joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180031480
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x1850
call fcn.1800480a0
sub rsp, rax
mov rax, qword [0x1800654c0]
xor rax, rsp
mov qword [rsp + 0x1840], rax
lea rax, [rsp + 0x34]
mov rbx, rcx
mov r8, rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800314fb
cmp dword [rsp + 0x38], 4
jne 0x1800314fb
mov eax, dword [rsp + 0x30]
jmp 0x1800314fd
xor eax, eax
test eax, eax
je 0x180031590
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x7fe
call fcn.180035e00
mov r11d, 0x5b
lea rcx, [rsp + 0x40]
mov r8d, 0x400
mov rdx, rbx
mov word [rsp + 0x40], r11w
call qword [sym.imp.SHLWAPI.dll_StrNCatW]
lea rdx, [0x18005447c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rsp + 0x1868]
lea rcx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.SHLWAPI.dll_StrNCatW]
lea r9, [rsp + 0x1870]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x840]
mov edx, 0x800
call qword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x1840]
xor rcx, rsp
call fcn.1800336d0
add rsp, 0x1850
pop rbx
ret

Function at 0x1800315ac
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rsi
mov rsi, rcx
mov ecx, 0x20
call fcn.180033c8c
mov rdi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18003160d
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x1800315ed
and qword [rax + 0x18], rcx
jmp 0x18003160f
cmp rcx, rsi
jne 0x180031600
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x18003160f
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x18003160f
xor edi, edi
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x180031680]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x18003164c
mov r8, qword [rcx]
cmp rcx, rsi
setne dl
call qword [r8 + 0x18]
and qword [rsi + 0x18], 0
mov rax, rdi
jmp 0x180031672
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180031708
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1800654c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov bpl, r8b
mov rdi, rdx
xor r12d, r12d
cmp word [0x180069470], r12w
je 0x180031872
lea rcx, [r11 - 0x50]
call fcn.18002c980
nop
cmp qword [rsp + 0xa0], r12
je 0x18003185a
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
lea rbx, [0x180052402]
cmp rsi, r12
cmovne rbx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8, rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea rdx, [0x180054480]
lea rcx, [rsp + 0x60]
call fcn.18002cf08
nop
cmp bpl, r12b
je 0x18003181b
lea edx, [r12 + 1]
lea rcx, [rsp + 0x38]
call fcn.18002c838
cmp qword [rax + 0x20], 8
jb 0x1800317d7
mov r9, qword [rax + 8]
jmp 0x1800317db
lea r9, [rax + 8]
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r8, qword [rsp + 0x68]
mov dword [rsp + 0x20], r12d
lea rdx, [0x180069470]
mov rcx, 0xffffffff80000002
call fcn.18002d058
cmp qword [rsp + 0x58], 8
jb 0x180031844
mov rcx, qword [rsp + 0x40]
call fcn.180033b90
jmp 0x180031844
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rdx, [0x180069470]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
cmp qword [rsp + 0x80], 8
jb 0x18003185a
mov rcx, qword [rsp + 0x68]
call fcn.180033b90
nop
cmp qword [rsp + 0xa8], 8
jb 0x180031872
mov rcx, qword [rsp + 0x90]
call fcn.180033b90
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800336d0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180031ad8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1800654c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
dec eax
cmp eax, 0xc6
ja 0x180031b97
lea rsi, [0x180069470]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call fcn.180035e00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, 0x104
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x180054084]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCatBuffW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCatBuffW]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp byte [0x180069770], bl
jne 0x180031c8e
mov esi, 1
lea rax, [0x18003189c]
mov qword [rsp + 0x20], rax
lea rax, [0x180069770]
lea ecx, [rsi + 0x1f]
mov byte [0x180069770], sil
mov dword [0x1800697a8], esi
mov qword [rsp + 0x28], rax
call fcn.180033c8c
cmp rax, rbx
je 0x180031bef
movdqu xmm0, xmmword [rsp + 0x20]
lea rcx, [0x1800544f0]
mov qword [rax], rcx
movdqu xmmword [rax + 8], xmm0
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x68], rax
call fcn.1800315ac
mov rcx, qword [0x1800697c8]
mov r11, rax
mov qword [rsp + 0x20], rax
cmp rcx, rbx
je 0x180031c25
mov rbx, qword [0x1800697d8]
sub rbx, rcx
sar rbx, 3
mov rdi, qword [0x1800697d0]
mov rax, rdi
sub rax, rcx
sar rax, 3
cmp rax, rbx
jae 0x180031c4b
lea rax, [rdi + 8]
mov qword [rdi], r11
mov qword [0x1800697d0], rax
jmp 0x180031c91
cmp rcx, rdi
jbe 0x180031c55
call fcn.180033b38
mov rax, qword [0x1800697b0]
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [0x1800697b0]
call fcn.180031f3c
jmp 0x180031c91
mov sil, bl
mov al, sil
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800336d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180032794
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x180032802
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x1800327ce
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.180032908
mov edi, dword [rbx + 0x18]
lea r14, [0x180066fb0]
jmp 0x18003285d
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003281c
add r11, 4
sub r8, 1
jne 0x180032819
mov edx, edi
mov rcx, rbx
call fcn.180032908
mov rcx, rbx
call fcn.180032a48
mov rcx, rbx
dec edi
call fcn.1800329c0
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x180032819
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x180032878
add r11, 4
sub r8, 1
jne 0x180032875
xor edx, edx
mov rcx, rbx
call fcn.180032908
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x1800328ec
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x1800328bb
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180032908
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x180032922
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003291c
repz ret
Function at 0x1800332dc
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800654c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x1800334ce
lea rdi, [0x1800533f0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x180033362
cmp cl, r14b
je 0x18003334d
cmp cl, r14b
je 0x1800334ce
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x180033381
cmp bpl, r14b
je 0x18003336b
cmp bpl, r14b
je 0x1800334ce
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1800229c4
jmp 0x1800333b3
lea rdi, [0x1800533f0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x180033492
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x1800333d4
cmp dil, r14b
je 0x1800333ac
cmp dil, r14b
je 0x1800334ce
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1800229c4
lea rdx, [0x1800533f0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x180033456
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x180033424
cmp cl, r14b
je 0x180033408
cmp cl, r14b
je 0x1800334ce
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1800229c4
cmp rsi, r13
lea rdi, [0x1800533f0]
jb 0x18003334d
jmp 0x1800334ce
mov qword [rbx + 0x20], recvfrom
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180001b10
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003348d
mov rcx, qword [rsp + 0x38]
call fcn.180033b90
mov rax, rbx
jmp 0x180033508
mov qword [rbx + 0x20], recvfrom
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180001b10
nop
cmp qword [rsp + 0x50], 0x10
jb 0x1800334c9
mov rcx, qword [rsp + 0x38]
call fcn.180033b90
mov rax, rbx
jmp 0x180033508
mov qword [rbx + 0x20], recvfrom
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180001b10
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180033505
mov rcx, qword [rsp + 0x38]
call fcn.180033b90
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800336d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180035bf7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800654c0]
jne 0x1800336ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1800336e6
repz ret
ror rcx, 0x10
jmp 0x180035b50
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180067f70]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180068068]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180035bd5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180067f70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180035bf7
mov rax, qword [rsp + 0x88]
mov qword [0x180068068], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180068008], rax
mov rax, qword [0x180068068]
mov qword [0x180067ee0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180067ff0], rax
mov dword [0x180067ed0], 0xc0000409
mov dword [0x180067ed4], 1
mov rax, qword [0x1800654c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800654c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180067f68], eax
mov ecx, 1
call fcn.180035de0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18004f838]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180067f68], 0
jne 0x180035c7e
mov ecx, 1
call fcn.180035de0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180036dcc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180036c40
Function at 0x18003e1e0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180035ef4
xor ebx, ebx
mov rdi, rax
cmp qword [0x180068bc0], rbx
jne 0x18003e2e6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18003e3bb
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003e3bb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180068bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180068bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180068bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180068be0], rax
test rax, rax
je 0x18003e2dd
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180068bd8], rax
jmp 0x18003e2ed
mov rax, qword [0x180068bd8]
jmp 0x18003e2f4
mov rax, qword [0x180068bd8]
mov r11, qword [0x180068be0]
cmp rax, rdi
je 0x18003e35c
cmp r11, rdi
je 0x18003e35c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180068be0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18003e35c
test rax, rax
je 0x18003e35c
call rsi
test rax, rax
je 0x18003e356
lea rcx, [rsp + 0x88]
mov r9d, recvfrom
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18003e356
test byte [rsp + 0x38], 1
jne 0x18003e35c
bts ebp, 0x15
jmp 0x18003e39a
mov rcx, qword [0x180068bc8]
cmp rcx, rdi
je 0x18003e39a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18003e39a
call rax
mov rbx, rax
test rax, rax
je 0x18003e39a
mov rcx, qword [0x180068bd0]
cmp rcx, rdi
je 0x18003e39a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18003e39a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180068bc0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18003e3bb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18003e3bd
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180002280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x28
mov byte [rsp + 2], 0
mov eax, 5
mov word [rsp + 4], ax
mov byte [rsp + 1], 0
jmp 0x1800022b3
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180002369
mov byte [rsp], 0
jmp 0x1800022d0
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180002364
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0x30]
shl edx, 2
movzx r8d, byte [rsp + 1]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rsp]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rsp + 0x40]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov r8, qword [rsp + 0x38]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
mov eax, 7
mov word [rsp + 8], ax
mov dword [rsp + 0x10], 2
mov qword [rsp + 0x18], 2
mov eax, 2
mov word [rsp + 0xc], ax
mov byte [rsp + 3], 0x63
jmp 0x1800022c7
jmp 0x1800022a8
add rsp, 0x28
ret

Function at 0x180002370
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, 4
mov word [rsp + 4], ax
mov qword [rsp + 8], 0
mov byte [rsp + 1], 0
jmp 0x18000239e
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180002405
mov byte [rsp], 0
jmp 0x1800023b7
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180002403
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x1800142f0]
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x30]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
mov qword [rsp + 0x10], 0
jmp 0x1800023ae
jmp 0x180002393
add rsp, 0x28
ret
Function at 0x180003100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x60], 0
mov eax, 3
mov word [rsp + 0x30], ax
mov eax, 3
mov word [rsp + 0x34], ax
mov eax, 1
mov word [rsp + 0x38], ax
mov byte [rsp + 0x28], 0
mov eax, 5
mov word [rsp + 0x3c], ax
lea rax, [rsp + 0xa0]
lea rcx, str.VLuGFysU
mov rdi, rax
mov rsi, rcx
mov ecx, 9
rep movsb byte [rdi], byte [rsi]
mov eax, 9
mov word [rsp + 0x40], ax
mov dword [rsp + 0x50], 6
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x29], 0x74
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0x10
jmp 0x1800031c2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x100]
cmp dword [rsp + 0x24], eax
jae 0x180003368
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf0]
mov rdi, rax
lea rsi, [rcx + 0xb0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x2a], 0x65
mov rax, qword [rsp + 0xf0]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180002ee0
mov dword [rsp + 0x20], 0xf
jmp 0x180003225
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x1800032f6
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xf0]
movzx eax, byte [rcx + rax + 0xb0]
cmp eax, 0xff
jne 0x18000327f
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xf0]
mov byte [rcx + rax + 0xb0], 0
mov qword [rsp + 0x70], 9
jmp 0x18000321b
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xf0]
movzx eax, byte [rcx + rax + 0xb0]
inc eax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0xf0]
mov byte [rdx + rcx + 0xb0], al
jmp 0x1800032f6
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x54], 8
mov qword [rsp + 0x90], 0
mov eax, 1
mov word [rsp + 0x48], ax
mov byte [rsp + 0x2f], 0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0xf8]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
movzx ecx, byte [rsp + rcx + 0xb0]
xor eax, ecx
mov ecx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0xf8]
mov byte [rdx + rcx], al
mov dword [rsp + 0x58], 3
mov qword [rsp + 0x98], 0
jmp 0x1800031ae
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18000f150
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1800038c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180003911
xor eax, eax
jmp 0x180003a6f
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x180003944
mov rax, qword [rsp + 0x30]
jmp 0x180003a6f
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
cmp dword [rsp + rax + 0xd0], 0
jne 0x180003979
mov rax, qword [rsp + 0x30]
jmp 0x180003a6f
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0xd0]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x180003a01
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180003a6a
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x188]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180003a68
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x180003a6a
jmp 0x1800039f7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000f150
add rsp, 0x168
pop rdi
pop rsi
ret