joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bdc40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, r8
mov edx, dword [rdx + 0x10]
mov rbx, rcx
cmp edx, dword [r8 + 0x10]
jne 0x1800bdca1
test edx, edx
jne 0x1800bdc94
xor r9d, r9d
mov dword [rcx + 0x10], r9d
cmp byte [rcx + 0x19], r9b
je 0x1800bdd05
mov qword [rcx + 0x20], r9
mov al, 1
mov dword [rcx + 0x14], r9d
mov byte [rcx + 0x19], r9b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rcx + 0x18], 0xdb
je 0x1800bdcb3
xor ecx, ecx
call fcn.1800c57e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rcx + 0x14], edx
jae 0x1800bdcc1
call fcn.1800bef90
test al, al
je 0x1800bdca1
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rbx + 0x14]
cmova ecx, dword [rbx + 0x14]
cmp qword [rbx + 0x20], 0
mov dword [rbx + 0x10], ecx
je 0x1800bdca1
xor r9d, r9d
cmp dword [rdi + 0x10], r9d
jbe 0x1800bdd05
nop
mov rax, qword [rsi + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, r9d
inc r9d
movzx edx, byte [rcx + r8]
xor dl, byte [r8 + rax]
mov rax, qword [rbx + 0x20]
mov byte [r8 + rax], dl
cmp r9d, dword [rdi + 0x10]
jb 0x1800bdce0
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800bf789
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x1800bf8e1
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rsi, r9
movzx ebp, r8b
mov ebx, edx
mov rdi, rcx
test edx, edx
je 0x1800bf8bf
xor r8d, r8d
test edx, edx
je 0x1800bf8bf
mov qword [rsp + 0x250], r14
xor edx, edx
lea r14d, [r8 + 0x30]
nop word [rax + rax]
movzx r10d, byte [rdi]
mov eax, 0x37
mov ecx, r10d
shr ecx, 4
cmp ecx, 9
cmovbe eax, r14d
inc r8d
add al, cl
mov byte [rsp + rdx + 0x20], al
cmp r8d, 0x1f4
jne 0x1800bf827
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800d3f30
movzx r10d, byte [rdi]
lea r9, [rsp + 0x20]
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1800bf833
lea r9, [rsp + 0x21]
add r9, rdx
add rdx, 2
movzx ecx, r10b
mov eax, 0x37
and ecx, 0xf
cmp ecx, 9
cmovbe eax, r14d
inc r8d
add al, cl
mov byte [r9], al
cmp r8d, 0x1f4
jne 0x1800bf869
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800d3f30
xor r8d, r8d
xor edx, edx
inc rdi
dec ebx
test bpl, bpl
je 0x1800bf89d
test ebx, ebx
je 0x1800bf8a5
mov byte [rsp + rdx + 0x20], 0x3a
inc r8d
inc rdx
cmp r8d, 0x1f4
jne 0x1800bf89d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800d3f30
xor r8d, r8d
xor edx, edx
test ebx, ebx
jne 0x1800bf7e0
mov r14, qword [rsp + 0x250]
test r8d, r8d
je 0x1800bf8bf
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800d3f30
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x258]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800dc910
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov dword [r8], 0
mov dword [rdx], 0xffffffff
call fcn.1800c3810
test al, al
je 0x1800dc975
test rbx, rbx
je 0x1800dc96e
mov rax, qword [rbx]
lea rdx, str.GetAttributes:_filename_is_empty
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x1800dca54
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.180211600
lea rcx, [rsp + 0x30]
call fcn.1800bfb10
nop
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1800c0ae0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x30]
call fcn.1800c3ab0
lea rcx, [rsp + 0x30]
call fcn.1800c28e0
test eax, eax
jle 0x1800dca1b
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x1a0]
call fcn.180211600
lea rcx, [rsp + 0x1a0]
call fcn.1800bfb10
nop
mov r8, rbx
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x30]
call fcn.1800dcf80
lea rcx, [rsp + 0x1a0]
call fcn.1800c3600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rdi], eax
lea rcx, [rsp + 0x1a0]
call fcn.1800bfb80
jmp 0x1800dca30
lea rcx, [rsp + 0x30]
call fcn.1800c3600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rdi], eax
mov eax, dword [rdi]
cmp eax, 0xffffffff
jne 0x1800dca44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, dword [rdi]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x30]
call fcn.1800bfb80
movzx eax, bl
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x328
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800ddc30
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x13a0]
mov eax, 0x14a0
call fcn.18007c000
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x14d0], rbx
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0x1390], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.180211600
lea rcx, [rsp + 0x30]
call fcn.1800bfb10
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800c0ae0
mov r8b, 0x5c
mov dl, 0x2f
lea rcx, [rsp + 0x30]
call fcn.1800c3ab0
lea rcx, [rsp + 0x30]
call fcn.1800c28e0
cmp eax, 0x104
jle 0x1800dddd6
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0xa0]
call fcn.180211600
lea rcx, [rbp + 0xa0]
call fcn.1800bfb10
nop
lea rcx, [rbp + 0xa0]
call fcn.1800c46b0
lea rcx, [rsp + 0x30]
call fcn.1800c3600
mov rcx, rax
lea r9, [rsp + 0x28]
lea r8, [rbp + 0x380]
mov edx, 0x800
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rbp + 0xa0]
test eax, eax
je 0x1800ddd2b
lea rdx, [rbp + 0x380]
call fcn.1800c4260
mov bl, 1
jmp 0x1800ddd37
lea rdx, [rsp + 0x30]
call fcn.1800c1250
xor bl, bl
xor edx, edx
mov r8d, 0x170
lea rcx, [rbp + 0x210]
call fcn.180211600
lea rcx, [rbp + 0x210]
call fcn.1800bfb10
nop
test bl, bl
je 0x1800ddd6f
lea rdx, [0x180267250]
lea rcx, [rbp + 0x210]
call fcn.1800c0970
lea rcx, [rbp + 0xa0]
call fcn.1800c31f0
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.1800c0970
lea rcx, [rbp + 0x210]
call fcn.1800c3600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x1800dddb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, 2
cmove ebx, ecx
test ebx, ebx
setne bl
lea rcx, [rbp + 0x210]
call fcn.1800bfb80
nop
lea rcx, [rbp + 0xa0]
call fcn.1800bfb80
jmp 0x1800dde2a
lea rcx, [rsp + 0x30]
call fcn.1800c3600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x1800dde25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x1800dde1a
mov edx, eax
mov rcx, rdi
call fcn.180106ba0
lea r8, [rsp + 0x30]
lea rdx, str.failedToDeleteFilepath
mov rcx, rdi
call fcn.1801065f0
mov ecx, 1
cmp esi, 2
cmove ebx, ecx
test ebx, ebx
setne bl
lea rcx, [rsp + 0x30]
call fcn.1800bfb80
movzx eax, bl
mov rcx, qword [rbp + 0x1390]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x14d0]
add rsp, 0x14a0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800de090
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1850
call fcn.18007c000
sub rsp, rax
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x1840], rax
mov rbx, rcx
lea rdx, [rsp + 0x830]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1800de0ea
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800c3dc0
jmp 0x1800de0fa
lea rdx, [rsp + 0x830]
mov rcx, rbx
call fcn.1800c4260
mov rcx, qword [rsp + 0x1840]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x1850
pop rbx
ret
Function at 0x1800de780
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.180211600
lea rcx, [rsp + 0x30]
call fcn.1800bfb10
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800c4040
lea rcx, [rsp + 0x30]
call fcn.1800c3600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.1800bfb80
mov eax, ebx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x1b0
pop rbx
ret

Function at 0x1800de810
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.180211600
lea rcx, [rsp + 0x30]
call fcn.1800bfb10
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800c4040
lea rcx, [rsp + 0x30]
call fcn.1800c3600
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea rcx, [rsp + 0x30]
call fcn.1800bfb80
movzx eax, bl
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1b0
pop rdi
ret

Function at 0x1800dfad0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
cmp byte [0x180387502], 0
jne 0x1800dfae6
call fcn.1800df110
test al, al
jne 0x1800dfb19
mov eax, dword [0x180387514]
test eax, eax
jne 0x1800dfaf5
call sub.KERNEL32.dll_GetTickCount
imul eax, eax, 0x41a7
mov dword [0x180387514], eax
test eax, eax
jne 0x1800dfbb9
mov eax, 1
mov dword [0x180387514], eax
add rsp, 0x28
ret
mov rcx, qword [0x180387508]
test rcx, rcx
jne 0x1800dfb51
mov eax, dword [0x180387514]
test eax, eax
jne 0x1800dfb34
call sub.KERNEL32.dll_GetTickCount
imul ecx, eax, 0x41a7
mov eax, 1
test ecx, ecx
cmove ecx, eax
mov eax, ecx
mov dword [0x180387514], ecx
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
call fcn.180103810
movsxd rdx, dword [0x180387510]
lea r8, sym.LoaderKernel.dll_1_bID_MjfIzcypTm24yu_z_nD4S
movsxd rcx, dword [0x18036db34]
movzx eax, byte [rdx + r8 + 0x36db40]
mov ebx, dword [r8 + rcx*4 + 0x387520]
xor ebx, dword [r8 + rdx*4 + 0x387520]
mov dword [0x180387510], eax
movzx eax, byte [rcx + r8 + 0x36db40]
mov rcx, qword [0x180387508]
mov dword [0x18036db34], eax
mov dword [r8 + rdx*4 + 0x387520], ebx
call fcn.180103850
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180104a00
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call fcn.1800d4870
cmp byte [0x180387fd1], 0
jne 0x180104a8c
xor edx, edx
mov r8d, 0x200
lea rcx, [0x1803881a0]
call fcn.180211600
mov dword [rsp + 0x28], 0x100
lea rdx, [rsp + 0x28]
lea rcx, [0x1803881a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x180104a85
movsd xmm0, qword [str.Win32]
movsd qword [0x1803881a0], xmm0
movzx eax, word [0x1802a0300]
mov word [0x1803881a8], ax
mov byte [0x180387fd1], 1
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.180211600
lea rcx, [rsp + 0x30]
call fcn.1800bfb10
nop
lea rdx, [0x1803881a0]
lea rcx, [rsp + 0x30]
call fcn.1800c0ab0
lea rcx, [rsp + 0x30]
call fcn.1800c31f0
mov rdx, rax
mov rcx, rbx
call fcn.1800d2e50
nop
lea rcx, [rsp + 0x30]
call fcn.1800bfb80
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x1b0
pop rbx
ret

Function at 0x180105120
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18010524c
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18010523f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18010523f
test rdi, rdi
je 0x180105217
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x30]
call fcn.1800d27d0
nop
lea rcx, [rsp + 0x30]
call fcn.1800d3e80
mov rbx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.1800d6d80
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x28]
mov rax, qword [rdi]
lea rdx, str.Failed_to_get_file_size__64_
mov rcx, rdi
call qword [rax + 0x28]
nop
lea rcx, [rsp + 0x30]
call fcn.1800d28c0
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
mov edx, dword [rsp + 0x28]
mov ecx, ebx
call fcn.180104e10
jmp 0x18010521e
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180105217
call fcn.18021d6e0
mov rcx, qword [rbx + 8]
call fcn.18022ed98
mov ecx, eax
call fcn.18022ed58
jmp 0x18010521e
Function at 0x1801053d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0xb0]
xor eax, eax
mov rbx, qword [rsp + 0xb8]
mov r12, r9
mov ebp, r8d
mov r14, rdx
mov r15, rcx
mov byte [rsi], 0
mov dword [r9], eax
test rdx, rdx
jne 0x180105435
test rbx, rbx
je 0x18010542e
mov rax, qword [rbx]
lea rdx, str.NULL_buf_pointer.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x180105558
test r8d, r8d
je 0x180105556
mov r13d, 0x10000
nop dword [rax]
nop dword [rax + rax]
cmp ebp, r13d
mov byte [rsi], 0
mov edi, ebp
mov dword [rsp + 0x30], eax
cmova edi, r13d
test edi, edi
je 0x180105518
test r14, r14
je 0x180105518
mov rcx, qword [r15 + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1801054c9
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, edi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1801054bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x1801054aa
mov byte [rsi], 1
mov al, 1
jmp 0x18010552f
test rbx, rbx
je 0x18010552d
mov edx, eax
mov rcx, rbx
call fcn.180106ba0
jmp 0x18010552d
cmp dword [rsp + 0x30], 0
jne 0x1801054a3
mov byte [rsi], 1
mov al, 1
jmp 0x18010552f
mov r9, qword [r15 + 8]
test r9, r9
je 0x18010550a
mov r8d, edi
mov edx, 1
mov rcx, r14
call fcn.18021e4ac
mov dword [rsp + 0x30], eax
cmp eax, edi
jne 0x1801054ee
mov al, 1
jmp 0x18010552f
mov rcx, qword [r15 + 8]
call fcn.18022ed6c
test eax, eax
je 0x1801054a0
test rbx, rbx
je 0x18010552d
mov rcx, rbx
call fcn.180106a70
jmp 0x18010552d
test rbx, rbx
je 0x18010552d
lea rdx, str.No_file_is_open.
jmp 0x180105524
test rbx, rbx
je 0x18010552d
lea rdx, str.NULL_buf_or_bufSize
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
mov ecx, dword [rsp + 0x30]
add dword [r12], ecx
sub ebp, ecx
add r14, rcx
test al, al
je 0x18010542e
cmp byte [rsi], 0
jne 0x180105556
mov eax, 0
test ebp, ebp
jne 0x180105450
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180105890
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov r14, r9
mov rsi, qword [rsp + 0xb0]
mov rdi, r8
mov rbp, rdx
mov r15, rcx
jne 0x1801058f2
cmp qword [rcx + 8], 0
jne 0x1801058f2
test rsi, rsi
je 0x1801059f0
mov rax, qword [rsi]
lea rdx, str.Failed_to_write_because_file_is_not_open.
mov rcx, rsi
call qword [rax + 0x28]
xor al, al
jmp 0x1801059bd
xor r13d, r13d
test r14, r14
je 0x1801058fd
mov qword [r9], r13
test r8, r8
je 0x1801059bb
mov edx, dword [rsp + 0x30]
mov r12d, 0x989680
mov rcx, qword [r15 + 0x10]
cmp rdi, r12
mov ebx, edi
cmovg ebx, r12d
cmp rcx, 0xffffffffffffffff
je 0x18010597b
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, ebx
mov qword [rsp + 0x20], r13
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18010594a
mov edx, dword [rsp + 0x30]
cmp edx, ebx
je 0x1801059a0
test rsi, rsi
je 0x1801059f0
mov rax, qword [rsi]
lea rdx, str.WriteFileError
mov r8b, 1
mov rcx, rsi
call qword [rax + 0x48]
mov rcx, rsi
call fcn.180106a70
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
xor al, al
jmp 0x1801059bd
mov r9, qword [r15 + 8]
test r9, r9
je 0x1801059a0
mov edx, ebx
mov r8d, 1
mov rcx, rbp
call fcn.18021ddc4
cmp rax, 1
jne 0x1801059db
mov edx, ebx
mov dword [rsp + 0x30], ebx
mov eax, ebx
add rbp, rax
sub rdi, rax
test r14, r14
je 0x1801059b2
mov eax, edx
add qword [r14], rax
test rdi, rdi
jne 0x180105910
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rsi, rsi
je 0x1801059f0
mov rax, qword [rsi]
lea rdx, str.fwrite_failed.
mov rcx, rsi
call qword [rax + 0x28]
xor al, al
jmp 0x1801059bd
Function at 0x1801071f0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x28
mov r14, r9
mov ebx, r8d
mov r15, rdx
test r9, r9
je 0x1801073de
xor ebp, ebp
mov dword [r9], ebp
test ebx, ebx
je 0x1801073de
test rdx, rdx
je 0x1801073de
lea ecx, [r8 + r8*4]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea ecx, [rdx + 4]
mov dword [r9], ecx
call fcn.1800da980
mov r10, rax
test rax, rax
je 0x1801073de
mov qword [rsp + 0x58], rdi
mov eax, 0xaaaaaaab
mul ebx
mov qword [rsp + 0x20], r13
mov ecx, ebp
mov edi, edx
lea r13, [0x1802a0f90]
shr edi, 1
je 0x180107308
mov qword [rsp + 0x50], rsi
lea ebp, [rdi + rdi*2]
mov qword [rsp + 0x60], r12
lea ecx, [rdi*4]
mov r12d, edi
mov r11, r10
mov rsi, r15
nop dword [rax + rax]
movzx edx, byte [rsi]
lea r11, [r11 + 4]
movzx r8d, byte [rsi + 2]
mov eax, edx
movzx r9d, byte [rsi + 1]
lea rsi, [rsi + 3]
shr rax, 2
and edx, 3
shl edx, 4
movzx eax, byte [rax + r13]
mov byte [r11 - 4], al
mov eax, r9d
shr rax, 4
and r9d, 0xf
or rdx, rax
shl r9d, 2
movzx eax, byte [rdx + r13]
mov byte [r11 - 3], al
mov eax, r8d
shr rax, 6
and r8d, 0x3f
mov edx, r9d
or rdx, rax
movzx eax, byte [rdx + r13]
mov byte [r11 - 2], al
movzx eax, byte [r8 + r13]
mov byte [r11 - 1], al
sub r12, 1
jne 0x180107290
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea eax, [rdi + rdi*2]
mov rdi, qword [rsp + 0x58]
sub ebx, eax
sub ebx, 1
je 0x180107379
cmp ebx, 1
jne 0x1801073c0
movsxd rdx, ecx
inc ecx
movsxd rax, ebp
movzx r8d, byte [rax + r15]
movzx r9d, byte [rax + r15 + 1]
mov eax, r8d
shr rax, 2
and r8d, 3
shl r8d, 4
movzx eax, byte [rax + r13]
mov byte [rdx + r10], al
mov eax, r9d
shr rax, 4
and r9d, 0xf
or r8, rax
movsxd rdx, ecx
inc ecx
shl r9d, 2
movzx eax, byte [r8 + r13]
mov byte [rdx + r10], al
movzx eax, byte [r9 + r13]
movsxd rdx, ecx
mov byte [rdx + r10], al
jmp 0x1801073b4
movsxd rdx, ecx
inc ecx
movsxd rax, ebp
movzx r8d, byte [rax + r15]
mov eax, r8d
and r8d, 3
shr rax, 2
shl r8d, 4
movzx eax, byte [rax + r13]
mov byte [rdx + r10], al
movzx eax, byte [r8 + r13]
movsxd rdx, ecx
inc ecx
mov byte [rdx + r10], al
movsxd rax, ecx
mov byte [rax + r10], 0x3d
inc ecx
movsxd rax, ecx
inc ecx
mov byte [rax + r10], 0x3d
mov r13, qword [rsp + 0x20]
movsxd rax, ecx
mov byte [rax + r10], 0
mov rax, r10
mov dword [r14], ecx
add rsp, 0x28
pop r15
pop r14
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x180108e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rsi, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x180109015
test edx, edx
je 0x180109015
mov qword [rax + 8], r14
mov eax, 0x23
mov word [rbp + 0x4b], ax
mov r14d, 0x28
mov qword [rbp - 0x19], 0x250024
mov dword [rbp - 0x11], 0x270026
mov dword [rbp - 0xd], 0x290028
mov dword [rbp - 9], 0x10000
mov dword [rbp - 5], 0x30002
mov dword [rbp - 1], 0x50004
mov dword [rbp + 3], 0x70006
mov qword [rbp + 7], 0x90008
mov qword [rbp + 0xf], 0x2a0000
mov dword [rbp + 0x17], 0xa0000
mov dword [rbp + 0x1b], 0xc000b
mov dword [rbp + 0x1f], 0xe000d
mov dword [rbp + 0x23], 0x10000f
mov dword [rbp + 0x27], 0x120011
mov dword [rbp + 0x2b], 0x140013
mov dword [rbp + 0x2f], 0x160015
mov dword [rbp + 0x33], 0x180017
mov dword [rbp + 0x37], 0x1a0019
mov dword [rbp + 0x3b], 0x1c001b
mov dword [rbp + 0x3f], 0x1e001d
mov dword [rbp + 0x43], 0x20001f
mov dword [rbp + 0x47], 0x220021
cmp edx, 2
jb 0x180108ff2
nop dword [rax]
movzx ecx, byte [rbx]
lea eax, [rcx - 0x28]
cmp edi, 3
jb 0x180108f98
cmp ax, 0x32
jbe 0x180108f34
mov ecx, r14d
sub cx, r14w
movzx eax, cx
movzx ecx, byte [rbx + 1]
movzx r9d, word [rbp + rax*2 - 0x19]
lea eax, [rcx - 0x28]
cmp ax, 0x32
jbe 0x180108f51
mov ecx, r14d
sub cx, r14w
add rbx, 2
movzx eax, cx
movzx ecx, byte [rbx]
movzx r8d, word [rbp + rax*2 - 0x19]
lea eax, [rcx - 0x28]
cmp ax, 0x32
jbe 0x180108f71
mov ecx, r14d
sub cx, r14w
movzx edx, cx
imul ecx, r9d, 0x2b
movzx edx, word [rbp + rdx*2 - 0x19]
add cx, r8w
movzx eax, cx
imul ecx, eax, 0x2b
add dx, cx
mov rcx, rsi
call fcn.1800bc0e0
jmp 0x180108fde
cmp ax, 0x32
jbe 0x180108fa2
movzx ecx, r14w
sub cx, r14w
inc rbx
movzx eax, cx
movzx ecx, byte [rbx]
movzx r8d, word [rbp + rax*2 - 0x19]
lea eax, [rcx - 0x28]
cmp ax, 0x32
jbe 0x180108fc1
mov ecx, r14d
sub cx, r14w
movzx eax, r8b
movzx edx, cx
imul ecx, eax, 0x2b
movzx edx, byte [rbp + rdx*2 - 0x19]
add dl, cl
mov rcx, rsi
call fcn.1800bb260
cmp edi, 3
jbe 0x180108ff2
add edi, 0xfffffffd
inc rbx
cmp edi, 2
jae 0x180108f20
mov r14, qword [rsp + 0xa0]
mov al, 1
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov al, 1
jmp 0x180108ffc