joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ea57c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400c9410
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400ea606
cmp byte [rbp - 0x21], r15b
je 0x1400ea601
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400ea63c
call fcn.1400dab00
test eax, eax
jne 0x1400ea628
cmp byte [rbp - 0x21], r15b
je 0x1400ea620
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400ea63c
cmp byte [rbp - 0x21], r15b
je 0x1400ea639
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400d2ff0
test eax, eax
jne 0x1400ea6dc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400c9410
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400ea67b
cmp byte [rbp - 0x21], r15b
je 0x1400ea6b0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400ea6b0
call fcn.1400dab00
test eax, eax
jne 0x1400ea69c
cmp byte [rbp - 0x21], r15b
je 0x1400ea695
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400ea6b0
cmp byte [rbp - 0x21], r15b
je 0x1400ea6ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400d2ff0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400ea6dc
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400ea6df
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400ea6ed
mov rcx, rdi
call fcn.1400d7418
cmp byte [rbp + 0x3f], r15b
je 0x1400ea6fc
mov rcx, qword [rbp + 0x27]
call fcn.1400d7418
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400eb18c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400db954
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400db954
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400eb2dc
cmp rax, 0xffffffffffffffff
je 0x1400eb2dc
xor edi, edi
test rbp, rbp
jle 0x1400eb287
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400d73a0
mov rbx, rax
test rax, rax
jne 0x1400eb214
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400eb27d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400d57e8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400ddd34
cmp eax, 0xffffffff
je 0x1400eb25d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400eb224
mov edx, r15d
mov ecx, r14d
call fcn.1400d57e8
jmp 0x1400eb27d
cmp byte [rsi + 0x38], dil
je 0x1400eb274
cmp dword [rsi + 0x34], 5
jne 0x1400eb274
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400eb27d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400d7418
jmp 0x1400eb2f0
jns 0x1400eb2f0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400db954
cmp rax, 0xffffffffffffffff
jne 0x1400eb2a8
cmp byte [rsi + 0x30], dil
je 0x1400eb2f0
mov edi, dword [rsi + 0x2c]
jmp 0x1400eb2f0
mov ecx, r14d
call fcn.1400e3cf4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400eb2f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400eb2f0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400eb2e9
mov eax, dword [rsi + 0x2c]
jmp 0x1400eb2ee
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400db954
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400ebe60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ebe88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400ebe88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2fc4ca9d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cb3d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ef108]
test eax, eax
je 0x2fc4cb46a
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ef110]
mov qword [rbp - 8], rax
jmp 0x2fc4cb44e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cb442
cmp qword [rbp - 0x10], 0
je 0x2fc4cb442
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cb408
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cb46b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cb570
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cb598
mov eax, 0
jmp 0x2fc4cb5e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cb5c1
mov eax, 0
jmp 0x2fc4cb5e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cb5e1
mov eax, 0
jmp 0x2fc4cb5e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cb5ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cb66a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cb661
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cb661
mov rax, qword [rbp - 8]
jmp 0x2fc4cb67f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cb634
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180002a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 8], ecx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov eax, dword [rsp + 0xa0]
lea ebp, [r8 - 0xe9e]
mov r15d, dword [rsp + 0xb0]
lea r14d, [r8 - 0x3ca7]
mov rbx, qword [rsp + 0xa8]
mov edi, r8d
lea r13d, [rax - 0xe30]
lea esi, [r15 - 0x3c09]
lea r9d, [rsi + 0x3ca7]
lea ecx, [rax - 0xfba]
mov dword [rsp + 0x80], ecx
cmp r13d, r9d
jge 0x180002b18
lea eax, [r15 - 0xeab]
add ecx, 0xffffff3f
mov dword [rsp + 0x28], eax
lea r8d, [rbp + 0x893]
mov dword [rsp + 0x20], r9d
lea edx, [r13 + 0xd92]
mov r9, rbx
call sym.eunc774sx0.dll_BZfd80Y7
mov r11d, eax
mov qword [rsp + 0x38], rbx
add eax, 0xfffff82c
lea r10d, [rsi + 0x2aa1]
mov dword [rsp + 0x30], eax
lea r8d, [rdi - 0xfba]
mov r9d, esi
mov dword [rsp + 0x28], r10d
xor r11d, 0x1baa
lea edx, [r15 - 0xf1c]
xor r9d, 0x2e77
mov dword [rsp + 0x20], r11d
lea ecx, [rsi + 0x334a]
call fcn.1800013b0
mov eax, dword [rbx + 0xec]
xor r14d, 0x334a
xor eax, 0xb48ff
sub dword [rbx + 0x108], eax
jmp 0x180002c8d
mov edx, dword [rsp + 0xb8]
mov eax, edx
and eax, dword [rbx + 0x114]
cmp dword [rbx + 0x4c], eax
jne 0x180002c8d
mov eax, dword [rbx + 0x70]
add eax, dword [rbx + 0x10c]
cmp ebp, eax
jbe 0x180002c8d
mov r12d, dword [rbx + 0x7c]
mov eax, esi
sub eax, dword [rbx + 0x30]
add eax, r15d
cmp r12d, eax
jae 0x180002c8d
and ebp, 0x2c2c
nop dword [rax]
mov ecx, dword [rbx + 8]
mov edi, r13d
mov r11d, dword [rbx + 0x114]
xor edi, edx
mov r9d, dword [rbx + 0xa0]
mov edx, ecx
mov r10d, dword [rbx + 0xf0]
add r11d, r14d
mov r8d, dword [rbx + 0x4c]
sub r10d, 0x2c2c
add ecx, dword [rbx + 0xe4]
sub r8d, 0x3140
and ecx, dword [rbx + 0x11c]
xor edi, 0x3140
mov qword [rsp + 0x40], rbx
sub r13d, r14d
mov dword [rsp + 0x38], r11d
or edx, ebp
imul r9d, r15d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r8d
mov r8d, r13d
add r9d, 0x2c2c
call fcn.180011cb0
mov edx, dword [rbx + 0x108]
