joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800415ec
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0xa8], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x48], 0
and dword [rsp + 0x44], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.1800473f8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.1800474b4
and qword [rbx + 0x18], 0
mov qword [rbx + 0x20], sendto
lea rdx, [rsp + 0x90]
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
mov byte [rbx + 8], 0
call fcn.180002ed4
mov rax, rbx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180047b20
add rsp, 0xb0
pop rbx
ret

Function at 0x1800419b0
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha256

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0xa1]
mov rbx, r9
mov byte [rsp + 0xa0], 0
call fcn.18004a190
mov eax, dword [rbx]
xor edx, edx
mov dword [rsp + 0xa0], eax
movzx eax, word [rbx + 4]
lea r9d, [rdx + 0x40]
mov word [rsp + 0xa4], ax
mov r8, r9
mov cl, byte [rsp + rdx + 0xa0]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x11f], cl
mov byte [rsp + rdx + 0xdf], al
jne 0x180041a18
and dword [rsp + 0x70], r8d
and qword [rsp + 0x78], r8
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov ebx, 0x5be0cd19
mov r8d, r9d
mov dword [rsp + 0x80], 0x6a09e667
mov dword [rsp + 0x84], 0xbb67ae85
mov dword [rsp + 0x88], 0x3c6ef372
mov dword [rsp + 0x8c], 0xa54ff53a
mov dword [rsp + 0x90], 0x510e527f
mov dword [rsp + 0x94], 0x9b05688c
mov dword [rsp + 0x98], 0x1f83d9ab
mov dword [rsp + 0x9c], ebx
call fcn.1800477ac
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.1800477ac
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.18004780c
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x30]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x80], 0x6a09e667
mov dword [rsp + 0x84], 0xbb67ae85
mov dword [rsp + 0x88], 0x3c6ef372
mov dword [rsp + 0x8c], 0xa54ff53a
mov dword [rsp + 0x90], 0x510e527f
mov dword [rsp + 0x94], 0x9b05688c
mov dword [rsp + 0x98], 0x1f83d9ab
mov dword [rsp + 0x9c], ebx
call fcn.1800477ac
lea ebx, [rsi + 0x20]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.1800477ac
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.18004780c
mov qword [rdi + 0x20], sendto
mov qword [rdi + 0x18], rsi
lea rdx, [rsp + 0xa0]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], sil
call fcn.180002ed4
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180047b20
add rsp, 0x178
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180042ea8
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
xor r15d, r15d
mov r13, r8
mov r14, rdx
mov rbx, rcx
cmp dword [0x180093e54], r15d
je 0x180042eed
xor edx, edx
xor ecx, ecx
mov dword [0x180093e54], r15d
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x68]
mov edi, 1
lea r9, [0x18006c4a0]
lea rcx, [0x18006c570]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x20], rax
mov ebp, r15d
mov qword [rsp + 0x68], r15
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r15d
jge 0x180042f29
xor eax, eax
jmp 0x18004308d
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], r15
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea rdx, [0x18006ebe0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [rax + 0x18]
cmp eax, r15d
jl 0x180043080
mov rcx, qword [rsp + 0x58]
mov eax, 3
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
lea edx, [rax + 7]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, r15d
jl 0x180043075
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], r15
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
lea rdx, [0x180072248]
mov r9d, 0x30
mov r8, rbx
mov qword [rsp + 0x20], r15
call qword [rax + SHCreateDirectory]
cmp eax, r15d
jl 0x180043075
mov ebp, edi
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r9, [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov r8d, 0xa
or edx, 0xffffffff
mov esi, r15d
call qword [rax + 0x20]
mov ecx, dword [rsp + 0x50]
mov r12d, eax
cmp ecx, r15d
je 0x18004306a
mov edi, r15d
jbe 0x18004303a
lea rbx, [rsp + 0x70]
mov rcx, qword [rbx]
mov rdx, r13
call r14
mov ecx, dword [rsp + 0x50]
cmp eax, r15d
je 0x180043038
inc edi
add rbx, 8
cmp edi, ecx
jb 0x18004301a
jmp 0x18004303a
mov esi, ebp
mov edi, r15d
cmp ecx, r15d
jbe 0x18004305c
lea rbx, [rsp + 0x70]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
inc edi
add rbx, 8
cmp edi, dword [rsp + 0x50]
jb 0x180043047
cmp esi, r15d
jne 0x18004306a
cmp r12d, r15d
je 0x180042fde
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
call qword [rdx + InitCommonControls]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
call qword [rdx + InitCommonControls]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + InitCommonControls]
mov eax, ebp
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180043e0c
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x180043ffe
lea rdi, [0x18006da50]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x180043e92
cmp cl, r14b
je 0x180043e7d
cmp cl, r14b
je 0x180043ffe
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x180043eb1
cmp bpl, r14b
je 0x180043e9b
cmp bpl, r14b
je 0x180043ffe
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.18000f154
jmp 0x180043ee3
lea rdi, [0x18006da50]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x180043fc2
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x180043f04
cmp dil, r14b
je 0x180043edc
cmp dil, r14b
je 0x180043ffe
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.18000f154
lea rdx, [0x18006da50]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x180043f86
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x180043f54
cmp cl, r14b
je 0x180043f38
cmp cl, r14b
je 0x180043ffe
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.18000f154
cmp rsi, r13
lea rdi, [0x18006da50]
jb 0x180043e7d
jmp 0x180043ffe
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800029c8
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180043fbd
mov rcx, qword [rsp + 0x38]
call fcn.180048114
mov rax, rbx
jmp 0x180044038
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800029c8
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180043ff9
mov rcx, qword [rsp + 0x38]
call fcn.180048114
mov rax, rbx
jmp 0x180044038
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800029c8
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180044035
mov rcx, qword [rsp + 0x38]
call fcn.180048114
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800443dc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18004444a
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x180044416
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.180044550
mov edi, dword [rbx + 0x18]
lea r14, [0x18008c0d0]
jmp 0x1800444a5
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x180044464
add r11, 4
sub r8, 1
jne 0x180044461
mov edx, edi
mov rcx, rbx
call fcn.180044550
mov rcx, rbx
call fcn.180044690
mov rcx, rbx
dec edi
call fcn.180044608
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x180044461
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x1800444c0
add r11, 4
sub r8, 1
jne 0x1800444bd
xor edx, edx
mov rcx, rbx
call fcn.180044550
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x180044534
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x180044503
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180044550
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18004456a
inc rdx
add rcx, r11
sub r10, 1
jne 0x180044564
repz ret
Function at 0x180045208
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov r13, r8
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x60], sendto
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x48], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.1800029c8
nop
mov eax, dword [rsp + 0x58]
and eax, 0xf
lea r15d, [rbx + 0x10]
mov edi, r15d
sub edi, eax
cmove edi, r15d
cmp edi, ebx
jle 0x180045296
mov ebx, edi
mov r8b, dil
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.18000f154
sub rbx, 1
jne 0x18004527e
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.18002cef8
lea rdi, [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
cmp rdx, r15
cmovae rdi, rax
cmp qword [rsi + 0x20], r15
jb 0x1800452c8
mov rbx, qword [rsi + 8]
jmp 0x1800452cc
lea rbx, [rsi + 8]
mov rcx, r14
mov rbp, qword [rsp + 0x58]
cmp rbp, r15
jb 0x18004533b
shr rbp, 4
mov rdx, rdi
sub rcx, rdi
mov r8, rbx
sub r8, rdi
mov r9, r15
mov al, byte [rcx + rdx]
xor al, byte [rdx]
mov byte [r8 + rdx], al
inc rdx
sub r9, 1
jne 0x1800452ec
cmp qword [r13 + 0x20], r15
jb 0x18004530a
mov r8, qword [r13 + 8]
jmp 0x18004530e
lea r8, [r13 + 8]
mov byte [rsp + 0x20], 1
mov r9d, dword [r13 + 0x18]
mov rdx, rbx
mov rcx, rbx
call fcn.180044c24
mov rcx, rbx
add rdi, r15
add rbx, r15
sub rbp, 1
jne 0x1800452dd
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [r14], xmm0
cmp rdx, r15
jb 0x180045351
mov rcx, rax
call fcn.180048114
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180047b20
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180045374
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov rdx, qword [rdx + 0x18]
test dl, 0xf
je 0x1800453e6
mov qword [rcx + 0x20], sendto
mov qword [rcx + 0x18], r13
mov byte [rcx + 8], r13b
xor r8d, r8d
lea rdx, [0x18006c857]
call fcn.180002ed4
mov rax, rbx
jmp 0x1800455d8
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.18002cef8
nop
mov rbp, qword [rdi + 0x18]
mov r15d, sendto
cmp qword [rdi + 0x20], r15
jb 0x18004540a
mov rdi, qword [rdi + 8]
jmp 0x18004540e
add rdi, 8
lea rsi, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rsi, qword [rsp + 0x48]
cmp rbp, r15
jb 0x18004547a
shr rbp, 4
cmp qword [r12 + 0x20], r15
jb 0x180045435
mov r8, qword [r12 + 8]
jmp 0x18004543a
lea r8, [r12 + 8]
mov byte [rsp + 0x20], 0
mov r9d, dword [r12 + 0x18]
mov rdx, rsi
mov rcx, rdi
call fcn.180044c24
mov r11, rsi
sub r14, rsi
mov rcx, r15
mov al, byte [r14 + r11]
xor byte [r11], al
inc r11
sub rcx, 1
jne 0x180045458
mov r14, rdi
add rdi, r15
add rsi, r15
sub rbp, 1
jne 0x180045427
xor r13d, r13d
mov r9, qword [rsp + 0x58]
cmp r9, r15
jae 0x1800454c0
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x18006c857]
mov rcx, rbx
call fcn.180002ed4
nop
cmp qword [rsp + 0x60], r15
jb 0x1800454b8
mov rcx, qword [rsp + 0x48]
call fcn.180048114
mov rax, rbx
jmp 0x1800455d8
lea rdi, [r9 - 1]
cmp r9, rdi
ja 0x1800454d3
call fcn.180047a7c
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rax, qword [rsp + 0x48]
mov dil, byte [rax + rdi]
cmp dil, r15b
jbe 0x180045528
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x18006c857]
mov rcx, rbx
call fcn.180002ed4
nop
cmp qword [rsp + 0x60], r15
jb 0x180045520
mov rcx, qword [rsp + 0x48]
call fcn.180048114
mov rax, rbx
jmp 0x1800455d8
mov bpl, r13b
cmp dil, r13b
jbe 0x1800455ac
movzx r12d, dil
movzx eax, bpl
mov rsi, r9
sub rsi, rax
dec rsi
cmp r9, rsi
ja 0x180045550
call fcn.180047a7c
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rax, qword [rsp + 0x48]
movsx eax, byte [rax + rsi]
cmp eax, r12d
jne 0x180045573
inc bpl
cmp bpl, dil
jb 0x180045534
jmp 0x1800455ac
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x18006c857]
mov rcx, rbx
call fcn.180002ed4
nop
cmp qword [rsp + 0x60], r15
jb 0x1800455a7
mov rcx, qword [rsp + 0x48]
call fcn.180048114
mov rax, rbx
jmp 0x1800455d8
movzx eax, dil
sub r9, rax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1800027bc
nop
cmp qword [rsp + 0x60], r15
jb 0x1800455d5
mov rcx, qword [rsp + 0x48]
call fcn.180048114
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180045708
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rdx, rcx
lea r9, str..________.dirty
lea rcx, [rsp + 0x30]
mov r8d, 1
call fcn.180036ba4
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsi]
mov rdi, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
test rdi, rdi
je 0x180045755
cmp rdi, rax
je 0x18004575a
call fcn.1800480bc
cmp rbx, rsi
je 0x1800457b3
test rdi, rdi
jne 0x18004576e
call fcn.1800480bc
xor r11d, r11d
jmp 0x180045771
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18004577c
call fcn.1800480bc
cmp qword [rbx + 0x38], 8
jb 0x180045789
mov rcx, qword [rbx + 0x20]
jmp 0x18004578d
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x20]
call fcn.1800225a4
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x18004574b
lea rcx, [rsp + 0x30]
call fcn.180021cac
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180045d88
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.18004a190
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.180045708
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x180045e33
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x180045ebb
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.1800375d8
cmp eax, edi
jne 0x180045ebb
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x180045ebb
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1800456c8
cmp qword [rsp + 0x40], 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x180045ea4
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x180045ea9
mov edi, 9
cmp qword [rsp + 0x40], 8
jb 0x180045ebb
mov rcx, qword [rsp + 0x28]
call fcn.180048114
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800475d0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov r9, rcx
lea r8, [rsp + 0x10]
mov r10d, sendto
lea rcx, [rdx + 1]
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
add rcx, 4
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r10, 1
jne 0x1800475f9
lea r10, [rsp + 0x48]
mov r11d, 0x30
mov ecx, dword [r10 - 0x34]
mov edx, dword [r10]
add r10, 4
mov r8d, ecx
mov eax, ecx
shr ecx, 3
rol r8d, 0xe
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
rol eax, 0xd
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
sub r11, 1
mov dword [r10 + 4], r8d
jne 0x180047633
mov edi, dword [r9 + 0x5c]
mov r14d, dword [r9 + 0x50]
mov r10d, dword [r9 + 0x54]
mov r11d, dword [r9 + 0x58]
mov r15d, dword [r9 + 0x60]
mov ebx, dword [r9 + 0x64]
mov ebp, dword [r9 + 0x6c]
mov dword [rsp + 0x150], edi
mov edi, dword [r9 + 0x68]
mov esi, dword [rsp + 0x150]
xor r12d, r12d
lea r13d, [r12 + 0x40]
mov eax, r15d
mov r8d, r15d
mov ecx, r15d
ror r8d, 0xb
rol eax, 7
not ecx
xor r8d, eax
and ecx, edi
mov eax, r15d
ror eax, 6
mov edx, r14d
xor r8d, eax
mov eax, ebx
and eax, r15d
xor ecx, eax
lea rax, [0x18006d8f0]
add r8d, ecx
mov ecx, r10d
add r8d, dword [r12 + rax]
xor ecx, r14d
mov eax, r14d
add r8d, dword [rsp + r12 + 0x10]
and ecx, r11d
add r12, 4
add r8d, ebp
ror edx, 0xd
rol eax, 0xa
xor edx, eax
mov eax, r14d
mov ebp, edi
ror eax, 2
mov edi, ebx
mov ebx, r15d
xor edx, eax
mov eax, r10d
lea r15d, [r8 + rsi]
and eax, r14d
mov esi, r11d
mov r11d, r10d
xor ecx, eax
mov r10d, r14d
add edx, ecx
sub r13, 1
lea r14d, [rdx + r8]
jne 0x1800476af
mov eax, dword [r9 + 0x50]
add eax, r14d
mov dword [r9 + 0x50], eax
mov eax, r10d
add eax, dword [r9 + 0x54]
mov dword [r9 + 0x54], eax
mov eax, r11d
add eax, dword [r9 + 0x58]
mov dword [r9 + 0x58], eax
mov eax, dword [r9 + 0x5c]
add eax, esi
mov dword [r9 + 0x5c], eax
mov eax, dword [r9 + 0x60]
add eax, r15d
mov dword [r9 + 0x60], eax
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add eax, dword [r9 + 0x64]
mov dword [r9 + 0x64], eax
mov eax, edi
add eax, dword [r9 + 0x68]
mov dword [r9 + 0x68], eax
mov eax, ebp
add eax, dword [r9 + 0x6c]
mov dword [r9 + 0x6c], eax
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180049437
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18008a090]
jne 0x180047b3a
rol rcx, 0x10
test cx, 0xffff
jne 0x180047b36
repz ret
ror rcx, 0x10
jmp 0x180049390
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800940b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800941a8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180049415
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800940b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180049437
mov rax, qword [rsp + 0x88]
mov qword [0x1800941a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180094148], rax
mov rax, qword [0x1800941a8]
mov qword [0x180094020], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180094130], rax
mov dword [0x180094010], 0xc0000409
mov dword [0x180094014], 1
mov rax, qword [0x18008a090]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18008a098]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800940a8], eax
mov ecx, 1
call fcn.18004a174
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180069c78]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800940a8], 0
jne 0x1800494be
mov ecx, 1
call fcn.18004a174
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180049f4c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180049dc0