joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1800015e0
Capabilities:
Allocate thread local storage
Print debug messages
Set thread local storage value

Disassembly:
sub rsp, 0x88
mov rax, qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x21], 0
mov dword [rsp + 0x28], 0
jmp 0x18000160c
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x100
jge 0x180001637
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
movabs rdx, 0xababababdededede
cmp qword [rcx + rax], rdx
jne 0x180001635
mov byte [rsp + 0x21], 1
jmp 0x180001602
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
je 0x1800017bc
mov rax, qword gs:[0x30]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rsp + 0x2c], eax
movabs rdx, 0x1234cdcd4321fefe
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
jmp 0x18000168c
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x2000
jge 0x1800016c3
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
movabs rax, 0x1234cdcd4321fefe
cmp qword [rsp + 0x58], rax
jne 0x1800016c1
mov byte [rsp + 0x20], 1
jmp 0x1800016c3
jmp 0x180001682
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1800016d1
jmp 0x1800017d3
mov eax, 0x40
sub eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x24]
lea eax, [rcx + rax*8 + 0x18]
mov eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x180001724
movabs rax, 0xababababdededede
mov rcx, qword [rsp + 0x30]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180001758
mov rax, qword [rsp + 0x30]
lea rcx, [0x18016d818]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x120
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x48]
add rax, 0x128
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
lea rcx, [0x1800015c0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
lea rcx, [0x1800015d0]
mov qword [rax], rcx
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
je 0x1800017bc
lea rcx, str.Failed_to_stub_RpcImpersonateClient
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
test eax, eax
je 0x1800017d3
lea rcx, str.Failed_to_stub_RpcRevertToSelf
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x88
ret
Function at 0x180001810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov r9d, 1
lea r8, [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x180001855
xor eax, eax
jmp 0x1800018f2
mov dword [rsp + 0x34], 8
mov dword [rsp + 0x3c], 0
xor r9d, r9d
lea r8, [rsp + 0x3c]
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xffffffff
jne 0x18000188b
xor eax, eax
jmp 0x1800018f2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800018c7
xor eax, eax
jmp 0x1800018f2
xor r9d, r9d
lea r8, [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x1800018ed
xor eax, eax
jmp 0x1800018f2
mov eax, 1
add rsp, 0x58
ret

Function at 0x180001900
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x3c], 0
mov r9d, 1
lea r8, [rsp + 0x3c]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x18000194e
xor eax, eax
jmp 0x180001a49
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x40], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xffffffff
jne 0x180001987
xor eax, eax
jmp 0x180001a49
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800019be
xor eax, eax
jmp 0x180001a49
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800019ea
xor eax, eax
jmp 0x180001a49
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180001a1e
xor eax, eax
jmp 0x180001a49
xor r9d, r9d
lea r8, [rsp + 0x3c]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x180001a44
xor eax, eax
jmp 0x180001a49
mov eax, 1
add rsp, 0x58
ret
Function at 0x180004670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x180004693
xor al, al
jmp 0x180004695
mov al, 1
add rsp, 0x38
ret
Function at 0x1800158b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, r8
mov edx, dword [rdx + 0x10]
mov rbx, rcx
cmp edx, dword [r8 + 0x10]
je 0x1800158e3
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test edx, edx
jne 0x180015916
xor r9d, r9d
mov dword [rcx + 0x10], r9d
cmp byte [rcx + 0x19], r9b
je 0x180015995
mov qword [rcx + 0x20], r9
mov al, 1
mov dword [rcx + 0x14], r9d
mov byte [rcx + 0x19], r9b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rcx + 0x18], 0xdb
je 0x180015935
xor ecx, ecx
call fcn.18000a020
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rcx + 0x14], edx
jae 0x180015943
call fcn.180016790
test al, al
je 0x1800158d1
mov ecx, dword [rdi + 0x10]
mov eax, dword [rbx + 0x14]
cmp ecx, eax
cmova ecx, eax
cmp qword [rbx + 0x20], 0
mov dword [rbx + 0x10], ecx
je 0x1800158d1
xor r9d, r9d
cmp dword [rdi + 0x10], r9d
jbe 0x180015995
nop word [rax + rax]
mov rax, qword [rdi + 0x20]
mov rcx, qword [rsi + 0x20]
mov r8d, r9d
inc r9d
movzx edx, byte [rcx + r8]
xor dl, byte [rax + r8]
mov rax, qword [rbx + 0x20]
mov byte [r8 + rax], dl
cmp r9d, dword [rdi + 0x10]
jb 0x180015970
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800187a0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov dword [r8], 0
mov dword [rdx], 0xffffffff
call fcn.180008740
test al, al
je 0x180018805
test rdi, rdi
je 0x1800187fe
mov rax, qword [rdi]
lea rdx, str.GetAttributes:_filename_is_empty
mov rcx, rdi
call qword [rax + 0x28]
xor al, al
jmp 0x1800188dd
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.1800058c0
nop
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180006380
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x30]
call fcn.180008930
lea rcx, [rsp + 0x30]
call fcn.180007920
test eax, eax
jle 0x1800188a8
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x1a0]
call fcn.1800cae70
lea rcx, [rsp + 0x1a0]
call fcn.1800058c0
nop
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x30]
call fcn.180018a90
lea rcx, [rsp + 0x1a0]
call fcn.1800085a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbx], eax
lea rcx, [rsp + 0x1a0]
call fcn.180005930
jmp 0x1800188bd
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbx], eax
cmp dword [rbx], 0xffffffff
jne 0x1800188cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
cmp dword [rbx], 0xffffffff
setne bl
lea rcx, [rsp + 0x30]
call fcn.180005930
movzx eax, bl
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x328
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180019690
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x13a0]
mov eax, 0x14a0
call fcn.1800c9710
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x14d0], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rbp + 0x1390], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.1800058c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180006380
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x30]
call fcn.180008930
lea rcx, [rsp + 0x30]
call fcn.180007920
cmp eax, 0x104
jle 0x180019831
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0xa0]
call fcn.1800cae70
lea rcx, [rbp + 0xa0]
call fcn.1800058c0
nop
lea rcx, [rbp + 0xa0]
call fcn.1800093d0
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rcx, rax
lea r9, [rsp + 0x28]
lea r8, [rbp + 0x380]
mov edx, 0x800
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x18001977d
lea rdx, [rbp + 0x380]
jmp 0x18001978a
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.180008fd0
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x210]
call fcn.1800cae70
lea rcx, [rbp + 0x210]
call fcn.1800058c0
nop
lea rdx, [0x1800ed9f4]
lea rcx, [rbp + 0x210]
call fcn.180006210
lea rcx, [rbp + 0xa0]
call fcn.180008170
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.180006210
lea rcx, [rbp + 0x210]
call fcn.1800085a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x180019811
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, 2
cmove ebx, ecx
test ebx, ebx
setne bl
lea rcx, [rbp + 0x210]
call fcn.180005930
nop
lea rcx, [rbp + 0xa0]
call fcn.180005930
jmp 0x180019885
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x180019880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x180019875
mov edx, eax
mov rcx, rdi
call fcn.180039e60
lea r8, [rsp + 0x30]
lea rdx, str.failedToDeleteFilepath
mov rcx, rdi
call fcn.180039a40
mov ecx, 1
cmp esi, 2
cmove ebx, ecx
test ebx, ebx
setne bl
lea rcx, [rsp + 0x30]
call fcn.180005930
movzx eax, bl
mov rcx, qword [rbp + 0x1390]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x14d0]
add rsp, 0x14a0
pop rdi
pop rsi
pop rbp
ret

Function at 0x180019a30
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1850
call fcn.1800c9710
sub rsp, rax
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x1840], rax
mov rbx, rcx
lea rdx, [rsp + 0x830]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x180019a8a
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180008b90
jmp 0x180019a9a
lea rdx, [rsp + 0x830]
mov rcx, rbx
call fcn.180008fd0
mov rcx, qword [rsp + 0x1840]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x1850
pop rbx
ret
Function at 0x18001a300
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x320
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x340], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.1800058c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180006380
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x30]
call fcn.180008930
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.180018c20
lea rcx, [rsp + 0x30]
call fcn.180008740
test al, al
jne 0x18001a3e5
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x1a0]
call fcn.1800cae70
lea rcx, [rsp + 0x1a0]
call fcn.1800058c0
nop
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x30]
call fcn.180018a90
lea rcx, [rsp + 0x1a0]
call fcn.1800085a0
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x1a0]
call fcn.180005930
jmp 0x18001a3fc
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
test ebx, ebx
setne bl
lea rcx, [rsp + 0x30]
call fcn.180005930
movzx eax, bl
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x340]
add rsp, 0x320
pop rdi
ret

Function at 0x18001a430
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.1800058c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180008dd0
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.180005930
mov eax, ebx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x1b0
pop rbx
ret

Function at 0x18001a4c0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.1800058c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180008dd0
lea rcx, [rsp + 0x30]
call fcn.1800085a0
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea rcx, [rsp + 0x30]
call fcn.180005930
movzx eax, bl
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x18001b070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x20], 0
mov rbx, rcx
jne 0x18001b145
mov qword [rsp + 0x88], rdi
lea rdx, [rsp + 0x20]
xor edi, edi
mov word [rsp + 0x28], 0x101
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x2a], dil
call fcn.18001af00
cmp byte [0x18017ef11], dil
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
jne 0x18001b0d5
call fcn.1800cfa50
mov byte [0x18017ef11], 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1800ceb68
movzx eax, word [rsp + 0x4c]
mov ecx, 0x76c
add ax, cx
mov word [rbx + 0x1e], di
mov rdi, qword [rsp + 0x88]
mov word [rbx + 0x10], ax
movzx eax, word [rsp + 0x48]
inc ax
mov dword [rbx + 0x24], 0xffffffff
mov word [rbx + 0x12], ax
movzx eax, word [rsp + 0x50]
mov word [rbx + 0x14], ax
movzx eax, word [rsp + 0x44]
mov word [rbx + 0x16], ax
movzx eax, word [rsp + 0x40]
mov word [rbx + 0x18], ax
movzx eax, word [rsp + 0x3c]
mov word [rbx + 0x1a], ax
movzx eax, word [rsp + 0x38]
mov word [rbx + 0x1c], ax
mov byte [rbx + 0x20], 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x70
pop rbx
ret
Function at 0x1800357c0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x30
mov r15, r9
mov ebx, r8d
mov r12, rdx
test r9, r9
jne 0x1800357e4
xor eax, eax
add rsp, 0x30
pop r15
pop r12
pop rbx
ret
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov dword [r9], ebp
test ebx, ebx
je 0x1800359c5
test r12, r12
je 0x1800359c5
lea ecx, [r8 + r8*4]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea ecx, [rdx + 4]
mov dword [r9], ecx
call fcn.18002b230
mov r11, rax
test rax, rax
je 0x1800359c5
mov qword [rsp + 0x28], r13
mov eax, 0xaaaaaaab
mul ebx
mov qword [rsp + 0x20], r14
lea r13, [0x1801258b0]
mov r14d, edx
mov r9d, ebp
shr r14d, 1
je 0x1800358e5
mov qword [rsp + 0x58], rsi
lea ebp, [r14 + r14*2]
mov qword [rsp + 0x60], rdi
lea r9d, [r14*4]
mov rdi, r12
mov esi, r14d
mov r10, r11
nop dword [rax]
movzx ecx, byte [rdi]
lea r10, [r10 + 4]
movzx edx, byte [rdi + 2]
mov eax, ecx
movzx r8d, byte [rdi + 1]
lea rdi, [rdi + 3]
shr rax, 2
and ecx, 3
shl ecx, 4
movzx eax, byte [rax + r13]
mov byte [r10 - 4], al
mov eax, r8d
shr rax, 4
and r8d, 0xf
or rcx, rax
shl r8d, 2
movzx eax, byte [rcx + r13]
mov byte [r10 - 3], al
mov eax, edx
shr rax, 6
and edx, 0x3f
mov ecx, r8d
or rcx, rax
movzx eax, byte [rcx + r13]
mov byte [r10 - 2], al
movzx eax, byte [rdx + r13]
mov byte [r10 - 1], al
sub rsi, 1
jne 0x180035870
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
lea eax, [r14 + r14*2]
mov r14, qword [rsp + 0x20]
sub ebx, eax
sub ebx, 1
je 0x18003595b
cmp ebx, 1
jne 0x1800359a3
movsxd rax, ebp
movzx edx, byte [rax + r12]
lea eax, [rbp + 1]
movsxd rcx, eax
mov eax, edx
shr rax, 2
and edx, 3
shl edx, 4
movzx r8d, byte [rcx + r12]
movzx eax, byte [rax + r13]
movsxd rcx, r9d
inc r9d
mov byte [rcx + r11], al
mov eax, r8d
shr rax, 4
and r8d, 0xf
or rdx, rax
movsxd rcx, r9d
inc r9d
shl r8d, 2
movzx eax, byte [rdx + r13]
mov byte [rcx + r11], al
movzx eax, byte [r8 + r13]
movsxd rcx, r9d
mov byte [rcx + r11], al
jmp 0x180035995
movsxd rcx, r9d
inc r9d
movsxd rax, ebp
movzx edx, byte [rax + r12]
mov eax, edx
and edx, 3
shr rax, 2
shl edx, 4
movzx eax, byte [rax + r13]
mov byte [rcx + r11], al
movzx eax, byte [rdx + r13]
movsxd rcx, r9d
inc r9d
mov byte [rcx + r11], al
movsxd rax, r9d
mov byte [rax + r11], 0x3d
inc r9d
movsxd rax, r9d
inc r9d
mov byte [rax + r11], 0x3d
mov r13, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
movsxd rax, r9d
mov byte [rax + r11], 0
mov rax, r11
mov dword [r15], r9d
add rsp, 0x30
pop r15
pop r12
pop rbx
ret
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r12
pop rbx
ret
Function at 0x1800370c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rsi, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x18003728c
test edx, edx
je 0x18003728c
mov qword [rax + 8], r14
mov eax, 0x23
mov word [rbp + 0x4b], ax
mov r14d, 0x28
mov qword [rbp - 0x19], 0x250024
mov dword [rbp - 0x11], 0x270026
mov dword [rbp - 0xd], 0x290028
mov dword [rbp - 9], 0x10000
mov dword [rbp - 5], 0x30002
mov dword [rbp - 1], 0x50004
mov dword [rbp + 3], 0x70006
mov qword [rbp + 7], 0x90008
mov qword [rbp + 0xf], 0x2a0000
mov dword [rbp + 0x17], 0xa0000
mov dword [rbp + 0x1b], 0xc000b
mov dword [rbp + 0x1f], 0xe000d
mov dword [rbp + 0x23], 0x10000f
mov dword [rbp + 0x27], 0x120011
mov dword [rbp + 0x2b], 0x140013
mov dword [rbp + 0x2f], 0x160015
mov dword [rbp + 0x33], 0x180017
mov dword [rbp + 0x37], 0x1a0019
mov dword [rbp + 0x3b], 0x1c001b
mov dword [rbp + 0x3f], 0x1e001d
mov dword [rbp + 0x43], 0x20001f
mov dword [rbp + 0x47], 0x220021
cmp edx, 2
jb 0x180037284
nop dword [rax]
movzx ecx, byte [rbx]
lea eax, [rcx - 0x28]
cmp edi, 3
jb 0x18003722b
cmp ax, 0x32
jbe 0x1800371c4
mov ecx, r14d
sub cx, r14w
movzx eax, cx
movzx ecx, byte [rbx + 1]
movzx r9d, word [rbp + rax*2 - 0x19]
lea eax, [rcx - 0x28]
cmp ax, 0x32
jbe 0x1800371e1
mov ecx, r14d
sub cx, r14w
add rbx, 2
movzx eax, cx
movzx ecx, byte [rbx]
movzx r8d, word [rbp + rax*2 - 0x19]
lea eax, [rcx - 0x28]
cmp ax, 0x32
jbe 0x180037201
mov ecx, r14d
sub cx, r14w
movzx eax, r9w
movzx edx, cx
imul ecx, eax, 0x2b
movzx edx, word [rbp + rdx*2 - 0x19]
add cx, r8w
movzx eax, cx
imul ecx, eax, 0x2b
add dx, cx
mov rcx, rsi
call fcn.180014360
jmp 0x180037270
cmp ax, 0x32
jbe 0x180037234
mov ecx, r14d
sub cx, r14w
inc rbx
movzx eax, cx
movzx ecx, byte [rbx]
movzx r8d, word [rbp + rax*2 - 0x19]
lea eax, [rcx - 0x28]
cmp ax, 0x32
jbe 0x180037253
mov ecx, r14d
sub cx, r14w
movzx eax, r8b
movzx edx, cx
imul ecx, eax, 0x2b
movzx edx, byte [rbp + rdx*2 - 0x19]
add dl, cl
mov rcx, rsi
call fcn.1800136a0
cmp edi, 3
jbe 0x180037284
add edi, 0xfffffffd
inc rbx
cmp edi, 2
jae 0x1800371b0
mov r14, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov al, 1
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret