joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180222400
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rdi
push r12
push r15
sub rsp, 0x280
xor ebx, ebx
xor edi, edi
mov rbp, r8
mov r15, rdx
mov r12, rcx
mov dword [rsp + 0x60], 0x67452301
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0x64], 0xefcdab89
mov dword [rsp + 0x68], 0x98badcfe
mov qword [rsp + 0x6c], 0x10325476
test r8, r8
jns 0x180222452
movabs rbp, 0x7fffffffffffffff
jmp 0x180222458
jle 0x180222588
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2b8], r13
mov qword [rsp + 0x2c0], r14
mov r13d, 0x200
mov rax, qword [r15]
mov r8d, ebp
cmp rbp, r13
lea rdx, [rsp + 0x80]
mov rcx, r15
cmovg r8d, r13d
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jle 0x180222570
movsxd rsi, eax
mov ecx, edi
lea rax, [rsi*8]
shr ecx, 3
sub rbp, rsi
add edi, eax
lea eax, [rsi*8]
and ecx, 0x3f
mov dword [rsp + 0x70], edi
cmp edi, eax
jae 0x1802224c2
inc ebx
mov rax, rsi
xor edi, edi
shr rax, 0x1d
add ebx, eax
movsxd rax, ecx
mov dword [rsp + 0x74], ebx
mov ebx, 0x40
sub rbx, rax
cmp rsi, rbx
jb 0x18022253d
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x80]
mov r8, rbx
add rcx, rax
call fcn.1800a0460
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.180095700
mov rdi, rbx
add rbx, 0x40
cmp rbx, rsi
ja 0x18022253b
lea r14, [rsp + 0x80]
lea r14, [r14 - 0x40]
lea rdx, [r14 + rbx]
lea rcx, [rsp + 0x20]
call fcn.180095700
add rbx, 0x40
add rdi, 0x40
cmp rbx, rsi
jbe 0x180222520
xor ecx, ecx
movsxd rax, ecx
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
sub rsi, rdi
add rcx, rax
add rdx, rdi
mov r8, rsi
call fcn.1800a0460
test rbp, rbp
jle 0x180222570
mov ebx, dword [rsp + 0x74]
mov edi, dword [rsp + 0x70]
jmp 0x180222476
mov r13, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x20]
mov rdx, r12
call fcn.180096000
add rsp, 0x280
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret

Function at 0x180222ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rdx]
mov esi, dword [r8]
mov rbp, qword [rcx + 0x48]
mov r14, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
mov r12, qword [rcx + 0x60]
mov rbx, r8
mov rdi, rdx
mov r9, rcx
mov r10d, setsockopt
nop
xor eax, dword [r9 + r10*4]
dec r10
mov r8d, eax
mov r11d, eax
shr rax, 0x10
movzx ecx, al
mov edx, r8d
mov eax, dword [r14 + rcx*4]
shr rdx, 0x18
mov ecx, r8d
add eax, dword [rbp + rdx*4]
shr rcx, 8
movzx edx, cl
movzx ecx, r8b
xor eax, dword [r15 + rdx*4]
add eax, dword [r12 + rcx*4]
xor eax, esi
mov esi, r11d
cmp r10, 1
jg 0x180222b00
mov ecx, dword [r9]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
xor ecx, r11d
mov dword [rdi], ecx
mov ecx, dword [r9 + 4]
mov rdi, qword [rsp + 0x38]
xor ecx, eax
mov dword [rbx], ecx
mov rbx, qword [rsp + 0x20]
pop r15
pop r14
pop r12
ret
Function at 0x180222b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rdx]
mov esi, dword [r8]
mov rbp, qword [rcx + 0x48]
mov r14, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
mov r12, qword [rcx + 0x60]
mov rbx, r8
mov rdi, rdx
mov r9, rcx
xor r10d, r10d
nop dword [rax + rax]
xor eax, dword [r9 + r10*4]
inc r10
mov r8d, eax
mov r11d, eax
shr rax, 0x10
movzx ecx, al
mov edx, r8d
mov eax, dword [r14 + rcx*4]
shr rdx, 0x18
mov ecx, r8d
add eax, dword [rbp + rdx*4]
shr rcx, 8
movzx edx, cl
movzx ecx, r8b
xor eax, dword [r15 + rdx*4]
add eax, dword [r12 + rcx*4]
xor eax, esi
mov esi, r11d
cmp r10, 0x10
jl 0x180222bc0
mov ecx, dword [r9 + 0x44]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
xor ecx, r11d
mov dword [rdi], ecx
mov ecx, dword [r9 + 0x40]
mov rdi, qword [rsp + 0x38]
xor ecx, eax
mov dword [rbx], ecx
mov rbx, qword [rsp + 0x20]
pop r15
pop r14
pop r12
ret
Function at 0x180227dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
movzx eax, byte [rdx + 1]
movzx r11d, byte [rdx]
mov rbx, r8
shl r11d, 8
mov r8, rcx
movzx ecx, byte [rdx + 5]
or r11d, eax
movzx eax, byte [rdx + 2]
shl r11d, 8
or r11d, eax
movzx eax, byte [rdx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rdx + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [rdx + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [rdx + 7]
shl eax, 8
or eax, ecx
mov ecx, dword [r8 + 4]
dec ecx
movsxd rdi, ecx
test ecx, ecx
jle 0x180227f8d
mov qword [rsp + 0x10], rbp
mov rbp, qword [r8 + 8]
mov qword [rsp + 0x18], rsi
lea rsi, [rdi + rdi*2]
mov qword [rsp + 0x20], r14
lea r14, [0x180423e80]
shl rsi, 2
dec rdi
shr rdi, 1
inc rdi
nop dword [rax]
mov r10d, eax
mov ecx, eax
mov r9d, eax
shr ecx, 0x10
and r9d, 0x3ff00
ror r10d, 0xe
and ecx, 0x3ff
shl r9d, 2
and r10d, 0xffc00
or r10d, ecx
mov ecx, eax
lea rsi, [rsi - 0x18]
and ecx, 0x3ff
or r9d, ecx
mov ecx, dword [rsi + rbp + 0x18]
mov edx, r9d
xor edx, r10d
and edx, dword [rsi + rbp + 0x20]
xor ecx, edx
mov r8d, edx
xor r8d, r9d
xor ecx, r10d
xor r8d, dword [rsi + rbp + 0x1c]
mov r9d, ecx
mov edx, ecx
mov r10d, r8d
mov ecx, r8d
shr rdx, 0xa
mov r8d, dword [r14 + rdx*4]
shr rcx, 0xa
and r9d, 0x3ff
or r8d, dword [r14 + rcx*4 + 0x2000]
and r10d, 0x3ff
or r8d, dword [r14 + r9*4 + 0x1000]
or r8d, dword [r14 + r10*4 + 0x3000]
xor r11d, r8d
mov r9d, r11d
mov ecx, r11d
mov edx, r11d
shr ecx, 0x10
ror r9d, 0xe
and edx, 0x3ff00
and ecx, 0x3ff
and r9d, 0xffc00
shl edx, 2
or r9d, ecx
mov ecx, r11d
and ecx, 0x3ff
or edx, ecx
mov r8d, edx
xor r8d, r9d
and r8d, dword [rsi + rbp + 0x14]
mov ecx, r8d
xor r8d, r9d
xor r8d, dword [rsi + rbp + 0xc]
xor ecx, edx
xor ecx, dword [rsi + rbp + 0x10]
mov edx, r8d
mov r9d, r8d
mov r10d, ecx
shr rdx, 0xa
shr rcx, 0xa
mov r8d, dword [r14 + rdx*4]
and r9d, 0x3ff
and r10d, 0x3ff
or r8d, dword [r14 + rcx*4 + 0x2000]
or r8d, dword [r14 + r9*4 + 0x1000]
or r8d, dword [r14 + r10*4 + 0x3000]
xor eax, r8d
dec rdi
jne 0x180227e50
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov byte [rbx + 3], al
mov byte [rbx + 7], r11b
shr eax, 8
mov byte [rbx + 2], al
shr r11d, 8
shr eax, 8
mov byte [rbx + 6], r11b
mov byte [rbx + 1], al
shr r11d, 8
mov byte [rbx + 5], r11b
shr eax, 8
shr r11d, 8
mov byte [rbx], al
mov byte [rbx + 4], r11b
mov rbx, qword [rsp + 0x28]
pop rdi
ret
Function at 0x180229a70
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rax, [rsp + 0x20]
test rax, rax
je 0x180229ac8
mov ecx, 0xa9
mov qword [rsp + 0x50], rbx
call fcn.18008a510
mov ecx, 0x2c
mov rbx, rax
call fcn.18008a510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x180229ac2
call rax
jmp 0x180229ac8
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
cmp ax, 9
je 0x180229ade
cmp ax, 6
mov eax, 0x20
jne 0x180229ae3
mov eax, 0x40
add rsp, 0x58
ret
Function at 0x1802746d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
movsxd rdx, dword [rcx + 0x78]
mov rbx, rcx
mov rcx, 0xffffffffffffffff
mov eax, 2
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.18009f808
movsxd r8, dword [rbx + 0x78]
lea rdx, [0x180303540]
add r8, r8
mov rcx, rax
mov rsi, rax
call fcn.1800a0460
xor edi, edi
mov r11d, edi
cmp dword [rbx + 0x78], edi
jle 0x1802747d0
movss xmm1, dword [0x180392fe0]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r9d, edi
mov r10, rsi
mov ebp, 0x200
mov r14d, 0x2000
mov r15d, 0xffff9f3a
nop word [rax + rax]
movsx r8d, word [r10]
inc r11d
lea r10, [r10 + 2]
mov eax, r8d
not r8w
lea r9, [r9 + 4]
cdq
movzx ecx, r8w
shr r8w, 7
xor eax, edx
sub eax, edx
add edi, eax
imul cx, bp
add cx, r8w
movzx eax, cx
shr ax, 3
imul cx, r14w
add ax, cx
xor ax, r15w
cwde
movd xmm0, eax
mov rax, qword [rbx + 0x80]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [r9 + rax - 4], xmm0
cmp r11d, dword [rbx + 0x78]
jl 0x180274760
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1800a0c6c
mov rsi, qword [rsp + 0x48]
lea eax, [rdi - 0x809c4e0]
mov rdi, qword [rsp + 0x50]
cmp eax, 0x4920e177
je 0x18027495d
movss xmm1, dword [0x180393198]
mov ecx, dword [0x180422004]
mov edx, reloc.WS2_32.dll_inet_ntoa
nop word [rax + rax]
xorps xmm0, xmm0
imul eax, ecx, 0x2bc03
mov ecx, 0xffc39ec3
add rdx, 0x14
sub ecx, eax
and ecx, 0xffffff
mov eax, ecx
cvtsi2ss xmm0, rax
mov rax, qword [rbx + 0x80]
mulss xmm0, dword [rbx + 0xc0]
addss xmm0, dword [rbx + 0xc4]
mulss xmm0, xmm1
movss dword [rdx + rax - 0x20], xmm0
xorps xmm0, xmm0
imul eax, ecx, 0x2bc03
mov ecx, 0xffc39ec3
sub ecx, eax
and ecx, 0xffffff
mov eax, ecx
cvtsi2ss xmm0, rax
mov rax, qword [rbx + 0x80]
mulss xmm0, dword [rbx + 0xc0]
addss xmm0, dword [rbx + 0xc4]
mulss xmm0, xmm1
movss dword [rdx + rax - 0x1c], xmm0
xorps xmm0, xmm0
imul eax, ecx, 0x2bc03
mov ecx, 0xffc39ec3
sub ecx, eax
and ecx, 0xffffff
mov eax, ecx
cvtsi2ss xmm0, rax
mov rax, qword [rbx + 0x80]
mulss xmm0, dword [rbx + 0xc0]
addss xmm0, dword [rbx + 0xc4]
mulss xmm0, xmm1
movss dword [rdx + rax - 0x18], xmm0
xorps xmm0, xmm0
imul eax, ecx, 0x2bc03
mov ecx, 0xffc39ec3
sub ecx, eax
and ecx, 0xffffff
mov eax, ecx
cvtsi2ss xmm0, rax
mov rax, qword [rbx + 0x80]
mulss xmm0, dword [rbx + 0xc0]
addss xmm0, dword [rbx + 0xc4]
mulss xmm0, xmm1
movss dword [rdx + rax - 0x14], xmm0
imul eax, ecx, 0x2bc03
xorps xmm0, xmm0
mov ecx, 0xffc39ec3
sub ecx, eax
and ecx, 0xffffff
mov eax, ecx
cvtsi2ss xmm0, rax
mov rax, qword [rbx + 0x80]
mulss xmm0, dword [rbx + 0xc0]
addss xmm0, dword [rbx + 0xc4]
mulss xmm0, xmm1
movss dword [rdx + rax - 0x10], xmm0
cmp rdx, 0x535b8
jl 0x180274810
mov dword [0x180422004], ecx
add rsp, 0x30
pop rbx
ret
Function at 0x180277560
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
lea r9, [rcx + 1]
mov r10d, 0x400
lea r11, [0x180357ea0]
movzx edx, byte [r9 - 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
lea r9, [r9 + 4]
movzx ecx, dl
mov edx, dword [r11 + rcx*4]
xor edx, eax
movzx eax, byte [r9 - 4]
mov ecx, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 3]
mov r8d, dword [r11 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 2]
mov edx, dword [r11 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
dec r10
jne 0x180277573
not eax
ret

Function at 0x180288c70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, edx
mov ebx, 1
mov esi, ebx
mov eax, 4
shl esi, cl
mov rcx, 0xffffffffffffffff
movsxd rbp, esi
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.1800a103c
xor ecx, ecx
mov qword [rdi], rax
mov dword [rax], ecx
cmp rbx, rbp
jge 0x180288cdf
sar esi, 1
nop
xor ecx, esi
mov eax, esi
test ecx, esi
jne 0x180288cd0
sar eax, 1
xor ecx, eax
test ecx, eax
je 0x180288cc8
mov rax, qword [rdi]
inc rbx
mov dword [rax + rbx*4 - 4], ecx
cmp rbx, rbp
jl 0x180288cc0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180001150
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x20]
mov r8d, 3
mov rdx, rbx
call fcn.1800f4e00
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 3
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x140
pop rbx
ret

Function at 0x180001250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180001269
xor eax, eax
add rsp, 0x28
ret
movzx eax, al
shr eax, 4
and eax, 1
add rsp, 0x28
ret

Function at 0x180001280
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
lea rcx, [rsp + 0x231]
mov r8d, 0x207
xor edx, edx
mov byte [rsp + 0x230], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x20], 0
call fcn.1800f4fb0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
movsxd r12, ecx
cmp byte [r12 + rbx - 1], 0x5c
je 0x180001309
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov ebp, 3
mov qword [rsp + 0x470], rsi
not rcx
dec rcx
cmp ecx, ebp
jle 0x180001395
lea rsi, [rbx + 3]
nop
cmp byte [rsi], 0x5c
jne 0x18000137b
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.1800f4fb0
lea edx, [rbp + 1]
lea rcx, [rsp + 0x20]
movsxd r8, edx
mov rdx, rbx
call fcn.1800f4e00
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18000137b
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1800013d4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
inc ebp
inc rsi
not rcx
dec rcx
cmp ebp, ecx
jl 0x180001330
cmp byte [r12 + rbx - 1], 0x5c
jne 0x1800013a3
mov byte [r12 + rbx - 1], 0
mov eax, 1
mov rsi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop r12
pop rdi
pop rbp
ret
lea rdx, str._CBackUpFile::CreateFilePath__s
lea rcx, [rsp + 0x230]
mov r8, rbx
call fcn.1800f509c
cmp byte [r12 + rbx - 1], 0x5c
jne 0x1800013f9
mov byte [r12 + rbx - 1], 0
xor eax, eax
jmp 0x1800013a8
Function at 0x180001810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180001843
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180001887
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x180001882
cmp rbx, r11
jae 0x180001887
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x180001870
cmp rbx, r11
jb 0x18000188b
xor eax, eax
jmp 0x180001897
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800058a0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov ebp, r8d
mov rbx, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x207
mov edi, r9d
mov byte [rsp + 0x30], 0
call fcn.1800f4fb0
test rbx, rbx
je 0x1800059b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x1800059b8
lea rdx, [rsp + 0x30]
mov r9d, edi
mov r8d, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call fcn.180001cc0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180001250
test eax, eax
jne 0x180005934
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180001280
mov edx, 0x5c
mov rcx, rbx
call fcn.1800f7e94
mov r11, rax
test rax, rax
je 0x1800059a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
cmp byte [rsp + rcx + 0x2e], 0x5c
jne 0x180005963
inc r11
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [r11 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180005970
xor eax, eax
lea rdi, [rsp + 0x30]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..tmp]
mov dword [rdi - 1], eax
movzx eax, byte [0x180151a1c]
mov byte [rdi + 3], al
mov r9d, dword [rsp + 0x290]
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.180005190
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x180005be0
Capabilities:
Encode data using base64

Disassembly:
push rsi
mov r10, r8
mov esi, edx
mov r11, rcx
test rcx, rcx
je 0x180005d24
test edx, edx
js 0x180005d24
test r8, r8
je 0x180005d0e
mov qword [rsp + 0x10], rbx
mov ebx, edx
test edx, edx
jle 0x180005d05
mov qword [rsp + 0x18], rdi
mov rdi, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
nop
cmp ebx, 3
jl 0x180005c8f
movzx ecx, byte [r11 + 1]
movzx edx, byte [r11]
movzx r9d, byte [r11 + 2]
mov r8d, ecx
shr ecx, 4
mov rax, rdx
shr rax, 2
add r11, 3
movzx eax, byte [rax + rdi]
mov byte [r10], al
mov eax, edx
shl eax, 4
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rdi]
mov rcx, r9
mov byte [r10 + 1], al
lea eax, [r8*4]
shr rcx, 6
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rdi]
mov byte [r10 + 2], al
mov rax, r9
and eax, 0x3f
add r10, 4
movzx eax, byte [rax + rdi]
mov byte [r10 - 1], al
jmp 0x180005cf5
movzx r8d, byte [r11]
inc r11
cmp ebx, 2
jne 0x180005ca4
movzx ecx, byte [r11]
inc r11
jmp 0x180005ca6
xor cl, cl
movzx edx, cl
movzx eax, r8b
shr rax, 2
mov ecx, edx
movzx eax, byte [rax + rdi]
shr ecx, 4
mov byte [r10], al
movzx eax, r8b
shl eax, 4
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rdi]
mov byte [r10 + 1], al
cmp ebx, 1
jne 0x180005cdb
mov al, 0x3d
jmp 0x180005ce8
and edx, 0xf
shl edx, 2
movsxd rax, edx
movzx eax, byte [rax + rdi]
mov byte [r10 + 2], al
mov byte [r10 + 3], 0x3d
add r10, 4
sub ebx, 3
test ebx, ebx
jg 0x180005c20
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [r10], 0x30
lea ecx, [rsi + 2]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
pop rsi
ret
or eax, 0xffffffff
pop rsi
ret

Function at 0x18000c280
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x9c
call fcn.1800f4fb0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x18000c2de
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000c30b
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x18000c303
cmp dword [rsp + 0x24], 6
mov byte [rbx + 8], al
jb 0x18000c2fc
mov dword [rbx + 0xc], 1
mov byte [rbx + 8], 3
mov eax, 1
jmp 0x18000c30d
cmp eax, 1
jne 0x18000c30b
mov byte [rbx + 8], al
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xd0
pop rbx
ret
Function at 0x18000c330
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x230
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rcx
call fcn.18000c280
mov ebp, 1
test eax, eax
je 0x18000c445
lea rdx, [rsp + 0x20]
mov r8d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18000c445
lea edx, [rbp + 0x5b]
lea rcx, [rsp + 0x20]
call fcn.1800f7e94
mov rdi, rax
test rax, rax
je 0x18000c445
cmp dword [rbx + 0xc], 0
mov qword [rsp + 0x248], rsi
je 0x18000c3cc
lea rdx, str.EXPLORER.EXE
lea rcx, [rax + 1]
call fcn.18010b680
mov ecx, dword [0x1801de368]
test eax, eax
cmove ecx, ebp
mov dword [0x1801de368], ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, 0x5c
mov rcx, rax
mov rsi, rax
call fcn.1800f7e94
mov rbx, rax
test rax, rax
jne 0x18000c3ef
mov rbx, rsi
jmp 0x18000c3f2
inc rbx
lea rdx, str.cygwin.bat
mov r8d, 0xa
mov rcx, rbx
call fcn.18010c858
mov rsi, qword [rsp + 0x248]
test eax, eax
je 0x18000c42c
lea rdx, str.safeboxTray.exe
mov r8d, 0xf
mov rcx, rbx
call fcn.18010c858
test eax, eax
jne 0x18000c445
lea r8, [rdi + 1]
lea rcx, str.line:_d__IsUnHookProcess:___s
mov edx, 0x309
call fcn.18005cd20
xor eax, eax
jmp 0x18000c447
mov eax, ebp
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18000ca50
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x9c
call fcn.1800f4fb0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x18000caae
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000cade
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x18000cad6
cmp dword [rsp + 0x24], 6
mov dword [rbx + 0x38], eax
jb 0x18000cacf
mov dword [rbx + 0x30], 1
mov dword [rbx + 0x38], 3
mov eax, 1
jmp 0x18000cae0
cmp eax, 1
jne 0x18000cade
mov dword [rbx + 0x38], eax
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xd0
pop rbx
ret