joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c498
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rcx, qword [0x18002bc58]
xor ebx, ebx
test rcx, rcx
je 0x18000c581
mov esi, 0x126
lea edx, [rbx + 8]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000c581
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x22
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.eiorejfisd
mov ecx, 0x2732
lea edx, [rbx + 0x34]
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000c51a
mov eax, ebx
lea rcx, [rsp + 0x30]
inc eax
inc rcx
cmp eax, 0x14
jb 0x18000c50e
jmp 0x18000c52b
mov ecx, ebx
lea rdx, [rsp + 0x30]
inc ecx
inc rdx
cmp ecx, 0x22
jb 0x18000c521
lea r8, [0x180029220]
mov r9, rdi
sub r8, rdi
movabs rax, 0x47ae147ae147ae15
mov rcx, rbx
mul rbx
mov rax, rbx
inc rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0x19
sub rcx, rax
lea rax, [0x180025280]
mov al, byte [rcx + rax]
xor al, byte [r8 + r9]
mov byte [r9], al
inc r9
sub rsi, 1
jne 0x18000c538
mov rax, rdi
jmp 0x18000c583
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18000ce14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov edi, dword [rcx + 0x3c]
mov r15d, edx
mov r10, rcx
mov eax, dword [rdi + rcx + 0x88]
test eax, eax
je 0x18000ce9c
lea r11, [rcx + rax]
xor esi, esi
mov ebx, dword [r11 + 0x20]
mov ebp, dword [r11 + 0x24]
add rbx, rcx
mov r14d, dword [r11 + 0x1c]
add rbp, rcx
add r14, rcx
cmp dword [r11 + 0x18], esi
jbe 0x18000ce9c
mov ecx, dword [rbx]
mov edx, 0
add rcx, r10
je 0x18000ce7e
cmp byte [rcx], dl
je 0x18000ce7e
mov rax, rcx
inc rax
inc edx
cmp byte [rax], 0
jne 0x18000ce74
xor r8d, r8d
call fcn.180014970
xor eax, 0xa235cb91
cmp eax, r15d
je 0x18000ceb8
inc esi
add rbx, 4
cmp esi, dword [r11 + 0x18]
jb 0x18000ce61
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [rbp + rsi*2]
mov ebx, dword [r14 + rcx*4]
add rbx, r10
cmp rbx, r11
jb 0x18000cf74
mov eax, dword [rdi + r10 + 0x8c]
add rax, r11
cmp rbx, rax
jae 0x18000cf74
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea rax, [rsp + 0x20]
sub rdx, rcx
mov cl, byte [rdx + rax]
cmp cl, 0x2e
je 0x18000cf0e
test cl, cl
je 0x18000cf0e
mov byte [rax], cl
inc r8d
inc rax
cmp r8d, 0x40
jb 0x18000cef4
mov sil, byte [r8 + rbx]
lea eax, [r8 + 1]
mov edi, eax
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0x64
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 4]
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + r8 + 0x20], 0x2e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000ce9c
test sil, sil
lea rdx, [rdi + rbx]
mov rcx, rax
cmove rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ce9c
jmp 0x18000ce9e
mov rax, rbx
jmp 0x18000ce9e
Function at 0x18000d008
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r10d, r8d
lea r11, [0x180029440]
imul r9, r10, 0x21
xor ebx, ebx
mov dword [rsp + 0x60], 0xa235cb91
mov edi, edx
mov rsi, rcx
mov r8d, ebx
movzx eax, byte [r9 + r11]
test al, al
je 0x18000d075
lea r8, [rsp + 0x20]
mov edx, ebx
sub r9, r8
lea rcx, [rsp + 0x20]
add r11, r9
mov r8d, eax
mov r9d, eax
mov rax, rdx
inc rdx
and eax, 3
mov al, byte [rsp + rax + 0x60]
xor al, byte [r11 + rcx + 1]
mov byte [rcx], al
inc rcx
sub r9, 1
jne 0x18000d058
mov byte [rsp + r8 + 0x20], bl
lea rcx, [rsp + 0x20]
cmp r10d, 5
jne 0x18000d08d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x18000d096
mov rax, qword [0x18002b0d8]
call qword [rax]
test rax, rax
je 0x18000d0ab
mov r8, rax
mov edx, edi
mov rcx, rsi
call fcn.18000cf7c
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18000dab0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x90
lea rax, [rax - 0x78]
mov r10d, r9d
mov r9, qword [rsp + 0xd0]
mov r11, r8
mov qword [rsp + 0x28], rax
mov edi, edx
mov r12, rcx
xor ebx, ebx
mov dword [rax], ebx
mov r8d, r10d
mov eax, dword [rsp + 0xd8]
mov rdx, r11
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.180011504
mov qword [rsp + 0x38], rax
mov r15, rax
test rax, rax
jne 0x18000db1c
lea rax, [0x18002bb7c]
jmp 0x18000dc0f
mov ebp, dword [rsp + 0xe0]
mov esi, ebp
cmp ebp, edi
jae 0x18000db47
lea r8, [r12 + rbp]
xor edx, edx
mov eax, esi
div dword [rsp + 0x30]
mov al, byte [r8]
cmp byte [rdx + r15], al
je 0x18000db87
inc esi
inc r8
cmp esi, edi
jb 0x18000db2d
xor r9d, r9d
mov dword [rsp + 0x28], 0x22
lea rax, [rsp + 0x40]
mov edx, 0x138a
lea r8, str.aiodewio
mov qword [rsp + 0x20], rax
lea ecx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000dbe8
lea rax, [rsp + 0x40]
inc ebx
inc rax
cmp ebx, 0x14
jb 0x18000db7b
jmp 0x18000dbf7
sub esi, ebp
je 0x18000db47
mov rcx, qword [0x18002bc58]
test rcx, rcx
je 0x18000dbd5
lea r8d, [rsi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000dbd5
mov r8, rax
mov r9d, esi
xor edx, edx
mov eax, ebp
div dword [rsp + 0x30]
mov al, byte [rdx + r15]
xor al, byte [rbp + r12]
inc ebp
mov byte [r8], al
inc r8
sub r9, 1
jne 0x18000dbb4
jmp 0x18000dbfe
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18000c864
jmp 0x18000db10
lea rcx, [rsp + 0x40]
inc ebx
inc rcx
cmp ebx, 0x22
jb 0x18000dbed
lea rdi, [0x18002bb7c]
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18000c864
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
Function at 0x18000dc2c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x47]
sub rsp, 0x90
lea rax, [rbp - 0x31]
mov r10d, r9d
mov r9, qword [rbp + 0x6f]
mov r11, r8
mov qword [rsp + 0x28], rax
mov edi, edx
mov eax, dword [rbp + 0x77]
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x20], eax
mov r8d, r10d
mov dword [rbp - 0x31], ebx
mov rdx, r11
xor ecx, ecx
mov r14d, ebx
call fcn.180011504
mov qword [rbp - 0x29], rax
mov r12, rax
test rax, rax
jne 0x18000dc9b
lea rax, [0x18002bbbc]
jmp 0x18000dde9
mov esi, dword [rbp + 0x7f]
mov r8d, esi
cmp esi, edi
jae 0x18000dccd
lea r9, [rsi + r13]
xor edx, edx
mov eax, r8d
div dword [rbp - 0x31]
mov al, byte [r9]
cmp byte [rdx + r12], al
je 0x18000dcc7
inc r8d
inc r9
cmp r8d, edi
jb 0x18000dca9
jmp 0x18000dccd
mov r14d, r8d
sub r14d, esi
lea rax, [rbp - 0x21]
mov edi, 0x22
mov dword [rsp + 0x28], edi
lea r8, str.quoaehzdffud
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x16315
mov ecx, 0x1e455
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000dd11
mov eax, ebx
lea rcx, [rbp - 0x21]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x14
jb 0x18000dd03
jmp 0x18000dd25
mov ecx, ebx
lea rdx, [rbp - 0x21]
lea eax, [rcx + 0xa]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, edi
jb 0x18000dd17
test r14d, r14d
je 0x18000dd8b
mov rcx, qword [0x18002bc58]
test rcx, rcx
je 0x18000dd7a
lea r8d, [r14 + 1]
mov edx, 8
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000dd7a
mov r8, rax
mov r9d, r14d
xor edx, edx
mov eax, esi
div dword [rbp - 0x31]
mov al, byte [rdx + r12]
xor al, byte [rsi + r13]
inc esi
movzx eax, al
mov word [r8], ax
lea r8, [r8 + 2]
sub r9, 1
jne 0x18000dd56
jmp 0x18000ddda
mov edx, dword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.18000c864
jmp 0x18000dc8f
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.MjnUJbuyIOJ
mov edx, 0xc76
mov ecx, 0x8c4
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000ddc6
lea rax, [rbp - 0x21]
inc ebx
inc rax
cmp ebx, 0x14
jb 0x18000ddba
jmp 0x18000ddd3
lea rcx, [rbp - 0x21]
inc ebx
inc rcx
cmp ebx, edi
jb 0x18000ddca
lea rdi, [0x18002bbbc]
mov edx, dword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.18000c864
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x18000ded0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov rdi, rdx
xor r8d, r8d
lea rdx, [0x1800253c4]
mov r14d, r9d
mov r13, rcx
call fcn.18000d68c
xor ebx, ebx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18000e0cb
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x210], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e0ba
mov r12d, dword [rbp + 0x220]
mov r15d, dword [rbp + 0x218]
cmp word [rbp - 0x74], 0x2e
jne 0x18000df76
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x18000e094
cmp ax, 0x2e
jne 0x18000df76
cmp word [rbp - 0x70], bx
je 0x18000e094
mov eax, dword [rsp + 0x60]
test al, 0x10
je 0x18000df86
test r14b, 2
jne 0x18000df8c
jmp 0x18000dffb
test r14b, 4
je 0x18000dffb
mov r15, qword [rbp + 0x208]
mov rsi, qword [rbp + 0x200]
mov rax, qword [0x18002b150]
lea rcx, [rbp - 0x74]
mov rdx, qword [rdi]
call qword [rax + 0x30]
test eax, eax
je 0x18000dfd5
mov r8, r15
lea rdx, [rsp + 0x60]
mov rcx, r13
call rsi
test eax, eax
je 0x18000dfe0
test r12d, r12d
je 0x18000dfd5
mov rax, qword [0x18002b0d8]
mov ecx, r12d
call qword [rax + 0x188]
inc ebx
add rdi, 8
cmp ebx, 1
jb 0x18000df9a
mov eax, dword [rsp + 0x60]
xor ebx, ebx
mov rsi, qword [rbp + 0x210]
mov r15d, dword [rbp + 0x218]
mov rdi, qword [rbp + 0x1e8]
test al, 0x10
je 0x18000e094
test r14b, 1
je 0x18000e094
xor r9d, r9d
lea r8, [rbp - 0x74]
lea rdx, [0x180025194]
mov rcx, r13
call fcn.18000d68c
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
je 0x18000e092
test r15d, r15d
je 0x18000e045
mov rax, qword [0x18002b0d8]
mov ecx, r15d
call qword [rax + 0x188]
mov rax, qword [rbp + 0x208]
mov r9d, r14d
mov dword [rsp + 0x40], r12d
mov r8d, 1
mov dword [rsp + 0x38], r15d
mov rdx, rdi
and qword [rsp + 0x30], 0
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x200]
mov qword [rsp + 0x20], rax
call fcn.18000ded0
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x50]
call fcn.18000c864
xor ebx, ebx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000df52
mov rax, qword [0x18002b0d8]
mov rcx, rsi
call qword [rax + 0x108]
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x58]
call fcn.18000c864
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18000e230
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18002b0d8]
xor r8d, r8d
mov rbp, rdx
mov rsi, rcx
xor edi, edi
call qword [rax + 0x240]
test eax, eax
jne 0x18000e318
xor edx, edx
mov word [rsp + 0x30], di
mov r8d, 0x206
lea rcx, [rsp + 0x32]
call sub.msvcrt.dll_memset
mov ecx, 0x1415
call fcn.18000de90
mov rcx, qword [0x18002b140]
lea edx, [rdi + 1]
add rcx, 0x668
mov qword [rsp + 0x260], rax
mov r8d, 0xf4240
mov rbx, rax
call fcn.18001c37c
mov r9, rbp
mov dword [rsp + 0x20], eax
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0x103
call fcn.180010d20
lea rcx, [rsp + 0x260]
call fcn.18000de2c
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x18000e301
mov rax, qword [0x18002b0d8]
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [rax + 0x240]
test eax, eax
jne 0x18000e306
or edi, 0xffffffff
jmp 0x18000e328
mov rax, qword [0x18002b0d8]
mov rcx, rsi
call qword [rax + 0x238]
jmp 0x18000e328
mov rdx, qword [0x18002b0d8]
mov rcx, rsi
call qword [rdx + 0x238]
lea r11, [rsp + 0x240]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18000e344
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x260
mov edx, 0x80
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call sub.msvcrt.dll_memset
mov r8d, 0x200
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180014c14
mov rax, qword [0x18002b0d8]
mov rcx, rbx
call qword [rax + 0x238]
test eax, eax
je 0x18000e39e
mov eax, 1
jmp 0x18000e422
mov rcx, qword [0x18002b140]
or r8d, 0xffffffff
add rcx, 0x668
mov edx, 0xf0000000
call fcn.18001c37c
mov r9d, eax
lea r8, [0x1800253cc]
mov edx, 0x20
lea rcx, [rsp + 0x20]
call fcn.180010d20
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [0x180025390]
mov rcx, rbx
call fcn.18000d68c
mov qword [rsp + 0x278], rax
test rax, rax
je 0x18000e420
mov rdx, rax
mov rcx, rbx
call fcn.18000e230
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x278]
mov ebx, eax
call fcn.18000c864
test ebx, ebx
jns 0x18000e394
xor eax, eax
add rsp, 0x260
pop rbx
ret

Function at 0x18000efb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [0x18002bc58]
test rcx, rcx
jne 0x18000efd7
mov eax, ebx
jmp 0x18000f00c
mov r8d, dword [rdi]
mov edx, 8
inc r8d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18000f00c
cmp dword [rdi], ebx
jbe 0x18000f00c
mov ecx, ebx
and ecx, 3
mov edx, ebx
inc ebx
mov cl, byte [rcx + rdi + 0x108]
xor cl, byte [rdx + rdi + 4]
mov byte [rdx + rax], cl
cmp ebx, dword [rdi]
jb 0x18000eff1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f43c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r10, qword [0x18002b140]
xor r8d, r8d
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x40]
lea edx, [r8 + 8]
mov r9d, edx
mov rax, r8
inc r8
and eax, 7
mov al, byte [rax + r10 + 0x1880]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x18000f45e
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.180014970
add rsp, 0x28
ret

Function at 0x1800102e8
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
xor r13d, r13d
mov r12, rcx
mov dword [rax + 0x10], r13d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x278]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rsp + 0x278]
mov ebp, r13d
mov r14, rax
test edx, edx
jle 0x18001042c
lea r15, [rsp + 0x20]
mov rsi, qword [r14]
cmp word [rsi], 0x2f
ja 0x18001035b
movzx eax, word [rsi]
movabs rcx, 0xa00000002401
bt rcx, rax
jb 0x180010397
cmp ebx, 0x20
jae 0x180010397
mov rcx, rsi
mov qword [r15], rsi
mov rdi, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x18001038a
cmp word [rsi + rdi*2], 0x2c
jne 0x180010382
mov word [rsi + rdi*2], r13w
inc rdi
cmp rdi, rcx
jl 0x180010376
mov edx, dword [rsp + 0x278]
inc ebx
add r15, 8
inc ebp
add r14, 8
cmp ebp, edx
jl 0x18001033f
cmp ebx, 1
jne 0x1800103ad
mov rbx, qword [rsp + 0x20]
jmp 0x1800103b4
jle 0x18001042c
mov rbx, qword [rsp + 0x28]
cmp word [rbx], 0x5c
je 0x180010417
cmp word [rbx + 2], 0x3a
je 0x180010417
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
lea rdx, [0x180025194]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.18000d68c
mov r8d, 0x104
mov qword [rsp + 0x280], rax
mov rdx, rax
mov rcx, r12
call fcn.180010dd4
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x280]
call fcn.18000c864
jmp 0x180010428
mov r8d, 0x104
mov rdx, rbx
mov rcx, r12
call fcn.180010dd4
xor eax, eax
jmp 0x18001042f
or eax, 0xffffffff
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180012d08
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov qword [rsp + 0x70], rdi
xor edx, edx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rsp + 0x70]
xor edx, edx
lea r9, [0x180024db0]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
lea rcx, [0x180024dc0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180012e23
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rax
mov r10, qword [rcx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [r10 + SafeArrayPutElement]
test eax, eax
js 0x180012e23
mov rcx, qword [rsp + 0x68]
lea edx, [rdi + 0xa]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x180012e23
mov rcx, qword [0x18002bc58]
test rcx, rcx
je 0x180012e23
lea edx, [rdi + 8]
lea r8d, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180012e23
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
jmp 0x180012e45
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180012e33
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180012e43
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180014970
Capabilities:
Encode data using xor

Disassembly:
not r8d
test edx, edx
jne 0x18001497a
xor eax, eax
ret
mov r9d, edx
lea rdx, [0x1800252a0]
movzx eax, byte [rcx]
inc rcx
xor r8d, eax
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
sub r9, 1
jne 0x180014984
not r8d
mov eax, r8d
ret
Function at 0x180016bbc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, edx
mov eax, 0xaaaaaaab
mul edx
mov rbp, rcx
mov rcx, qword [0x18002bc58]
shr edx, 1
lea edi, [rdx*4 + 5]
test rcx, rcx
je 0x180016d07
lea r8d, [rdi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, rax
test rax, rax
je 0x180016d07
xor r11d, r11d
xor edx, edx
test ebx, ebx
je 0x180016cf9
lea esi, [rdi - 4]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp edx, esi
jae 0x180016cf9
xor r10d, r10d
xor r8d, r8d
mov cl, byte [r11 + rbp]
mov byte [rsp + r8 + 0x48], cl
cmp r11d, ebx
jae 0x180016c46
inc r10d
jmp 0x180016c4c
mov byte [rsp + r8 + 0x48], 0
inc r11d
inc r8
cmp r8, 3
jl 0x180016c33
test r10d, r10d
je 0x180016cf0
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rsp + 0x48]
and ecx, 3
movzx r8d, byte [rsp + 0x49]
shr rax, 2
shl ecx, 4
mov al, byte [rax + r14]
mov byte [rsp + 0x50], al
mov eax, r8d
shr rax, 4
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x51], al
cmp r10d, 1
jle 0x180016cce
movzx eax, byte [rsp + 0x4a]
and r8d, 0xf
shr rax, 6
shl r8d, 2
mov ecx, r8d
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x52], al
cmp r10d, 2
jle 0x180016cd3
movzx eax, byte [rsp + 0x4a]
and eax, 0x3f
mov cl, byte [rax + r14]
jmp 0x180016cd5
mov byte [rsp + 0x52], 0x3d
mov cl, 0x3d
mov byte [rsp + 0x53], cl
xor r8d, r8d
mov al, byte [rsp + r8 + 0x50]
inc r8
mov byte [rdx + r9], al
inc edx
cmp r8, 4
jl 0x180016cdc
cmp r11d, ebx
jb 0x180016c25
cmp edx, edi
jae 0x180016d02
mov byte [rdx + r9], 0
mov rax, r9
jmp 0x180016d09
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180017580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
movsxd rsi, edx
mov rdi, rcx
lea rax, str.business.doc
xor r9d, r9d
inc rax
inc r9d
cmp byte [rax], 0
jne 0x1800175a2
mov eax, SafeArrayGetDim
mov byte [rsp + 0x2f], 0
cmp r9d, eax
cmova r9d, eax
xor ecx, ecx
test r9d, r9d
je 0x1800175d9
lea rdx, [rsp + 0x20]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, r9d
jb 0x1800175ca
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9b, byte [rbx + 0x100]
mov r11, rsi
mov r10b, byte [rbx + 0x101]
test esi, esi
jle 0x18001762a
inc r9b
movzx r8d, r9b
mov dl, byte [r8 + rbx]
add r10b, dl
movzx ecx, r10b
mov al, byte [rcx + rbx]
mov byte [r8 + rbx], al
mov byte [rcx + rbx], dl
add dl, byte [r8 + rbx]
movzx eax, dl
mov cl, byte [rax + rbx]
xor byte [rdi], cl
inc rdi
sub r11, 1
jne 0x1800175f9
mov rsi, qword [rsp + 0x48]
mov byte [rbx + 0x100], r9b
mov byte [rbx + 0x101], r10b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001775c
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
lea r9, [rsp]
add rcx, 0x1d
mov r10d, reloc.OLEAUT32.dll_SafeArrayGetDim
sub r9, r8
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
lea rcx, [rcx + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r9 + rcx - 0x21], edx
sub r10, 1
jne 0x18001778f
lea rcx, [rsp + 8]
lea edx, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
ror eax, 0x1f
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x1800177c5
mov r15d, dword [r8]
lea esi, [rdx + 0x14]
mov r12d, dword [r8 + 4]
mov r14d, r15d
mov r13d, dword [r8 + 8]
mov r10d, r12d
mov ebx, dword [r8 + 0xc]
mov r9d, r13d
mov edi, dword [r8 + 0x10]
xor ebp, ebp
mov eax, r9d
lea r11d, [rdi + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, r14d
and ecx, ebx
ror edx, 0x1b
or ecx, eax
mov edi, ebx
mov ebx, r9d
add edx, ecx
add edx, dword [rsp + rbp*4]
mov r9d, r10d
shr r10d, 2
add r11d, edx
shl r9d, 0x1e
inc rbp
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rsi
jl 0x180017801
mov ebp, 0x28
ror r11d, 0x1b
add edi, 0x6ed9eba1
add r11d, dword [rsp + rsi*4]
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add r11d, ecx
mov r9d, r10d
inc rsi
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rsi, rbp
jl 0x18001784b
mov edx, 0x3c
mov ecx, r9d
ror r11d, 0x1b
or ecx, r10d
mov eax, r9d
and ecx, ebx
and eax, r10d
add edi, 0x8f1bbcdc
or ecx, eax
add ecx, dword [rsp + rbp*4]
add r11d, edi
add r11d, ecx
mov edi, ebx
mov ebx, r9d
inc rbp
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rdx
jl 0x18001788d
mov eax, dword [rsp + rdx*4]
add edi, 0xca62c1d6
ror r11d, 0x1b
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add eax, ecx
mov r9d, r10d
add r11d, eax
shr r10d, 2
inc rdx
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rdx, 0x50
jl 0x1800178d1
add dword [r8 + 0xc], ebx
lea eax, [r15 + r11]
add dword [r8 + 0x10], edi
lea r11, [rsp + 0x140]
and dword [r8 + 0x5c], 0
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r8], eax
lea eax, [r12 + r10]
mov dword [r8 + 4], eax
lea eax, [r9 + r13]
mov dword [r8 + 8], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret