x63da888a5f98bb7b
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0x4a1b2e5bdb45f422
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rdi
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x1f], rax
movabs rax, 0x5f63f088c5bc7a29
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x27], rax
movabs rax, 0x43f8ede93efec91e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x2f], rax
movabs rax, 0x4a685d3ea9219043
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x37], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
movdqa xmm2, xmmword [rbp - 0x19]
xorps xmm2, xmmword [rbp + 0x17]
movdqa xmm0, xmmword [rbp - 9]
movq rcx, xmm2
movdqa xmm1, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp + 0x27]
mov qword [rbp + 0x3f], rax
lea rax, [rbp - 0x19]
xorps xmm1, xmmword [rbp + 0x37]
movdqa xmmword [rbp - 0x19], xmm2
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp + 7], xmm1
test cl, cl
je 0x18005b59b
nop word [rax + rax]
inc rax
mov r8, rax
cmp byte [rax], 0
jne 0x18005b590
mov rcx, qword [0x180176ed8]
sub r8d, edx
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18005b5c7
mov eax, dword [rax + 3]
mov rax, qword [rax + rcx + 7]
mov rbx, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800d6ea0
add rsp, 0xd0
pop rbp
ret
Function at 0x180067400
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x180176040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x1801786f8]
mov rbx, rcx
mov rcx, qword [0x180178700]
cmp rax, rcx
je 0x18006744c
cmp qword [rax], rbx
je 0x18006743f
add rax, 0x10
cmp rax, rcx
jne 0x180067431
cmp rax, rcx
je 0x18006744c
mov eax, dword [rax + 8]
jmp 0x18006762b
mov dl, 3
mov qword [rsp + 0xc8], rdi
call fcn.180071f90
mov rdi, rax
lea rdx, [rsp + 0x40]
movabs rax, 0xb34cff0495a0c5bb
mov r8d, edx
mov qword [rsp + 0x30], rax
movabs rax, 0xf7175c203df0b29
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0xd1fdddcb1b1f82a1
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0xd9580bb73352199a
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0x33202935a6cc1d26
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xfdf45b708804d262
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0xc76c9b61f9c9a4dd
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0x605111ac6ab92b46
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0xbe9bfdbf7e6ce4c7
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
movabs rax, 0xf93c67d25a3439e8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x88], rax
movabs rax, 0x40414115ceb87451
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x90], rax
movabs rax, 0xfdf45b708824e80a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rsp + 0x80]
mov qword [rsp + 0x98], rax
movq rax, xmm2
xorps xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x1800675f0
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x1800675e5
mov rcx, qword [0x180176ed8]
sub r8d, edx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
or word [rdi + 8], 6
mov rdx, rbx
mov rcx, rdi
call fcn.180067690
mov rdi, qword [rsp + 0xc8]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800d6ea0
add rsp, 0xb0
pop rbx
ret
Function at 0x180067690
Capabilities:
Encrypt data using rc4 ksa
Write file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180176040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r9, rdx
xor r11d, r11d
movzx edx, word [rcx + 8]
mov rbx, rcx
mov eax, 0xa
test dl, 4
je 0x1800676cf
lea r8d, [rax + 6]
lea r11, [0x18015eb20]
jmp 0x1800676f1
test dl, 0x10
je 0x1800676dc
mov r8d, 8
jmp 0x1800676f1
mov r8, rax
test dl, 0x20
je 0x1800676f4
mov r8d, 2
lea r11, [0x18015eb24]
mov eax, r8d
mov byte [rsp + 0x72], 0
lea rcx, [rsp + 0x72]
test r9, r9
jne 0x180067712
lea rcx, [rsp + 0x71]
mov byte [rsp + 0x71], 0x30
jmp 0x18006785f
lea r10, [0x180000000]
cmp eax, 0xa
jne 0x1800677c3
cmp r9, 0x64
jb 0x180067789
mov qword [rsp + 0xa0], rdi
movabs rdi, 0x47ae147ae147ae15
nop word [rax + rax]
mov r8, r9
mov rax, rdi
mul r9
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 6
imul rax, r8, 0x64
sub r9, rax
movzx eax, byte [r10 + r9*2 + 0x129cd1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r10 + r9*2 + 0x129cd0]
mov r9, r8
mov byte [rcx], al
cmp r8, 0x64
jae 0x180067740
mov rdi, qword [rsp + 0xa0]
dec rcx
mov rdx, rcx
cmp r9, 0xa
jae 0x1800677a5
movzx eax, byte [r9 + r10 + 0x15e738]
mov byte [rcx], al
jmp 0x18006785f
movzx eax, byte [r10 + r9*2 + 0x129cd0]
dec rcx
mov byte [rcx], al
movzx eax, byte [r10 + r9*2 + 0x129cd1]
mov byte [rdx], al
jmp 0x18006785f
cmp eax, 0x10
jne 0x180067841
cmp r9, 0x100
jb 0x18006780d
nop dword [rax]
nop word [rax + rax]
movzx eax, r9b
shr r9, 8
lea rdx, [rax*2 + 0x129ac0]
movzx eax, byte [rdx + r10 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [rdx + r10]
mov byte [rcx], al
cmp r9, 0x100
jae 0x1800677e0
dec rcx
mov rdx, rcx
cmp r9, 0x10
jae 0x180067826
movzx eax, byte [r9 + r10 + 0x15e738]
mov byte [rcx], al
jmp 0x18006785f
movzx eax, byte [r10 + r9*2 + 0x129ac0]
dec rcx
mov byte [rcx], al
movzx eax, byte [r10 + r9*2 + 0x129ac1]
mov byte [rdx], al
jmp 0x18006785f
xor edx, edx
mov rax, r9
div r8
dec rcx
mov r9, rax
movzx eax, byte [rdx + r10 + 0x15e738]
mov byte [rcx], al
test r9, r9
jne 0x180067841
test r11, r11
je 0x18006787c
test byte [rbx + 8], 2
je 0x18006787c
movzx eax, byte [r11 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r11]
mov byte [rcx], al
lea r8, [rsp + 0x72]
mov qword [rsp + 0x20], 0
sub r8d, ecx
mov rdx, rcx
mov rcx, qword [0x180176ed8]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d6ea0
add rsp, 0x90
pop rbx
ret
Function at 0x1800678c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r8d, ecx
test r9d, r9d
je 0x1800678d5
lea eax, [r9 - 2]
cmp eax, 0x22
jbe 0x1800678d5
mov rax, rdx
ret
mov r11d, r8d
mov byte [rdx + 0x40], 0
mov eax, r8d
shr r11d, 0x1f
neg eax
lea rcx, [rdx + 0x40]
test r11b, r11b
cmovne r8d, eax
test r8d, r8d
jne 0x1800678ff
dec rcx
mov rax, rcx
mov byte [rcx], 0x30
ret
cmp r9d, 0xa
jne 0x180067995
lea r9, [0x180129cd0]
cmp r8d, 0x64
jb 0x180067950
nop word [rax + rax]
mov eax, 0x51eb851f
mul r8d
shr edx, 5
imul eax, edx, 0x64
sub r8d, eax
add r8d, r8d
movzx eax, byte [r8 + r9 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r8 + r9]
mov r8d, edx
mov byte [rcx], al
cmp edx, 0x64
jae 0x180067920
dec rcx
cmp r8d, 0xa
jae 0x18006796a
mov eax, r8d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
movzx eax, byte [rax + r10]
jmp 0x180067980
lea eax, [r8 + r8]
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx], al
dec rcx
movzx eax, byte [rdx + r9]
mov byte [rcx], al
test r11b, r11b
je 0x180067a39
dec rcx
mov rax, rcx
mov byte [rcx], 0x2d
ret
cmp r9d, 0x10
jne 0x180067a10
lea r9, [0x180129ac0]
cmp r8d, 0x100
jb 0x1800679d9
nop dword [rax + rax]
movzx eax, r8b
add eax, eax
shr r8d, 8
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [rdx + r9]
mov byte [rcx], al
cmp r8d, 0x100
jae 0x1800679b0
dec rcx
cmp r8d, 0x10
jae 0x1800679f4
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
movzx eax, byte [r8 + r10]
mov byte [rcx], al
mov rax, rcx
ret
lea eax, [r8 + r8]
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx], al
dec rcx
movzx eax, byte [rdx + r9]
mov byte [rcx], al
mov rax, rcx
ret
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
nop word [rax + rax]
xor edx, edx
mov eax, r8d
div r9d
dec rcx
mov r8d, eax
movzx edx, byte [rdx + r10]
mov byte [rcx], dl
test eax, eax
jne 0x180067a20
mov rax, rcx
ret
Function at 0x18006e480
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x18
movsxd rsi, dword [rsp + 0x58]
mov r11, rdx
mov qword [rsp + 0x30], rbx
mov r10, rcx
mov qword [rsp + 0x38], rdi
mov rbp, rdx
lea rdi, [r8 - 1]
mov qword [rsp + 0x40], r12
sar rdi, 1
mov rbx, rdx
mov qword [rsp + 8], r14
mov r14, r8
cmp rdx, rdi
jge 0x18006e531
mov qword [rsp + 0x10], r13
mov r13d, 0x30
mov qword [rsp], r15
nop word [rax + rax]
lea rdx, [rbx + rbx]
lea rax, [rdx + rdx*2]
lea r8, [r10 + rax*8]
movss xmm0, dword [rsi + r8 + 0x30]
lea rax, [r11 + r11*2]
comiss xmm0, dword [rsi + r8 + 0x18]
seta cl
movzx ebx, cl
xor rbx, 1
inc rbx
add rbx, rdx
mov edx, 0x18
test cl, cl
mov r11, rbx
cmove rdx, r13
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [rdx + r8 + 0x10]
movsd qword [r10 + rax*8 + 0x10], xmm1
cmp rbx, rdi
jl 0x18006e4d0
mov r15, qword [rsp]
mov r13, qword [rsp + 0x10]
cmp rbx, rdi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jne 0x18006e56b
test r14b, 1
jne 0x18006e56b
lea rax, [r11 + r11*2]
lea rcx, [r14 + r14*2]
movups xmm0, xmmword [r10 + rcx*8 - 0x18]
lea r11, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x10], xmm1
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
cmp rbp, r11
jge 0x18006e5c0
movsxd r8, dword [rsp + 0x60]
nop
lea rcx, [r11 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*2]
lea rax, [rsi + rdx*8]
movss xmm0, dword [rax + r10]
comiss xmm0, dword [r8 + r9]
jbe 0x18006e5c0
lea rax, [r11 + r11*2]
mov r11, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [r10 + rdx*8 + 0x10]
movsd qword [r10 + rax*8 + 0x10], xmm1
cmp rbp, rcx
jl 0x18006e580
movups xmm0, xmmword [r9]
lea rax, [r11 + r11*2]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [r9 + 0x10]
movsd qword [r10 + rax*8 + 0x10], xmm1
add rsp, 0x18
pop rsi
pop rbp
ret
Function at 0x180071f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x180176040]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor esi, esi
movzx ecx, dl
mov word [0x180177038], si
mov edi, esi
sub ecx, 1
je 0x180071fe3
sub ecx, 1
je 0x180071fda
cmp ecx, 1
jne 0x180071fea
lea rdi, str._error_
jmp 0x180071fea
lea rdi, str._warning_
jmp 0x180071fea
lea rdi, str._info_
xor ecx, ecx
call fcn.1800e3ff0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.1800e3fe8
movzx ebx, byte [0x180177030]
lea r9, [rsp + 0x38]
lea r8, str._n__d__m__Y__T_
mov edx, 0x20
lea rcx, [rsp + 0x60]
call fcn.180055d10
mov rcx, qword [0x180176ed8]
lea rdx, [rsp + 0x60]
sub rax, rbx
mov qword [rsp + 0x20], rsi
add rdx, rbx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x104
call fcn.1800fdfa0
lea r8, [rsp + 0x80]
test rdi, rdi
je 0x180072092
movzx eax, byte [rdi]
lea r8, [rsp + 0x80]
test al, al
je 0x18007208f
sub rdi, r8
nop
mov byte [r8], al
inc r8
movzx eax, byte [rdi + r8]
test al, al
jne 0x180072080
mov byte [r8], sil
cmp byte [rsp + 0x80], sil
je 0x1800720c4
mov rcx, qword [0x180176ed8]
lea rax, [rsp + 0x80]
sub r8d, eax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [0x180177030], sil
lea rax, [0x180177030]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1800d6ea0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret