joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003b2f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x18028c2e8]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor esi, esi
mov dword [rbp - 0x10], 0xc9dfd0cc
mov eax, esi
mov dword [rbp - 0xc], 0x89cde28c
mov dword [rbp - 8], 0xafa6eff4
mov word [rbp - 4], 0xa8
nop
movsxd rcx, eax
lea rdx, [rbp - 0x10]
add rdx, rcx
lea ecx, [rax - 0x48]
inc eax
xor byte [rdx], cl
cmp eax, 0xd
jb 0x18003b340
lea rcx, [rbp - 0x10]
mov byte [rbp - 3], sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x208
mov rbx, rax
call fcn.18003fa60
mov r8d, 0x104
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rbp]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18003b4f0
xorps xmm0, xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rsp + 0x60], xmm0
lea rax, [rbp]
mov dword [rbp - 0x10], 0xaac56b
mov qword [rbp - 0x58], rax
lea r8, [rsp + 0x40]
lea rax, [rbp - 0x60]
mov dword [rbp - 0xc], 0x11d0cd44
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x40]
mov dword [rbp - 8], 0xc000c28c
movups xmmword [rsp + 0x40], xmm0
xor ecx, ecx
mov qword [rbp - 0x70], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rbp - 4], 0xee95c24f
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x60], 0x20
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x48], rsi
movdqu xmmword [rbp - 0x34], xmm0
mov dword [rbp - 0x24], esi
movups xmmword [rbp - 0x20], xmm0
mov dword [rsp + 0x40], 0x58
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x58], 2
mov dword [rsp + 0x60], 1
mov qword [rbp - 0x40], 0x20
mov dword [rbp - 0x38], 3
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
jne 0x18003b4cf
mov rax, qword [rbp - 0x70]
mov ebx, 1
cmp dword [rax + 0xc], ebx
jb 0x18003b4cf
nop dword [rax]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x70], 2
lea rdx, [rbp - 0x10]
xor ecx, ecx
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
jne 0x18003b4e7
mov rax, qword [rbp - 0x70]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x78], rsi
lea rdx, [rbp - 0x10]
mov dword [rsp + 0x70], 1
xor ecx, ecx
mov dword [rax + 4], ebx
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
jne 0x18003b4cf
mov rax, qword [rbp - 0x70]
inc ebx
cmp ebx, dword [rax + 0xc]
jbe 0x18003b480
lea r8, [rsp + 0x40]
mov dword [rsp + 0x70], 2
lea rdx, [rbp - 0x10]
xor ecx, ecx
call sub.WINTRUST.dll_WinVerifyTrust
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.18003d080
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180049c80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18003d0e0
sub rsp, rax
mov rax, qword [0x18028c2e8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180055450
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180049ccf
mov rax, rbp
jmp 0x180049dd7
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x293370]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180059478
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x293370]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180049dd3
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180049dd3
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180059478
test rax, rax
js 0x180049dd3
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180049dd3
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180049dc5
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180049dc5
cmp byte [rcx], 0xd
jne 0x180049dab
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180049dba
cmp byte [rcx + 1], 0xa
jne 0x180049dba
inc rcx
jmp 0x180049dba
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x28c650]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180049d8d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180049dd7
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18003d080
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180058688
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x180293370]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1800586e6
cmp word [rdx], r12w
jne 0x1800586e6
or byte [rax + r8*8 + 0x38], cl
jmp 0x1800586ec
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x180058847
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x180058822
lea r9, [rcx + 2]
cmp ax, r13w
je 0x180058725
mov rcx, r9
jmp 0x180058748
cmp r9, rdx
jae 0x18005875f
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x180058709
jmp 0x180058847
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005881c
cmp dword [rsp + 0x80], edi
je 0x18005881c
mov rdx, r14
lea r11, [0x180293370]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1800587f5
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1800587c8
mov word [rbx], r12w
jmp 0x180058843
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1800587d1
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x180058843
cmp word [rsp + 0x70], r12w
jne 0x180058802
cmp rbx, rsi
je 0x1800587c2
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.180059480
cmp word [rsp + 0x70], r12w
je 0x180058847
mov word [rbx], r13w
jmp 0x180058843
lea r11, [0x180293370]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18005883f
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x180058847
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18005909c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1800590ce
call fcn.1800539f8
mov dword [rax], 0x16
call fcn.180043cf8
jmp 0x1800591ed
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800591ed
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1800591ed
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1800590fd
lock or dword [rcx + 0x14], 0x10
jmp 0x1800591ed
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x180059111
call fcn.18005eecc
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.180055450
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.180058b34
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1800591db
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1800591a6
mov rcx, rsi
call fcn.180055450
cmp eax, edi
je 0x180059191
mov rcx, rsi
call fcn.180055450
cmp eax, 0xfffffffe
je 0x180059191
mov rcx, rsi
call fcn.180055450
movsxd rbx, eax
lea r14, [0x180293370]
mov rcx, rsi
sar rbx, 6
call fcn.180055450
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x180059198
lea rdx, [0x18028c5f0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800591a6
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1800591ca
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1800591ca
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1800591ca
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1800591f0
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x18005b360
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18005b390
xor eax, eax
jmp 0x18005b453
mov rbp, rbx
cmp word [rax], si
je 0x18005b3b5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18005b39c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18005b398
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18005b2b0
movsxd r14, eax
test eax, eax
jne 0x18005b3f3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18005b389
mov rcx, r14
call fcn.180053ee4
mov rdi, rax
test rax, rax
jne 0x18005b40c
xor ecx, ecx
call fcn.180053ea8
jmp 0x18005b3e8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18005b2b0
test eax, eax
jne 0x18005b43d
mov rcx, rdi
call fcn.180053ea8
jmp 0x18005b447
xor ecx, ecx
call fcn.180053ea8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18006052c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180059480
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180059480
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18006067c
cmp rax, 0xffffffffffffffff
je 0x18006067c
xor edi, edi
test rbp, rbp
jle 0x180060627
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800569e8
mov rbx, rax
test rax, rax
jne 0x1800605b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18006061d
mov edx, 0x8000
mov ecx, r14d
call fcn.1800603b4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180058378
cmp eax, 0xffffffff
je 0x1800605fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800605c4
mov edx, r15d
mov ecx, r14d
call fcn.1800603b4
jmp 0x18006061d
cmp byte [rsi + 0x38], dil
je 0x180060614
cmp dword [rsi + 0x34], 5
jne 0x180060614
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18006061d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180053ea8
jmp 0x180060690
jns 0x180060690
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180059480
cmp rax, 0xffffffffffffffff
jne 0x180060648
cmp byte [rsi + 0x30], dil
je 0x180060690
mov edi, dword [rsi + 0x2c]
jmp 0x180060690
mov ecx, r14d
call fcn.18005dd5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180060690
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180060690
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180060689
mov eax, dword [rsi + 0x2c]
jmp 0x18006068e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180059480
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x100001c9c
Capabilities:
List domain servers

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
cmp word [0x100007a80], bx
je 0x100001d10
lea r8, [rsp + 0x70]
lea edx, [rbx + 0x65]
lea rcx, [0x100007a80]
call sub.NETAPI32.dll_NetServerGetInfo
cmp eax, ebx
jne 0x100001db9
mov rcx, qword [rsp + 0x70]
bt dword [rcx + 0x18], 0x19
jae 0x100001daf
lea rcx, [0x100007a80]
cmp word [0x100006974], bx
je 0x100001cfa
call fcn.100001dc8
jmp 0x100001d06
lea rdx, [0x1000013c8]
call fcn.100001f54
mov rcx, qword [rsp + 0x70]
jmp 0x100001daf
movzx eax, word [0x100007ae0]
mov qword [rsp + 0x40], rbx
lea rdx, [0x100007ae0]
neg ax
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x78]
sbb rcx, rcx
or r9d, 0xffffffff
and rcx, rdx
mov edx, 0x65
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x2000000
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.NETAPI32.dll_NetServerEnum
cmp eax, ebx
jne 0x100001db9
jmp 0x100001d9c
dec eax
mov dword [rsp + 0x60], eax
lea rcx, [rax + rax*4]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + rcx*8 + 8]
cmp word [0x100006974], bx
je 0x100001d8c
call fcn.100001dc8
jmp 0x100001d9c
lea rdx, [0x1000013c8]
call fcn.100001f54
cmp eax, ebx
jne 0x100001daa
mov eax, dword [rsp + 0x60]
cmp eax, ebx
jne 0x100001d68
dec eax
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x78]
cmp rcx, rbx
je 0x100001db9
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x100003830
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x790
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x780], rax
mov r12, qword [0x100006990]
mov rbp, r8
mov esi, 0x104
mov r8, qword [r12 + 8]
lea rcx, [r11 - 0x548]
mov rdx, rsi
call fcn.1000041f2
mov rdi, qword [r12 + 8]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, [0x100001778]
repne scasw ax, word [rdi]
mov eax, esi
not rcx
dec rcx
sub eax, ecx
lea r13, [rsp + rcx*2 + 0x270]
movsxd r14, eax
mov rdx, r14
mov rcx, r13
call fcn.1000041f2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1000038e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x100003a77
xor r15d, r15d
lea rsi, [rsp + 0x4c]
lea rdi, [0x100001780]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x100003a41
lea rsi, [rsp + 0x4c]
lea rdi, [0x100001784]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x100003a41
lea rcx, [rsp + 0x4c]
call qword [sym.imp.msvcrt.dll__wcslwr]
mov rdx, r14
mov rcx, r13
mov r8, rax
call fcn.1000041f2
mov r8, qword [r12 + 0x18]
cmp r8, r15
je 0x100003953
lea rcx, [rsp + 0x270]
mov edx, 0x104
call fcn.1000041fe
mov rcx, qword [r12 + 0x10]
lea rdx, [rsp + 0x4c]
mov r8d, 0x104
call fcn.100003c3c
cmp eax, r15d
je 0x100003a41
cmp qword [r12 + 0x18], r15
je 0x100003a01
lea r9, [rsp + 0x680]
lea r8, [rsp + 0x580]
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x270]
call fcn.100003ab0
cmp eax, r15d
je 0x100003a01
test byte [rsp + 0x20], 0x10
je 0x100003a41
lea rcx, [rsp + 0x480]
call fcn.100003b84
cmp eax, r15d
je 0x100003a41
mov ecx, 0x28
call qword [sym.imp.msvcrt.dll_malloc]
cmp rax, r15
jne 0x1000039df
mov ecx, 0x3f4
call fcn.10000216c
jmp 0x100003a41
lea r8, [rsp + 0x680]
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x480]
mov r9, rax
call fcn.100003630
jmp 0x100003a41
lea rcx, [rsp + 0x270]
call fcn.100003b84
cmp eax, r15d
je 0x100003a41
mov eax, dword [rbp + 0x18]
cmp dword [rbp], eax
jge 0x100003a2f
lea rcx, [rsp + 0x270]
mov rdx, rbp
call fcn.100003734
mov edi, eax
jmp 0x100003a3c
mov ecx, 0x3f8
call fcn.10000216c
or edi, 0xffffffff
cmp edi, r15d
jne 0x100003a5a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
cmp eax, r15d
jne 0x1000038ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, r15d
jne 0x100003a75
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
cmove edi, r15d
mov eax, edi
mov rcx, qword [rsp + 0x780]
xor rcx, rsp
call fcn.1000041c0
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100003b84
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
mov r8, rcx
cmp rcx, rbx
je 0x100003c13
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
mov edx, 0x104
not rcx
dec rcx
cmp rcx, rdx
ja 0x100003c13
lea rcx, [rsp + 0x20]
call fcn.1000041f2
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea rax, [rsp + rcx*2 + 0x1e]
sub rax, 2
cmp word [rax], 0x5c
je 0x100003bf9
cmp word [rax], 0x2f
jne 0x100003bfe
mov word [rax], bx
jmp 0x100003be9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
jmp 0x100003c15
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000041c0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x180002310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
add r8d, 0xfffffffd
mov rbx, rdx
cmp r8d, 0x1c
ja case.0x180002347.11
lea rdx, [0x180000000]
movsxd rax, r8d
mov ecx, dword [rdx + rax*4 + 0x2554]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x10], 0x7a634c75
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4120
mov byte [rbp + 0x16], 0
jmp 0x18000253d
mov dword [rbp + 0x10], 0x7a634c1b
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4220
mov byte [rbp + 0x16], 0
jmp 0x18000253d
mov dword [rbp + 0x10], 0x6d724149
lea rdx, [rbp + 0x11]
mov dword [rbp + 0x14], 0x79726f
jmp 0x18000253d
mov dword [rbp - 0x18], 0x3630314e
mov dword [rbp - 0x14], 0x6f6f5220
mov word [rbp - 0x10], 0x6d
jmp 0x180002539
mov dword [rbp - 0x18], 0x3431391a
mov dword [rbp - 0x14], 0x6f6f5220
mov word [rbp - 0x10], 0x6d
jmp 0x180002539
movdqa xmm0, xmmword [0x180051d60]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 8], 0
jmp 0x180002539
mov dword [rbp - 0x18], 0x696f5476
mov dword [rbp - 0x14], 0x7374656c
jmp 0x180002535
mov dword [rbp + 0x10], 0x7a634c3a
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4120
mov byte [rbp + 0x16], 0
jmp 0x18000253d
mov dword [rbp + 0x10], 0x7a634c01
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4220
mov byte [rbp + 0x16], 0
jmp 0x18000253d
mov dword [rbp - 0x18], 0x706c411f
mov dword [rbp - 0x14], 0x57206168
mov dword [rbp - 0x10], 0x65687261
mov word [rbp - 0xc], 0x6461
mov byte [rbp - 0xa], 0
jmp 0x180002539
mov dword [rbp + 0x10], 0x3937304f
lea rdx, [rbp + 0x11]
mov byte [rbp + 0x14], 0
jmp 0x18000253d
mov dword [rbp - 0x18], 0x63694d77
mov dword [rbp - 0x14], 0x48206f72
mov word [rbp - 0x10], 0x4449
mov byte [rbp - 0xe], 0
jmp 0x180002539
mov dword [rbp - 0x18], 0x7a634c50
mov dword [rbp - 0x14], 0x6d724120
mov dword [rbp - 0x10], 0x79726f
jmp 0x180002539
mov dword [rbp + 0x10], 0x73655448
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x616c
mov byte [rbp + 0x16], 0
jmp 0x18000253d
mov dword [rbp + 0x20], 0x545013
lea rdx, [rbp + 0x21]
jmp 0x18000253d
mov dword [rbp - 0x18], 0x616c4775
mov dword [rbp - 0x14], 0x52207373
mov dword [rbp - 0x10], 0x6d6f6f
jmp 0x180002539
mov dword [rbp + 0x10], 0x7461476b
lea rdx, [rbp + 0x11]
mov dword [rbp + 0x14], 0x412065
jmp 0x18000253d
mov dword [rbp + 0x10], 0x74614743
lea rdx, [rbp + 0x11]
mov dword [rbp + 0x14], 0x422065
jmp 0x18000253d
mov dword [rbp - 0x18], 0x746e4956
mov dword [rbp - 0x14], 0x6f637265
mov word [rbp - 0x10], 0x6d
jmp 0x180002539
mov dword [rbp - 0x18], 0x30333307
mov dword [rbp - 0x14], 0x6f6f5220
mov word [rbp - 0x10], 0x6d
jmp 0x180002539
mov dword [rbp - 0x18], 0x6b6e5566
mov dword [rbp - 0x14], 0x6e776f6e
mov byte [rbp - 0x10], 0
lea rdx, [rbp - 0x17]
mov rcx, rbx
call fcn.180002c00
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180005d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x180005e93
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x180005e93
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x180005d99
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180005eb7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180005daf
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x180005daf
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180005dc2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x180005e0d
mov r9d, eax
cmp eax, 0x800
jae 0x180005ddc
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x180005e0d
cmp eax, 0x10000
jae 0x180005df6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x180005e0d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x180005e93
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180005e31
cmp r10d, 3
jae 0x180005e3d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x180005e6e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180005e50
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x180005d4e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x180005ea2