joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180034834
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
mov eax, 0x1038
call fcn.18006de30
sub rsp, rax
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r8, rcx
lea r9, [rsp + 0x1048]
lea rcx, [rsp + 0x20]
mov edx, 0x800
call qword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.180059930
add rsp, 0x1038
ret

Function at 0x180034acc
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rsp + 0x30], 0
mov rsi, rdx
mov rbx, rcx
xor eax, eax
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov rdi, r8
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, 0x1000
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x30], r13
jb 0x180034c73
and dword [rsp + 0x88], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x4c], 0
mov r12d, 1
lea r8, [rsp + 0x4c]
xor edx, edx
mov rcx, rsi
mov r9d, r12d
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, r13d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180034c50
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x180034b92
mov eax, dword [rbx + 8]
mov dword [rdi], eax
movabs rax, 0x706c646f70bfbbef
cmp qword [rbx], rax
jne 0x180034c50
cmp dword [rbx + 8], 2
je 0x180034bb5
cmp dword [rbx + 8], 3
jne 0x180034c50
mov ecx, dword [rbx + 0x18c]
mov edx, 0x190
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rdx + rbx], al
add rdx, r12
cmp rdx, r13
jl 0x180034bc0
cmp byte [rbx + 0x4a3], 0
jne 0x180034c27
cmp dword [rbx + 0x1a0], 0x40
ja 0x180034c27
mov eax, 0x270f
cmp word [rbx + 0x190], ax
ja 0x180034c27
movzx eax, word [rbx + 0x192]
cmp ax, r12w
jb 0x180034c27
cmp ax, 0xc
ja 0x180034c27
movzx eax, word [rbx + 0x196]
cmp ax, r12w
jb 0x180034c27
cmp ax, 0x1f
ja 0x180034c27
mov ebx, r12d
jmp 0x180034c29
xor ebx, ebx
cmp dword [rsp + 0x40], 0
jne 0x180034c4c
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
jmp 0x180034c75
cmp dword [rsp + 0x40], 0
jne 0x180034c73
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x180039100
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x380
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x370], rax
xor edi, edi
lea rcx, str..gxdte_cd
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x180039282
lea rcx, [rsp + 0x162]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x160], di
call fcn.180059f80
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x118
mov dword [rsp + 0x40], 0x11c
call fcn.180059f80
lea rcx, [rsp + 0x40]
call fcn.180002cc4
cmp eax, edi
je 0x1800391a8
cmp dword [rsp + 0x44], 6
lea rbx, str.gxdte64_win7.sys
je 0x1800391af
lea rbx, str.gxdte64.sys
lea r8, [rsp + 0x160]
mov r9d, 0x104
mov rdx, rbx
xor ecx, ecx
call fcn.180002a40
lea rcx, [rsp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x180039208
cmp word [0x1800a7540], di
je 0x180039208
lea rdx, [0x1800a7540]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x160]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, str.gxdte
mov rcx, rbx
call fcn.180005d44
lea r9, str.gxdte_driver
lea r8, str.gxdte64.sys
cmp eax, edi
mov eax, 1
lea rdx, [rsp + 0x160]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x22343
call fcn.18003f214
mov rcx, rbx
call fcn.180005c9c
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, str..gxdte_cd
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0x390]
add rsp, 0x380
pop rdi
ret

Function at 0x180039d2c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
movabs rax, 0x6666666666666667
sub rcx, qword [rbx + 0x18]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180039d90
lea r8, str.shlSelFiles
lea rdx, str.softwareprojonepodlp_smpcache
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x180039e0d
xor edi, edi
lea rdx, [0x180083b30]
lea rcx, [rsp + 0x30]
lea r8d, [rdi + 1]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
call fcn.1800076b4
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1800012c0
cmp qword [rsp + 0x78], 8
lea r9, [rsp + 0x60]
cmovae r9, qword [rsp + 0x60]
lea r8, str.shlSelFiles
lea rdx, str.softwareprojonepodlp_smpcache
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
call fcn.1800056d0
cmp qword [rsp + 0x78], 8
jb 0x180039e0d
mov rcx, qword [rsp + 0x60]
call fcn.1800018ec
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x180039e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r11d, 0xffffffff
mov r9d, edx
mov r10, rcx
mov eax, r11d
test edx, edx
je 0x180039e68
movzx r8d, byte [r10]
mov edx, eax
mov ecx, eax
xor r8, rdx
shr ecx, 8
inc r10
movzx edx, r8b
lea r8, [0x1800a3070]
mov eax, dword [r8 + rdx*4]
xor eax, ecx
add r9d, r11d
jne 0x180039e41
not eax
ret

Function at 0x180039e6c
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0xa0], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x44], 0
and dword [rsp + 0x40], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
call fcn.18003fc6c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.18003fd20
and qword [rbx + 0x18], 0
mov qword [rbx + 0x20], sendto
lea rdx, [rsp + 0x90]
mov r8d, sendto
mov rcx, rbx
mov byte [rbx + 8], 0
call fcn.180007324
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180059930
add rsp, 0xb0
pop rbx
ret

Function at 0x18003a140
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rdi, rdx
xor edx, edx
mov esi, r8d
mov rbx, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x30], 0
call fcn.180059f80
mov r11d, dword [str.podlp]
mov al, byte [0x180083924]
xor edx, edx
mov dword [rsp + 0x30], r11d
mov byte [rsp + 0x34], al
lea r9d, [rdx + 0x40]
mov r8, r9
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x11f], cl
mov byte [rsp + rdx + 0x8f], al
jne 0x18003a19f
and dword [rsp + 0x48], r8d
and dword [rsp + 0x44], r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
mov r8d, r9d
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.180041070
lea rcx, [rsp + 0x30]
mov r8d, esi
mov rdx, rdi
call fcn.180041070
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.18004112c
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x90], 0x67452301
mov dword [rsp + 0x94], 0xefcdab89
mov dword [rsp + 0x98], 0x98badcfe
mov dword [rsp + 0x9c], 0x10325476
mov dword [rsp + 0xa0], 0xc3d2e1f0
mov dword [rsp + 0xa8], esi
mov dword [rsp + 0xa4], esi
call fcn.180041070
lea edi, [rsi + 0x14]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x90]
mov r8d, edi
call fcn.180041070
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xf0]
call fcn.18004112c
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], rsi
lea rdx, [rsp + 0xf0]
mov r8, rdi
mov rcx, rbx
mov byte [rbx + 8], sil
call fcn.180007324
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180059930
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x18003a2fc
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x180
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x170], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov rbx, r9
mov byte [rsp + 0x30], 0
call fcn.180059f80
mov r8d, dword [rsp + 0x1d0]
mov r13d, 0x40
mov rdx, rbx
cmp r8d, r13d
jbe 0x18003a3f1
and dword [rsp + 0xc0], 0
and dword [rsp + 0x104], 0
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x7380166f
mov dword [rsp + 0xa4], 0x4914b2b9
mov dword [rsp + 0xa8], 0x172442d7
mov dword [rsp + 0xac], 0xda8a0600
mov dword [rsp + 0xb0], 0xa96f30bc
mov dword [rsp + 0xb4], 0x163138aa
mov dword [rsp + 0xb8], 0xe38dee4d
mov dword [rsp + 0xbc], 0xb0fb0e4e
call fcn.180041248
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x110]
call fcn.180041308
lea rdx, [rsp + 0x110]
mov r8, r13
lea rcx, [rsp + 0x30]
call fcn.1800599f0
xor edx, edx
mov r8, r13
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x9f], cl
mov byte [rsp + rdx + 0x10f], al
jne 0x18003a400
and dword [rsp + 0x50], r8d
and dword [rsp + 0x94], r8d
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov ebx, 0x172442d7
mov r8d, r13d
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.180041248
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.180041248
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.180041308
and dword [rsp + 0x50], 0
and dword [rsp + 0x94], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
mov r8d, r13d
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.180041248
mov ebx, 0x20
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.180041248
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.180041308
and qword [rdi + 0x18], 0
mov qword [rdi + 0x20], sendto
lea rdx, [rsp + 0x150]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], 0
call fcn.180007324
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180059930
add rsp, 0x180
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18003bbd0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x18003bc56
cmp rax, 0xffffffffffffffff
je 0x18003bc6a
and dword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003bc56
cmp dword [rsp + 0x58], 4
jne 0x18003bc56
cmp dword [rsp + 0x60], 0x21726152
jne 0x18003bc56
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18003bc6c
cmp rbx, 0xffffffffffffffff
je 0x18003bc6a
test rbx, rbx
je 0x18003bc6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x18003bc74
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x80e0
call fcn.18006de30
sub rsp, rax
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x80d0], rax
mov rsi, rcx
lea rcx, str.unrar64.dll
mov ebp, r9d
mov rdi, r8
call fcn.18003ba74
mov rbx, rax
test rax, rax
jne 0x18003bcc2
mov eax, 0x453
jmp 0x18003bdc2
lea rdx, str.RAROpenArchiveEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARCloseArchive
mov rcx, rbx
mov qword [0x1800a7750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARReadHeaderEx
mov rcx, rbx
mov qword [0x1800a7758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARProcessFileW
mov rcx, rbx
mov qword [0x1800a7760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARSetPassword
mov rcx, rbx
mov qword [0x1800a7768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [0x1800a7750]
mov qword [0x1800a7770], rax
test rbx, rbx
je 0x18003bdbd
cmp qword [0x1800a7758], 0
je 0x18003bdbd
cmp qword [0x1800a7760], 0
je 0x18003bdbd
cmp qword [0x1800a7768], 0
je 0x18003bdbd
test rax, rax
je 0x18003bdbd
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0xa8
call fcn.180059f80
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x64], rax
call rbx
mov r11, rax
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x18003bdc2
mov qword [rdi], r11
jmp 0x18003bdc2
mov eax, 0x454
mov rcx, qword [rsp + 0x80d0]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0x8108]
add rsp, 0x80e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003c730
Capabilities:
Check if file exists
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rdi, qword [rcx]
mov r12, rcx
mov rbx, qword [rax]
mov ebp, 1
mov rsi, qword [r12 + 0x30]
test rdi, rdi
je 0x18003c76b
cmp rdi, qword [r12]
je 0x18003c770
call fcn.1800590d8
cmp rbx, rsi
je 0x18003c878
test rdi, rdi
jne 0x18003c788
call fcn.1800590d8
xor r11d, r11d
jmp 0x18003c78b
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c796
call fcn.1800590d8
cmp qword [rbx + 0x60], 8
jb 0x18003c7a3
mov rcx, qword [rbx + 0x48]
jmp 0x18003c7a7
lea rcx, [rbx + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18003c820
test rdi, rdi
jne 0x18003c7c0
call fcn.1800590d8
xor r11d, r11d
jmp 0x18003c7c3
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c7ce
call fcn.1800590d8
cmp qword [rbx + 0x38], 8
jb 0x18003c7db
mov rsi, qword [rbx + 0x20]
jmp 0x18003c7df
lea rsi, [rbx + 0x20]
test rdi, rdi
jne 0x18003c7ee
call fcn.1800590d8
xor r11d, r11d
jmp 0x18003c7f1
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c7fc
call fcn.1800590d8
cmp qword [rbx + 0x60], 8
jb 0x18003c809
mov rcx, qword [rbx + 0x48]
jmp 0x18003c80d
lea rcx, [rbx + 0x48]
mov r8d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18003c822
xor ebp, ebp
test rdi, rdi
jne 0x18003c82c
call fcn.1800590d8
cmp byte [rbx + 0x69], 0
je 0x18003c83c
call fcn.1800590d8
jmp 0x18003c75b
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x18003c857
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x18003c846
jmp 0x18003c75b
mov rax, qword [rbx + 8]
jmp 0x18003c86a
cmp rbx, qword [rax + 0x10]
jne 0x18003c870
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x18003c85d
mov rbx, rax
jmp 0x18003c75b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x18003ccfc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18003cd6a
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18003cd36
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18003ce70
mov edi, dword [rbx + 0x18]
lea r14, [0x1800a3590]
jmp 0x18003cdc5
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003cd84
add r11, 4
sub r8, 1
jne 0x18003cd81
mov edx, edi
mov rcx, rbx
call fcn.18003ce70
mov rcx, rbx
call fcn.18003cfb0
mov rcx, rbx
dec edi
call fcn.18003cf28
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18003cd81
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003cde0
add r11, 4
sub r8, 1
jne 0x18003cddd
xor edx, edx
mov rcx, rbx
call fcn.18003ce70
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18003ce54
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18003ce23
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18003ce70
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18003ce8a
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003ce84
repz ret
Function at 0x18003dd2c
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18003df1e
lea rdi, [0x1800825b0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003ddb2
cmp cl, r14b
je 0x18003dd9d
cmp cl, r14b
je 0x18003df1e
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003ddd1
cmp bpl, r14b
je 0x18003ddbb
cmp bpl, r14b
je 0x18003df1e
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180007118
jmp 0x18003de03
lea rdi, [0x1800825b0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18003dee2
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18003de24
cmp dil, r14b
je 0x18003ddfc
cmp dil, r14b
je 0x18003df1e
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180007118
lea rdx, [0x1800825b0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18003dea6
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18003de74
cmp cl, r14b
je 0x18003de58
cmp cl, r14b
je 0x18003df1e
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180007118
cmp rsi, r13
lea rdi, [0x1800825b0]
jb 0x18003dd9d
jmp 0x18003df1e
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007214
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003dedd
mov rcx, qword [rsp + 0x38]
call fcn.1800018ec
mov rax, rbx
jmp 0x18003df58
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007214
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003df19
mov rcx, qword [rsp + 0x38]
call fcn.1800018ec
mov rax, rbx
jmp 0x18003df58
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007214
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003df55
mov rcx, qword [rsp + 0x38]
call fcn.1800018ec
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003dfe4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
xor r11d, r11d
mov rdi, rcx
mov dword [rsp], 0x2ac3268c
mov dword [rsp + 4], 0x33747d9a
mov dword [rsp + 8], 0xd1de98ac
mov dword [rsp + 0xc], 0x6eee320c
lea ebx, [r11 + 0x20]
lea rsi, [0x180000000]
mov r9d, dword [r11 + rsi + 0x824e0]
xor r9d, dword [rsp + r11 + 4]
xor r9d, dword [rsp + r11 + 0xc]
xor r9d, dword [rsp + r11 + 8]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + rsi + 0x823d0]
movzx eax, cl
movzx ecx, byte [rax + rsi + 0x823d0]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + rsi + 0x823d0]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + rsi + 0x823d0]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [rsp + r11]
xor ecx, r10d
mov dword [rsp + r11 + 0x10], ecx
mov dword [r11 + rdi], ecx
add r11, 4
sub rbx, 1
jne 0x18003e026
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret