joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800248b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180024af3
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fb40
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180024ad2
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x180024969
mov r8, qword [rdi + 0x10]
mov rdx, rax
xor ecx, ecx
test r15, r15
je 0x180024994
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r15
jb 0x180024980
mov r13, qword [r13 + 0x30]
and r13, rdx
shl r13, 4
add r13, qword [r12]
mov r12, qword [r13]
cmp r12, rbp
jne 0x1800249b9
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x180024ab3
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1800249cf
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x1800249dd
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024a24
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180024a20
mov rax, qword [rbx]
cmp rax, rdi
je 0x180024a17
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x180024aa9
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x180024a84
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024a3f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024a4d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024a24
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180024a20
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x180024aa9
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x180024950
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0608
int3
Function at 0x180024b00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180024d43
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fb40
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180024d22
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x180024bb9
mov r8, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
test r15, r15
je 0x180024be4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r15
jb 0x180024bd0
and rcx, qword [r13 + 0x30]
shl rcx, 4
mov r13, qword [r12]
add r13, rcx
mov r12, qword [r13]
cmp r12, rbp
jne 0x180024c09
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x180024d03
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024c1f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024c2d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024c74
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180024c70
mov rax, qword [rbx]
cmp rax, rdi
je 0x180024c67
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x180024cf9
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x180024cd4
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024c8f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024c9d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024c74
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180024c70
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x180024cf9
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x180024ba0
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0608
int3
Function at 0x180024d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180024f93
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fb40
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180024f72
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x180024e09
mov r8, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
test r15, r15
je 0x180024e34
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r15
jb 0x180024e20
and rcx, qword [r13 + 0x30]
shl rcx, 4
mov r13, qword [r12]
add r13, rcx
mov r12, qword [r13]
cmp r12, rbp
jne 0x180024e59
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x180024f53
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024e6f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024e7d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024ec4
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180024ec0
mov rax, qword [rbx]
cmp rax, rdi
je 0x180024eb7
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x180024f49
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x180024f24
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024edf
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024eed
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024ec4
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180024ec0
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x180024f49
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x180024df0
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0608
int3
Function at 0x180024fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1800251e3
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fb40
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x1800251c2
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x180025059
mov r8, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
test r15, r15
je 0x180025084
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r15
jb 0x180025070
and rcx, qword [r13 + 0x30]
shl rcx, 4
mov r13, qword [r12]
add r13, rcx
mov r12, qword [r13]
cmp r12, rbp
jne 0x1800250a9
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x1800251a3
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1800250bf
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x1800250cd
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180025114
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180025110
mov rax, qword [rbx]
cmp rax, rdi
je 0x180025107
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x180025199
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x180025174
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x18002512f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x18002513d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180025114
mov r8, r15
call fcn.1800f5860
test eax, eax
jne 0x180025110
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x180025199
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x180025040
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0608
int3
Function at 0x180028130
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax], 0
je 0x1800281b9
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
movzx edx, byte [rax]
call fcn.18000f7c0
movzx ebx, al
call fcn.180045de0
lea rcx, [rsp + 0x38]
mov byte [rax + 0x509], bl
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f23a0
add rsp, 0x50
pop rbx
ret
mov rax, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x10]
movzx edx, byte [rax]
call fcn.18000f7c0
movzx ebx, al
call fcn.180045de0
mov byte [rax + 0x509], bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f23a0
add rsp, 0x50
pop rbx
ret

Function at 0x18002e840
Capabilities:
Check if file exists
Create directory
Encode data using base64
Encode data using xor
Get hostname

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x470
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x478], rbx
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rdi
mov rax, qword [0x180189e48]
xor rax, rbp
mov qword [rbp + 0x430], rax
mov r13, rcx
lea rcx, [0x180169b30]
jmp 0x1801a9a10
Function at 0x180032a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp qword [rcx + 0x7a10], 0
mov rbx, rcx
jne 0x180032bcb
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1800f4d70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x14
mov dword [rsp + 0x34], 0xdf00fb
xor r10d, r10d
mov dword [rsp + 0x30], ecx
mov r8d, eax
mov dword [rsp + 0x38], 0xd000f4
mov eax, r10d
mov dword [rsp + 0x3c], 0xd200c6
mov dword [rsp + 0x40], 0xed00f1
mov r9d, 0xae
mov dword [rsp + 0x44], 0xe400f3
mov dword [rsp + 0x48], 0xd800d0
mov dword [rsp + 0x4c], 0xde00c8
mov dword [rsp + 0x50], 0xd800f1
mov dword [rsp + 0x54], 0xe000d3
mov dword [rsp + 0x58], 0xa500e5
mov dword [rsp + 0x5c], 0xc2
nop
mov ecx, eax
lea rdx, [rsp + 0x34]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
mov ecx, dword [rsp + 0x30]
cmp eax, ecx
jb 0x180032b30
mov word [rsp + rcx*2 + 0x34], r10w
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x60]
call sym.dll.dll__swprintf
xor r9d, r9d
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000018
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x7a10], rax
test rax, rax
je 0x180032bf0
xor r9d, r9d
mov qword [rsp + 0x20], 0x1000018
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x79e8], rax
test rax, rax
je 0x180032bf0
xor edx, edx
mov r8d, 0x1000018
mov rcx, rax
call fcn.1800f4d70
mov eax, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800f23a0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rbp
ret
xor eax, eax
jmp 0x180032bd0

Function at 0x180032d90
Capabilities:
Terminate process

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov rax, qword [0x180189e48]
xor rax, rbp
mov qword [rbp], rax
mov r14, rcx
mov r15d, edx
lea rcx, str.WriteExeShareMemory_LoginStata
jmp 0x1801ab67e
Function at 0x180034430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movdqa xmm0, xmmword [0x18016c440]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], inet_ntoa
mov dword [rbp - 0x5c], 0xd5d1c0c2
mov dword [rbp - 0x58], 0x9bd6dade
mov dword [rbp - 0x54], 0xb9d9c2da
xor eax, eax
nop word [rax + rax]
mov ecx, eax
lea rdx, [rbp - 0x5c]
add rdx, rcx
lea ecx, [rax - 0x52]
xor byte [rdx], cl
inc eax
mov edx, dword [rbp - 0x60]
cmp eax, edx
jb 0x1800344a0
mov byte [rbp + rdx - 0x5c], 0
lea rdx, [rbx + 0x4e8]
lea r8, [rbp - 0x5c]
lea rcx, [rbp - 0x48]
call fcn.18002b5a0
nop
xor r9d, r9d
lea r8, [rbp - 0x28]
mov rdx, rax
mov rcx, rbx
call fcn.180065260
mov ebx, eax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18003451c
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180034517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003454c
call fcn.1800f2740
movdqa xmm0, xmmword [0x18016c440]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800f23a0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
call fcn.1800f98d4
int3

Function at 0x180034560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x18016c440]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov ecx, 0x10
mov dword [rsp + 0x20], ecx
movdqa xmm0, xmmword [0x18016c580]
movdqu xmmword [rsp + 0x24], xmm0
mov byte [rsp + 0x34], 0xbe
xor eax, eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
nop word [rax + rax]
mov ecx, eax
lea rdx, [rsp + 0x24]
add rdx, rcx
lea ecx, [rax - 0x52]
xor byte [rdx], cl
inc eax
mov ecx, dword [rsp + 0x20]
cmp eax, ecx
jb 0x1800345e0
mov byte [rsp + rcx + 0x24], 0
lea rdx, [rbx + 0x4e8]
lea r8, [rsp + 0x24]
lea rcx, [rsp + 0x40]
call fcn.18002b5a0
nop
mov r9, rdi
lea r8, [rsp + 0x60]
mov rdx, rax
mov rcx, rbx
call fcn.180065260
mov ebx, eax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180034663
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003465e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180034699
call fcn.1800f2740
movdqa xmm0, xmmword [0x18016c440]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800f23a0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
call fcn.1800f98d4
int3
Function at 0x180039460
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x1f8], rax
mov r13, rdx
mov dword [rsp + 0x30], 0
lea rcx, [0x180169ce0]
jmp 0x1801adada

Function at 0x18003c170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push r13
sub rsp, 0x38
mov rax, qword [rcx + 0x538]
mov r13, rcx
mov rbx, qword [rax]
cmp rbx, rax
je 0x18003c25c
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop word [rax + rax]
mov r15, qword [rbx + 0x28]
lea r14, [rbx + 0x10]
mov rbp, qword [r14 + 0x10]
mov rdi, r14
cmp r15, 0x10
jb 0x18003c1d8
mov rdi, qword [r14]
cmp rbp, 7
jb 0x18003c232
lea rsi, [rdi + rbp]
mov edx, 0x47
lea r8, [rsi - 6]
mov rcx, rdi
sub r8, rdi
call fcn.1800f57c0
test rax, rax
je 0x18003c232
nop dword [rax + rax]
cmp dword [rax], 0x454d4147
jne 0x18003c216
cmp word [rax + 4], 0x4e45
jne 0x18003c216
cmp byte [rax + 6], 0x43
je 0x18003c264
inc rax
lea r8, [rsi - 6]
sub r8, rax
mov rcx, rax
mov edx, 0x47
call fcn.1800f57c0
test rax, rax
jne 0x18003c200
mov rbx, qword [rbx]
cmp rbx, qword [r13 + 0x538]
jne 0x18003c1c0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop r13
pop rbx
ret
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x18003c232
xor ecx, ecx
mov rdi, rbx
mov r8, r14
movabs rdx, 0xcbf29ce484222325
cmp r15, 0x10
jb 0x18003c290
mov r8, qword [r14]
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r12
cmp rcx, rbp
jb 0x18003c290
mov rcx, qword [r13 + 0x560]
and rcx, rdx
mov rdx, qword [r13 + 0x548]
shl rcx, 4
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x18003c2e4
cmp rax, rbx
jne 0x18003c2da
mov rax, qword [r13 + 0x538]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x18003c2ef
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x18003c2ef
cmp rax, rbx
jne 0x18003c2ef
mov rax, qword [rbx]
mov qword [rdx], rax
mov rbx, qword [rbx]
mov rcx, r14
dec qword [r13 + 0x540]
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rax, qword [rdi + 8]
mov qword [rbx + 8], rax
call fcn.18000d550
mov edx, 0x50
mov rcx, rdi
call fcn.1800f2740
jmp 0x18003c235

Function at 0x18003c330
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Hash data using fnv
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rbx, rdx
mov qword [rbp - 0x48], rdx
mov r13, rcx
mov qword [rsp + 0x70], rcx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
lea rcx, str.Run_UserEncryptionScript
jmp 0x1801af661