joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002b260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
imul eax, r8d, 0x5f1
mov r12d, r8d
mov esi, r8d
mov dword [rsp + 0x40], eax
cmp r8d, eax
ja 0x18002b495
mov r13, qword [rsp + 0xc8]
xor ebx, ebx
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
cmp esi, 0x4114
ja 0x18002b390
je 0x18002b37a
cmp esi, 0x49
je 0x18002b32c
cmp esi, 0x62
je 0x18002b2f8
cmp esi, 0x101
je 0x18002b45a
cmp esi, 0x307a
jne 0x18002b436
test r14, r14
je 0x18002b44b
mov rdi, qword [r14 + 0x10]
jmp 0x18002b436
mov qword [rsp + 0x28], rbx
mov r9d, 0x62
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call fcn.180064120
mov r9, qword [rsp + 0xb8]
mov r15, rax
mov rdx, qword [rsp + 0xa8]
jmp 0x18002b436
mov eax, dword [rdx]
lea r8, [r13 + 0x280]
mov qword [rsp + 0x30], r9
xor edx, edx
mov dword [rsp + 0xb0], eax
xor r9d, r9d
lea rax, [rsp + 0xb0]
mov dword [rsp + 0x28], 0x11d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180018b10
mov r9, qword [rsp + 0xb8]
mov r14, rax
mov rdx, qword [rsp + 0xa8]
jmp 0x18002b436
test r15, r15
jne 0x18002b436
mov dword [rsp + 0x48], 0xffffffff
jmp 0x18002b495
cmp esi, 0x60ab
je 0x18002b402
cmp esi, 0x81c6
je 0x18002b3ba
cmp esi, 0x90dc
je 0x18002b455
cmp esi, 0xc278
je 0x18002b495
jmp 0x18002b436
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xffffffff
je 0x18002b383
mov r9, qword [rsp + 0xb8]
and ebp, 0x400
mov rdx, qword [rsp + 0xa8]
neg ebp
sbb eax, eax
neg eax
dec eax
mov dword [rsp + 0x48], eax
jmp 0x18002b436
mov rax, qword [rsp + 0xc0]
cmp dword [rax], ebx
je 0x18002b4d1
test rdi, rdi
je 0x18002b436
nop word [rax + rax]
test byte [rdi + 0x58], 6
je 0x18002b4d1
mov rdi, qword [rdi + 0x110]
test rdi, rdi
jne 0x18002b420
imul eax, r12d, 0xa9
add esi, eax
cmp esi, dword [rsp + 0x40]
jbe 0x18002b2b2
jmp 0x18002b495
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
mov rax, rbx
jmp 0x18002b49a
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf3
call fcn.180016860
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x13f
xor edx, edx
mov qword [rsp + 0x20], r13
xor ecx, ecx
test eax, eax
je 0x18002b4ab
call fcn.180016df0
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x48]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.180016df0
xor r9d, r9d
mov dword [rsp + 0xb0], eax
xor r8d, r8d
lea rcx, [rsp + 0xb0]
mov edx, 0xc3
call fcn.180023ef0
jmp 0x18002b491
mov rax, rdi
jmp 0x18002b49a
Function at 0x180043a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x138
mov r13d, dword [rbp + 0xa0]
xor ebx, ebx
mov rsi, qword [rbp + 0xb0]
mov r10, r8
movaps xmmword [rax - 0x58], xmm6
mov r8, rcx
movaps xmmword [rax - 0x68], xmm7
lea rcx, [0x180000000]
lea edi, [r13 - 0xe]
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
mov r14d, r13d
mov dword [rsp + 0x58], r13d
xorps xmm9, xmm9
mov dword [rsp + 0x40], edi
cmp r13d, edi
jbe 0x180043fc4
movsd xmm8, qword [0x180119700]
add r13d, 0xffffffe9
mov edi, dword [rbp + 0xa0]
movsd xmm7, qword [rsp + 0x50]
mov r15, qword [rsp + 0x50]
mov r12d, dword [rbp + 0xa0]
mov eax, dword [rsp + 0x40]
Function at 0x180060930
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea r15d, [r8 + 0x3d4]
mov edi, r8d
mov rsi, rdx
mov r14, rcx
cmp r8d, r15d
jae 0x180060ba9
mov rbp, qword [rsp + 0x50]
lea r13, str.VINSERTF64x2Zrr
mov ebx, dword [rsp + 0x40]
xor r12d, r12d
nop word [rax + rax]
cmp edi, 0x14a
ja 0x180060ac8
je 0x180060ba9
mov eax, edi
sub eax, 0x8f
je 0x180060aa3
sub eax, 0x2c
je 0x180060a4f
sub eax, 0x2d
je 0x1800609fe
sub eax, 3
je 0x1800609f1
cmp eax, 0x23
jne 0x180060b93
cmp qword [0x180121738], r12
je 0x1800609e7
cmp qword [0x180121730], r12
je 0x1800609e7
mov byte [rsp + 0x48], 1
jmp 0x180060b93
mov byte [rsp + 0x48], r12b
jmp 0x180060b93
mov rbp, r12
mov qword [rsp + 0x50], r12
jmp 0x180060b93
mov rax, qword [r14]
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov ecx, 0x11c
call fcn.1800bfd10
mov rdx, qword [r14]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsi]
mov r9d, 0xa4
mov qword [rsp + 0x40], rax
call fcn.1800ed620
mov qword [rsp + 0x48], rax
jmp 0x180060b93
lea rdx, [rsp + 0x60]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor r8d, r8d
lea r9, [rsp + 0x40]
mov edx, 0xdb
mov rcx, rsi
cmp eax, 1
jae 0x180060a8b
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0x20], r13
call fcn.18002dea0
jmp 0x180060b93
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.18002dea0
jmp 0x180060b93
mov r9, rsi
mov dword [rsp + 0x40], 4
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xfe
mov r14, r12
call fcn.1800dee70
jmp 0x180060b93
mov eax, edi
sub eax, 0x14d
je 0x180060b34
sub eax, 0x23
je 0x180060ba9
sub eax, 0x3f
je 0x180060aed
cmp eax, 0x62
je 0x180060ba9
jmp 0x180060b93
test ebx, ebx
jne 0x180060b2e
lea r8, [rbp + 0x28]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea edx, [rbx + 0x16]
xor ecx, ecx
call fcn.180098b00
mov r8, qword [rbp + 8]
mov r9, rsi
xor edx, edx
mov dword [rsp + 0x20], 0x40
xor ecx, ecx
call fcn.180089ec0
lea r8d, [rbx + 0x68]
mov rdx, rsi
mov rcx, rbp
call fcn.1800b2040
mov dword [rsp + 0x48], ebx
jmp 0x180060b93
test rsi, rsi
je 0x180060ba1
cmp dword [rsi + 0xa18], 0xbad1dead
je 0x180060ba1
xor edx, edx
xor r9d, r9d
mov r8, r14
lea ecx, [rdx + 0x3f]
call fcn.180049c60
mov dword [rsp + 0x40], eax
lea r8, [rsi + 0x300]
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], r14
mov r9d, 0xe1
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.180088ab0
mov rbp, qword [rsp + 0x50]
mov rbx, rax
add edi, 0x62
cmp edi, r15d
jb 0x180060990
jmp 0x180060ba9
mov dword [rsp + 0x48], 0xffffffe8
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800fd9d0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800811a0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
lea esi, [r8 + 5]
mov edi, r8d
mov r14, rdx
mov rbx, rcx
cmp r8d, esi
jae 0x180081242
mov rcx, qword [rsp + 0x58]
xor ebp, ebp
nop dword [rax + rax]
mov eax, edi
sub eax, 0x75
je 0x180081228
sub eax, 1
je 0x180081218
sub eax, 1
je 0x180081212
sub eax, 3
je 0x1800811f0
cmp eax, 1
jne 0x18008123c
mov rax, rcx
jmp 0x180081247
mov eax, dword [r14]
lea rcx, [rsp + 0x50]
mov r8, qword [rbx + 0xe8]
mov edx, 0xc0
mov dword [rsp + 0x50], eax
call fcn.18008c190
mov rcx, rax
jmp 0x18008123c
mov qword [rbx + 0x14], rbp
jmp 0x18008123c
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
jmp 0x18008123c
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
inc edi
cmp edi, esi
jb 0x1800811d0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800856c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x50]
lea ebp, [rcx + 0x324]
mov rsi, r8
mov r14, rdx
mov edi, ecx
cmp ecx, ebp
jae 0x18008578a
xor r15d, r15d
cmp edi, 0x103
ja 0x18008576e
je 0x180085741
mov eax, edi
sub eax, 0x10
je 0x180085737
sub eax, 0x65
je 0x180085715
cmp eax, 0x21
jne 0x18008577c
mov ebx, r15d
jmp 0x18008577c
mov r9, rsi
mov dword [rsp + 0x50], 0x1000
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0xfe
call fcn.1800dee70
mov r14, r15
jmp 0x18008577c
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
jmp 0x18008577c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, dword [r14]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18008577c
mov eax, 0xfffffff6
jmp 0x18008578c
mov eax, edi
sub eax, 0x11c
je 0x18008578a
cmp eax, 0x6d
je 0x1800857a5
add edi, 0x86
cmp edi, ebp
jb 0x1800856f5
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, r15d
jmp 0x18008578c
Function at 0x18008c190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x98]
mov rbp, r8
imul r15d, edx, 0x285
mov r14d, edx
mov r12, rcx
mov esi, edx
cmp edx, r15d
ja 0x18008c201
xor edi, edi
movabs r13, 0x2020202020202020
nop
cmp esi, 0x38
je 0x18008c353
cmp esi, 0xc0
je 0x18008c33e
cmp esi, 0x1c70
je 0x18008c23f
cmp esi, 0x38a8
je 0x18008c21c
cmp esi, 0x6180
jne 0x18008c35f
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, 0x3c
mov dword [rsp + 0x98], edi
lea r8, [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1800b3920
jmp 0x18008c35f
lea rax, [rsp + 0x98]
mov dword [rsp + 0x98], edi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x106
call fcn.18008add0
cmp eax, 0xffffffff
je 0x18008c201
mov dword [rsp + 0x98], r13d
nop dword [rax]
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jle 0x18008c290
mov r8d, 3
lea rdx, [rsp + 0x99]
lea rcx, [rsp + 0x98]
call sub.VCRUNTIME140.dll_memmove
movsx eax, byte [rsp + 0x88]
mov byte [rsp + 0x9b], al
cmp dword [rsp + 0x98], 0x74697571
je 0x18008c337
mov ecx, eax
mov esi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
movzx ecx, byte [rsp + 0x88]
mov edx, 0x3f
test eax, eax
mov r9d, esi
mov r8d, esi
cmovne edx, ecx
lea rcx, str.NVVM_reflection__enabled_by_default
movsx edx, dl
call fcn.1800fcfa0
lea rcx, [0x180106764]
call fcn.1800fcfa0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x18008c290
mov esi, 0x1c70
jmp 0x18008c35f
mov ecx, dword [r12]
cmp ecx, dword [rbp + 0x10]
jae 0x18008c376
mov ebx, dword [rbp + 0x18]
imul ebx, ecx
add rbx, qword [rbp + 8]
jmp 0x18008c35f
lea rcx, str.HRESULT_D3DXAssembleShaderFromFileA_0x_08Ix__0x_08Ix__0x_08Ix__0x_I32x__0x_08Ix__0x_08Ix___0x_I32x
call fcn.1800fcfa0
imul eax, r14d, 0x81
add esi, eax
cmp esi, r15d
jbe 0x18008c1d0
jmp 0x18008c201
mov rax, rdi
jmp 0x18008c204
Function at 0x180093ad0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea eax, [r9 - 4]
mov qword [rsp + 0x50], r8
mov rbx, qword [rsp + 0x50]
mov r13d, r9d
mov dword [rsp + 0x60], eax
mov r14, rdx
mov r12, rcx
cmp r9d, eax
jbe 0x180093c64
lea r10, [0x180121f10]
lea r9, str.REALLOC
lea r11, str.PROXY
mov eax, r13d
sub eax, 0xfb
je 0x180093bbb
sub eax, 2
je 0x180093c64
sub eax, 1
je 0x180093bb4
cmp eax, 1
jne 0x180093c56
mov ebp, dword [r8]
xor esi, esi
mov r15, qword [r14 + 8]
cmp dword [r14 + 0x10], esi
jbe 0x180093c56
nop word [rax + rax]
mov edi, esi
shl rdi, 5
mov ecx, dword [rdi + r15 + 8]
cmp ebp, ecx
jne 0x180093b9b
mov r8, qword [rdi + r15]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], ecx
mov r9, r12
mov ecx, 0x8b
call fcn.18008d960
jmp 0x180093b9f
mov eax, ebp
sub eax, ecx
test eax, eax
je 0x180093c92
inc esi
cmp esi, dword [r14 + 0x10]
jb 0x180093b70
jmp 0x180093c3c
xor ebx, ebx
jmp 0x180093c56
movsxd rdx, dword [r8]
lea rcx, str.ALLOC
shl rdx, 5
mov r8, r14
mov eax, dword [rdx + r10 + 0x18]
cmp byte [rdx + r10 + 1], 1
mov dword [rsp + 0x40], eax
mov rax, qword [rdx + r10 + 0x10]
cmovne rcx, r9
cmp byte [rdx + r10], 1
lea r9, str.LEGIT
mov qword [rsp + 0x38], rax
mov rax, qword [rdx + r10 + 8]
cmovne r9, r11
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + r10 + 0x1c]
lea rdx, str.runtool::exprof::Controller::sayErrorMessage
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.1800fd000
mov rax, qword [0x1801217c8]
test rax, rax
je 0x180093c35
lea rcx, [rsp + 0x70]
call rax
cmp dword [r12], 0
jne 0x180093c9b
mov r8, qword [rsp + 0x50]
lea r11, str.PROXY
lea r9, str.REALLOC
lea r10, [0x180121f10]
dec r13d
cmp r13d, dword [rsp + 0x60]
ja 0x180093b32
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800fd9d0
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [r15 + 0x10]
add rax, rdi
jmp 0x180093c67
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x18009a3a0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, qword [rsp + 0x80]
lea r15d, [rcx + 5]
mov rbp, rdx
mov esi, ecx
cmp ecx, r15d
jae 0x18009a4b9
mov r14, qword [rsp + 0x80]
xor ebx, ebx
mov eax, esi
sub eax, 0x32
je 0x18009a48a
sub eax, 1
je 0x18009a453
sub eax, 1
je 0x18009a407
sub eax, 1
je 0x18009a4b9
cmp eax, 2
jne 0x18009a4ae
mov qword [rbp + 0x38], rbx
mov dword [rbp + 0x40], ebx
jmp 0x18009a4ae
lea rax, [rsp + 0x88]
mov rcx, r14
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x18009a4cd
mov eax, dword [rsp + 0x80]
mov edi, dword [rsp + 0x70]
imul rdi, rax
mov eax, dword [rsp + 0x88]
imul rdi, rax
jmp 0x18009a4ae
movzx eax, word [r14]
mov rcx, r14
test ax, ax
je 0x18009a483
nop
cmp ax, 0x5c
je 0x18009a480
cmp ax, 0x2f
je 0x18009a480
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x18009a460
mov esi, 0x33
jmp 0x18009a4ae
mov word [rcx], bx
mov esi, 0x33
jmp 0x18009a4ae
mov qword [rsp + 0x28], rbx
mov r9d, 0x62
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
xor ecx, ecx
call fcn.180064120
mov r14, rax
test rax, rax
je 0x18009a4cd
inc esi
cmp esi, r15d
jb 0x18009a3d4
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800b2040
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea ebx, [r8 + 0x78]
mov r14d, r8d
mov dword [rsp + 0xa0], ebx
mov rdi, rdx
mov rbp, rcx
cmp r8d, ebx
jae case.0x1800b20b0.5
mov rsi, qword [rsp + 0xa8]
lea r12d, [r8 - 0x44]
mov r13d, dword [rsp + 0xa0]
lea rdx, [0x180000000]
mov r15, qword [rsp + 0xa8]
cmp r12d, 0x83
ja case.0x1800b20b0.12
movzx eax, byte [rdx + r12 + 0xb22e8]
mov ecx, dword [rdx + rax*4 + 0xb22b4]
add rcx, rdx
jmp rcx
mov rsi, qword [rdi + 0x10]
jmp case.0x1800b20b0.12
xor ebx, ebx
cmp dword [rdi + 0x2c], ebx
jbe 0x1800b20ff
nop
xor edx, edx
mov r9, rsi
xor r8d, r8d
lea ecx, [rdx + 0x28]
call fcn.1800f5c10
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800b20ed
mov r8d, 0x10d
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1800d3940
mov rsi, qword [rsi + 0x48]
inc ebx
cmp ebx, dword [rdi + 0x2c]
jb 0x1800b20c0
lea rdx, [0x180000000]
mov ebx, dword [rsp + 0xa0]
add r14d, 0xa
add r12d, 0xa
cmp r14d, ebx
jb 0x1800b2094
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x50
mov eax, ebx
sub eax, 0x4f
je 0x1800b225b
cmp eax, 1
jne 0x1800b215b
xor r9d, r9d
mov r8, rbp
mov edx, 0xbd
mov rcx, rdi
call fcn.18004c2d0
mov r13d, eax
dec ebx
cmp ebx, 0x4e
ja 0x1800b2135
mov ebx, dword [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov r9d, 0x62
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call fcn.180064120
mov r15, rax
test rax, rax
je 0x1800b2279
lea rdx, [0x180000000]
jmp case.0x1800b20b0.12
mov edx, dword [rsp + 0xa8]
cmp edx, 0xffffffff
je 0x1800b2279
mov eax, edx
lea rdx, [0x180000000]
and al, 0xa0
neg al
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x38], ecx
jmp case.0x1800b20b0.12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x180000000]
jmp case.0x1800b20b0.12
mov rax, qword [rdi]
test rax, rax
je case.0x1800b20b0.12
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je case.0x1800b20b0.12
call qword [rax + 0x20]
lea rdx, [0x180000000]
jmp case.0x1800b20b0.12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0xa8], eax
lea rdx, [0x180000000]
jmp case.0x1800b20b0.12
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
mov r9d, 0x134
mov dword [rsp + 0x30], 8
mov r8, rbp
call fcn.1800d9ca0
lea rdx, [0x180000000]
jmp case.0x1800b20b0.12
mov rax, qword [rdi]
test rax, rax
je 0x1800b226f
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1800b226f
call qword [rax + 0x30]
mov dword [rsp + 0x38], r13d
jmp case.0x1800b20b0.5
mov dword [rsp + 0x38], 0xffffffff
jmp case.0x1800b20b0.5
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x38], eax
jmp case.0x1800b20b0.5
mov rax, qword [rdi]
movabs rcx, 0xcf1bbcdcbf9b0000
imul rax, rcx
mov ecx, 0x40
sub ecx, dword [rbp]
shr rax, cl
jmp 0x1800b2118
Function at 0x1800d69c0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x58]
lea ebp, [r9 - 9]
mov r15, r8
mov r14, rdx
cmp r9d, ebp
jbe case.0x1800d6a1d.0
lea esi, [r9 - 0x2f]
lea r12, [0x180000000]
nop dword [rax + rax]
cmp esi, 0x1e
ja case.0x1800d6a1d.8
movzx eax, byte [r12 + rsi + 0xd6af0]
mov ecx, dword [r12 + rax*4 + 0xd6acc]
add rcx, r12
jmp rcx
mov dword [r15], 0
jmp case.0x1800d6a1d.8
mov dword [r14 + 8], 0x98badcfe
mov qword [r14 + 0xc], 0x10325476
mov dword [r14 + 0x14], 0
jmp case.0x1800d6a1d.8
mov rax, qword [r14 + 0x28]
test rax, rax
je case.0x1800d6a1d.8
dec rax
mov r9d, 0x63
xor r8d, r8d
mov qword [r14 + 0x28], rax
xor edx, edx
mov rcx, r14
call fcn.1800d7460
jmp case.0x1800d6a1d.8
mov dword [r14], 0x67452301
mov dword [r14 + 4], 0xefcdab89
jmp case.0x1800d6a1d.8
xor r9d, r9d
xor edx, edx
mov r8d, 0xed
mov rcx, r14
call fcn.1800f3ce0
xor ebx, ebx
dec esi
lea eax, [rsi + 0x2f]
cmp eax, ebp
ja 0x1800d6a00
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov edx, dword [r15]
lea rcx, str._.s
mov r8, r14
call fcn.1800fcfa0
xor eax, eax
jmp 0x1800d6a9c
Function at 0x140001270
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1030
call fcn.14000e610
sub rsp, rax
mov rsi, rdx
mov rbx, rcx
lea rdx, str.http:__8.134.160.120_123.conf
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x1050], 1
mov dword [rsp + 0x20], 0x4000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
je 0x140001344
cmp qword [rbx + 0x18], 8
jb 0x1400012d2
mov rbx, qword [rbx]
lea rdx, [0x140018ea4]
mov rcx, rbx
call fcn.140005284
mov rbx, rax
test rax, rax
je 0x14000133b
cmp dword [rsp + 0x1050], 0
jbe 0x140001333
lea r9, [rsp + 0x1050]
lea rdx, [rsp + 0x30]
mov r8d, 0xfff
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r8d, dword [rsp + 0x1050]
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 1
call fcn.140005424
cmp dword [rsp + 0x1050], 0
ja 0x1400012f3
mov rcx, rbx
call fcn.14000558c
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140bd30b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140bd3237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140bd30e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bd30c7
add dl, dl
jne 0x140bd30ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bd314e
xor eax, eax
add dl, dl
jne 0x140bd30fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bd3205
add dl, dl
jne 0x140bd310e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd311b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd3128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd3135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140bd3142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140bd30d6
mov eax, 1
add dl, dl
jne 0x140bd315e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd316b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bd3153
sub eax, ebx
mov ebx, 1
jne 0x140bd31a4
mov ecx, 1
add dl, dl
jne 0x140bd3186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bd3193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bd317b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bd30d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140bd31c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bd31cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bd31b5
cmp eax, 0x7d00
jae 0x140bd31f3
cmp eax, 0x500
jb 0x140bd31ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bd30d6
cmp eax, 0x7f
ja 0x140bd31f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bd30d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140bd322a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140bd30d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20