joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180210e74
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
xor eax, eax
test rcx, rcx
je 0x180210fca
test r8, r8
je 0x180210fca
test r9, r9
je 0x180210fca
lea esi, [rdx + 2]
mov edi, 0xaaaaaaab
imul rsi, rdi
shr rsi, 0x20
and esi, 0x7ffffffe
lea esi, [rsi + rsi]
add esi, 1
cmp dword [r9], esi
jb 0x180210fca
mov eax, edx
imul rax, rdi
shr rax, 0x21
lea r11d, [rax + rax*2]
xor eax, eax
test r11d, r11d
jne 0x180210ed8
mov r10, r8
jmp 0x180210f61
lea r14, [0x180545300]
mov r10, r8
xor edi, edi
movzx ebx, byte [rcx]
shr rbx, 2
mov bl, byte [rbx + r14]
mov byte [r10], bl
movzx ebx, byte [rcx]
shl rbx, 4
and ebx, 0x30
movzx esi, byte [rcx + 1]
shr rsi, 4
or rsi, rbx
mov bl, byte [r14 + rsi]
mov byte [r10 + 1], bl
movzx esi, byte [rcx + 1]
and esi, 0xf
movzx ebx, byte [rcx + 2]
shr rbx, 6
lea rsi, [rbx + rsi*4]
mov bl, byte [r14 + rsi]
mov byte [r10 + 2], bl
movzx esi, byte [rcx + 2]
and esi, 0x3f
mov bl, byte [rsi + r14]
mov byte [r10 + 3], bl
cmp dil, 0x10
jae 0x180210f48
add r10, 4
inc dil
jmp 0x180210f55
mov word [r10 + 4], 0xa0d
add r10, 6
xor edi, edi
add rcx, 3
add eax, 3
cmp eax, r11d
jb 0x180210ee4
cmp eax, edx
jae 0x180210fbb
movzx esi, byte [rcx]
inc eax
xor edi, edi
cmp eax, edx
jae 0x180210f74
movzx edi, byte [rcx + 1]
mov rcx, rsi
shr rcx, 2
shl rsi, 4
and esi, 0x30
mov ebx, edi
shr rbx, 4
or rbx, rsi
lea rsi, [0x180545300]
mov cl, byte [rcx + rsi]
mov byte [r10], cl
mov cl, byte [rsi + rbx]
mov byte [r10 + 1], cl
mov cl, 0x3d
cmp eax, edx
jae 0x180210fae
shl edi, 2
and edi, 0x3c
mov cl, byte [rdi + rsi]
mov byte [r10 + 2], cl
mov byte [r10 + 3], 0x3d
add r10, 4
mov byte [r10], 0
sub r10d, r8d
mov dword [r9], r10d
mov eax, 1
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x18022d4b4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r9
mov r15d, r8d
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [r9]
call fcn.1801bffc4
mov r14d, eax
test eax, eax
jne 0x18022d5ca
mov ecx, dword [rsi + 4]
lea eax, [rcx - 1]
mov r14d, 0x16
cmp eax, 0x7f
ja 0x18022d5ca
test cl, 7
jne 0x18022d5ca
mov eax, dword [rsi + 8]
cmp eax, 0x80
ja 0x18022d5ca
cmp eax, ecx
jne 0x18022d574
cmp ecx, r15d
ja 0x18022d574
movsxd rax, dword [rsi]
lea rax, [rax + rax*4]
shl rax, 5
lea rdx, [0x18060fed0]
mov r10, qword [rax + rdx + 0x68]
test r10, r10
je 0x18022d574
lea r8, [rsi + 0x110]
mov r11d, dword [rsi + 0xc]
lea r9, [rsi + 0x10]
mov eax, r15d
xor edx, edx
div ecx
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r11d
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call r10
mov r14d, eax
test eax, eax
jne 0x18022d5ca
mov ecx, dword [rsi + 4]
mov eax, r15d
xor edx, edx
div ecx
mov r15d, edx
xor r14d, r14d
test r15d, r15d
je 0x18022d5ca
lea rax, [rsi + 0x110]
mov qword [rsp + 0x30], rax
lea r12, [rsi + 0x90]
lea r13, [rsi + 0x10]
mov eax, dword [rsi + 8]
cmp eax, ecx
jne 0x18022d5ea
mov rcx, rsi
call fcn.180276604
movsxd rax, dword [rsi]
lea rbp, [rax + rax*4]
shl rbp, 5
mov rcx, r13
mov rdx, r12
mov r8, qword [rsp + 0x30]
lea rax, [0x18060fed0]
call qword [rbp + rax + 0x28]
test eax, eax
je 0x18022d5de
mov r14d, eax
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsi + 8], 0
mov ecx, dword [rsi + 4]
jmp 0x18022d5ee
test eax, eax
jne 0x18022d633
xor eax, eax
cmp r15d, ecx
jb 0x18022d633
xor eax, eax
test ecx, ecx
jle 0x18022d617
cdqe
mov rcx, qword [rsi + rax + 0x90]
xor rcx, qword [rbx + rax]
mov qword [rdi + rax], rcx
add eax, 8
mov ecx, dword [rsi + 4]
cmp eax, ecx
jl 0x18022d5fb
movsxd rax, ecx
add rbx, rax
add rdi, rax
sub r15d, eax
mov dword [rsi + 8], eax
test r15d, r15d
je 0x18022d5ca
mov ecx, dword [rsi + 4]
jmp 0x18022d593
mov cl, byte [rbx]
lea edx, [rax + 1]
mov dword [rsi + 8], edx
cdqe
xor cl, byte [rsi + rax + 0x90]
inc rbx
mov byte [rdi], cl
inc rdi
dec r15d
jmp 0x18022d626
Function at 0x18026fe84
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc78
xorps xmm0, xmm0
movups xmmword [r8], xmm0
mov dword [r8 + 0x10], 0
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x10], eax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp], xmm0
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x20], xmm0
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov r10d, 1
mov r9d, 5
lea rax, [r10 - 1]
xor edx, edx
lea rcx, [rax + rax*4]
lea rcx, [rsp + rcx*4]
add rcx, 0x20
mov esi, dword [rcx + rdx*4]
lea r11, [r10 + r10*4]
lea rcx, [rsp + r11*4]
add rcx, 0x20
mov dword [rcx + rdx*4], esi
inc rdx
cmp rdx, r9
jne 0x18026fecb
mov edx, dword [rsp + r11*4 + 0x30]
and edx, 1
shl edx, 0x1d
xor eax, eax
mov esi, dword [rcx + rax*4]
mov edi, esi
shr edi, 1
or edi, edx
shl esi, 0x1f
mov dword [rcx + rax*4], edi
inc rax
mov edx, esi
cmp rax, r9
jne 0x18026fefe
and byte [rsp + r11*4 + 0x23], 0x3f
inc r10
cmp r10, 0x9e
jne 0x18026fec5
movsx rcx, word [0x18060dc70]
xor eax, eax
lea rcx, [rcx + rcx*4]
lea rcx, [rsp + rcx*4]
add rcx, 0x20
mov edx, dword [rcx + rax*4]
and edx, dword [rsp + rax*4]
mov dword [r8 + rax*4], edx
inc rax
cmp rax, 5
jne 0x18026ff3f
mov r11d, 1
mov r9d, 0x3fffffff
lea r10, [0x18060dc70]
mov ecx, dword [rsp + 0x10]
and ecx, 1
shl ecx, 0x1d
xor eax, eax
mov edx, dword [rsp + rax*4]
mov esi, edx
shr esi, 1
or esi, ecx
shl edx, 0x1f
mov dword [rsp + rax*4], esi
inc rax
mov ecx, edx
cmp rax, 5
jne 0x18026ff71
mov eax, dword [rsp]
and eax, r9d
mov dword [rsp], eax
movsx rcx, word [r10 + r11*2]
movsx rdx, word [r10 + r11*2 + 0x27a]
lea rcx, [rcx + rcx*4]
lea rdx, [rdx + rdx*4]
mov esi, dword [rsp + rdx*4 + 0x20]
xor esi, dword [rsp + rcx*4 + 0x20]
and esi, eax
xor dword [r8], esi
xor eax, eax
lea rsi, [rax*4]
or rsi, 4
movups xmm0, xmmword [rsp + rsi]
lea rdi, [rsp + rcx*4]
add rdi, 0x20
movups xmm1, xmmword [rsi + rdi]
lea rdi, [rsp + rdx*4 + 0x20]
movups xmm2, xmmword [rsi + rdi]
xorps xmm2, xmm1
andps xmm2, xmm0
movups xmm0, xmmword [r8 + rsi]
xorps xmm0, xmm2
movups xmmword [r8 + rsi], xmm0
test rax, rax
lea rax, [rax + 4]
jne 0x18026ffb9
inc r11
cmp r11, 0x9e
jne 0x18026ff65
add rsp, 0xc78
pop rdi
pop rsi
ret
Function at 0x180270aa4
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0x20
test rcx, rcx
jne 0x1801473f5
mov eax, 0xe
jmp 0x180147421
mov rsi, rcx
mov ecx, 0xc
call fcn.1802fb6e2
test rax, rax
jne 0x18014740e
mov eax, 0xc
jmp 0x180147421
mov qword [rax], 0
mov dword [rax + 8], 0
mov qword [rsi], rax
xor eax, eax
add rsp, 0x20
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.18010df5b
cmp eax, 1
je 0x180270acf
test eax, eax
jne 0x180270ae0
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x18032ed04
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1801473e4
mov eax, 0xe1
add rsp, 0x28
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x18032ed1a
mov eax, 0xe
jmp 0x18032ee0a
mov rsi, rcx
mov ecx, 0x68
call fcn.1802fb6e2
test rax, rax
jne 0x18032ed36
mov eax, 0xc
jmp 0x18032ee0a
mov rdi, rax
mov dword [rax], 0
lea rcx, [0x1805a1a8c]
call sub.KERNEL32.dll_GetModuleHandleA
cmp rax, 0xffffffffffffffff
je 0x18032edec
mov rbx, rax
lea rdx, str.AcquireSRWLockShared
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x40], rax
lea rdx, str.ReleaseSRWLockShared
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x48], rax
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x50], rax
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x58], rax
lea rdx, str.InitializeSRWLock
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x60], rax
cmp qword [rdi + 0x40], 0
je 0x18032edec
cmp qword [rdi + 0x48], 0
je 0x18032edec
cmp qword [rdi + 0x50], 0
je 0x18032edec
test rax, rax
je 0x18032edec
mov rax, qword [rdi + 0x58]
test rax, rax
je 0x18032edec
mov dword [rdi], 1
mov rcx, rdi
add rcx, 0x30
call qword [rdi + 0x60]
jmp 0x18032edfd
cmp dword [rdi], 0
jne 0x18032ede0
mov rcx, rdi
add rcx, 8
call sub.KERNEL32.dll_InitializeCriticalSection
mov qword [rdi + 0x38], 0
mov qword [rsi], rdi
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x180270ef6
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
cmp edx, 2
jl 0x180270fd9
mov r8d, edx
mov edx, 1
lea r9, [0x180591a50]
lea r10, [0x180591e50]
lea r11, [0x180592250]
lea r14, [0x180592650]
mov rsi, rdx
shl rsi, 4
movzx edi, byte [rcx + rsi]
movzx ebx, byte [rcx + rsi + 1]
mov ebx, dword [r10 + rbx*4]
xor ebx, dword [r9 + rdi*4]
movzx edi, byte [rcx + rsi + 2]
movzx eax, byte [rcx + rsi + 3]
xor ebx, dword [r11 + rdi*4]
xor ebx, dword [r14 + rax*4]
mov dword [rcx + rsi], ebx
movzx eax, byte [rcx + rsi + 4]
movzx edi, byte [rcx + rsi + 5]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 6]
movzx ebx, byte [rcx + rsi + 7]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 4], edi
movzx eax, byte [rcx + rsi + 8]
movzx edi, byte [rcx + rsi + 9]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xa]
movzx ebx, byte [rcx + rsi + 0xb]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 8], edi
movzx eax, byte [rcx + rsi + 0xc]
movzx edi, byte [rcx + rsi + 0xd]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xe]
xor edi, dword [r11 + rax*4]
movzx eax, byte [rcx + rsi + 0xf]
xor edi, dword [r14 + rax*4]
mov dword [rcx + rsi + 0xc], edi
inc rdx
cmp rdx, r8
jne 0x180270f28
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1802734d4
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, r8
mov r15d, edx
mov r13, rcx
mov qword [rsp + 0x30], 0
lea rcx, [0x180592b44]
call fcn.1802a00fc
test rax, rax
je 0x18027355b
mov rdi, rax
lea rdx, str.CryptAcquireContextA
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rbp, rax
lea rdx, str.CryptReleaseContext
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov r12, rax
lea rdx, str.CryptGenRandom
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rbp, rbp
je 0x180273553
test r12, r12
je 0x180273553
mov rsi, rax
test rax, rax
jne 0x180273607
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
test r15d, r15d
je 0x18027367e
mov qword [rsp + 0x40], rbx
xor r8d, r8d
lea rdi, [rsp + 0x38]
mov r12d, r15d
xor eax, eax
xor ebp, ebp
xor ebx, ebx
mov esi, 7
mov r14d, eax
rdtsc
mov eax, eax
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x38], rdx
mov edx, 8
mov rcx, rdi
call fcn.18031b774
mov r8d, eax
and eax, 1
xor ebp, eax
rdtsc
mov eax, eax
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x38], rdx
mov edx, 8
mov rcx, rdi
call fcn.18031b774
mov r8d, eax
and eax, 1
xor eax, r14d
mov r14d, ebp
cmp ebp, eax
je 0x180273582
add ebx, ebx
or ebx, ebp
lea ecx, [rsi - 1]
test esi, esi
mov esi, ecx
jne 0x18027357f
mov byte [r13], bl
lea r13, [r13 + 1]
dec r12d
jne 0x180273578
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180273696
mov dword [rax], 4
jmp 0x180273696
mov dword [rsp + 0x20], 0xf0000020
lea r8, [0x180592b89]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9d, 1
call rbp
test eax, eax
jne 0x18027364f
mov dword [rsp + 0x20], 0xf0000028
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9d, 1
call rbp
test eax, eax
je 0x180273553
mov rcx, qword [rsp + 0x30]
mov edx, r15d
mov r8, r13
call rsi
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor edx, edx
call r12
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
cmp esi, 1
jne 0x18027355b
test r15d, r15d
jne 0x18027368b
test rbx, rbx
je 0x180273696
mov dword [rbx], 0
jmp 0x180273696
test rbx, rbx
je 0x180273696
mov dword [rbx], 5
mov eax, r15d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18027ad34
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
mov rbx, rcx
mov r9, rcx
sub r9, 0xffffffffffffff80
mov rcx, rdx
mov rdx, r8
mov r8d, esi
call fcn.18022d4b4
test eax, eax
je 0x18027ad65
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
add rbx, 0x9a0
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.18020f6e4

Function at 0x18028fc34
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebp, r9d
mov r12, r8
mov edi, edx
mov rsi, rcx
mov ecx, edx
call fcn.18010df24
mov ebx, eax
test eax, eax
jne 0x18028fda2
mov dword [rsi + 0x110], edi
test ebp, ebp
jne 0x18028fc74
mov ebx, 0x20001
jmp 0x18028fda2
movsxd rax, edi
imul r13, rax, 0x78
lea r15, [0x180611330]
mov eax, dword [r13 + r15 + 0xc]
mov qword [rsp + 0x28], rax
mov ecx, dword [r13 + r15 + 0x10]
call fcn.1802fb6e2
mov ebx, 0xc
test rax, rax
je 0x18028fda2
mov r14, rax
add r15, r13
add r15, 0x10
mov ecx, dword [r15]
call fcn.1802fb6e2
mov qword [rsi + 0x228], rax
test rax, rax
je 0x18028fd9a
mov ecx, dword [r15]
cmp ecx, ebp
jae 0x18028fd0a
lea rdx, [rsp + 0x34]
mov dword [rdx], ecx
mov qword [rsp + 0x20], rdx
mov ecx, edi
mov rdx, r12
mov r8d, ebp
mov r9, rax
call fcn.180218554
mov ebx, eax
test eax, eax
jne 0x18028fd8e
mov edx, dword [r15]
mov rcx, qword [rsp + 0x28]
cmp edx, ecx
jbe 0x18028fd38
sub edx, ecx
add rcx, qword [rsi + 0x228]
jmp 0x18028fd30
mov edi, ebp
mov rcx, rax
mov rdx, r12
mov r8, rdi
call fcn.18017fd34
mov edx, dword [r15]
mov eax, edx
sub eax, ebp
jbe 0x18028fd38
add rdi, qword [rsi + 0x228]
mov rcx, rdi
mov rdx, rax
call fcn.1800708d4
mov edx, dword [r15]
test edx, edx
je 0x18028fd5a
xor eax, eax
mov rcx, qword [rsi + 0x228]
mov cl, byte [rcx + rax]
xor cl, 0x36
mov byte [r14 + rax], cl
inc rax
mov ecx, dword [r15]
cmp rax, rcx
jb 0x18028fd3e
mov rcx, rsi
lea rax, [0x180611330]
call qword [r13 + rax + 0x58]
mov ebx, eax
test eax, eax
jne 0x18028fd8e
mov r8d, dword [r15]
mov rcx, rsi
mov rdx, r14
lea rax, [0x180611330]
call qword [r13 + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x18028fd8e
xor ebx, ebx
jmp 0x18028fd9a
mov rcx, qword [rsi + 0x228]
call fcn.1802fbeb6
mov rcx, r14
call fcn.1802fbeb6
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18029e7b4
Capabilities:
Print debug messages
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
call sub.KERNEL32.dll_OutputDebugStringA
lea rcx, [0x180595798]
call fcn.1802a00fc
test rax, rax
je 0x18029e88e
mov rdi, rax
lea rdx, str.RegisterEventSourceA
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rbx, rax
lea rdx, str.ReportEventA
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov r15, rax
lea rdx, str.DeregisterEventSource
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rbx, rbx
je 0x18029e886
test r15, r15
je 0x18029e886
mov r14, rax
test rax, rax
je 0x18029e886
lea rax, [0x1805957dd]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
lea rdx, str.hasplms
xor ecx, ecx
call rbx
test rax, rax
je 0x18029e886
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0xc0070003
call r15
mov rcx, rbx
call r14
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
lea rcx, [0x1805957f3]
call fcn.1802a00fc
test rax, rax
je 0x18029e8d2
mov rdi, rax
lea rdx, [0x1805957fe]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x18029e8ca
lea r8, str.Sentinel_HASP
xor ecx, ecx
mov rdx, rsi
mov r9d, 0x10
call rax
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TerminateProcess
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1802a00fc
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rsi, rcx
lea rcx, [0x18060fdf0]
lea rdx, str.SetDefaultDllDirectories
call fcn.18029feca
test eax, eax
jne 0x1802a018b
lea rcx, [rsp + 0x20]
mov edx, 0x104
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
jne 0x1802a0136
xor eax, eax
jmp 0x1802a0180
mov edi, eax
mov rcx, rsi
call fcn.180236c54
lea ecx, [rdi + 1]
add rcx, rax
add rcx, 1
cmp rcx, 0x104
ja 0x1802a0132
inc rax
mov ecx, edi
add rcx, rsp
add rcx, 0x21
mov byte [rcx - 1], 0x5c
mov rdx, rsi
mov r8, rax
call fcn.18017fd34
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call 0x18040f651
nop
add rsp, 0x128
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
mov r8d, 0x800
add rsp, 0x128
pop rdi
pop rsi
jmp 0x18040f651
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
Function at 0x1802d67c4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov ecx, dword [rcx]
call fcn.1801bffc4
test eax, eax
jne 0x1802d68ef
movsxd rcx, dword [rbx + 4]
mov eax, 0x16
cmp rcx, 0x80
ja 0x1802d68ef
mov edx, dword [rbx + 8]
cmp edx, 0x80
jg 0x1802d68ef
cmp ecx, edx
jg 0x1802d68ef
cmp ecx, edx
jne 0x1802d6820
xor edi, edi
jmp 0x1802d6850
lea eax, [rcx + 1]
mov dword [rbx + 4], eax
mov byte [rbx + rcx + 0xc], 0x80
mov edx, dword [rbx + 4]
mov ecx, dword [rbx + 8]
mov edi, 1
jmp 0x1802d684c
lea ecx, [rdx + 1]
mov dword [rbx + 4], ecx
movsxd rcx, edx
mov byte [rbx + rcx + 0xc], 0
mov edx, dword [rbx + 4]
mov ecx, dword [rbx + 8]
cmp edx, ecx
jl 0x1802d6838
test ecx, ecx
je 0x1802d6879
mov ecx, ecx
xor edx, edx
shl rdi, 7
add rdi, rbx
mov al, byte [rdx + rdi + 0x10c]
xor al, byte [rbx + rdx + 0x8c]
xor byte [rbx + rdx + 0xc], al
inc rdx
cmp rdx, rcx
jb 0x1802d685f
movsxd rax, dword [rbx]
lea rdi, [rax + rax*4]
shl rdi, 5
lea r15, [0x18060fed0]
lea r14, [rbx + 0x210]
lea rcx, [rbx + 0xc]
mov rdx, rcx
mov r8, r14
call qword [rdi + r15 + 0x28]
test eax, eax
jne 0x1802d68ef
movsxd rax, dword [rbx]
lea rax, [rax + rax*4]
shl rax, 5
mov rcx, r14
call qword [rax + r15 + 0x38]
xor eax, eax
cmp dword [rbx + 8], 0
mov esi, 0
je 0x1802d68eb
xor edx, edx
xor esi, esi
mov edi, dword [r13]
cmp rdx, rdi
jae 0x1802d68e9
mov cl, byte [rbx + rdx + 0xc]
mov byte [r12 + rdx], cl
inc rdx
inc esi
mov ecx, dword [rbx + 8]
cmp rdx, rcx
jb 0x1802d68c9
jmp 0x1802d68eb
mov esi, edx
mov dword [r13], esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18030a7c4
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov r10, rdx
lea rax, [rdx + 2]
movabs rsi, 0xaaaaaaaaaaaaaaab
mul rsi
movabs rax, 0x7ffffffffffffffe
and rax, rdx
lea rdx, [rax + rax]
add rdx, 1
mov eax, 0x54
cmp qword [r9], rdx
jb 0x18030a8e7
mov rax, r10
mul rsi
shr rdx, 1
lea r11, [rdx + rdx*2]
xor eax, eax
test r11, r11
jne 0x18030a817
mov rdx, r8
jmp 0x18030a87f
lea rsi, [0x18054aee0]
mov rdx, r8
movzx edi, byte [rcx]
shr rdi, 2
mov bl, byte [rdi + rsi]
mov byte [rdx], bl
movzx edi, byte [rcx]
shl rdi, 4
movzx ebx, byte [rcx + 1]
shr rbx, 4
and edi, 0x30
or rdi, rbx
mov bl, byte [rsi + rdi]
mov byte [rdx + 1], bl
movzx edi, byte [rcx + 1]
movzx ebx, byte [rcx + 2]
shr rbx, 6
and edi, 0xf
lea rdi, [rbx + rdi*4]
mov bl, byte [rsi + rdi]
mov byte [rdx + 2], bl
movzx edi, byte [rcx + 2]
and edi, 0x3f
mov bl, byte [rdi + rsi]
mov byte [rdx + 3], bl
add rdx, 4
add rcx, 3
add rax, 3
cmp rax, r11
jb 0x18030a821
cmp rax, r10
jae 0x18030a8df
movzx esi, byte [rcx]
inc rax
xor r11d, r11d
cmp rax, r10
jae 0x18030a897
movzx r11d, byte [rcx + 1]
mov rdi, rsi
shr rdi, 2
shl rsi, 4
mov ecx, r11d
shr rcx, 4
and esi, 0x30
or rsi, rcx
lea rcx, [0x18054aee0]
mov bl, byte [rdi + rcx]
mov byte [rdx], bl
mov bl, byte [rcx + rsi]
mov byte [rdx + 1], bl
mov bl, 0x3d
cmp rax, r10
jae 0x18030a8d4
shl r11d, 2
and r11d, 0x3c
mov bl, byte [r11 + rcx]
mov byte [rdx + 2], bl
mov byte [rdx + 3], 0x3d
add rdx, 4
mov byte [rdx], 0
sub edx, r8d
xor eax, eax
mov qword [r9], rdx
pop rbx
pop rdi
pop rsi
ret
Function at 0x18032ed04
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0x20
test rcx, rcx
jne 0x1801473f5
mov eax, 0xe
jmp 0x180147421
mov rsi, rcx
mov ecx, 0xc
call fcn.1802fb6e2
test rax, rax
jne 0x18014740e
mov eax, 0xc
jmp 0x180147421
mov qword [rax], 0
mov dword [rax + 8], 0
mov qword [rsi], rax
xor eax, eax
add rsp, 0x20
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.18010df5b
cmp eax, 1
je 0x180270acf
test eax, eax
jne 0x180270ae0
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x18032ed04
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1801473e4
mov eax, 0xe1
add rsp, 0x28
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x18032ed1a
mov eax, 0xe
jmp 0x18032ee0a
mov rsi, rcx
mov ecx, 0x68
call fcn.1802fb6e2
test rax, rax
jne 0x18032ed36
mov eax, 0xc
jmp 0x18032ee0a
mov rdi, rax
mov dword [rax], 0
lea rcx, [0x1805a1a8c]
call sub.KERNEL32.dll_GetModuleHandleA
cmp rax, 0xffffffffffffffff
je 0x18032edec
mov rbx, rax
lea rdx, str.AcquireSRWLockShared
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x40], rax
lea rdx, str.ReleaseSRWLockShared
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x48], rax
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x50], rax
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x58], rax
lea rdx, str.InitializeSRWLock
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x60], rax
cmp qword [rdi + 0x40], 0
je 0x18032edec
cmp qword [rdi + 0x48], 0
je 0x18032edec
cmp qword [rdi + 0x50], 0
je 0x18032edec
test rax, rax
je 0x18032edec
mov rax, qword [rdi + 0x58]
test rax, rax
je 0x18032edec
mov dword [rdi], 1
mov rcx, rdi
add rcx, 0x30
call qword [rdi + 0x60]
jmp 0x18032edfd
cmp dword [rdi], 0
jne 0x18032ede0
mov rcx, rdi
add rcx, 8
call sub.KERNEL32.dll_InitializeCriticalSection
mov qword [rdi + 0x38], 0
mov qword [rsi], rdi
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18037de64
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov r13d, r8d
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [r9]
call fcn.1801bffc4
mov ecx, eax
test eax, eax
jne 0x18037df5c
mov ebp, dword [rsi + 4]
lea eax, [rbp - 1]
mov ecx, 0x16
cmp eax, 0x7f
ja 0x18037df5c
mov eax, r13d
xor edx, edx
div ebp
and ebp, 7
or ebp, edx
jne 0x18037df5c
movsxd rcx, dword [rsi]
lea r9, [rcx + rcx*4]
shl r9, 5
lea r12, [0x18060fed0]
mov rbp, qword [r9 + r12 + 0x60]
test rbp, rbp
jne 0x18037df6f
test r13d, r13d
jne 0x18037dee1
xor ecx, ecx
jmp 0x18037df5c
lea r14, [rsi + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, r14
call qword [r9 + r12 + 0x30]
mov ecx, eax
test eax, eax
jne 0x18037df5c
lea r15, [rsp + 0x30]
mov ecx, dword [rsi + 4]
xor eax, eax
test ecx, ecx
jle 0x18037df2f
cdqe
mov rcx, qword [rsp + rax + 0x30]
xor rcx, qword [rsi + rax + 8]
mov rdx, qword [rbx + rax]
mov qword [rsi + rax + 8], rdx
mov qword [rdi + rax], rcx
add eax, 8
mov ecx, dword [rsi + 4]
cmp eax, ecx
jl 0x18037df0c
sub r13d, ecx
je 0x18037dedd
movsxd rax, ecx
add rdi, rax
add rbx, rax
movsxd rax, dword [rsi]
lea rbp, [rax + rax*4]
shl rbp, 5
mov rcx, rbx
mov rdx, r15
mov r8, r14
call qword [rbp + r12 + 0x30]
mov ecx, eax
test eax, eax
je 0x18037df03
mov eax, ecx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsi + 0x88]
add rsi, 8
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
mov r9, rsi
call rbp
jmp 0x18037df5e

Function at 0x18037ef54
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x30
movsxd rcx, ecx
lea rsi, [rsp + 0x2c]
mov dword [rsi], 0xffffffff
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_ReadFile
mov edx, dword [rsi]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, rdx
mov rax, rcx
add rsp, 0x30
pop rsi
ret

Function at 0x18038f234
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
movsxd rcx, ecx
lea rsi, [rsp + 0x2c]
mov dword [rsi], 0xffffffff
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
mov edx, dword [rsi]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, rdx
mov rax, rcx
add rsp, 0x30
pop rsi
ret