joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180073278
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov eax, dword [str.NDIS]
lea r8, str.SYSTEMCurrentControlSetServices_s
mov dword [rbp + 0x70], eax
mov bl, dl
mov al, byte [0x180281cd4]
mov r9, rcx
mov byte [rbp + 0x74], al
lea rcx, [rsp + 0x40]
mov eax, dword [str.tcpip]
mov edx, 0x104
mov dword [rbp + 0x78], eax
movzx eax, word [reloc.WS2_32.dll_WSASetLastError]
mov word [rbp + 0x7c], ax
mov al, byte [0x180281cde]
mov byte [rbp + 0x7e], al
movabs rax, 0x4944545f504e50
mov qword [rsp + 0x38], rax
call fcn.180063190
lea rax, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x180073310
xor al, al
jmp 0x18007338a
mov rcx, qword [rsp + 0x30]
lea rdx, str.Group
xor r8d, r8d
mov r9d, 1
test bl, bl
je 0x180073360
lea rax, [rbp + 0x70]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x78]
mov r9d, 7
lea rdx, str.DependOnService
mov dword [rsp + 0x28], r9d
xor r8d, r8d
jmp 0x18007336d
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rbp
ret
Function at 0x18007339c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
mov edx, 0x104
lea r9, str..CtrlSM
xor esi, esi
lea r8, str._s_s
call fcn.180063190
and qword [rsp + 0x30], rsi
jmp 0x18007340b
cmp rdi, 0xffffffffffffffff
jne 0x18007344f
inc esi
cmp esi, 1
jne 0x18007357d
xor edx, edx
mov rcx, rbx
call fcn.1800730c4
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000000
lea rcx, [rbp - 0x20]
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x1802c69b8], 4
mov r14d, eax
je 0x1800733ea
cmp rdi, 0xffffffffffffffff
je 0x18007357d
mov esi, 0x9c
lea rcx, [rsp + 0x40]
mov r8d, esi
xor edx, edx
call fcn.1801c27d0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
and qword [rsp + 0x38], 0
lea rax, [rbp + 0x120]
and dword [rbp + 0x118], 0
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0x118]
mov dword [rsp + 0x28], 4
mov edx, 0x22019c
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800734db
cmp dword [rbp + 0x120], 0
jbe 0x1800734db
lea rcx, str.aswstm
call fcn.180072f34
test al, al
je 0x18007357d
mov dl, 1
jmp 0x180073575
cmp dword [rsp + 0x44], 6
jb 0x1800734f3
jne 0x18007357d
cmp dword [rsp + 0x48], 1
ja 0x18007357d
and dword [rbp + 0x118], 0
lea rcx, str.nisdrv
call fcn.180072f34
test al, al
jne 0x18007353d
lea rcx, str.360netmon
call fcn.180072f34
test al, al
jne 0x18007353d
lea rcx, str.symnets
call fcn.180072f34
test al, al
jne 0x18007353d
lea r8, [rbp + 0x118]
mov rdx, rbx
xor ecx, ecx
call fcn.1800735a4
jmp 0x180073563
lea r8, [rbp + 0x118]
mov rdx, rbx
mov cl, 1
call fcn.1800735a4
test al, al
je 0x180073563
cmp dword [rbp + 0x118], 0
jne 0x180073563
mov rcx, rbx
call fcn.1800737b4
lea rcx, str.aswstm
call fcn.180072f34
test al, al
je 0x18007357d
xor edx, edx
mov rcx, rbx
call fcn.180073278
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x1f0]
mov rax, rdi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800735a4
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rbx, r8
mov dil, cl
mov r9, rdx
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.180063190
lea rax, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800735fd
xor al, al
jmp 0x180073663
mov rcx, qword [rsp + 0x30]
mov r9d, 4
lea rdx, [0x180281d40]
test dil, dil
je 0x18007363e
lea rax, [rsp + 0x178]
mov dword [rsp + 0x178], r9d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x180073651
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret

Function at 0x180073674
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r8
lea rax, [r11 - 0x18]
mov rdi, rdx
mov qword [r11 - 0x28], rax
mov sil, cl
lea rdx, str.SYSTEMCurrentControlSetControlGroupOrderList
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800736bd
xor al, al
jmp 0x1800737a2
test sil, sil
je 0x180073755
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rbx
lea rdx, str.PNP_TDI
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1800736fc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800736b6
mov ecx, dword [rbx]
add rcx, 4
call fcn.1801ca874
mov rcx, qword [rsp + 0x30]
mov qword [rdi], rax
test rax, rax
je 0x1800736f4
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PNP_TDI
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
je 0x180073792
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi]
call fcn.1801ca87c
and qword [rdi], 0
jmp 0x1800736b6
mov eax, dword [rbx]
cmp eax, 4
jbe 0x180073763
shr eax, 2
dec eax
jmp 0x180073765
xor eax, eax
mov rcx, qword [rdi]
lea rdx, str.PNP_TDI
mov r9d, 3
xor r8d, r8d
mov dword [rcx], eax
mov eax, dword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180079d00
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov rdi, rcx
call fcn.1801d20c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x180079d3b
test al, 0x10
jne 0x180079d5c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180079de5
mov edx, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1801d20c0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180079d7d
test al, 0x10
jne 0x180079d9e
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180079de5
mov edx, 6
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movdqa xmm0, xmmword [0x180283720]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18005d244
nop
lea rcx, [rdi + 0x208]
lea rdx, [rsp + 0x20]
call fcn.18007c62c
mov bl, al
lea rcx, [rsp + 0x20]
call fcn.18005e40c
test bl, bl
setne al
jmp 0x180079de7
xor al, al
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18007ac14
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rbx, rdx
mov rsi, rcx
lea rax, vtable.ProtocolFilters::AutoLock.0
mov qword [r11 - 0x20], rax
lea rbp, [rcx + 0x20]
mov qword [r11 - 0x18], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, rsi
call fcn.18007ad14
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18007ac68
mov rcx, qword [rbx]
lea rdx, [0x180282298]
call fcn.1801c91e8
mov qword [rsi + 0x18], rax
xor edi, edi
test rax, rax
jne 0x18007aca1
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18007ac8c
mov rcx, qword [rbx]
lea rdx, [0x1802822a0]
call fcn.1801c91e8
mov qword [rsi + 0x18], rax
test rax, rax
je 0x18007acf2
mov qword [rsi + 0x10], rdi
mov rcx, rsi
call fcn.18007b8c0
test al, al
jne 0x18007acef
mov rcx, qword [rsi + 0x18]
call fcn.1801c95dc
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18007acc7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rbx + 0x18], 8
jb 0x18007acd7
mov rbx, qword [rbx]
lea rdx, [0x1802822a0]
mov rcx, rbx
call fcn.1801c91e8
mov qword [rsi + 0x18], rax
test rax, rax
je 0x18007acf2
mov dil, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18007b5a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rdx
mov rdi, rcx
lea rax, vtable.ProtocolFilters::AutoLock.0
mov qword [rbp - 0x38], rax
lea r15, [rcx + 0x20]
mov qword [rbp - 0x30], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8, rbx
lea rdx, [rbp - 0x28]
call fcn.18007ae2c
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.18007fcdc
xor r13d, r13d
mov rbx, qword [rbp + 0x30]
cmp rbx, qword [rdi]
je 0x18007b6be
xor r8d, r8d
mov edx, dword [rbx + 0x40]
mov rcx, qword [rdi + 0x18]
call fcn.1801c9b24
mov r9, qword [rdi + 0x18]
lea r8d, [r13 + 0x10]
lea r14d, [r13 + 1]
mov edx, r14d
lea rcx, [rbp - 0x48]
call fcn.1801c9490
cmp rax, 0x10
jne 0x18007b6be
xor r8d, r8d
mov edx, dword [rbx + 0x40]
mov rcx, qword [rdi + 0x18]
call fcn.1801c9b24
mov word [rbp - 0x46], r13w
mov r9, qword [rdi + 0x18]
lea r8d, [r13 + 0x10]
mov edx, r14d
lea rcx, [rbp - 0x48]
call fcn.1801c9890
cmp rax, 0x10
jne 0x18007b6be
mov rsi, qword [rbx + 0x58]
test rsi, rsi
je 0x18007b6a4
lea rcx, [rsi + 0x20]
lea r12, vtable.ProtocolFilters::IOB.0
mov qword [rcx], r12
call fcn.18006d240
mov qword [rsi], r12
mov rcx, rsi
call fcn.18006d240
lea edx, [r13 + 0x40]
mov rcx, rsi
call fcn.18009e42c
mov r8, rbx
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.1800808c4
mov rcx, qword [rdi + 0x18]
call fcn.1801d266c
jmp 0x18007b6c1
mov r14b, r13b
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18007b6f8
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007b6f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007b733
call fcn.18009e42c
movdqa xmm0, xmmword [0x180283730]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], r13b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, r14b
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1801c897c
nop
int3
Function at 0x18007b73c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15, r8
mov rbx, rdx
mov rdi, rcx
lea rax, vtable.ProtocolFilters::AutoLock.0
mov qword [rbp - 0x11], rax
lea r14, [rcx + 0x20]
mov qword [rbp - 9], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rax, vtable.ProtocolFilters::IOB.0
mov qword [rbp - 1], rax
and qword [rbp + 7], 0
and dword [rbp + 0xf], 0
and dword [rbp + 0x13], 0
mov dword [rbp + 0x17], 0x6400000
mov esi, 1
mov dword [rbp + 0x1b], esi
mov r8, rbx
lea rdx, [rbp + 0x1f]
call fcn.18007ae2c
mov r8, rax
lea rdx, [rbp + 0x67]
mov rcx, rdi
call fcn.18007fcdc
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x18007b806
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007b801
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007b8b9
call fcn.18009e42c
mov rbx, qword [rbp + 0x67]
cmp rbx, qword [rdi]
je 0x18007b878
mov qword [rbx + 0x50], r15
xor r8d, r8d
mov edx, dword [rbx + 0x40]
mov rcx, qword [rdi + 0x18]
call fcn.1801c9b24
mov r9, qword [rdi + 0x18]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rsi
lea rcx, [rbp - 0x21]
call fcn.1801c9490
cmp rax, 0x10
jne 0x18007b878
mov qword [rbp - 0x19], r15
xor r8d, r8d
mov edx, dword [rbx + 0x40]
mov rcx, qword [rdi + 0x18]
call fcn.1801c9b24
mov r9, qword [rdi + 0x18]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rsi
lea rcx, [rbp - 0x21]
call fcn.1801c9890
cmp rax, 0x10
jne 0x18007b878
mov rcx, qword [rdi + 0x18]
call fcn.1801d266c
jmp 0x18007b87b
xor sil, sil
lea rax, vtable.ProtocolFilters::IOB.0
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
call fcn.18006d240
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, sil
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1801c897c
nop
int3
Function at 0x18007b8c0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rcx
xor edi, edi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], dil
mov r14d, edi
xor edx, edx
mov rcx, qword [rcx + 0x18]
xor r8d, r8d
call fcn.1801c9b24
mov r9, qword [rsi + 0x18]
mov edx, 1
lea r8d, [rdx + 0xf]
lea rcx, [rbp - 0x58]
call fcn.1801c9490
cmp rax, 0x10
sete al
test al, al
je 0x18007b9d7
cmp word [rbp - 0x56], di
je 0x18007b9da
movzx edx, word [rbp - 0x56]
cmp rdx, qword [rbp - 0x38]
ja 0x18007b95d
mov qword [rbp - 0x38], rdx
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rax, qword [rbp - 0x48]
mov byte [rax + rdx], dil
jmp 0x18007b96d
sub rdx, qword [rbp - 0x38]
xor r8d, r8d
lea rcx, [rbp - 0x48]
call fcn.180067c24
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
movzx ebx, word [rbp - 0x56]
mov r9, qword [rsi + 0x18]
mov r8d, ebx
mov edx, 1
call fcn.1801c9490
cmp rax, rbx
jne 0x18007b9da
mov dword [rbp - 0x28], r14d
mov qword [rbp - 0x20], rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdi
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.1800800b0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rax + 0x10], xmm1
movzx eax, word [rbp - 0x58]
add r14d, eax
mov edx, r14d
mov rcx, qword [rsi + 0x18]
jmp 0x18007b904
mov dil, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x18007ba11
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007ba0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007ba31
call fcn.18009e42c
mov al, dil
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1801c897c
int3
Function at 0x18007badc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, rdx
mov rdi, rcx
lea rax, vtable.ProtocolFilters::AutoLock.0
mov qword [rbp - 0x38], rax
lea r15, [rcx + 0x30]
mov qword [rbp - 0x30], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rsi, [rdi + 0x10]
mov rdx, rbx
mov rcx, rsi
call fcn.18005d18c
nop
mov rbx, qword [rdi]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.180066c0c
mov rax, qword [rdi]
mov qword [rax + 8], rbx
mov rax, qword [rdi]
mov qword [rax], rbx
mov rax, qword [rdi]
mov qword [rax + 0x10], rbx
and qword [rdi + 8], 0
and qword [rbp - 0x18], 0
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
mov r13d, 1
mov r14b, r13b
cmp qword [rsi + 0x18], 8
jb 0x18007bb7d
mov rsi, qword [rsi]
lea rdx, [0x180282298]
mov rcx, rsi
call fcn.1801c91e8
mov rbx, rax
test rax, rax
jne 0x18007bbd8
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18007bcde
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007bbce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007bd31
call fcn.18009e42c
jmp 0x18007bcde
mov esi, 4
jmp 0x18007bc79
cmp dword [rbp + 0x30], 0x7d0
ja 0x18007bc96
mov edx, dword [rbp + 0x30]
cmp rdx, qword [rbp - 0x18]
ja 0x18007bc10
mov qword [rbp - 0x18], rdx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax + rdx], 0
jmp 0x18007bc20
sub rdx, qword [rbp - 0x18]
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.180067c24
mov r9, rbx
mov r8d, 8
mov rdx, r13
lea rcx, [rbp + 0x40]
call fcn.1801c9490
cmp rax, 8
jne 0x18007bc96
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
mov r8d, dword [rbp + 0x30]
mov r9, rbx
mov rdx, r13
call fcn.1801c9490
mov rcx, rax
mov eax, dword [rbp + 0x30]
cmp rcx, rax
jne 0x18007bc96
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18007fff8
mov rcx, rax
mov rax, qword [rbp + 0x40]
mov qword [rcx], rax
mov r9, rbx
mov r8, rsi
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.1801c9490
cmp rax, rsi
je 0x18007bbe2
jmp 0x18007bc99
xor r14b, r14b
mov rcx, rbx
call fcn.1801c95dc
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18007bcd9
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007bcd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007bd2b
call fcn.18009e42c
test r14b, r14b
jne 0x18007bd06
mov rbx, qword [rdi]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.180066c0c
mov rdx, qword [rdi]
mov qword [rdx + 8], rbx
mov rdx, qword [rdi]
mov qword [rdx], rbx
mov rdx, qword [rdi]
mov qword [rdx + 0x10], rbx
and qword [rdi + 8], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, r13b
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.1801c897c
nop
call fcn.1801c897c
int3
Function at 0x18007bf2c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, 1
add rcx, 0x10
cmp qword [rcx + 0x18], 8
jb 0x18007bf54
mov rcx, qword [rcx]
lea rdx, [0x18028140c]
call fcn.1801c91e8
mov rsi, rax
test rax, rax
je 0x18007c03c
mov rax, qword [r14]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18007c031
mov eax, dword [rbx + 0x30]
lea rcx, [rsp + 0x40]
mov r9, rsi
mov dword [rsp + 0x40], eax
mov r8d, 4
mov rdx, rdi
call fcn.1801c9890
cmp rax, 4
jne 0x18007c02e
lea rcx, [rbx + 0x40]
mov r9, rsi
lea r8d, [rax + 4]
mov rdx, rdi
call fcn.1801c9890
cmp rax, 8
jne 0x18007c02e
mov rbp, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp qword [rcx + 0x18], 0x10
jb 0x18007bfcd
mov rcx, qword [rcx]
mov r9, rsi
mov r8, rbp
mov rdx, rdi
call fcn.1801c9890
cmp rax, rbp
jne 0x18007c02e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18007c008
mov rax, qword [rbx + 8]
jmp 0x18007bffd
cmp rbx, qword [rax + 0x10]
jne 0x18007c003
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18007bff0
mov rbx, rax
jmp 0x18007c023
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], 0
jne 0x18007c023
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18007c014
cmp rbx, qword [r14]
jne 0x18007bf7b
jmp 0x18007c031
xor dil, dil
mov rcx, rsi
call fcn.1801c95dc
mov al, dil
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18007dbec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rax, rdx
jb 0x18007dc0b
mov rax, qword [rdx]
lea rdx, [0x18028140c]
mov rcx, rax
call fcn.1801c91e8
mov rsi, rax
test rax, rax
je 0x18007dc5a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1801c9b24
mov edi, dword [rbx + 0x10]
mov r9, rsi
mov rcx, qword [rbx + 8]
mov r8d, edi
mov edx, 1
call fcn.1801c9890
mov rcx, rsi
mov rbx, rax
call fcn.1801c95dc
cmp rbx, rdi
jne 0x18007dc5a
mov al, 1
jmp 0x18007dc5c
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18007eacc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.18007eb14
cmp qword [rbx + 0x68], 0
jne 0x18007eb0e
and qword [rsp + 0x28], 0
lea r8, [0x18007eb7c]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call fcn.1801d1e40
mov qword [rbx + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x18007eb0e
and qword [rbx + 0x68], 0
add rsp, 0x30
pop rbx
ret

Function at 0x180083338
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1802c222c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1802c8348], ecx
jle 0x18008338c
lea rcx, [0x1802c8348]
call fcn.18009ebd8
cmp dword [0x1802c8348], 0xffffffff
jne 0x18008338c
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rcx, [0x1802c8348]
mov dword [0x1802c834c], eax
call fcn.18009eb78
cmp byte [0x1802c834c], 5
sete al
add rsp, 0x28
ret