joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180091ec0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rcx, qword [rsp + 0xc0]
mov qword [rcx + 0x20], rax
cmp qword [rsp + 0xc8], 0
je 0x180091f38
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + 8]
mov qword [rax + 0x30], rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xc0]
lea r8, [0x180091cc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, qword [rsp + 0xc0]
mov qword [rcx + 0x38], rax
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x38], 0
je 0x180092140
cmp qword [rsp + 0xc8], 0
je 0x18009207a
mov ecx, Ordinal_211
call fcn.1800b7490
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0xc0], 0
je 0x180091fcf
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x180091fd8
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.180093000
mov qword [rsp + 0x38], rax
jmp 0x180091ffa
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.180092530
nop
lea rcx, [rsp + 0x60]
call fcn.180080b00
cmp dword [rax + 0x10], 0
je 0x18009206b
lea rcx, [rsp + 0x60]
call fcn.180080b00
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [rax]
test eax, eax
je 0x18009206b
mov rax, qword [rsp + 0xc0]
add rax, 0x40
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180092400
nop
lea rcx, [rsp + 0x60]
call fcn.1800767b0
jmp 0x180092140
mov ecx, 0x1c0
call fcn.1800b7490
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0xc0], 0
je 0x1800920aa
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x1800920b3
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
call fcn.18007f3c0
mov qword [rsp + 0x50], rax
jmp 0x1800920d5
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x70]
call fcn.180092570
nop
lea rcx, [rsp + 0x70]
call fcn.180080b00
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [rax]
test eax, eax
je 0x180092136
mov rax, qword [rsp + 0xc0]
add rax, 0x40
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.180092400
nop
lea rcx, [rsp + 0x70]
call fcn.1800767b0
mov eax, 1
add rsp, 0xb8
ret
Function at 0x180093960
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x90]
call fcn.180082180
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x459
jne 0x1800939d3
lea rcx, str.Utf82Unicode:_Invalid_UTF_8_sequence._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rsp + 0x30], 0
jne 0x1800939e7
lea rcx, str.Utf82Unicode:_Error_in_conversion._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movsxd rax, dword [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180093e40
nop
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180093de0
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x90]
call fcn.180082180
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
je 0x180093a5b
lea rcx, str.Utf82Unicode:_MultiByteToWideChar_CP_UTF8_failed._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180093de0
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.180081eb0
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x50]
call fcn.180093e10
mov rax, qword [rsp + 0x88]
add rsp, 0x78
ret
Function at 0x180093aa0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0xa0]
call fcn.180081e40
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x459
jne 0x180093b28
lea rcx, str.WideByte2Acsi:_Invalid_UTF_8_sequence._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rsp + 0x40], 0
jne 0x180093b3c
lea rcx, str.WideByte2Acsi:_Error_in_conversion._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180093d40
nop
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180093ce0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xa0]
call fcn.180081e40
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
je 0x180093bc2
lea rcx, str.WideByte2Acsi:_WideCharToMultiByte_CP_OEMCP_failed._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180093ce0
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.1800826e0
mov eax, dword [rsp + 0x44]
or eax, 1
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x60]
call fcn.180093d10
mov rax, qword [rsp + 0x98]
add rsp, 0x88
ret
Function at 0x180096220
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
xor edx, edx
mov rax, qword [rsp + 0xa0]
movabs rcx, 0x100000000
div rcx
mov rax, rdx
cmp rax, 0x7fffffff
jbe 0x180096257
mov byte [rsp + 0x20], 1
jmp 0x18009625c
mov byte [rsp + 0x20], 0
xor edx, edx
mov rax, qword [rsp + 0xa0]
movabs rcx, 0x100000000
div rcx
movabs rcx, 0x100000000
imul rax, rcx
movzx ecx, byte [rsp + 0x20]
movabs rdx, 0x100000000
imul rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
movabs rax, 0x800000000000
cmp qword [rsp + 0x28], rax
jne 0x1800962bc
movabs rax, 0x7fff80000000
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x58]
lea rcx, [0x18051c1f0]
call fcn.180080e30
lea rdx, [rsp + 0x70]
lea rcx, [0x18051c1f0]
call fcn.1800808e0
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.180080640
movzx eax, al
test eax, eax
je 0x1800964aa
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
movsx eax, byte [0x18051c16a]
mov ecx, dword [0x18051c16c]
imul ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 0
cmp qword [rsp + 0x30], 0
jne 0x18009634a
xor edx, edx
mov eax, 0x10000
div dword [0x18051c16c]
imul eax, dword [0x18051c16c]
mov eax, eax
mov qword [rsp + 0x30], rax
mov r9d, 1
mov r8d, 0x2000
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180096449
mov eax, dword [0x18051c16c]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x18009642c
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x68], eax
mov eax, dword [0x18051c16c]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
mov rax, qword [rsp + 0x50]
mov ecx, dword [0x18051c16c]
mov dword [rax + 4], ecx
lea rdx, [rsp + 0x28]
lea rcx, [0x18051c1f0]
call fcn.180098380
lea rcx, [rsp + 0x60]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x28]
lea rcx, [0x18051c1f0]
call fcn.180098380
jmp 0x1800964b8
mov dword [rsp + 0x40], 0x13f
lea rdx, [0x180494c58]
lea rcx, [rsp + 0x40]
call fcn.18020d658
xor eax, eax
jmp 0x1800964b8
mov eax, dword [0x18051c16c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18009634a
mov eax, dword [0x18051c16c]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18009634a
mov dword [rsp + 0x44], 0x146
lea rdx, [0x180494c58]
lea rcx, [rsp + 0x44]
call fcn.18020d658
xor eax, eax
jmp 0x1800964b8
lea rcx, [rsp + 0x58]
call fcn.180080620
add rax, 8
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x180098230
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18051c170], eax
cmp dword [0x18051c170], 0xffffffff
jne 0x180098267
mov dword [rsp + 0x20], 0x47a
lea rdx, [0x180494c58]
lea rcx, [rsp + 0x20]
call fcn.18020d658
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x18051c140], rax
cmp qword [0x18051c140], 0
jne 0x18009829e
mov dword [rsp + 0x24], 0x47f
lea rdx, [0x180494c58]
lea rcx, [rsp + 0x24]
call fcn.18020d658
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [0x18051c168], 1
mov byte [0x18051c169], 0
mov byte [0x18051c16a], 1
mov eax, dword [rsp + 0x2c]
mov dword [0x18051c16c], eax
lea rax, [0x1800964d0]
mov qword [0x18051c160], rax
lea rax, [0x180096810]
mov qword [0x18051c158], rax
lea rax, [fcn.180096950]
mov qword [0x18051c150], rax
lea rax, [0x180096ae0]
mov qword [0x18051c148], rax
mov qword [0x18051c138], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x18009fee0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov esi, r8d
mov rbp, rdx
mov r14d, ecx
test r8d, r8d
jle 0x18009ff3f
nop word [rax + rax]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
mov ecx, r14d
call fcn.1802317cc
mov edi, eax
test eax, eax
je 0x18009ff3f
cmp eax, 0xffffffff
jne 0x18009ff39
call fcn.180213f9c
cmp dword [rax], 4
jne 0x18009ff5c
add ebx, edi
cmp ebx, esi
jl 0x18009ff10
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
or eax, 0xffffffff
jmp 0x18009ff41
Function at 0x18009ffe0
Capabilities:
Read file on windows

Disassembly:
push r12
push r15
mov eax, 0x2048
call fcn.1800b8100
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r15d, r8d
mov r12d, ecx
mov ecx, r15d
xor r8d, r8d
xor edx, edx
call fcn.180227208
cmp eax, 0xffffffff
je 0x1800a0154
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.180227208
cmp eax, 0xffffffff
je 0x1800a0154
mov qword [rsp + 0x2068], rbx
mov qword [rsp + 0x2078], rbp
mov qword [rsp + 0x2040], rsi
mov qword [rsp + 0x2038], rdi
mov qword [rsp + 0x2030], r14
xor r14d, r14d
xor ebx, ebx
mov r8d, 0x2000
movsxd rax, ebx
lea rdx, [rsp + 0x20]
sub r8d, ebx
add rdx, rax
mov ecx, r15d
call fcn.1802317cc
mov edi, eax
test eax, eax
je 0x1800a00a1
cmp eax, 0xffffffff
jne 0x1800a0097
call fcn.180213f9c
cmp dword [rax], 4
jne 0x1800a0143
add ebx, edi
cmp ebx, 0x2000
jl 0x1800a0062
test ebx, ebx
jle 0x1800a0141
mov edi, ebx
lea rsi, [rsp + 0x20]
xor ebp, ebp
mov r8d, edi
mov rdx, rsi
mov ecx, r12d
call fcn.18022ca00
cmp eax, 0xffffffff
je 0x1800a00d5
test eax, eax
je 0x1800a00df
movsxd rcx, eax
sub edi, eax
add rsi, rcx
add ebp, eax
jmp 0x1800a00df
call fcn.180213f9c
cmp dword [rax], 4
jne 0x1800a00f0
test edi, edi
jg 0x1800a00b2
cmp ebp, 0xffffffff
je 0x1800a00f0
add r14d, ebx
jmp 0x1800a0060
mov dword [0x18051c174], 0xf
or eax, 0xffffffff
mov rdi, qword [rsp + 0x2038]
mov rsi, qword [rsp + 0x2040]
mov rbp, qword [rsp + 0x2078]
mov rbx, qword [rsp + 0x2068]
mov r14, qword [rsp + 0x2030]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x2048
pop r15
pop r12
ret
jns 0x1800a014f
mov dword [0x18051c174], 0xe
jmp 0x1800a00fa
mov eax, r14d
jmp 0x1800a00fd
mov dword [0x18051c174], 0xd
or eax, 0xffffffff
jmp 0x1800a0125
Function at 0x1800a3640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
call fcn.18021452c
mov r9, qword [0x1804b7690]
mov r10, rax
mov qword [rsp + 0x40], rax
test r9, r9
je 0x1800a36c2
movabs r11, 0x1845c8a0ce512957
mov rax, r11
imul qword [0x1804b7688]
mov rax, r11
mov r8, rdx
imul r10
sar r8, 0xd
sar rdx, 0xd
mov rcx, r8
mov rax, rdx
shr rcx, 0x3f
shr rax, 0x3f
add r8, rcx
add rdx, rax
cmp r8, rdx
je 0x1800a3817
xor eax, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.1802152bc
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x400
call fcn.18020d410
lea rcx, [rsp + 0x70]
call fcn.1800ab1e0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800a3717
mov r8, qword [rax]
mov edx, dword [rsp + 0x58]
lea r9, [0x1804b7650]
mov ecx, dword [rsp + 0x5c]
inc edx
mov eax, dword [rsp + 0x54]
add ecx, 0x76c
mov dword [rsp + 0x38], eax
mov eax, dword [section..data]
mov dword [rsp + 0x30], edx
lea rdx, str._slog_s__d__04d__02d__02d.log
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x20], eax
call fcn.1800a2af0
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x1800a37af
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x1800a37aa
test cl, 0x1f
jne 0x1800a3855
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800a385b
sub rcx, rax
cmp rcx, 8
jb 0x1800a3861
cmp rcx, 0x27
ja 0x1800a3867
mov rcx, rax
call fcn.1800b74cc
mov rcx, qword [0x1804b7690]
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x80], 0
mov byte [rsp + 0x70], 0
test rcx, rcx
je 0x1800a37e2
call fcn.1802145f0
call fcn.1800a3040
mov r8d, 0x40
lea rdx, [0x18032b0d8]
lea rcx, [rsp + 0x90]
call fcn.180214a08
mov qword [0x1804b7690], rax
mov r9, rax
test rax, rax
je 0x1800a3834
mov r8, qword [rsp + 0x40]
mov qword [0x1804b7688], r8
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.180214c68
mov rcx, qword [0x1804b7690]
call fcn.180214810
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800b80c0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x4a0
pop rdi
ret
call fcn.18020ef34
int3
call fcn.18020ef34
int3
call fcn.18020ef34
int3
call fcn.18020ef34
int3
Function at 0x1800a6c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd r14, dword [rdx + 0x1c]
xor r11d, r11d
mov rsi, qword [rdx]
or ebp, 0xffffffff
mov r10, qword [rdx + 8]
mov rbx, rcx
mov dword [rcx + 0x192c], r11d
mov r15, rdx
mov dword [rcx + 0x1930], 0x23d
mov ecx, r11d
mov r8d, r11d
test r14d, r14d
jle 0x1800a6ceb
cmp word [rsi + rcx*4], r11w
je 0x1800a6cda
inc dword [rbx + 0x192c]
mov ebp, r8d
movsxd rax, dword [rbx + 0x192c]
mov dword [rbx + rax*4 + 0x1038], r8d
mov byte [rcx + rbx + 0x1934], r11b
jmp 0x1800a6ce0
mov word [rsi + rcx*4 + 2], r11w
inc r8d
inc rcx
cmp rcx, r14
jl 0x1800a6cb1
cmp dword [rbx + 0x192c], 2
mov r12d, 1
jge 0x1800a6d58
movsxd r8, ebp
nop dword [rax]
cmp ebp, 2
jge 0x1800a6d11
inc ebp
inc r8
mov edx, ebp
mov rcx, r8
jmp 0x1800a6d17
mov edx, r11d
mov rcx, r11
inc dword [rbx + 0x192c]
movsxd rax, dword [rbx + 0x192c]
mov dword [rbx + rax*4 + 0x1038], edx
mov word [rsi + rcx*4], r12w
mov byte [rbx + rcx + 0x1934], r11b
dec dword [rbx + 0x1af70]
test r10, r10
je 0x1800a6d4f
movzx eax, word [r10 + rcx*4 + 2]
sub dword [rbx + 0x1af74], eax
cmp dword [rbx + 0x192c], 2
jl 0x1800a6d00
mov dword [r15 + 0x24], ebp
mov eax, dword [rbx + 0x192c]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cmp eax, r12d
jl 0x1800a6d85
nop
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.1800a9310
dec edi
cmp edi, r12d
jge 0x1800a6d70
movsxd rax, dword [rbx + 0x192c]
mov r8d, r12d
movsxd rdi, dword [rbx + 0x103c]
mov rdx, rsi
mov ecx, dword [rbx + rax*4 + 0x1038]
mov dword [rbx + 0x103c], ecx
mov rcx, rbx
dec dword [rbx + 0x192c]
call fcn.1800a9310
movsxd rcx, dword [rbx + 0x103c]
dec dword [rbx + 0x1930]
lea r8, [rsi + rcx*4]
movsxd rax, dword [rbx + 0x1930]
movsxd r9, r14d
mov dword [rbx + rax*4 + 0x1038], edi
dec dword [rbx + 0x1930]
movsxd rax, dword [rbx + 0x1930]
mov dword [rbx + rax*4 + 0x1038], ecx
movzx eax, word [r8]
add ax, word [rsi + rdi*4]
mov word [rsi + r9*4], ax
movzx eax, byte [rcx + rbx + 0x1934]
cmp byte [rdi + rbx + 0x1934], al
jb 0x1800a6e12
movzx eax, byte [rdi + rbx + 0x1934]
jmp 0x1800a6e1a
movzx eax, byte [rcx + rbx + 0x1934]
inc al
mov rdx, rsi
mov byte [r9 + rbx + 0x1934], al
mov rcx, rbx
mov word [r8 + 2], r14w
mov r8d, r12d
mov word [rsi + rdi*4 + 2], r14w
mov dword [rbx + 0x103c], r14d
inc r14d
call fcn.1800a9310
cmp dword [rbx + 0x192c], 2
jge 0x1800a6d85
dec dword [rbx + 0x1930]
mov rdx, r15
movsxd rcx, dword [rbx + 0x1930]
mov eax, dword [rbx + 0x103c]
mov dword [rbx + rcx*4 + 0x1038], eax
mov rcx, rbx
call fcn.1800a8300
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
jmp fcn.1800a8540
Function at 0x1800a71a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10, r8
mov r9, rdx
test rdx, rdx
jne 0x1800a71b6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x18032b630]
not ecx
cmp r10, 8
jb 0x1800a72a4
mov r11, r10
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add r10, rax
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1800a71e0
test r10, r10
je 0x1800a72d0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
sub r10, 1
jne 0x1800a72b0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x1800a9fb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
je 0x1800aa03c
mov eax, dword [rdi + 0xb4]
mov qword [rsp + 0x48], rsi
mov esi, dword [rdi + 0xb0]
cmp eax, esi
jb 0x1800a9ffd
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call fcn.18020cf10
mov ecx, dword [rdi + 0x90]
mov rdx, rbp
add dword [rdi + 0xb4], esi
add dword [rdi + 0x8c], esi
mov r8d, esi
call fcn.1800a71a0
mov dword [rdi + 0x90], eax
mov eax, esi
jmp 0x1800a9fe8
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x1800aa093
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800aa09a
mov ebx, dword [rsp + 0x40]
mov rdx, rbp
add dword [rdi + 0x8c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0x90]
call fcn.1800a71a0
mov dword [rdi + 0x90], eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rdi + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800aa740
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x1800aa848
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x1800aa782
cmp dword [rbx + 0x58], edi
jae 0x1800aa782
call fcn.1800b78dc
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x1800aa798
lea ecx, [rdi + rdi]
call fcn.1800b7c18
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.18020cf10
test edi, edi
je 0x1800aa83f
xor r11d, r11d
lea rsi, [0x18032b630]
nop dword [rax]
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov r8d, dword [rbx + 0x4c]
mov ecx, dword [rbx + 0x44]
mov r9d, r8d
and r9d, 0xfffd
movsx r10, byte [r11 + rax - 1]
or r9d, 2
mov eax, dword [rbx + 0x44]
xor rcx, r10
movzx edx, cl
shr eax, 8
mov ecx, dword [rsi + rdx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0x48]
mov dword [rbx + 0x44], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x48], ecx
movzx eax, byte [rbx + 0x4b]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
imul ecx, r9d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rbp, 1
jne 0x1800aa7c0
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1800aa898
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1800aa875
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.18020cf10
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800aa8cf
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret