joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b7a0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800f4320]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x18001b94a
cmp byte [rcx + 0x71], 0
je 0x18001b94a
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x18001b7fa
xor al, al
jmp 0x18001b94c
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.180003810
nop
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x18001b86e
sub eax, 1
jne 0x18001b8e2
jmp 0x18001b872
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x18001b8bf
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.18008b3ec
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x18001b8ef
cmp byte [rdi + 0x71], 0
je 0x18001b8f3
test rbx, rbx
jne 0x18001b830
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.180004080
jmp 0x18001b81f
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x18001b8f3
xor bl, bl
jmp 0x18001b8f5
mov bl, 1
cmp r9, 0x10
jb 0x18001b945
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x18001b940
test byte [rbp - 0x30], 0x1f
je 0x18001b913
call fcn.180086214
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001b922
call fcn.180086214
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001b931
call fcn.180086214
int3
cmp rcx, 0x27
jbe 0x18001b93d
call fcn.180086214
int3
mov rcx, rax
call fcn.180081458
movzx eax, bl
jmp 0x18001b94c
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180081d90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180020000
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x1800f4320]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbp, rcx
mov dword [r8], edx
mov ecx, edx
mov rsi, r9
mov rdi, r8
mov ebx, edx
call fcn.1800824f0
mov r14, rax
test rax, rax
je 0x180020050
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.180084ad0
mov byte [r14], 0
jmp 0x180020053
xor r14d, r14d
mov edx, dword [rdi]
mov r9, rbx
mov r8, rbp
mov rcx, r14
call fcn.180011670
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180026cd0
mov rax, qword [rsp + 0x148]
mov rbx, r14
mov esi, dword [rdi]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd0], xmm0
test rsi, rsi
je 0x1800200f1
lea rdi, [rsp + 0xd0]
sub rdi, r14
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800270f0
mov ecx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1800200d0
sub rdi, 0x10
movups xmmword [rsp + 0xd0], xmm0
sub rsi, 1
jne 0x1800200b0
mov rax, r14
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.180081d90
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180020120
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push rbx
push r12
sub rsp, 8
mov r12d, edx
mov rbx, r8
add r12, rcx
mov r11d, edx
cmp rcx, r12
jae 0x1800201f5
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp], r15
cmp r11d, 8
jb 0x1800201dd
mov r8d, dword [rcx]
mov r10d, 0xe3779b90
mov r9d, dword [rcx + 4]
mov edi, reloc.WS2_32.dll_recv
mov esi, dword [rbx + 8]
mov ebp, dword [rbx + 0xc]
mov r14d, dword [rbx]
mov r15d, dword [rbx + 4]
nop
mov edx, r8d
mov eax, r8d
shr edx, 5
add edx, ebp
shl eax, 4
add eax, esi
xor edx, eax
lea eax, [r8 + r10]
xor edx, eax
sub r9d, edx
mov edx, r9d
mov eax, r9d
shr edx, 5
shl eax, 4
add edx, r15d
add eax, r14d
xor edx, eax
lea eax, [r9 + r10]
xor edx, eax
lea r10d, [r10 + 0x61c88647]
sub r8d, edx
sub rdi, 1
jne 0x180020180
mov dword [rcx], r8d
sub r11d, 8
mov dword [rcx + 4], r9d
add rcx, 8
cmp rcx, r12
jb 0x180020155
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
mov r15, qword [rsp]
add rsp, 8
pop r12
pop rbx
ret
Function at 0x180026a00
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800f4320]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r9, r8
mov rbx, rdx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rbp - 0x41], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x49], rdi
mov byte [rbp - 0x59], dil
mov r8, qword [rcx + 0x10]
cmp r9, r8
jbe 0x180026ad5
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdx + 0x10], rdi
cmp qword [rdx + 0x18], 0x10
jb 0x180026a68
mov rax, qword [rdx]
jmp 0x180026a6b
mov rax, rbx
mov byte [rax], 0
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.180006da0
nop
mov rax, qword [rbp - 0x41]
cmp rax, 0x10
jb 0x180026bfc
inc rax
mov rcx, qword [rbp - 0x59]
cmp rax, 0x1000
jb 0x180026bf7
test cl, 0x1f
je 0x180026aa7
call fcn.180086214
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180026ab6
call fcn.180086214
int3
sub rcx, rax
cmp rcx, 8
jae 0x180026ac5
call fcn.180086214
int3
cmp rcx, 0x27
jbe 0x180026bf4
call fcn.180086214
nop
sub r8, r9
mov rdx, qword [rcx + 8]
add rdx, r9
mov byte [rbp + 0x2f], 0
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x39], 0x67452301
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
lea rcx, [rbp - 0x39]
call fcn.1800203e0
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.180020f70
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.180006860
mov rax, qword [rbp - 0x61]
cmp rax, 0x10
jb 0x180026b7b
inc rax
mov rcx, qword [rbp - 0x79]
cmp rax, 0x1000
jb 0x180026b76
test cl, 0x1f
je 0x180026b49
call fcn.180086214
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180026b58
call fcn.180086214
int3
sub rcx, rax
cmp rcx, 8
jae 0x180026b67
call fcn.180086214
int3
cmp rcx, 0x27
jbe 0x180026b73
call fcn.180086214
int3
mov rcx, rax
call fcn.180081458
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 0x10
jb 0x180026b93
mov rax, qword [rbx]
jmp 0x180026b96
mov rax, rbx
mov byte [rax], 0
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.180006da0
nop
mov rax, qword [rbp - 0x41]
cmp rax, 0x10
jb 0x180026bfc
inc rax
mov rcx, qword [rbp - 0x59]
cmp rax, 0x1000
jb 0x180026bf7
test cl, 0x1f
je 0x180026bca
call fcn.180086214
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180026bd9
call fcn.180086214
int3
sub rcx, rax
cmp rcx, 8
jae 0x180026be8
call fcn.180086214
int3
cmp rcx, 0x27
jbe 0x180026bf4
call fcn.180086214
int3
mov rcx, rax
call fcn.180081458
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180081d90
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret
Function at 0x180026e50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x180026e80
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800270f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xa0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x180027130
sub r9, 1
jne 0x180027120
mov bpl, 9
lea rdi, [rsi + 0x90]
lea r14, [0x1800d5570]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1800271d0
inc r8
sub r9, 1
jne 0x1800271c0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x180027210
sub r8, 1
jne 0x180027200
mov rcx, rbx
call fcn.180026e50
sub rdi, 0x10
add bpl, 0xff
jne 0x180027160
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1800272b0
inc r8
sub r9, 1
jne 0x1800272a0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1800272e0
sub rdx, 1
jne 0x1800272d2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180027310
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10d, 2
mov dword [rcx + 0x200], 1
mov r11d, r10d
mov dword [rcx + 0x204], 1
mov esi, r8d
mov word [rcx + 0x208], 0
mov rbp, rdx
lea r9, [0x1800d5980]
xor dil, dil
mov rax, rcx
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r11, 1
jne 0x180027360
mov rbx, rcx
nop
movzx r9d, byte [rbx]
lea rbx, [rbx + 1]
xor edx, edx
mov eax, r11d
div esi
inc r11d
movzx eax, byte [rdx + rbp]
add al, r9b
add dil, al
movzx edx, dil
movzx eax, byte [rdx + rcx]
mov byte [rbx - 1], al
mov byte [rdx + rcx], r9b
cmp r11d, 0x100
jb 0x1800273c0
lea rax, [rcx + 0x100]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r10, 1
jne 0x180027400
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180027470
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [rcx + 0x204]
mov rdi, rdx
movzx r11d, byte [rcx + 0x209]
sub rdi, r10
sub r8, r10
mov rbx, rcx
lea esi, [r10 + r9]
cmp r10d, esi
jae 0x180027524
lea r9, [r10 + r8]
sub rdi, r8
nop
movzx edx, r10b
lea r9, [r9 + 1]
inc r10d
movzx r8d, byte [rdx + rbx + 0x100]
add r11b, r8b
movzx ecx, r11b
movzx eax, byte [rcx + rbx + 0x100]
mov byte [rdx + rbx + 0x100], al
mov byte [rcx + rbx + 0x100], r8b
movzx eax, byte [rdx + rbx + 0x100]
add al, r8b
movzx ecx, al
movzx eax, byte [rcx + rbx + 0x100]
xor al, byte [rdi + r9 - 1]
mov byte [r9 - 1], al
cmp r10d, esi
jb 0x1800274b0
mov dword [rbx + 0x204], r10d
mov byte [rbx + 0x209], r11b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 0x204], r10d
mov byte [rcx + 0x209], r11b
ret
Function at 0x1800276e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10d, 2
mov dword [rcx + 0x200], 1
mov r11d, r10d
mov dword [rcx + 0x204], 1
mov esi, r8d
mov word [rcx + 0x208], 0
mov rbp, rdx
lea r9, [0x1800d6dc0]
xor dil, dil
mov rax, rcx
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r11, 1
jne 0x180027730
mov rbx, rcx
nop
movzx r9d, byte [rbx]
lea rbx, [rbx + 1]
xor edx, edx
mov eax, r11d
div esi
inc r11d
movzx eax, byte [rdx + rbp]
add al, r9b
add dil, al
movzx edx, dil
movzx eax, byte [rdx + rcx]
mov byte [rbx - 1], al
mov byte [rdx + rcx], r9b
cmp r11d, 0x100
jb 0x180027790
lea rax, [rcx + 0x100]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r10, 1
jne 0x1800277d0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180027840
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [rcx + 0x204]
mov rdi, rdx
movzx r11d, byte [rcx + 0x209]
sub rdi, r10
sub r8, r10
mov rbx, rcx
lea esi, [r10 + r9]
cmp r10d, esi
jae 0x1800278f4
lea r9, [r10 + r8]
sub rdi, r8
nop
movzx edx, r10b
lea r9, [r9 + 1]
inc r10d
movzx r8d, byte [rdx + rbx + 0x100]
add r11b, r8b
movzx ecx, r11b
movzx eax, byte [rcx + rbx + 0x100]
mov byte [rdx + rbx + 0x100], al
mov byte [rcx + rbx + 0x100], r8b
movzx eax, byte [rdx + rbx + 0x100]
add al, r8b
movzx ecx, al
movzx eax, byte [rcx + rbx + 0x100]
xor al, byte [rdi + r9 - 1]
mov byte [r9 - 1], al
cmp r10d, esi
jb 0x180027880
mov dword [rbx + 0x204], r10d
mov byte [rbx + 0x209], r11b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 0x204], r10d
mov byte [rcx + 0x209], r11b
ret
Function at 0x180027920
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800f4320]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov edi, r9d
mov rbp, r8
mov rsi, rdx
call fcn.180003260
mov rbx, rax
call fcn.180003270
mov rdx, rax
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.1800276e0
mov r10d, dword [rsp + 0x220]
movzx r11d, byte [rsp + 0x228]
sub rsi, r10
sub rbp, r10
mov eax, r10d
lea ebx, [r10 + rdi]
cmp r10d, ebx
jae 0x1800279da
add rax, rbp
sub rsi, rbp
movzx ecx, r10b
lea r8, [rsp + 0x20]
add r8, rcx
lea rdx, [rsp + 0x20]
inc r10d
lea rax, [rax + 1]
movzx r9d, byte [r8]
add r11b, r9b
movzx ecx, r11b
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r8], cl
mov byte [rdx], r9b
movzx ecx, byte [r8]
add cl, r9b
movzx edx, cl
movzx ecx, byte [rsp + rdx + 0x20]
xor cl, byte [rsi + rax - 1]
mov byte [rax - 1], cl
cmp r10d, ebx
jb 0x180027990
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180081d90
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x180028660
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1800f4320]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x67452301
mov rcx, qword [rdx]
xor eax, eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdx + 8]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x44], eax
call fcn.180028270
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1800283f0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180028560
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180081d90
add rsp, 0xa0
pop rbx
ret
Function at 0x18002bb30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1050
call fcn.180082070
sub rsp, rax
mov rax, qword [0x1800f4320]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rax, [rsp + 0x30]
mov rsi, r8
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x18002bc40
mov ecx, dword [rsp + 0x34]
cmp ecx, 1
jne 0x18002bbd2
cmp word [rsp + 0x40], bx
je 0x18002bbbe
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18002bbb4
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1800034d0
mov eax, edi
jmp 0x18002bc40
cmp ecx, 2
jne 0x18002bc3b
mov r8d, 0x400
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x30], eax
dec eax
cmp eax, 0x3ff
ja 0x18002bc34
cmp word [rsp + 0x840], bx
je 0x18002bc1d
lea rax, [rsp + 0x840]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18002bc13
mov r8, rbx
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.1800034d0
mov eax, edi
jmp 0x18002bc40
mov eax, 0xea
jmp 0x18002bc40
mov eax, 0x3f4
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180081d90
add rsp, 0x1050
pop rdi
pop rsi
pop rbx
ret