joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001eec0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov dword [rcx + 0x3c], 0x20
mov dword [rcx + 0x68], 1
mov dword [rcx + 0x60], 4
lea r8, [rcx + 0x84]
mov qword [rcx + 0x40], rdx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x64], edx
mov dword [rcx + 0x6c], edx
nop dword [rax]
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
add r8, 4
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x18001eef0
repz ret

Function at 0x1800204c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x1800205e0
add rcx, 0x48
call fcn.1800280b0
test eax, eax
je 0x180020500
mov eax, 0xc
jmp 0x1800205e2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rbx + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x180020534
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x1800204f6
lea rcx, [rbx + 0x20]
call fcn.180028020
test eax, eax
jne 0x1800204f6
lea rcx, [rbx + 0x28]
call fcn.180028020
test eax, eax
jne 0x1800204f6
lea rcx, [rbx + 0x30]
mov r8d, edi
mov edx, edi
call fcn.180028070
test eax, eax
jne 0x1800204f6
xor r9d, r9d
mov r8d, edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x180020591
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x1800204f6
lea rax, [rsp + 0x40]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rbx + 4], 1
call fcn.180058fa0
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1800205da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x1800204f6
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180023c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
add edx, edx
shr ecx, 7
shr rax, 8
movzx r10d, word [rbx + rax*2]
and ecx, 1
neg ecx
shr r10, 4
sar rcx, 4
and ecx, 0x7f
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x180023c30
mov rbx, qword [rsp + 8]
mov eax, r11d
ret
Function at 0x180023c70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, edx
xor r11d, r11d
mov rdi, r9
mov rsi, rcx
mov ebx, pe_nt_image_headers64
bts r10d, 8
nop word [rax + rax]
add r8d, r8d
mov r9d, r10d
mov ecx, r10d
shr ecx, 7
shr r9d, 8
mov eax, ebx
and ecx, 1
and eax, r8d
add r10d, r10d
neg ecx
add eax, ebx
sar rcx, 4
add r9d, eax
movzx edx, word [rsi + r9*2]
and ecx, 0x7f
shr rdx, 4
xor rdx, rcx
mov ecx, r10d
add r11d, dword [rdi + rdx*4]
xor ecx, r8d
not ecx
and ebx, ecx
cmp r10d, 0x10000
jb 0x180023ca0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, r11d
ret

Function at 0x180024000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
movzx r10d, word [rcx]
mov r12d, r8d
movzx r8d, word [rcx + 2]
mov rax, r10
mov r15, r9
shr rax, 4
xor r10, 0x7f0
mov r13d, edx
mov ebp, dword [r11 + rax*4]
mov rax, r8
shr r10, 4
mov r9d, dword [r11 + r10*4]
shr rax, 4
xor r8, 0x7f0
mov eax, dword [r11 + rax*4]
shr r8, 4
mov rbx, rcx
lea r14d, [r9 + rax]
mov eax, dword [r11 + r8*4]
mov rsi, r15
add eax, r9d
xor r9d, r9d
mov dword [rsp + 0x48], eax
nop dword [rax + rax]
cmp r9d, r12d
jae 0x1800241e6
mov r8d, r9d
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1800240d2
lea edi, [r13*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 4]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1800240a1
lea eax, [r10 + rbp]
inc r9d
add rsi, 4
mov dword [rsi - 4], eax
cmp r9d, 8
jb 0x180024080
movsxd rax, r9d
cmp r9d, 0x10
jae 0x18002416a
lea esi, [r9 - 8]
lea rbp, [r15 + rax*4]
cmp r9d, r12d
jae 0x1800241e6
mov r8d, esi
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x180024154
lea edi, [r13*8]
nop dword [rax + rax]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 0x104]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x180024120
lea eax, [r10 + r14]
inc r9d
add rbp, 4
mov dword [rbp - 4], eax
inc esi
cmp r9d, 0x10
jb 0x1800240f7
movsxd rax, r9d
cmp r9d, r12d
jae 0x1800241e6
mov ebp, dword [rsp + 0x48]
sub r12d, r9d
lea r10d, [r9 - 0x10]
mov esi, r12d
lea rdi, [r15 + rax*4]
nop word [rax + rax]
mov r8d, r10d
xor r9d, r9d
bts r8d, 8
cmp r8d, 1
je 0x1800241d2
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
movzx edx, word [rbx + rax*2 + 0x204]
neg ecx
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1800241a1
lea eax, [r9 + rbp]
add rdi, 4
inc r10d
sub rsi, 1
mov dword [rdi - 4], eax
jne 0x180024190
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1800265f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rsi, rcx
xor r8d, r8d
lea r9, [rcx + 0x33e14]
nop dword [rax]
xor r10d, r10d
mov ebx, r8d
mov r11d, 1
lea edi, [r10 + 4]
mov eax, r11d
mov edx, ebx
add r11d, r11d
movzx ecx, word [rsi + rax*2 + 0x344bc]
and edx, 1
shr ebx, 1
mov eax, edx
shr rcx, 4
or r11d, edx
neg eax
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r10d, dword [rsi + rcx*4 + 0x32764]
sub edi, 1
jne 0x180026620
inc r8d
mov dword [r9], r10d
add r9, 4
cmp r8d, 0x10
jb 0x180026610
mov rbx, qword [rsp + 8]
mov dword [rsi + 0x33e54], edi
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180026680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov r14d, 4
mov r10, rcx
lea rbx, [rcx + 0x30768]
mov r8d, r14d
lea r9, [rsp + 0x10]
nop word [rax + rax]
movzx edx, byte [rbx]
xor r11d, r11d
mov ebp, r8d
mov esi, edx
mov eax, edx
lea edi, [r11 + 1]
and eax, 1
shr esi, 1
mov r12, rdx
dec esi
or eax, 2
mov ecx, esi
shl eax, cl
sub ebp, eax
movsxd r13, eax
test esi, esi
je 0x18002672b
nop dword [rax + rax]
mov eax, edi
mov edx, ebp
add edi, edi
sub rax, r12
and edx, 1
shr ebp, 1
add rax, r13
or edi, edx
movzx ecx, word [r10 + rax*2 + 0x343d6]
mov eax, edx
neg eax
shr rcx, 4
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r11d, dword [r10 + rcx*4 + 0x32764]
sub esi, 1
jne 0x1800266f0
inc r8d
mov dword [r9], r11d
inc rbx
add r9, r14
cmp r8d, 0x80
jb 0x1800266c0
lea rbp, [rsp]
lea rdi, [r10 + 0x33214]
lea rsi, [r10 + 0x341d8]
sub rbp, r10
lea r12, [r10 + 0x3361c]
sub rbp, 0x33614
xor r11d, r11d
cmp dword [r10 + 0x33e58], r11d
jbe 0x1800267d4
mov rbx, rdi
nop word [rax + rax]
mov r8d, r11d
xor r9d, r9d
or r8d, 0x40
cmp r8d, 1
je 0x1800267c1
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
movzx edx, word [rsi + rax*2]
neg ecx
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [r10 + rdx*4 + 0x32764]
cmp r8d, 1
jne 0x180026790
mov dword [rbx], r9d
inc r11d
add rbx, 4
cmp r11d, dword [r10 + 0x33e58]
jb 0x180026780
mov edx, 0xe
cmp dword [r10 + 0x33e58], edx
jbe 0x18002680c
lea rcx, [rdi + 0x38]
nop word [rax + rax]
mov eax, edx
inc edx
add rcx, 4
shr eax, 1
sub eax, 5
shl eax, 4
add dword [rcx - 4], eax
cmp edx, dword [r10 + 0x33e58]
jb 0x1800267f0
mov eax, dword [rdi]
lea r8, [r10 + 0x30768]
lea rdx, [r12 + 8]
mov dword [r12 - 8], eax
mov eax, dword [rdi + 4]
mov r9d, 0x7c
mov dword [r12 - 4], eax
mov eax, dword [rdi + 8]
mov dword [r12], eax
mov eax, dword [rdi + 0xc]
mov dword [r12 + 4], eax