lea r9d, [rsi + 0x2d5e]
xor r9d, dword [rbx + 0xfc]
and edx, 0x353f
add edx, dword [rbx + 0xdc]
mov eax, dword [rbx + 0x80]
mov r10d, dword [rbx + 0xf0]
add eax, 0x30f9
imul r11d, dword [rbx + 0xd0], 0x3673
and r10d, dword [rbx + 8]
mov ecx, dword [rbx + 0xac]
mov r8d, dword [rbx + 0x20]
or r10d, dword [rbx + 0xf8]
or r8d, 0x37bf
sub ecx, dword [rbx + 0x10c]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], edx
lea edx, [r14 - 0x2d5e]
mov dword [rsp + 0x30], r9d
mov r9, rbx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.180002870
mov ecx, dword [rsp + 0x80]
add r12d, 2
and ecx, dword [rbx + 0x100]
mov r13d, eax
xor dword [rbx + 0x104], ecx
mov ecx, esi
sub ecx, dword [rbx + 0x30]
mov edx, dword [rsp + 0xb8]
add ecx, r15d
cmp r12d, ecx
jb 0x180002b60
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
lea eax, [r14 + 0x95d]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180002cc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x30
mov eax, dword [rsp + 0x80]
lea esi, [r8 - 0x5a3]
mov ecx, dword [rsp + 0x88]
mov r12d, eax
mov r14d, r8d
xor r12d, 0x12e0
xor r14d, 0x369c
mov rbx, r9
lea edx, [rax - 0x3ca7]
lea r13d, [rax - 0x9e]
mov dword [rsp + 0x80], edx
mov eax, esi
lea ebp, [rcx + 0xf49]
xor eax, 0x1c14
cmp r12d, eax
jle 0x180002e71
lea eax, [rbp - 0x4e8]
cmp r13d, eax
je 0x180002d64
mov eax, dword [r9 + 0x7c]
mov ecx, dword [r9 + 0x24]
xor ecx, dword [r9 + 0x48]
xor ecx, 0x12f249
imul eax, ecx
mov dword [r9 + 0x7c], eax
mov eax, dword [r9 + 0x108]
add eax, dword [r9 + 0x48]
xor eax, 0x1ce015
or dword [r9 + 0x20], eax
jmp 0x180002e71
imul eax, dword [r9 + 0xec], 0x2e77
mov qword [rsp + 0x60], rdi
mov edi, dword [r9 + 0x50]
or eax, 0x3673
cmp edi, eax
ja 0x180002e6c
mov qword [rsp + 0x68], r15
nop word [rax + rax]
lea eax, [rsi + 0x2e47]
xor eax, dword [rbx + 0x60]
cmp dword [rbx + 8], eax
jbe 0x180002e46
mov eax, dword [rbx + 0x118]
add eax, dword [rbx + 0x90]
imul eax, dword [rbx + 0x120]
cmp ebp, eax
ja 0x180002e46
mov r11d, dword [rbx + 0xf0]
mov r8d, dword [rbx + 0x2c]
mov r10d, dword [rbx + 0xc0]
xor r10d, dword [rbx + 0x6c]
mov eax, edx
mov edx, dword [rbx + 0xdc]
xor r11, rax
mov eax, dword [rbx + 0x5c]
or rdx, 0x2e09
xor r8, rax
imul r9d, ecx, 0x30f9
mov eax, r13d
or r8, rax
imul r10d, esi
mov eax, r14d
xor rdx, rax
mov qword [rsp + 0x28], r11
mov eax, dword [rbx + 0xac]
sub r9d, 0x8adc06e
or eax, dword [rbx + 0x24]
imul r9d, dword [rbx + 0x44]
imul ecx, eax, 0x3ca7
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [rsp + 0x80]
mov ecx, r14d
and ecx, 0x353f
xor ecx, dword [rbx + 0x5c]
xor ecx, r12d
mov dword [rbx + 0x5c], ecx
imul ecx, dword [rbx + 0xec], 0x2e77
inc edi
or ecx, 0x3673
cmp edi, ecx
mov ecx, dword [rsp + 0x88]
jbe 0x180002d90
mov r15, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
xor esi, 0x524
mov eax, esi
add rsp, 0x30
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x180002e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov ecx, dword [0x18002501c]
mov r12, r9
movzx edi, word [0x180025018]
dec ecx
movzx r10d, dx
xor edx, edx
mov dword [0x18002501c], ecx
mov ebp, r10d
movzx r11d, r8w
mov r8, qword [rsp + 0x48]
mov eax, r11d
div r10d
lea rbx, [r10*8]
movsxd rsi, eax
movzx eax, word [rbx + r8 + 4]
sub ecx, eax
movsxd r13, ecx
movzx ecx, r10b
or cl, 0xf6
movzx r14d, cl
cmp word [r8 + r14*2], r10w
jbe 0x180002f23
movzx eax, r11w
inc r11w
cmp word [0x180025030], ax
jbe 0x180002f23
movzx eax, word [0x180024fcc]
xor edx, edx
movzx ecx, r11w
div ecx
jmp 0x180003044
mov eax, dword [0x180024fec]
mov qword [rsp + 0x28], r15
movzx r15d, r11w
lea eax, [rax*4]
movsxd rdx, eax
mov eax, r15d
movzx r8d, word [rdi + rdx*2]
lea r9, [rdi + rdx*2]
and eax, 0x810
xor eax, 0x5b5
cdq
idiv r8d
mov word [r9], dx
mov rax, qword [0x180024fd0]
movzx edx, cl
inc cl
add rdx, rdx
mov eax, dword [rax + rdx*8]
cdq
idiv dword [r13 + r14*4]
mov dword [r13 + r14*4], eax
movzx edx, word [rbx + rdi + 8]
movzx eax, cl
lea r9d, [rax + rax*2]
movsxd rax, dword [0x180024fec]
sub edx, dword [rsi + rax*4]
movsxd rax, dword [0x180025058]
movsxd r8, edx
movzx edx, word [rdi + rax*2]
lea eax, [r9 + 8]
or r8, rdx
movzx edx, cl
mov qword [r12 + rax*8], r8
mov rax, qword [0x180025070]
mov r10d, dword [rax + rdx*8]
movzx edx, word [rdi + r9*2]
cmp r10d, edx
jle 0x180003033
lea ebx, [r10*4]
nop word [rax + rax]
dec cl
mov eax, ebp
cdq
movzx ecx, cl
idiv dword [rsi + rcx*4 + 8]
dec cl
cdq
movzx r9d, cl
idiv dword [0x180025058]
mov dword [0x180025058], eax
movsxd rax, ebx
add ebx, 4
lea r8, [rsi + rax*4]
mov eax, 0x2a8e
cdq
idiv dword [r8]
mov dword [r8], eax
lea eax, [r9 + r9]
lea r8, [rdi + rax*2]
movzx eax, r10w
or ax, r11w
inc r10d
movzx edx, ax
movzx eax, word [r8]
imul eax, edx
mov word [r8], ax
lea eax, [r9 + r9*2]
movzx eax, word [rdi + rax*2]
cmp r10d, eax
jg 0x180002fd0
movzx eax, word [0x180024fcc]
xor edx, edx
div r15d
mov r15, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800031e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x40
mov edi, dword [rsp + 0x98]
lea r13d, [rcx - 0x3bc7]
xor edi, 0x1baa
lea ebp, [rdx + 0xe60]
mov rbx, r9
mov eax, edi
mov r9d, dword [rsp + 0x90]
mov esi, edx
xor eax, 0x329
xor esi, 0x18db
add r9d, 0xb93
add r8d, 0x293
cmp r13d, eax
je 0x180003255
xor dword [rbx + 0xd8], 0xa89ce
xor r8d, 0x1930
lea eax, [r8 + 0x18a]
add rsp, 0x40
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rbx + 0x11c]
add ecx, esi
cmp edi, ecx
je 0x180003243
mov qword [rsp + 0x70], r12
lea eax, [rdx - 0x2cb4]
mov qword [rsp + 0x78], r14
mov r12d, edi
mov qword [rsp + 0x80], r15
mov r14d, ebp
mov r15d, ebp
and r14d, edi
xor r15d, 0x2e77
sub r12d, r9d
and ebp, 0x2c76
imul ecx, eax, 0x3ce1
mov dword [rsp + 0x98], ecx
mov r8d, dword [rbx + 0x78]
mov edx, ecx
mov eax, dword [rbx + 0x11c]
xor r8d, 0x3ce1
or eax, esi
mov dword [rsp + 0x30], r14d
add dword [rbx + 0xe0], eax
add r8d, r13d
mov dword [rsp + 0x28], r15d
mov r9d, ebp
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call fcn.180001670
mov edx, dword [rbx + 0x11c]
inc edi
mov ecx, dword [rsp + 0x98]
add edx, esi
cmp edi, edx
jne 0x1800032a2
mov r15, qword [rsp + 0x80]
add eax, 0x18a
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000fa40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, dword [rsp + 0x38]
lea r10d, [rdx - 0x3e2]
mov ebx, dword [rsp + 0x40]
add eax, 0xfffff781
xor eax, 0x357
mov r11d, r8d
mov edi, ecx
xor r11d, 0x4e
add ebx, 0xffffffc6
xor edi, 0x18eb
cmp edi, eax
mov esi, r9d
mov rax, qword [rsp + 0x30]
mov ebp, edx
jle 0x18000fa9d
lea rcx, [0x180014a60]
mov qword [rax + 0x98], rcx
jmp 0x18000fadb
mov r9d, dword [rax + 0x90]
mov edx, r11d
add r9d, 0x3ca7
cmp r11d, r9d
jne 0x18000fadb
mov r8d, dword [rax + 0xfc]
imul r8d, dword [rax + 0xac]
cmp r11d, r8d
ja 0x18000fad3
mov ecx, dword [rax + 0xf8]
add ecx, dword [rax + 0x40]
add r10d, ecx
add edx, 3
cmp edx, r9d
je 0x18000fac2
lea ecx, [rbp + 0xac9]
cmp r10d, ecx
jg 0x18000fbf5
xor esi, 0xa87
cmp ebx, esi
jle 0x18000fbab
lea ecx, [r10 + 0x39b]
cmp edi, ecx
je 0x18000fbab
xor r9d, r9d
nop word [rax + rax]
mov ecx, dword [rax + 0xec]
dec ecx
xor dword [rax + 0xdc], ecx
mov rcx, qword [rax + 0x98]
mov r8d, dword [rcx + r9]
add r9, 4
imul r8d, dword [rax + 0x58]
mov ecx, dword [rax + 0x24]
sub ecx, dword [rax + 0xf0]
add ecx, 0x2bd19
add dword [rax + 0x40], ecx
movsxd rdx, dword [rax + 0x64]
mov rcx, qword [rax + 0xb0]
mov byte [rdx + rcx], r8b
inc dword [rax + 0x64]
mov edx, dword [rax + 0x90]
mov ecx, dword [rax + 0x110]
sub edx, 5
mov r8d, dword [rax + 0xec]
imul ecx, edx
mov dword [rax + 0x110], ecx
mov edx, dword [rax + 0x48]
add edx, 0xfffffffe
add edx, r8d
add dword [rax + 0x5c], edx
xor r8d, dword [rax + 0x48]
add dword [rax + 0xcc], r8d
mov ecx, dword [rax + 0x5c]
sub ecx, dword [rax + 8]
xor ecx, 0xcf6c5413
add dword [rax + 0xc0], ecx
cmp r9, 0x3ea0
jl 0x18000fb10
mov ecx, ebx
xor ecx, 0xb18
cmp r11d, ecx
jge 0x18000fbc9
mov ecx, dword [rax + 0x90]
sub ecx, 0x2593c63e
mov dword [rax + 0x58], ecx
jmp 0x18000fbf5
mov ecx, dword [rsp + 0x28]
mov edx, dword [rax + 0x48]
add ecx, 0xfffffa86
add edx, ecx
cmp dword [rax + 0x110], edx
je 0x18000fbf5
mov ecx, dword [rax + 0x108]
xor ecx, 0xe06
or ecx, 0x30f9
mov dword [rax + 8], ecx
mov rbp, qword [rsp + 0x10]
xor ebx, 0xfed
mov rsi, qword [rsp + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x180010010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov edi, dword [rsp + 0xc0]
lea r13d, [rdx - 0x6ca]
mov edx, dword [rsp + 0xd8]
mov esi, edi
mov eax, dword [rsp + 0xe0]
mov r15d, r9d
xor eax, 0x1834
mov r8d, edx
lea ebp, [rdi + 0xa61]
mov dword [rsp + 0xe0], eax
xor r8d, 0x1157
lea r12d, [rdx - 0x3c09]
xor edi, 0x172
mov dword [rsp + 0x50], r12d
xor esi, 0x357
mov dword [rsp + 0xd8], r8d
xor r15d, 0x665
xor eax, 0x18db
mov r14, rcx
cmp ebp, eax
jle 0x1800101a0
lea eax, [r12 + 0x2e47]
xor ebp, 0x1bc9
mov dword [rsp + 0x28], ebp
lea r9d, [r13 - 0xb3c]
lea ecx, [r15 + 0x6c6]
mov dword [rsp + 0x20], eax
mov r8, r14
call fcn.180010ca0
mov qword [rsp + 0x48], r14
lea ebx, [rsi + 0x2f0]
mov ebp, eax
lea ecx, [r13 - 0x9b1]
mov edx, r12d
xor ecx, 0x1d6c
lea r10d, [rax - 0xff4]
xor edx, 0x37bf
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x40], r10d
lea edi, [rbp - 0x1004]
lea r11d, [rax - 0x132]
mov dword [rsp + 0x38], r11d
lea esi, [rax + 0x39b]
lea r9d, [rax + 0xe69]
mov dword [rsp + 0x30], ebx
xor eax, 0x329
mov dword [rsp + 0x28], edi
mov r8d, eax
mov dword [rsp + 0x20], esi
call fcn.1800015b0
mov r9d, dword [rsp + 0xe0]
lea ecx, [r15 + 0x4e4]
xor r13d, 0x19f1
lea r10d, [rbp - 0xba1]
mov dword [rsp + 0x38], r13d
lea r8d, [rbp - 0x3a]
mov dword [rsp + 0x30], ecx
lea edx, [r15 + 0xbe8]
sub eax, 0x55c
mov rcx, r14
mov dword [rsp + 0x28], eax
add r9d, 0x6f8
mov dword [rsp + 0x20], r10d
call fcn.18000fc20
lea eax, [r12 + 0x3bc7]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, esi
mov ebx, r13d
xor eax, r13d
add eax, 0xffffd3d4
mov dword [rsp + 0xe0], eax
cmp r13d, eax
jl 0x180010180
mov ecx, r12d
mov eax, edi
imul eax, r12d
xor ecx, 0x3ce1
mov r12d, dword [rsp + 0xe0]
mov dword [rsp + 0xa8], ecx
imul edx, eax, 0x2aa1
mov eax, r13d
or eax, 0x3ca7
mov dword [rsp + 0xd8], eax
lea eax, [r8 + rbp]
or eax, esi
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xb8], edx
mov r11d, dword [r14 + 0x70]
lea r9d, [r13 - 0x334a]
mov r8d, dword [r14 + 0xe0]
sub r15d, edx
mov edx, dword [r14 + 0xf8]
mov r10d, ecx
add r9d, dword [r14 + 0x38]
sub r10d, edx
mov eax, esi
add r8d, edx
mov edx, dword [rsp + 0xc0]
add r11d, 0x3673
xor r11, rax
and r8d, 0x3ce1
mov qword [rsp + 0x30], r11
mov eax, edi
xor eax, r15d
mov dword [rsp + 0x28], r10d
add eax, ebp
movsxd rcx, eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [rsp + 0xa8]
add ebx, 2
mov edx, dword [rsp + 0xb8]
cmp ebx, r12d
jge 0x180010200
mov eax, dword [rsp + 0x50]
add eax, 0x3bc7
jmp 0x180010188
Function at 0x180010290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
sub rsp, 0x40
mov edx, dword [rsp + 0x80]
lea ecx, [r8 + 0xe30]
mov rbx, r9
lea r15d, [r8 - 0x3d6]
mov r9d, dword [rsp + 0x88]
lea ebp, [r8 + 0x948]
mov edi, r9d
xor edx, 0x262
xor edi, 0x37bf
lea eax, [r9 - 0x1e2]
lea r10d, [r9 - 0x37bf]
cmp ecx, eax
jl 0x180010317
lea eax, [rdx - 0x1e2]
cmp ebp, eax
jle 0x1800103e3
lea eax, [r9 - 0x948]
cmp edx, eax
jle 0x1800103e3
mov ecx, dword [rbx + 0x40]
mov eax, 0x166d81
xor ecx, dword [rbx + 8]
sub eax, ecx
add dword [rbx + 0x58], eax
jmp 0x1800103e3
lea eax, [rdi - 0x2cdd]
xor eax, 0x3140
cmp dword [rbx + 0x70], eax
jne 0x1800103e3
mov eax, dword [rbx + 0xc4]
or eax, 0x334a
mov qword [rsp + 0x60], rsi
mov esi, dword [rbx + 0x7c]
cmp esi, eax
jae 0x1800103de
mov qword [rsp + 0x68], r14
lea r14d, [r10 - 0x2e09]
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbx + 0xdc]
mov eax, edx
imul eax, dword [rbx + 0x120]
xor edx, 0x2ced
mov ecx, dword [rbx + 0xc0]
sub edx, ebp
sub r10d, dword [rbx + 8]
add r10d, dword [rbx + 0x40]
mov r8d, dword [rbx + 0x60]
xor r8d, dword [rbx + 0x90]
imul r9d, eax, 0x2ced
mov eax, dword [rbx + 0xe8]
sub eax, dword [rbx + 0x10c]
mov dword [rsp + 0x38], eax
imul ecx, r15d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], ecx
mov ecx, r14d
mov dword [rsp + 0x20], edx
mov rdx, rbx
call fcn.180003510
mov ecx, dword [rbx + 0xc4]
add esi, 3
or ecx, 0x334a
mov r10d, eax
cmp esi, ecx
jb 0x180010360
mov r14, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
lea eax, [rdi + 0x3140]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop rdi
pop rbp
ret