joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002d1dc
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rdi, rcx
mov ecx, 8
call fcn.180054d48
xor ebx, ebx
cmp rax, rbx
je 0x18002d216
lea rcx, [rsp + 0x20]
mov qword [rax], rcx
jmp 0x18002d219
mov rax, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x18002d34a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180039b50
cmp eax, ebx
jne 0x18002d34a
mov rax, qword [rsp + 0x38]
mov rdi, rax
mov rbp, qword [rsp + 0x40]
cmp rax, rbp
jbe 0x18002d274
call fcn.180054d28
mov rbp, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
add rdi, 8
cmp rax, rbp
jbe 0x18002d287
call fcn.180054d28
cmp rsi, rbx
je 0x18002d293
cmp rsi, qword [rsp + 0x20]
je 0x18002d298
call fcn.180054d28
lea r12, [rdi - 8]
cmp r12, rbp
je 0x18002d348
cmp rsi, rbx
jne 0x18002d2b4
call fcn.180054d28
mov r11, rbx
jmp 0x18002d2b7
mov r11, qword [rsi]
cmp r12, qword [r11 + 0x20]
jb 0x18002d2c2
call fcn.180054d28
cmp qword [rdi + 0x18], 8
jb 0x18002d2ce
mov rcx, qword [rdi]
jmp 0x18002d2d1
mov rcx, rdi
call fcn.18002d17c
cmp eax, ebx
jne 0x18002d341
cmp rsi, rbx
jne 0x18002d2e9
call fcn.180054d28
mov r11, rbx
jmp 0x18002d2ec
mov r11, qword [rsi]
cmp r12, qword [r11 + 0x20]
jb 0x18002d2f7
call fcn.180054d28
cmp qword [rdi + 0x18], 8
jb 0x18002d303
mov rcx, qword [rdi]
jmp 0x18002d306
mov rcx, rdi
xor edx, edx
call fcn.18002dbbc
cmp eax, ebx
jne 0x18002d341
cmp rsi, rbx
jne 0x18002d320
call fcn.180054d28
mov r11, rbx
jmp 0x18002d323
mov r11, qword [rsi]
cmp r12, qword [r11 + 0x20]
jb 0x18002d32e
call fcn.180054d28
add rdi, 0x28
mov rbp, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
jmp 0x18002d27d
mov ebx, 1
jmp 0x18002d34a
jmp 0x18002d34a
lea rcx, [rsp + 0x20]
call fcn.180007770
mov rcx, qword [rsp + 0x20]
call fcn.180054958
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18002d6b8
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x290
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov r12d, edx
mov rdi, rcx
xor r13d, r13d
cmp rcx, r13
je 0x18002d867
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, r13d
je 0x18002d867
mov ebp, r13d
mov word [rsp + 0x70], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.180055bd0
call fcn.180002f5c
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, str._s._08x
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rdi
call fcn.18002cf90
lea r14d, [r13 + 1]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.18002c500
nop
mov rcx, qword [rsp + 0x50]
sub rcx, qword [rsp + 0x48]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18002d7a1
lea rcx, [rsp + 0x30]
call fcn.18002fd2c
mov rcx, qword [rsp + 0x30]
call fcn.180054958
jmp 0x18002d838
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180035a20
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.18002fd2c
mov rcx, qword [rsp + 0x30]
call fcn.180054958
cmp ebx, r13d
je 0x18002d838
mov ebx, r13d
mov r8d, r14d
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, r13d
jne 0x18002d7f9
mov r8d, r14d
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.18002ce74
jmp 0x18002d7fc
mov eax, r14d
cmp eax, r13d
jne 0x18002d816
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r14d
cmp ebx, 5
jl 0x18002d7d1
jmp 0x18002d838
mov ebp, r14d
mov edx, 2
cmp r12d, edx
jne 0x18002d838
mov rcx, rdi
call fcn.18002d378
cmp eax, r13d
je 0x18002d838
cmp rsi, r13
je 0x18002d838
mov dword [rsi], r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp r12d, r14d
jne 0x18002d863
mov edx, r14d
mov rcx, rdi
call fcn.18002d378
cmp eax, r13d
je 0x18002d863
mov ebp, r14d
cmp rsi, r13
je 0x18002d863
mov dword [rsi], r14d
mov eax, ebp
jmp 0x18002d869
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180055580
add rsp, 0x290
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800323ec
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x838
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov r8, rcx
lea r9, [r11 + 0x10]
lea rcx, [rsp + 0x20]
mov edx, 0x800
call qword [sym.imp.SHLWAPI.dll_wvnsprintfA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.180055580
add rsp, 0x838
ret
Function at 0x180032454
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
mov eax, 0x1038
call fcn.180069af0
sub rsp, rax
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r8, rcx
lea r9, [rsp + 0x1048]
lea rcx, [rsp + 0x20]
mov edx, 0x800
call qword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.180055580
add rsp, 0x1038
ret

Function at 0x1800326ec
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rsp + 0x30], 0
mov rsi, rdx
mov rbx, rcx
xor eax, eax
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov rdi, r8
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, 0x1000
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x30], r13
jb 0x180032893
and dword [rsp + 0x88], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x4c], 0
mov r12d, 1
lea r8, [rsp + 0x4c]
xor edx, edx
mov rcx, rsi
mov r9d, r12d
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, r13d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180032870
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1800327b2
mov eax, dword [rbx + 8]
mov dword [rdi], eax
movabs rax, 0x706c646f70bfbbef
cmp qword [rbx], rax
jne 0x180032870
cmp dword [rbx + 8], 2
je 0x1800327d5
cmp dword [rbx + 8], 3
jne 0x180032870
mov ecx, dword [rbx + 0x18c]
mov edx, 0x190
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rdx + rbx], al
add rdx, r12
cmp rdx, r13
jl 0x1800327e0
cmp byte [rbx + 0x4a3], 0
jne 0x180032847
cmp dword [rbx + 0x1a0], 0x40
ja 0x180032847
mov eax, 0x270f
cmp word [rbx + 0x190], ax
ja 0x180032847
movzx eax, word [rbx + 0x192]
cmp ax, r12w
jb 0x180032847
cmp ax, 0xc
ja 0x180032847
movzx eax, word [rbx + 0x196]
cmp ax, r12w
jb 0x180032847
cmp ax, 0x1f
ja 0x180032847
mov ebx, r12d
jmp 0x180032849
xor ebx, ebx
cmp dword [rsp + 0x40], 0
jne 0x18003286c
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
jmp 0x180032895
cmp dword [rsp + 0x40], 0
jne 0x180032893
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x180036b30
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x380
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x370], rax
xor edi, edi
lea rcx, str..gxdte_cd
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x180036cb2
lea rcx, [rsp + 0x162]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x160], di
call fcn.180055bd0
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x118
mov dword [rsp + 0x40], 0x11c
call fcn.180055bd0
lea rcx, [rsp + 0x40]
call fcn.180002ca4
cmp eax, edi
je 0x180036bd8
cmp dword [rsp + 0x44], 6
lea rbx, str.gxdte64_win7.sys
je 0x180036bdf
lea rbx, str.gxdte64.sys
lea r8, [rsp + 0x160]
mov r9d, 0x104
mov rdx, rbx
xor ecx, ecx
call fcn.180002a20
lea rcx, [rsp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x180036c38
cmp word [0x1800a0430], di
je 0x180036c38
lea rdx, [0x1800a0430]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x160]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, str.gxdte
mov rcx, rbx
call fcn.180005afc
lea r9, str.gxdte_driver
lea r8, str.gxdte64.sys
cmp eax, edi
mov eax, 1
lea rdx, [rsp + 0x160]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x22343
call fcn.18003c938
mov rcx, rbx
call fcn.180005a54
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, str..gxdte_cd
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x390]
add rsp, 0x380
pop rdi
ret

Function at 0x1800375b0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
movabs rax, 0x6666666666666667
sub rcx, qword [rbx + 0x18]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180037614
lea r8, [0x18007ec98]
lea rdx, str.softwareprojonepodlp_smpcache
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x180037691
xor edi, edi
lea rdx, [0x18007ec8c]
lea rcx, [rsp + 0x30]
lea r8d, [rdi + 1]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
call fcn.180007250
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1800012d8
cmp qword [rsp + 0x78], 8
lea r9, [rsp + 0x60]
cmovae r9, qword [rsp + 0x60]
lea r8, [0x18007ec98]
lea rdx, str.softwareprojonepodlp_smpcache
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
call fcn.180005488
cmp qword [rsp + 0x78], 8
jb 0x180037691
mov rcx, qword [rsp + 0x60]
call fcn.180054958
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1800376b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r11d, 0xffffffff
mov r9d, edx
mov r10, rcx
mov eax, r11d
test edx, edx
je 0x1800376ec
movzx r8d, byte [r10]
mov edx, eax
mov ecx, eax
xor r8, rdx
shr ecx, 8
inc r10
movzx edx, r8b
lea r8, [0x18009c0a0]
mov eax, dword [r8 + rdx*4]
xor eax, ecx
add r9d, r11d
jne 0x1800376c5
not eax
ret

Function at 0x1800376f0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0xa0], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x44], 0
and dword [rsp + 0x40], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
call fcn.18003d390
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.18003d444
and qword [rbx + 0x18], 0
mov qword [rbx + 0x20], sendto
lea rdx, [rsp + 0x90]
mov r8d, sendto
mov rcx, rbx
mov byte [rbx + 8], 0
call fcn.180006ec0
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180055580
add rsp, 0xb0
pop rbx
ret

Function at 0x1800379c4
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rdi, rdx
xor edx, edx
mov esi, r8d
mov rbx, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x30], 0
call fcn.180055bd0
mov r11d, dword [0x18007dfb4]
mov al, byte [0x18007dfb8]
xor edx, edx
mov dword [rsp + 0x30], r11d
mov byte [rsp + 0x34], al
lea r9d, [rdx + 0x40]
mov r8, r9
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x11f], cl
mov byte [rsp + rdx + 0x8f], al
jne 0x180037a23
and dword [rsp + 0x48], r8d
and dword [rsp + 0x44], r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
mov r8d, r9d
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.18003e794
lea rcx, [rsp + 0x30]
mov r8d, esi
mov rdx, rdi
call fcn.18003e794
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.18003e850
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x90], 0x67452301
mov dword [rsp + 0x94], 0xefcdab89
mov dword [rsp + 0x98], 0x98badcfe
mov dword [rsp + 0x9c], 0x10325476
mov dword [rsp + 0xa0], 0xc3d2e1f0
mov dword [rsp + 0xa8], esi
mov dword [rsp + 0xa4], esi
call fcn.18003e794
lea edi, [rsi + 0x14]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x90]
mov r8d, edi
call fcn.18003e794
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xf0]
call fcn.18003e850
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], rsi
lea rdx, [rsp + 0xf0]
mov r8, rdi
mov rcx, rbx
mov byte [rbx + 8], sil
call fcn.180006ec0
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180055580
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x180037b80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x180
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x170], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov rbx, r9
mov byte [rsp + 0x30], 0
call fcn.180055bd0
mov r8d, dword [rsp + 0x1d0]
mov r13d, 0x40
mov rdx, rbx
cmp r8d, r13d
jbe 0x180037c75
and dword [rsp + 0xc0], 0
and dword [rsp + 0x104], 0
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x7380166f
mov dword [rsp + 0xa4], 0x4914b2b9
mov dword [rsp + 0xa8], 0x172442d7
mov dword [rsp + 0xac], 0xda8a0600
mov dword [rsp + 0xb0], 0xa96f30bc
mov dword [rsp + 0xb4], 0x163138aa
mov dword [rsp + 0xb8], 0xe38dee4d
mov dword [rsp + 0xbc], 0xb0fb0e4e
call fcn.18003e96c
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x110]
call fcn.18003ea2c
lea rdx, [rsp + 0x110]
mov r8, r13
lea rcx, [rsp + 0x30]
call fcn.180055640
xor edx, edx
mov r8, r13
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x9f], cl
mov byte [rsp + rdx + 0x10f], al
jne 0x180037c84
and dword [rsp + 0x50], r8d
and dword [rsp + 0x94], r8d
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov ebx, 0x172442d7
mov r8d, r13d
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.18003e96c
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.18003e96c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.18003ea2c
and dword [rsp + 0x50], 0
and dword [rsp + 0x94], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
mov r8d, r13d
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.18003e96c
mov ebx, 0x20
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.18003e96c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.18003ea2c
and qword [rdi + 0x18], 0
mov qword [rdi + 0x20], sendto
lea rdx, [rsp + 0x150]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], 0
call fcn.180006ec0
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180055580
add rsp, 0x180
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800392f4
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x18003937a
cmp rax, 0xffffffffffffffff
je 0x18003938e
and dword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003937a
cmp dword [rsp + 0x58], 4
jne 0x18003937a
cmp dword [rsp + 0x60], 0x21726152
jne 0x18003937a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180039390
cmp rbx, 0xffffffffffffffff
je 0x18003938e
test rbx, rbx
je 0x18003938e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x180039398
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x80e0
call fcn.180069af0
sub rsp, rax
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x80d0], rax
mov rsi, rcx
lea rcx, str.unrar64.dll
mov ebp, r9d
mov rdi, r8
call fcn.180039198
mov rbx, rax
test rax, rax
jne 0x1800393e6
mov eax, 0x453
jmp 0x1800394e6
lea rdx, str.RAROpenArchiveEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARCloseArchive
mov rcx, rbx
mov qword [0x1800a0640], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARReadHeaderEx
mov rcx, rbx
mov qword [0x1800a0648], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARProcessFileW
mov rcx, rbx
mov qword [0x1800a0650], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARSetPassword
mov rcx, rbx
mov qword [0x1800a0658], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [0x1800a0640]
mov qword [0x1800a0660], rax
test rbx, rbx
je 0x1800394e1
cmp qword [0x1800a0648], 0
je 0x1800394e1
cmp qword [0x1800a0650], 0
je 0x1800394e1
cmp qword [0x1800a0658], 0
je 0x1800394e1
test rax, rax
je 0x1800394e1
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0xa8
call fcn.180055bd0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x64], rax
call rbx
mov r11, rax
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x1800394e6
mov qword [rdi], r11
jmp 0x1800394e6
mov eax, 0x454
mov rcx, qword [rsp + 0x80d0]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x8108]
add rsp, 0x80e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180039e54
Capabilities:
Check if file exists
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rdi, qword [rcx]
mov r12, rcx
mov rbx, qword [rax]
mov ebp, 1
mov rsi, qword [r12 + 0x30]
test rdi, rdi
je 0x180039e8f
cmp rdi, qword [r12]
je 0x180039e94
call fcn.180054d28
cmp rbx, rsi
je 0x180039f9c
test rdi, rdi
jne 0x180039eac
call fcn.180054d28
xor r11d, r11d
jmp 0x180039eaf
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x180039eba
call fcn.180054d28
cmp qword [rbx + 0x60], 8
jb 0x180039ec7
mov rcx, qword [rbx + 0x48]
jmp 0x180039ecb
lea rcx, [rbx + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180039f44
test rdi, rdi
jne 0x180039ee4
call fcn.180054d28
xor r11d, r11d
jmp 0x180039ee7
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x180039ef2
call fcn.180054d28
cmp qword [rbx + 0x38], 8
jb 0x180039eff
mov rsi, qword [rbx + 0x20]
jmp 0x180039f03
lea rsi, [rbx + 0x20]
test rdi, rdi
jne 0x180039f12
call fcn.180054d28
xor r11d, r11d
jmp 0x180039f15
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x180039f20
call fcn.180054d28
cmp qword [rbx + 0x60], 8
jb 0x180039f2d
mov rcx, qword [rbx + 0x48]
jmp 0x180039f31
lea rcx, [rbx + 0x48]
mov r8d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x180039f46
xor ebp, ebp
test rdi, rdi
jne 0x180039f50
call fcn.180054d28
cmp byte [rbx + 0x69], 0
je 0x180039f60
call fcn.180054d28
jmp 0x180039e7f
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x180039f7b
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x180039f6a
jmp 0x180039e7f
mov rax, qword [rbx + 8]
jmp 0x180039f8e
cmp rbx, qword [rax + 0x10]
jne 0x180039f94
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x180039f81
mov rbx, rax
jmp 0x180039e7f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x18003a420
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18003a48e
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18003a45a
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18003a594
mov edi, dword [rbx + 0x18]
lea r14, [0x18009c5c0]
jmp 0x18003a4e9
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003a4a8
add r11, 4
sub r8, 1
jne 0x18003a4a5
mov edx, edi
mov rcx, rbx
call fcn.18003a594
mov rcx, rbx
call fcn.18003a6d4
mov rcx, rbx
dec edi
call fcn.18003a64c
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18003a4a5
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003a504
add r11, 4
sub r8, 1
jne 0x18003a501
xor edx, edx
mov rcx, rbx
call fcn.18003a594
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18003a578
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18003a547
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18003a594
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18003a5ae
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003a5a8
repz ret