nop dword [rax]
movzx eax, byte [r8]
add rdx, 4
inc r8
mov ecx, dword [rdi + rax*4]
add ecx, dword [rdx + rbp - 4]
sub r9, 1
mov dword [rdx - 4], ecx
jne 0x180026840
sub rsi, 0xffffffffffffff80
add rdi, 0x100
sub rbp, 0x200
add r12, 0x200
sub r14, 1
jne 0x180026763
lea r11, [rsp + 0x200]
mov dword [r10 + 0x3d5d0], r14d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800280d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
push rdi
push r13
push r14
push r15
sub rsp, 8
mov r10d, dword [r9]
xor r14d, r14d
mov edi, r8d
and r10d, 7
mov r13, rcx
mov r11, r14
cmp rdx, 5
jae 0x180028107
xor eax, eax
add rsp, 8
pop r15
pop r14
pop r13
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp], r12
mov r12d, dword [rsp + 0x50]
add edi, 5
or rsi, 0xffffffffffffffff
lea rbx, [rcx + rdx - 4]
lea r15, [0x180000000]
lea r8, [r11 + r13]
cmp r8, rbx
jae 0x180028152
nop dword [rax + rax]
movzx eax, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x180028152
inc r8
cmp r8, rbx
jb 0x180028140
mov r11, r8
sub r11, r13
cmp r8, rbx
jae 0x18002827f
mov rax, r11
sub rax, rsi
cmp rax, 3
jbe 0x180028190
mov r10d, r14d
movzx eax, byte [r8 + 4]
mov rsi, r11
test al, al
je 0x1800281d7
cmp al, 0xff
je 0x1800281d7
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x180028132
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x180028170
movzx eax, byte [r10 + r15 + 0x7db78]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + 4]
cmp byte [r10 + r15 + 0x7db70], r14b
je 0x1800281c1
test al, al
je 0x1800281c1
cmp al, 0xff
jne 0x180028170
and r10d, 3
mov rsi, r11
add r10d, r10d
or r10d, 1
inc r11
jmp 0x180028132
movzx r9d, al
movzx eax, byte [r8 + 3]
movsxd rbp, r10d
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 2]
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 1]
shl r9d, 8
or r9d, eax
test r12d, r12d
je 0x18002820f
lea edx, [r11 + r9]
add edx, edi
jmp 0x180028217
mov edx, r9d
sub edx, r11d
sub edx, edi
test r10d, r10d
je 0x180028251
movzx r9d, byte [r15 + rbp + 0x7db78]
mov eax, edx
shl r9d, 3
neg r9d
lea ecx, [r9 + 0x18]
shr eax, cl
test al, al
je 0x18002823c
cmp al, 0xff
jne 0x180028251
lea ecx, [r9 + 0x20]
mov r9d, 1
shl r9d, cl
dec r9d
xor r9d, edx
jmp 0x180028202
mov eax, edx
mov byte [r8 + 1], dl
shr eax, 0x18
and al, 1
dec al
not al
mov byte [r8 + 4], al
mov eax, edx
shr eax, 0x10
mov byte [r8 + 3], al
mov eax, edx
shr eax, 8
add r11, 5
mov byte [r8 + 2], al
jmp 0x180028132
mov r12, qword [rsp]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rax, r11
sub rax, rsi
mov rsi, qword [rsp + 0x40]
cmp rax, 3
ja 0x1800282ab
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
mov r14d, r10d
mov r15, qword [rsp + 0x48]
mov rax, r11
mov dword [r15], r14d
add rsp, 8
pop r15
pop r14
pop r13
pop rdi
ret
Function at 0x180032d60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rcx
mov ecx, dword [rcx]
cmp ecx, 8
jle 0x180032db9
and ecx, 1
je 0x180032d7f
mov eax, dword [r9 + 0x10]
add eax, eax
sub eax, dword [r9 + 0x14]
jmp 0x180032d8c
mov eax, dword [r9 + 0x10]
lea eax, [rax + rax*2]
sub eax, dword [r9 + 0x14]
sar eax, 1
mov edx, dword [r9 + 0x10]
mov dword [r9 + 0x10], eax
mov dword [r9 + 0x14], edx
test ecx, ecx
je 0x180032da9
add eax, eax
sub eax, edx
mov dword [r9 + 0x14], eax
add rsp, 8
ret
lea eax, [rax + rax*2]
sub eax, edx
sar eax, 1
mov dword [r9 + 0x14], eax
add rsp, 8
ret
cmp ecx, 1
jle 0x180032e1b
mov eax, ecx
xor r10d, r10d
mov qword [rsp], rbx
cdq
lea r11d, [rcx - 1]
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x180032e17
nop word [rax + rax]
and r11d, 7
and r10d, 7
movsxd r8, r11d
movsxd rdx, r10d
dec r11d
mov ecx, dword [r9 + r8*4 + 0x10]
inc r10d
xor dword [r9 + rdx*4 + 0x10], ecx
mov ecx, dword [r9 + rdx*4 + 0x10]
xor dword [r9 + r8*4 + 0x10], ecx
mov eax, dword [r9 + r8*4 + 0x10]
xor dword [r9 + rdx*4 + 0x10], eax
sub ebx, 1
jne 0x180032de0
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1800359d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rcx
mov ecx, dword [rcx]
cmp ecx, 8
jle 0x180035a67
and ecx, 1
je 0x1800359fd
mov edx, dword [r9 + 0x10]
mov eax, dword [r9 + 0x30]
add edx, edx
add eax, eax
sub edx, dword [r9 + 0x14]
sub eax, dword [r9 + 0x34]
jmp 0x180035a17
mov eax, dword [r9 + 0x10]
lea edx, [rax + rax*2]
mov eax, dword [r9 + 0x30]
sub edx, dword [r9 + 0x14]
lea eax, [rax + rax*2]
sub eax, dword [r9 + 0x34]
sar edx, 1
sar eax, 1
mov r8d, dword [r9 + 0x10]
mov r10d, dword [r9 + 0x30]
mov dword [r9 + 0x10], edx
mov dword [r9 + 0x14], r8d
mov dword [r9 + 0x34], r10d
mov dword [r9 + 0x30], eax
test ecx, ecx
je 0x180035a4a
add edx, edx
add eax, eax
sub edx, r8d
sub eax, r10d
mov dword [r9 + 0x34], eax
mov dword [r9 + 0x14], edx
add rsp, 8
ret
lea edx, [rdx + rdx*2]
lea eax, [rax + rax*2]
sub edx, r8d
sub eax, r10d
sar edx, 1
sar eax, 1
mov dword [r9 + 0x34], eax
mov dword [r9 + 0x14], edx
add rsp, 8
ret
cmp ecx, 1
jle 0x180035adb
mov eax, ecx
xor r10d, r10d
mov qword [rsp], rbx
cdq
lea r11d, [rcx - 1]
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x180035ad7
and r11d, 7
and r10d, 7
movsxd r8, r11d
movsxd rdx, r10d
dec r11d
mov ecx, dword [r9 + r8*4 + 0x10]
inc r10d
xor dword [r9 + rdx*4 + 0x10], ecx
mov ecx, dword [r9 + rdx*4 + 0x10]
xor dword [r9 + r8*4 + 0x10], ecx
mov eax, dword [r9 + r8*4 + 0x10]
xor dword [r9 + rdx*4 + 0x10], eax
mov eax, dword [r9 + r8*4 + 0x30]
xor dword [r9 + rdx*4 + 0x30], eax
mov eax, dword [r9 + rdx*4 + 0x30]
xor dword [r9 + r8*4 + 0x30], eax
mov eax, dword [r9 + r8*4 + 0x30]
xor dword [r9 + rdx*4 + 0x30], eax
sub ebx, 1
jne 0x180035a82
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x18003ad80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 8
mov qword [rsp + 0x20], rbp
xor ebp, ebp
mov qword [rsp + 0x30], r12
mov ebx, ebp
or r11d, 0xffffffff
mov qword [rsp + 0x38], r13
mov qword [rsp], r14
mov r10, rcx
mov esi, ebp
mov byte [rcx + 0x16f], bl
mov byte [rcx + 0x16e], bl
mov byte [rcx + 0x16d], bl
mov byte [rcx + 0x16c], bl
mov r14d, r11d
mov r9d, ebp
mov r12, rdx
mov r13d, r8d
test r8d, r8d
je 0x18003ae2b
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov edi, dword [r12]
lea eax, [r14 + r14*2]
dec r13d
movzx ecx, di
add ecx, eax
mov eax, edi
sar eax, 0x10
lea r14d, [rcx + rcx*2]
movzx eax, ax
add r14d, eax
test edi, edi
jns 0x18003ae09
mov eax, edi
not eax
jmp 0x18003ae0b
mov eax, edi
or ebp, eax
mov eax, edi
and r11d, edi
and eax, 1
or esi, edi
add r12, 4
neg eax
xor eax, edi
or ebx, eax
test r13d, r13d
jne 0x18003ade0
mov rdi, qword [rsp + 0x28]
and dword [r10 + 0x18], 0xff83ffff
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov eax, dword [r10 + 0x18]
mov dword [r10 + 0xc8], r14d
mov r14, qword [rsp]
test ebp, ebp
je 0x18003ae5d
add eax, 0x40000
shr ebp, 1
jne 0x18003ae50
mov dword [r10 + 0x18], eax
mov eax, dword [r10 + 0x18]
mov rbp, qword [rsp + 0x20]
test eax, 0x7c0000
jne 0x18003ae7e
btr eax, 8
mov dword [r10 + 0x18], eax
xor eax, eax
add rsp, 8
pop rsi
pop rbx
ret
test sil, 1
jne 0x18003aeaf
xor ecx, ecx
nop word [rax + rax]
shr esi, 1
add eax, 0xfffc0000
inc cl
inc r9d
test sil, 1
je 0x18003ae90
mov byte [r10 + 0x16d], cl
mov dword [r10 + 0x18], eax
jmp 0x18003af0c
test r11b, 1
je 0x18003aee0
xor ecx, ecx
nop word [rax + rax]
shr r11d, 1
add eax, 0xfffc0000
inc cl
inc r9d
test r11b, 1
jne 0x18003aec0
mov byte [r10 + 0x16e], cl
mov dword [r10 + 0x18], eax
jmp 0x18003af0c
test bl, 2
jne 0x18003af0c
xor ecx, ecx
nop word [rax + rax]
shr ebx, 1
add eax, 0xfffc0000
inc cl
inc r9d
test bl, 2
je 0x18003aef0
mov byte [r10 + 0x16f], cl
mov dword [r10 + 0x18], eax
mov r11d, dword [r10 + 0x18]
mov ecx, r11d
shr ecx, 0x12
mov eax, ecx
and eax, 0x1f
cmp al, 0x17
jbe 0x18003af44
and cl, 0x1f
and r11d, 0xff83ffff
sub cl, 0x17
movzx eax, cl
add r9d, eax
add r11d, 0x5c0000
mov byte [r10 + 0x16c], al
mov dword [r10 + 0x18], r11d
test r9d, r9d
je 0x18003af70
or dword [r10 + 0x18], 0x100
test r8d, r8d
je 0x18003af70
nop word [rax + rax]
mov ecx, r9d
add rdx, 4
sar dword [rdx - 4], cl
sub r8d, 1
jne 0x18003af60
movzx eax, byte [r10 + 0x16c]
add rsp, 8
pop rsi
pop rbx
ret
Function at 0x1800492e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor edi, edi
mov ebx, r8d
mov r10d, edx
mov r11, rcx
test edx, edx
je 0x1800493d1
lea rsi, [0x180000000]
nop dword [rax]
mov eax, dword [r11]
dec r10d
add r11, 4
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
mov eax, r8d
shr eax, 9
add r8d, eax
cmp r8d, 0x100
jae 0x18004935e
movsx edx, byte [r8 + rsi + 0x74d10]
mov ecx, 9
sub ecx, edx
shl edx, 8
shl r8d, cl
add edi, edx
movzx eax, r8b
movzx ecx, byte [rax + rsi + 0x74e10]
add edi, ecx
jmp 0x1800493c8
mov eax, r8d
cmp r8d, 0x10000
jae 0x18004937b
shr rax, 8
movsx edx, byte [rax + rsi + 0x74d10]
add edx, 8
jmp 0x1800493a4
cmp r8d, 0x1000000
jae 0x180049395
shr rax, 0x10
movsx edx, byte [rax + rsi + 0x74d10]
add edx, 0x10
jmp 0x1800493a4
shr rax, 0x18
movsx edx, byte [rax + rsi + 0x74d10]
add edx, 0x18
lea ecx, [rdx - 9]
shl edx, 8
mov r9d, r8d
shr r9, cl
movzx eax, r9b
movzx ecx, byte [rax + rsi + 0x74e10]
add ecx, edx
add edi, ecx
test ebx, ebx
je 0x1800493c8
cmp ecx, ebx
jge 0x1800493e3
test r10d, r10d
jne 0x180049310
mov eax, edi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
or eax, 0xffffffff
ret
Function at 0x18004d8d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
cmp dword [rcx + 0x24], 2
jne 0x18004d939
cmp dword [rcx + 0x20], 1
jne 0x18004d939
mov rdi, qword [rcx]
cmp byte [rdi], 0
jne 0x18004d939
mov eax, dword [rdi + 0x1c]
mov dword [rcx + 0x28], eax
mov byte [rdi + 0x20], 0
movsxd rdx, dword [rdi + 0x1c]
mov rcx, qword [rdi + 8]
call fcn.1800594bc
mov qword [rdi + 8], rax
mov qword [rbx + 0x18], rax
call fcn.180059da0
movsxd r8, dword [rbx + 0x28]
lea r9, [rax + 0x30]
mov edx, 1
mov rcx, qword [rbx + 0x18]
call fcn.18005a4d4
cmp dword [rbx + 0x24], 0
jne 0x18004d965
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18004d9aa
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x18004d9aa
mov r8d, dword [rbx + 0x58]
test r8d, r8d
je 0x18004d9aa
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
jmp 0x18004d9aa
cmp dword [rbx + 0x20], 0
jne 0x18004d98a
cmp byte [rbx + 0x10], 0
je 0x18004d97a
mov rcx, qword [rbx + 0x18]
call fcn.180059274
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18004d9aa
call fcn.180057d7c
jmp 0x18004d9aa
mov rdi, qword [rbx]
test rdi, rdi
je 0x18004d9aa
cmp byte [rdi + 0x20], 0
je 0x18004d9a1
mov rcx, qword [rdi + 8]
call fcn.180059274
mov rcx, rdi
call fcn.180057d7c
nop
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x18004d9c0
call fcn.180058570
mov qword [rbx + 0x50], 0
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18004d9d0
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18004d9df
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18004dbe0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov rdi, rcx
cmp dword [rcx + 0x20], 0
jne 0x18004dd15
mov ecx, 0x28
call fcn.180058470
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18004dc51
mov dword [rax + 0x14], 0x10000
mov dword [rax + 0x1c], 0
mov byte [rax], 0
mov byte [rax + 0x20], 1
mov dword [rax + 0x10], 0x10000
mov ecx, 0x10000
call fcn.1800592b4
mov qword [rbx + 8], rax
test rax, rax
jne 0x18004dc53
mov byte [rbx], 1
jmp 0x18004dc53
xor ebx, ebx
mov edx, 1
mov ecx, 0x100000
call fcn.18005aae4
mov rbp, rax
test rax, rax
je 0x18004dcbd
call fcn.180059da0
mov r9, rax
mov edx, 1
mov r8d, 0x100000
mov rcx, rbp
call fcn.18005a2e0
test eax, eax
jle 0x18004dcbd
nop dword [rax]
mov r8d, eax
mov rdx, rbp
mov rcx, rbx
call fcn.18004d740
call fcn.180059da0
mov r9, rax
mov edx, 1
mov r8d, 0x100000
mov rcx, rbp
call fcn.18005a2e0
test eax, eax
jg 0x18004dc90
cmp byte [rbx], 0
je 0x18004dcd3
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x28], 0
jmp 0x18004dcf2
mov byte [rbx + 0x20], 0
movsxd rdx, dword [rbx + 0x1c]
mov rcx, qword [rbx + 8]
call fcn.1800594bc
mov qword [rbx + 8], rax
mov qword [rdi + 0x18], rax
mov eax, dword [rbx + 0x1c]
mov dword [rdi + 0x28], eax
cmp byte [rbx + 0x20], 0
je 0x18004dd01
mov rcx, qword [rbx + 8]
call fcn.180059274
mov rcx, rbx
call fcn.180057d7c
mov rcx, rbp
call fcn.180059274
mov byte [rdi + 0x10], 1
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.18004db20
Function at 0x18005b873
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18008c590]
jne 0x180057dba
rol rcx, 0x10
test cx, 0xffff
jne 0x180057db6
repz ret
ror rcx, 0x10
jmp 0x18005b7cc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18008f070]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18008f168]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005b851
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18008f070]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18005b873
mov rax, qword [rsp + 0x88]
mov qword [0x18008f168], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18008f108], rax
mov rax, qword [0x18008f168]
mov qword [0x18008efe0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18008f0f0], rax
mov dword [0x18008efd0], 0xc0000409
mov dword [0x18008efd4], 1
mov rax, qword [0x18008c590]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18008c598]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18008f068], eax
mov ecx, 1
call fcn.18005c9b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180071708]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18008f068], 0
jne 0x18005b8fa
mov ecx, 1
call fcn.18005c9b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret