joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180038e50
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x380
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x370], rax
xor edi, edi
lea rcx, str..gxdte_cd
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x180038fd2
lea rcx, [rsp + 0x162]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x160], di
call fcn.180059db0
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x118
mov dword [rsp + 0x40], 0x11c
call fcn.180059db0
lea rcx, [rsp + 0x40]
call fcn.180002ccc
cmp eax, edi
je 0x180038ef8
cmp dword [rsp + 0x44], 6
lea rbx, str.gxdte64_win7.sys
je 0x180038eff
lea rbx, str.gxdte64.sys
lea r8, [rsp + 0x160]
mov r9d, 0x104
mov rdx, rbx
xor ecx, ecx
call fcn.180002a48
lea rcx, [rsp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x180038f58
cmp word [0x1800a7540], di
je 0x180038f58
lea rdx, [0x1800a7540]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x160]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, str.gxdte
mov rcx, rbx
call fcn.180005d4c
lea r9, str.gxdte_driver
lea r8, str.gxdte64.sys
cmp eax, edi
mov eax, 1
lea rdx, [rsp + 0x160]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x22343
call fcn.18003ef64
mov rcx, rbx
call fcn.180005ca4
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, str..gxdte_cd
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.180059760
mov rbx, qword [rsp + 0x390]
add rsp, 0x380
pop rdi
ret

Function at 0x180039a7c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
movabs rax, 0x6666666666666667
sub rcx, qword [rbx + 0x18]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180039ae0
lea r8, str.shlSelFiles
lea rdx, str.softwareprojonepodlp_smpcache
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x180039b5d
xor edi, edi
lea rdx, [0x180083b50]
lea rcx, [rsp + 0x30]
lea r8d, [rdi + 1]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
call fcn.1800076f0
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1800012d4
cmp qword [rsp + 0x78], 8
lea r9, [rsp + 0x60]
cmovae r9, qword [rsp + 0x60]
lea r8, str.shlSelFiles
lea rdx, str.softwareprojonepodlp_smpcache
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
call fcn.1800056d8
cmp qword [rsp + 0x78], 8
jb 0x180039b5d
mov rcx, qword [rsp + 0x60]
call fcn.180058b34
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180059760
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x180039b80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r11d, 0xffffffff
mov r9d, edx
mov r10, rcx
mov eax, r11d
test edx, edx
je 0x180039bb8
movzx r8d, byte [r10]
mov edx, eax
mov ecx, eax
xor r8, rdx
shr ecx, 8
inc r10
movzx edx, r8b
lea r8, [0x1800a3070]
mov eax, dword [r8 + rdx*4]
xor eax, ecx
add r9d, r11d
jne 0x180039b91
not eax
ret

Function at 0x180039bbc
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0xa0], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x44], 0
and dword [rsp + 0x40], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
call fcn.18003f9bc
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.18003fa70
and qword [rbx + 0x18], 0
mov qword [rbx + 0x20], sendto
lea rdx, [rsp + 0x90]
mov r8d, sendto
mov rcx, rbx
mov byte [rbx + 8], 0
call fcn.180007360
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180059760
add rsp, 0xb0
pop rbx
ret

Function at 0x180039e90
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rdi, rdx
xor edx, edx
mov esi, r8d
mov rbx, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x30], 0
call fcn.180059db0
mov r11d, dword [str.podlp]
mov al, byte [0x180083944]
xor edx, edx
mov dword [rsp + 0x30], r11d
mov byte [rsp + 0x34], al
lea r9d, [rdx + 0x40]
mov r8, r9
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x11f], cl
mov byte [rsp + rdx + 0x8f], al
jne 0x180039eef
and dword [rsp + 0x48], r8d
and dword [rsp + 0x44], r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
mov r8d, r9d
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.180040dc0
lea rcx, [rsp + 0x30]
mov r8d, esi
mov rdx, rdi
call fcn.180040dc0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.180040e7c
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x90], 0x67452301
mov dword [rsp + 0x94], 0xefcdab89
mov dword [rsp + 0x98], 0x98badcfe
mov dword [rsp + 0x9c], 0x10325476
mov dword [rsp + 0xa0], 0xc3d2e1f0
mov dword [rsp + 0xa8], esi
mov dword [rsp + 0xa4], esi
call fcn.180040dc0
lea edi, [rsi + 0x14]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x90]
mov r8d, edi
call fcn.180040dc0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xf0]
call fcn.180040e7c
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], rsi
lea rdx, [rsp + 0xf0]
mov r8, rdi
mov rcx, rbx
mov byte [rbx + 8], sil
call fcn.180007360
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180059760
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x18003a04c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x180
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x170], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov rbx, r9
mov byte [rsp + 0x30], 0
call fcn.180059db0
mov r8d, dword [rsp + 0x1d0]
mov r13d, 0x40
mov rdx, rbx
cmp r8d, r13d
jbe 0x18003a141
and dword [rsp + 0xc0], 0
and dword [rsp + 0x104], 0
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x7380166f
mov dword [rsp + 0xa4], 0x4914b2b9
mov dword [rsp + 0xa8], 0x172442d7
mov dword [rsp + 0xac], 0xda8a0600
mov dword [rsp + 0xb0], 0xa96f30bc
mov dword [rsp + 0xb4], 0x163138aa
mov dword [rsp + 0xb8], 0xe38dee4d
mov dword [rsp + 0xbc], 0xb0fb0e4e
call fcn.180040f98
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x110]
call fcn.180041058
lea rdx, [rsp + 0x110]
mov r8, r13
lea rcx, [rsp + 0x30]
call fcn.180059820
xor edx, edx
mov r8, r13
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x9f], cl
mov byte [rsp + rdx + 0x10f], al
jne 0x18003a150
and dword [rsp + 0x50], r8d
and dword [rsp + 0x94], r8d
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov ebx, 0x172442d7
mov r8d, r13d
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.180040f98
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.180040f98
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.180041058
and dword [rsp + 0x50], 0
and dword [rsp + 0x94], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
mov r8d, r13d
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.180040f98
mov ebx, 0x20
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.180040f98
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.180041058
and qword [rdi + 0x18], 0
mov qword [rdi + 0x20], sendto
lea rdx, [rsp + 0x150]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], 0
call fcn.180007360
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180059760
add rsp, 0x180
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18003b920
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x18003b9a6
cmp rax, 0xffffffffffffffff
je 0x18003b9ba
and dword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003b9a6
cmp dword [rsp + 0x58], 4
jne 0x18003b9a6
cmp dword [rsp + 0x60], 0x21726152
jne 0x18003b9a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18003b9bc
cmp rbx, 0xffffffffffffffff
je 0x18003b9ba
test rbx, rbx
je 0x18003b9ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x18003b9c4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x80e0
call fcn.18006dc60
sub rsp, rax
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x80d0], rax
mov rsi, rcx
lea rcx, str.unrar64.dll
mov ebp, r9d
mov rdi, r8
call fcn.18003b7c4
mov rbx, rax
test rax, rax
jne 0x18003ba12
mov eax, 0x453
jmp 0x18003bb12
lea rdx, str.RAROpenArchiveEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARCloseArchive
mov rcx, rbx
mov qword [0x1800a7750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARReadHeaderEx
mov rcx, rbx
mov qword [0x1800a7758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARProcessFileW
mov rcx, rbx
mov qword [0x1800a7760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARSetPassword
mov rcx, rbx
mov qword [0x1800a7768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [0x1800a7750]
mov qword [0x1800a7770], rax
test rbx, rbx
je 0x18003bb0d
cmp qword [0x1800a7758], 0
je 0x18003bb0d
cmp qword [0x1800a7760], 0
je 0x18003bb0d
cmp qword [0x1800a7768], 0
je 0x18003bb0d
test rax, rax
je 0x18003bb0d
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0xa8
call fcn.180059db0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x64], rax
call rbx
mov r11, rax
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x18003bb12
mov qword [rdi], r11
jmp 0x18003bb12
mov eax, 0x454
mov rcx, qword [rsp + 0x80d0]
xor rcx, rsp
call fcn.180059760
mov rbx, qword [rsp + 0x8108]
add rsp, 0x80e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003c480
Capabilities:
Check if file exists
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rdi, qword [rcx]
mov r12, rcx
mov rbx, qword [rax]
mov ebp, 1
mov rsi, qword [r12 + 0x30]
test rdi, rdi
je 0x18003c4bb
cmp rdi, qword [r12]
je 0x18003c4c0
call fcn.180058f08
cmp rbx, rsi
je 0x18003c5c8
test rdi, rdi
jne 0x18003c4d8
call fcn.180058f08
xor r11d, r11d
jmp 0x18003c4db
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c4e6
call fcn.180058f08
cmp qword [rbx + 0x60], 8
jb 0x18003c4f3
mov rcx, qword [rbx + 0x48]
jmp 0x18003c4f7
lea rcx, [rbx + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18003c570
test rdi, rdi
jne 0x18003c510
call fcn.180058f08
xor r11d, r11d
jmp 0x18003c513
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c51e
call fcn.180058f08
cmp qword [rbx + 0x38], 8
jb 0x18003c52b
mov rsi, qword [rbx + 0x20]
jmp 0x18003c52f
lea rsi, [rbx + 0x20]
test rdi, rdi
jne 0x18003c53e
call fcn.180058f08
xor r11d, r11d
jmp 0x18003c541
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c54c
call fcn.180058f08
cmp qword [rbx + 0x60], 8
jb 0x18003c559
mov rcx, qword [rbx + 0x48]
jmp 0x18003c55d
lea rcx, [rbx + 0x48]
mov r8d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18003c572
xor ebp, ebp
test rdi, rdi
jne 0x18003c57c
call fcn.180058f08
cmp byte [rbx + 0x69], 0
je 0x18003c58c
call fcn.180058f08
jmp 0x18003c4ab
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x18003c5a7
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x18003c596
jmp 0x18003c4ab
mov rax, qword [rbx + 8]
jmp 0x18003c5ba
cmp rbx, qword [rax + 0x10]
jne 0x18003c5c0
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x18003c5ad
mov rbx, rax
jmp 0x18003c4ab
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x18003ca4c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18003caba
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18003ca86
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18003cbc0
mov edi, dword [rbx + 0x18]
lea r14, [0x1800a3590]
jmp 0x18003cb15
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003cad4
add r11, 4
sub r8, 1
jne 0x18003cad1
mov edx, edi
mov rcx, rbx
call fcn.18003cbc0
mov rcx, rbx
call fcn.18003cd00
mov rcx, rbx
dec edi
call fcn.18003cc78
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18003cad1
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003cb30
add r11, 4
sub r8, 1
jne 0x18003cb2d
xor edx, edx
mov rcx, rbx
call fcn.18003cbc0
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18003cba4
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18003cb73
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18003cbc0
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18003cbda
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003cbd4
repz ret
Function at 0x18003da7c
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18003dc6e
lea rdi, [0x1800825d0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003db02
cmp cl, r14b
je 0x18003daed
cmp cl, r14b
je 0x18003dc6e
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003db21
cmp bpl, r14b
je 0x18003db0b
cmp bpl, r14b
je 0x18003dc6e
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180007154
jmp 0x18003db53
lea rdi, [0x1800825d0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18003dc32
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18003db74
cmp dil, r14b
je 0x18003db4c
cmp dil, r14b
je 0x18003dc6e
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180007154
lea rdx, [0x1800825d0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18003dbf6
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18003dbc4
cmp cl, r14b
je 0x18003dba8
cmp cl, r14b
je 0x18003dc6e
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180007154
cmp rsi, r13
lea rdi, [0x1800825d0]
jb 0x18003daed
jmp 0x18003dc6e
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007250
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003dc2d
mov rcx, qword [rsp + 0x38]
call fcn.180058b34
mov rax, rbx
jmp 0x18003dca8
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007250
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003dc69
mov rcx, qword [rsp + 0x38]
call fcn.180058b34
mov rax, rbx
jmp 0x18003dca8
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007250
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003dca5
mov rcx, qword [rsp + 0x38]
call fcn.180058b34
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180059760
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003dd34
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
xor r11d, r11d
mov rdi, rcx
mov dword [rsp], 0x2ac3268c
mov dword [rsp + 4], 0x33747d9a
mov dword [rsp + 8], 0xd1de98ac
mov dword [rsp + 0xc], 0x6eee320c
lea ebx, [r11 + 0x20]
lea rsi, [0x180000000]
mov r9d, dword [r11 + rsi + 0x82500]
xor r9d, dword [rsp + r11 + 4]
xor r9d, dword [rsp + r11 + 0xc]
xor r9d, dword [rsp + r11 + 8]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + rsi + 0x823f0]
movzx eax, cl
movzx ecx, byte [rax + rsi + 0x823f0]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + rsi + 0x823f0]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + rsi + 0x823f0]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [rsp + r11]
xor ecx, r10d
mov dword [rsp + r11 + 0x10], ecx
mov dword [r11 + rdi], ecx
add r11, 4
sub rbx, 1
jne 0x18003dd76
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003de24
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb0
mov rbp, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x90
call fcn.180059db0
movzx eax, byte [rbx + 1]
movzx r11d, byte [rbx]
movzx ecx, byte [rbx + 4]
shl r11d, 8
mov esi, 0x20
shl ecx, 8
or r11d, eax
movzx eax, byte [rbx + 2]
shl r11d, 8
lea r12, [0x1800823f0]
or r11d, eax
movzx eax, byte [rbx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x20], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x24], ecx
movzx ecx, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
lea rbx, [rsp + 0x28]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x28]
sub rbp, rax
mov dword [rsp + 0x2c], ecx
mov r9d, dword [rbx + rbp]
xor r9d, dword [rbx - 4]
xor r9d, dword [rbx]
add rbx, 4
xor r9d, dword [rbx]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + r12]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + r12]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r10d
ror eax, 8
xor ecx, eax
mov eax, r10d
rol eax, 2
xor ecx, eax
xor ecx, dword [rbx - 0xc]
xor ecx, r10d
sub rsi, 1
mov dword [rbx + 4], ecx
jne 0x18003df07
mov ecx, dword [rsp + 0xac]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 2], cl
mov ecx, dword [rsp + 0xa8]
mov byte [rdi + 1], al
mov al, byte [rsp + 0xac]
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 6], cl
mov ecx, dword [rsp + 0xa4]
mov byte [rdi + 5], al
mov al, byte [rsp + 0xa8]
mov byte [rdi + 7], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 0xa], cl
mov ecx, dword [rsp + 0xa0]
mov byte [rdi + 9], al
mov al, byte [rsp + 0xa4]
mov byte [rdi + 0xb], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rdi + 0xd], al
mov al, byte [rsp + 0xa0]
mov byte [rdi + 0xe], cl
mov byte [rdi + 0xf], al
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18003e770
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
lea r9, str..________.dirty
mov r8d, 1
mov rdx, rcx
lea rcx, [rax - 0x48]
call fcn.180001b3c
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsi]
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rdi, rdi
je 0x18003e7c9
cmp rdi, rax
je 0x18003e7ce
call fcn.180058f08
cmp rbx, rsi
je 0x18003e827
test rdi, rdi
jne 0x18003e7e2
call fcn.180058f08
xor r11d, r11d
jmp 0x18003e7e5
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003e7f0
call fcn.180058f08
cmp qword [rbx + 0x38], 8
jb 0x18003e7fd
mov rcx, qword [rbx + 0x20]
jmp 0x18003e801
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000c9a8
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
jmp 0x18003e7bf
lea rcx, [rsp + 0x40]
call fcn.180008048
nop
mov rcx, qword [rsp + 0x40]
call fcn.180058b34
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret