joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180084c80
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.180078b30
test eax, eax
je 0x180084d57
call fcn.180078b90
test eax, eax
je 0x180084d49
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x180084cf7
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x180084cfb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180084d59
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180084d35
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x180084d30
cmp eax, 2
jne 0x180084d35
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180084d57
lea rcx, str.Terminal_Server
call fcn.180084b40
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x180084c80

Function at 0x180085020
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.180078b30
test eax, eax
je 0x180084d57
call fcn.180078b90
test eax, eax
je 0x180084d49
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x180084cf7
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x180084cfb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180084d59
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180084d35
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x180084d30
cmp eax, 2
jne 0x180084d35
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180084d57
lea rcx, str.Terminal_Server
call fcn.180084b40
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x180084c80
Function at 0x180086650
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x40
xor ebx, ebx
lea rax, [rsp + 0x78]
mov rsi, rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rdx], rbx
mov rbp, rcx
mov rdx, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1800866b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1800866b0
xor eax, eax
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x60], rdi
call fcn.18004b754
mov ecx, dword [rsp + 0x68]
mov qword [rsi], rax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18004b754
mov r8, qword [rsi]
mov rdi, rax
test r8, r8
je 0x18008671b
test rax, rax
je 0x18008672c
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test rdi, rdi
je 0x180086728
mov rcx, rdi
call fcn.180049d70
test ebx, ebx
jne 0x180086739
mov rcx, qword [rsi]
test rcx, rcx
je 0x180086739
call fcn.180049d70
mov eax, ebx
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
Function at 0x180088680
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x390
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rdi, rdx
mov r8, rdx
mov edx, 4
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x1800887ec
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x270], 0
call fcn.18004a760
lea rdx, [0x180101ed4]
lea rcx, [rsp + 0x270]
mov r8, rbp
call fcn.18004ad04
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800887e2
lea rdx, [0x180101ed0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1800887bf
lea rdx, str.._C
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1800887bf
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.18004a760
lea r9, [rsp + 0x4c]
lea rdx, [0x1800d4548]
lea rcx, [rsp + 0x160]
mov r8, rbp
call fcn.18004ad04
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x160]
je 0x1800887af
mov rdx, rdi
call fcn.180088680
jmp 0x1800887bd
mov r8, rdi
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test ebx, ebx
je 0x1800887d9
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180088731
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x3c0]
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x390
pop rdi
pop rbp
pop rbx
ret

Function at 0x180089ef0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x180089f08
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x28]
mov r9d, dword [rbx + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 2]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [rbx + 0x34]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180089f5a
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rbx + 0x18], 0
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18008a1b0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x18008a260
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, dword [rcx + 0x38]
mov esi, 4
test edi, edi
je 0x18008a1fe
call fcn.180078be0
test eax, eax
je 0x18008a1fe
mov rcx, rbx
call fcn.18008a120
lea ecx, [rdi - 0x2000]
cmp eax, ecx
jbe 0x18008a1f7
add edi, eax
mov esi, 0x10004
jmp 0x18008a200
xor edi, edi
lea rax, [rbx + 8]
lea r8, [0x18008a080]
mov edx, edi
mov qword [rsp + 0x28], rax
mov r9, rbx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18008a260
mov edx, dword [rbx + 0x3c]
mov dword [rbx + 0x18], 1
test edx, edx
je 0x18008a24b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x18008cad0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1800cba70
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x18008cbdd
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
movzx ecx, byte [r10 - 1]
cmp r8d, 3
jl 0x18008cb5f
movzx eax, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
movzx eax, byte [rdx + rbx]
mov byte [r9 + 3], al
jmp 0x18008cbb4
shl ecx, 0x10
cmp r8d, 2
jne 0x18008cb71
movzx eax, byte [r10]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
cmp r8d, 1
jne 0x18008cba0
lea eax, [r8 + 0x3c]
jmp 0x18008cbab
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
sub r8d, 3
add r9, 4
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x18008cb00
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x18008d230
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0xb8
call fcn.1800cba70
sub rsp, rax
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x110]
xor esi, esi
mov r13, r9
movsxd rdi, r8d
mov r12, rdx
mov rbp, rcx
mov eax, esi
test r9, r9
je 0x18008d27e
lea eax, [rsi + 1]
mov qword [rcx], r9
jmp 0x18008d281
mov r13, qword [rcx]
mov qword [rsp + 0xb0], rbx
test rdx, rdx
je 0x18008d351
mov rcx, r13
call fcn.180094b40
mov ebx, eax
cmp eax, 0x80
jle 0x18008d2bb
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x54
call fcn.18008e710
cmp ebx, edi
jge 0x18008d2f3
lea rcx, [rbp + 8]
mov r8, r14
mov rdx, r13
call fcn.18008c310
lea rcx, [rbp + 8]
mov r8, rdi
mov rdx, r12
call fcn.18008c3f0
lea r12, [rbp + 0x68]
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 8]
mov r8, r12
call fcn.18008c410
jmp 0x18008d32e
test edi, edi
js 0x18008d2ff
cmp edi, 0x80
jle 0x18008d317
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x5e
call fcn.18008e710
lea rcx, [rbp + 0x6c]
mov r8, rdi
mov rdx, r12
call fcn.18004b380
lea r12, [rbp + 0x68]
mov dword [r12], edi
mov ecx, dword [r12]
cmp ecx, 0x80
je 0x18008d359
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rcx + rbp + 0x6c]
call fcn.18004a760
jmp 0x18008d359
test eax, eax
je 0x18008d40d
lea rax, [rsp + 0x20]
mov rdi, rbp
mov rdx, rsi
sub rdi, rax
nop word [rax + rax]
lea rcx, [rsp + rdx + 0x20]
add rdx, 2
movzx eax, byte [rdi + rcx + 0x6c]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rdi + rcx + 0x6d]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x18008d370
lea rcx, [rbp + 0x28]
mov r8, r14
mov rdx, r13
call fcn.18008c310
mov rcx, r13
call fcn.180094b40
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x28]
movsxd r8, eax
call fcn.18008c3f0
nop dword [rax]
lea rdx, [rsp + rsi + 0x20]
add rsi, 2
movzx eax, byte [rdi + rdx + 0x6c]
xor al, 0x5c
mov byte [rdx], al
movzx eax, byte [rdi + rdx + 0x6d]
xor al, 0x5c
mov byte [rdx + 1], al
cmp rsi, 0x80
jl 0x18008d3c0
lea rcx, [rbp + 0x48]
mov r8, r14
mov rdx, r13
call fcn.18008c310
mov rcx, r13
call fcn.180094b40
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x48]
movsxd r8, eax
call fcn.18008c3f0
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.18008c5b0
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0xb8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008e440
Capabilities:
Access the windows event log

Disassembly:
invalid
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x278
call fcn.1800cba70
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x180132920]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x18008e4c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x18008e4c0
lea rbx, [rbp + 0x268]
call fcn.18006b7b8
mov rdx, qword [rbp + 0x260]
lea rcx, [rax + 0x60]
mov r8, rbx
call fcn.1800b990c
jmp 0x18008e688
mov r8, qword [rbp + 0x260]
mov rcx, r8
call fcn.18008e0f0
inc eax
mov edi, eax
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18008e4e9
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800cba70
sub rsp, rcx
xor esi, esi
lea rbx, [rsp + 0x50]
test rbx, rbx
jne 0x18008e510
lea rbx, str.no_stack_
jmp 0x18008e5e3
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18008e559
mov rdx, rsi
test rdi, rdi
je 0x18008e559
nop word [rax + rax]
mov rax, qword [rbp + 0x260]
inc rdx
movsx ecx, byte [rdx + rax - 1]
mov word [rbx + rdx*2 - 2], cx
cmp rdx, rdi
jb 0x18008e540
mov rdx, rsi
test rdi, rdi
je 0x18008e5e3
mov r10d, 0x53
lea r9, [0x180000000]
lea r11d, [r10 + 0x20]
lea r12d, [r10 - 0x10]
lea r13d, [r10 + 0x10]
nop
cmp word [rbx + rdx*2], 0x25
jne case.0x18008e5b2.47
lea r8, [rbx + rdx*2 + 2]
nop dword [rax]
movzx eax, word [r8]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x18008e5b2.47
cdqe
movzx eax, byte [r9 + rax + 0x8e6c0]
mov ecx, dword [r9 + rax*4 + 0x8e6a8]
add rcx, r9
jmp rcx
inc rdx
add r8, 2
jmp 0x18008e590
mov word [rbx + rdx*2 + 2], r10w
jmp case.0x18008e5b2.47
mov word [rbx + rdx*2 + 2], r11w
jmp case.0x18008e5b2.47
mov word [rbx + rdx*2 + 2], r12w
jmp case.0x18008e5b2.47
mov word [rbx + rdx*2 + 2], r13w
inc rdx
cmp rdx, rdi
jb 0x18008e580
lea r9, [rbp + 0x268]
lea rcx, [rbp + 0x10]
mov r8, rbx
mov edx, 0xff
call fcn.18004ac34
mov word [rbp + 0x20e], si
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x18008e66f
call fcn.18008e310
test eax, eax
jle 0x18008e66f
lea rdx, str.OPENSSL
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rsp + 0x40], rsi
mov ecx, 1
mov rbx, rax
lea rax, [rbp + 0x10]
mov edx, ecx
mov qword [rbp], rax
lea rax, [rbp]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], cx
mov rcx, rbx
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x18008e688
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.18004ac60
lea rsp, [rbp + 0x228]
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180093910
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800cba70
sub rsp, rax
mov rbx, r8
call fcn.180093320
test eax, eax
js 0x180093b4e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x180093999
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x180093950
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x180093b4c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x180000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x104010]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x104010]
mov r9d, dword [rdi + rdx*4 + 0x104c10]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x105410]
movzx ecx, byte [rdi + rax*4 + 0x104010]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x105810]
movzx ecx, byte [rdi + rax*4 + 0x104010]
xor r9d, dword [rdi + rcx*4 + 0x105010]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x104010]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x104010]
mov r8d, dword [rdi + rdx*4 + 0x104c10]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x105410]
movzx ecx, byte [rdi + rax*4 + 0x104010]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x105010]
movzx ecx, byte [rdi + rax*4 + 0x104010]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x105810]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x104010]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x104010]
mov r8d, dword [rdi + rdx*4 + 0x104c10]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x105410]
movzx ecx, byte [rdi + rax*4 + 0x104010]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x105010]
movzx ecx, byte [rdi + rax*4 + 0x104010]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x105810]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x104010]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x104010]
mov r8d, dword [rdi + rdx*4 + 0x105410]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x105010]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x104010]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x104c10]
movzx ecx, byte [rdi + rax*4 + 0x104010]
xor r8d, dword [rdi + rcx*4 + 0x105810]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1800939c0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180094d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800cba70
sub rsp, rax
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x180094efc
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x180094e98
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1800900c0
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180094e32
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180094efc
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a1c40
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x1800a1c98
movzx eax, byte [rcx]
test al, al
je 0x1800a1c98
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x1800a1c60
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x1800bf600
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1800bf664
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800bf330
jmp 0x1800bf66a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180157be0], eax
test eax, eax
je 0x1800bf67e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x1800bf600

Function at 0x1800bf750
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x148
ret

Function at 0x1800bf7b0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.18004a760
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x248
ret