joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800175f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.18001711c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rax + 0xdac]
mov rcx, rbx
call fcn.180017468
test eax, eax
jle 0x180017108
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jb 0x1800170f2
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800175f4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x18004a470]
xor edi, edi
test rbx, rbx
je 0x1800176aa
mov eax, dword [rbx + 4]
test eax, eax
jne 0x180017625
cmp dword [rbx + 0xc], eax
jne 0x18001762e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xc], eax
mov rdi, rbx
mov rbx, qword [rbx + 0x28]
jmp 0x180017607
test eax, eax
jne 0x180017625
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xc]
cmp eax, 0x3e8
jbe 0x180017625
cmp dword [rbx + 0x10], 0
jne 0x180017657
mov rcx, qword [rbx + 0x20]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
cmp dword [rbx + 0x10], 4
jne 0x18001766c
mov rcx, qword [rbx + 0x20]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x180017680
cmp dword [rbx + 0x10], 2
je 0x180017625
mov rax, qword [rbx + 0x28]
mov rcx, rbx
test rdi, rdi
je 0x18001769e
mov qword [rdi + 0x28], rax
call fcn.18001f744
mov rbx, qword [rdi + 0x28]
jmp 0x180017607
mov qword [0x18004a470], rax
call fcn.18001f744
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800176b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test r8d, r8d
jle 0x180017702
mov r8d, esi
xor r9d, r9d
mov rdx, rbp
sub r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
add rbp, rcx
add ebx, ecx
cmp ecx, 0xffffffff
je 0x180017719
cmp ebx, esi
jl 0x1800176dc
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edx, 2
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x180017704
Function at 0x180017738
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x478], 0
mov dword [rsp + 0x47c], 0x64
lea ebx, [rax + 0x7530]
jmp 0x18001781b
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x240]
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x478]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x240], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x180017829
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x240]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18001781b
mov rcx, qword [rdi + 0x20]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x180017829
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180017829
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jb 0x18001777c
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180017844
Capabilities:
Get socket status
Resolve dns
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x30], 0
lea ebx, [rax + 0x7530]
mov dword [rsp + 0x34], 0x64
jmp 0x1800178f9
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x160]
mov qword [rbp + 0x168], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov dword [rbp + 0x160], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 1
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x50]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x180017965
mov rcx, qword [rdi + 0x20]
lea rdx, [rbp + 0x160]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x180017905
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jb 0x18001788d
jmp 0x180017965
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180017965
mov eax, 2
movzx ecx, si
mov word [rsp + 0x38], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbp + 0x3b0]
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [rdi + 0x20]
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18001975c
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov r12d, 0x8000
mov r15, r8
mov ecx, r12d
mov rsi, rdx
call fcn.18001f784
lea r8, str._s
mov r9, r14
mov rcx, rax
mov edx, r12d
mov rbx, rax
call fcn.18001fb3c
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbx
mov rbp, rax
call fcn.18001f744
cmp rbp, 0xffffffffffffffff
je 0x18001987a
lea rdi, [rsi + 0x2c]
test byte [rsi], 0x10
je 0x180019851
mov al, byte [rdi]
cmp al, byte [0x18003293c]
jne 0x1800197e7
mov al, byte [rdi + 1]
cmp al, byte [0x18003293d]
je 0x18001985d
mov al, byte [rdi]
cmp al, byte [0x180032940]
jne 0x180019807
mov al, byte [rdi + 1]
cmp al, byte [0x180032941]
jne 0x180019807
mov al, byte [rdi + 2]
cmp al, byte [0x180032942]
je 0x18001985d
mov rcx, r12
call fcn.18001f784
lea r8, [0x180032704]
mov r9, rdi
mov rcx, rax
mov rdx, r12
mov rbx, rax
call fcn.18001fb3c
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.18001989c
mov r8d, 1
mov rdx, rbx
mov rcx, r14
call r15
mov rcx, rbx
call fcn.18001f744
jmp 0x18001985d
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call r15
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800197cd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180019ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
cmp dword [rsp + 0x30], 0
jne 0x180019cbe
jmp 0x180019d77
mov eax, dword [rsp + 0x30]
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 0
mov byte [rsp + rcx + 4], al
mov eax, dword [rsp + 0x30]
shr eax, 8
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 1
mov byte [rsp + rcx + 4], al
mov eax, dword [rsp + 0x30]
shr eax, 0x10
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 2
mov byte [rsp + rcx + 4], al
mov eax, dword [rsp + 0x30]
shr eax, 0x18
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 3
mov byte [rsp + rcx + 4], al
mov dword [rsp], 0
jmp 0x180019d30
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x180019d77
mov eax, dword [rsp]
mov qword [rsp + 8], rax
mov ecx, dword [rsp]
xor edx, edx
mov eax, ecx
mov ecx, 4
div rcx
mov rax, rdx
movzx eax, byte [rsp + rax + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movsx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp]
mov rdx, qword [rsp + 0x20]
mov byte [rdx + rcx], al
jmp 0x180019d28
add rsp, 0x18
ret
Function at 0x180019d90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
call fcn.180019c90
mov qword [rsp + 0x20], rax
xor eax, eax
cmp eax, 1
je 0x180019e08
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180019df9
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x40
jb 0x180019df9
cmp qword [rsp + 0x28], 0x400
jae 0x180019df9
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
jne 0x180019df9
jmp 0x180019e08
mov rax, qword [rsp + 0x20]
dec rax
mov qword [rsp + 0x20], rax
jmp 0x180019d9e
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x18001a6f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x18]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 6]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
cmp qword [rsp + 0x20], 0
je 0x18001a7d9
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp]
mov eax, dword [rax + 0x10]
mov qword [rsp + 0x18], rax
mov rdi, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
cmp eax, 0x20000000
jne 0x18001a7c8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x18]
mov dword [rax], ecx
mov rax, qword [rsp]
add rax, 0x28
mov qword [rsp], rax
jmp 0x18001a72f
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x18001b7a4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
lea rsi, [0x180047840]
mov ebp, 0x800
lea r8, str.._._._..._._._
mov rcx, rsi
mov r9d, 0x1800
mov edx, ebp
call fcn.18001b8d4
xor r14d, r14d
mov eax, r14d
xor byte [rax + rsi], 0x8a
inc rax
cmp rax, rbp
jl 0x18001b7e6
lea rcx, [rsp + 0x20]
mov r8d, ebp
mov rdx, rsi
call fcn.180016644
jmp 0x18001b896
lea rcx, [rsp + 0x20]
call fcn.180016760
lea rcx, [rsp + 0x20]
movsx ebx, ax
call fcn.180016760
mov rcx, qword [0x180051d08]
movsx rdi, di
mov edx, ebx
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x18001b880
dec edx
je 0x18001b869
dec edx
jne 0x18001b896
lea rcx, [rsp + 0x20]
movsx edx, ax
movsx rbx, ax
call fcn.1800168f4
mov rcx, qword [0x180051d08]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001fe20
jmp 0x18001b896
lea rcx, [rsp + 0x20]
call fcn.180016654
mov rcx, qword [0x180051d08]
mov dword [rdi + rcx + 8], eax
jmp 0x18001b896
lea rcx, [rsp + 0x20]
call fcn.180016760
mov rdx, qword [0x180051d08]
mov word [rdi + rdx + 8], ax
lea rcx, [rsp + 0x20]
call fcn.180016760
movzx edi, ax
test ax, ax
jg 0x18001b807
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp fcn.18001fa30

Function at 0x18001b8d4
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x18001b91a
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov ebx, edx
mov r11, rcx
xor r10d, r10d
movsxd rdi, r9d
mov eax, r10d
mov rcx, rdi
inc r10d
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [rcx + r8 - 1]
xor byte [r11], al
inc r11
cmp r10d, ebx
jl 0x18001b8ed
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x18001b91c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov ebx, edx
mov r11, rcx
test edx, edx
jle 0x18001b949
mov eax, r10d
inc r10d
cdq
idiv r9d
movsxd rax, edx
mov cl, byte [rax + r8]
xor byte [r11], cl
inc r11
cmp r10d, ebx
jl 0x18001b92d
mov rbx, qword [rsp + 8]
ret
Function at 0x18001c958
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
mov eax, 0x52964ee9
cmp byte [rcx], r9b
je 0x18001c982
movzx ecx, word [rcx]
mov edx, eax
inc r9d
ror edx, 8
add edx, ecx
mov ecx, r9d
add rcx, r8
xor eax, edx
cmp byte [rcx], 0
jne 0x18001c968
repz ret

Function at 0x18001c984
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov r13, rcx
mov r8d, 0x20202020
mov r9, qword [rax + 0x60]
mov r10, qword [r9 + 0x18]
add r10, 0x10
mov r9, qword [r10]
cmp r9, r10
je 0x18001cb74
mov rdi, qword [r9 + 0x30]
mov r9, qword [r9]
movsxd rax, dword [rdi + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x18001c9c2
lea rsi, [rdi + rcx]
cmp dword [rsi + 0x18], 0
je 0x18001c9c2
mov ecx, dword [rsi + 0xc]
mov eax, dword [rcx + rdi]
or eax, r8d
cmp eax, 0x6c64746e
jne 0x18001c9c2
mov eax, dword [rcx + rdi + 4]
or eax, r8d
cmp eax, 0x6c642e6c
jne 0x18001c9c2
movzx eax, word [rcx + rdi + 8]
or ax, 0x20
cmp ax, 0x6c
jne 0x18001c9c2
mov ebx, dword [rsi + 0x1c]
mov ebp, dword [rsi + 0x20]
mov eax, dword [rsi + 0x24]
mov r8d, edx
add rax, rdi
add rbx, rdi
add rbp, rdi
mov rcx, r13
shl r8, 4
xor edx, edx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], rbp
xor r15d, r15d
call fcn.18001fa30
xor r14d, r14d
cmp dword [rsi + 0x18], r14d
jbe 0x18001cb0f
mov ebp, dword [rbp + r14*4]
add rbp, rdi
je 0x18001cafd
mov eax, 0x694b
cmp word [rbp], ax
jne 0x18001caa8
mov rcx, rbp
call fcn.18001c958
cmp eax, 0x8dcd4499
jne 0x18001caa8
mov rax, qword [rsp + 0x88]
movzx eax, word [rax + r14*2]
mov ecx, dword [rbx + rax*4]
add rcx, rdi
call fcn.18001c91c
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov eax, 0x775a
cmp word [rbp], ax
jne 0x18001cafd
mov ebx, r15d
mov rcx, rbp
add rbx, rbx
call fcn.18001c958
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x20]
mov dword [r13 + rbx*8], eax
movzx eax, word [r8 + r14*2]
mov ecx, dword [rdx + rax*4]
inc r15d
mov dword [r13 + rbx*8 + 4], ecx
movzx eax, word [r8 + r14*2]
mov ecx, dword [rdx + rax*4]
add rcx, rdi
mov qword [r13 + rbx*8 + 8], rcx
cmp r15d, dword [rsp + 0x78]
je 0x18001cb0f
mov rbx, rdx
mov rbp, qword [rsp + 0x28]
inc r14d
cmp r14d, dword [rsi + 0x18]
jb 0x18001ca5d
lea r11d, [r15 - 1]
xor r10d, r10d
test r11d, r11d
je 0x18001cb74
mov eax, r15d
sub eax, r10d
dec eax
je 0x18001cb6c
lea r8, [r13 + 4]
lea r9, [r13 + 0x14]
mov ebx, eax
mov esi, dword [r8]
mov edi, dword [r9]
cmp esi, edi
jbe 0x18001cb5f
mov eax, dword [r9 - 4]
mov edx, dword [r8 - 4]
mov rcx, qword [r8 + 4]
mov dword [r8 - 4], eax
mov rax, qword [r9 + 4]
mov dword [r8], edi
mov dword [r9 - 4], edx
mov dword [r9], esi
mov qword [r9 + 4], rcx
mov qword [r8 + 4], rax
add r9, 0x10
add r8, 0x10
dec rbx
jne 0x18001cb2f
inc r10d
cmp r10d, r11d
jb 0x18001cb1b
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001ce00
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
cmp dword [0x18004d840], 0
mov rsi, qword [rsp + 0xa0]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rbx, rcx
je 0x18001cf0b
mov eax, dword [0x18004d83c]
mov rcx, qword [0x180051bf8]
mov r10, qword [0x180051bf0]
cmp eax, 1
jne 0x18001ce58
test r10, r10
jne 0x18001ce6a
cmp eax, 2
jne 0x18001cf0b
test rcx, rcx
je 0x18001cf0b
test rbx, rbx
je 0x18001ce74
mov r9, rbx
jmp 0x18001ce91
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [0x180051bf8]
mov r10, qword [0x180051bf0]
mov r9, rax
mov eax, dword [0x18004d83c]
and qword [rsp + 0x50], 0
xor r8d, r8d
mov edx, 0x1fffff
and qword [rsp + 0x48], r8
and qword [rsp + 0x40], r8
and qword [rsp + 0x38], r8
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
cmp eax, 1
jne 0x18001cecf
lea rcx, [rsp + 0x60]
call r10
jmp 0x18001ceec
mov eax, dword [0x180051c00]
mov qword [0x18004d830], rcx
lea rcx, [rsp + 0x60]
mov dword [0x18004d838], eax
call fcn.18001f652
test eax, eax
jne 0x18001cf0b
test byte [rsp + 0xa8], 4
jne 0x18001cf04
mov rcx, qword [rsp + 0x60]
call fcn.18001d53c
mov rax, qword [rsp + 0x60]
jmp 0x18001cf63
mov rax, qword [rsp + 0xb0]
test rbx, rbx
jne 0x18001cf3c
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xa8]
mov r9, rsi
mov r8, rdi
mov rdx, rbp
mov rcx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18001cf63
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xa8]
mov r9, rdi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x18001d53c
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x18004d840], 0
mov rbx, rcx
je 0x18001d5ab
mov eax, dword [0x18004d83c]
cmp eax, 1
jne 0x18001d56f
mov r8, qword [0x180051bd8]
test r8, r8
je 0x18001d56f
lea rdx, [rsp + 0x38]
call r8
jmp 0x18001d59d
cmp eax, 2
jne 0x18001d5ab
mov rax, qword [0x180051be0]
test rax, rax
je 0x18001d5ab
mov qword [0x18004d830], rax
mov eax, dword [0x180051be8]
lea rdx, [rsp + 0x38]
mov dword [0x18004d838], eax
call fcn.18001f63f
test eax, eax
jne 0x18001d5ab
mov eax, dword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
Function at 0x18001df80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ecx, 0x37
call fcn.18001b970
mov ecx, 0x27
movzx ebx, ax
call fcn.18001b970
mov edx, 1
xor ecx, ecx
movzx edi, ax
call fcn.18000d26c
call fcn.180015364
call fcn.18001f0ac
cmp ebx, 1
jne 0x18001dfd9
cmp edi, ebx
jne 0x18001dfd0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001dfc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
cmp edi, 1
jne 0x18001e018
mov r9, qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18001ce00
or edx, 0xffffffff
mov rcx, rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18001e3d4
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rax, [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
and dword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r8d, 0x20
mov dl, 2
mov dword [rbp + 0x18], 0
mov word [rbp + 0x1c], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp + 0x10], eax
test eax, eax
je 0x18001e454
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp + 0x10]
add rsp, 0x60
pop rbp
ret

Function at 0x18001f318
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r8d
mov rdi, rdx
mov rbp, rcx
test r8d, r8d
je 0x18001f372
xor r9d, r9d
mov edx, ebx
mov rcx, rbp
lea r8d, [r9 + 1]
add rdx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18001f372
add ebx, eax
cmp ebx, 2
jb 0x18001f36e
lea eax, [rbx - 1]
cmp byte [rax + rdi], 0xa
jne 0x18001f36e
lea eax, [rbx - 2]
cmp byte [rax + rdi], 0xd
je 0x18001f38a
cmp ebx, esi
jb 0x18001f33c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea ecx, [rbx - 2]
mov eax, ebx
mov byte [rcx + rdi], 0
jmp 0x18001f375

Function at 0x180020cdc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.180020b44

Function at 0x180028ce0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180028cf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180028cf8
xor eax, eax
test eax, eax
je 0x180028d08
mov ecx, eax
call fcn.1800224ec
or eax, 0xffffffff
jmp 0x180028d0a
xor eax, eax
add rsp, 0x28
ret
Function at 0x180028d10
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180028d28
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180028d2a
xor eax, eax
test eax, eax
je 0x180028d3a
mov ecx, eax
call fcn.1800224ec
or eax, 0xffffffff
jmp 0x180028d3c
xor eax, eax
add rsp, 0x28
ret

Function at 0x180028d44
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x180028d5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180028d5c
xor eax, eax
test eax, eax
je 0x180028d6c
mov ecx, eax
call fcn.1800224ec
or eax, 0xffffffff
jmp 0x180028d6e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400011e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001213
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001256
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001251
cmp rbx, r11
jae 0x140001256
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001240
cmp rbx, r11
jb 0x14000125a
xor eax, eax
jmp 0x140001266
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CAboutDlg.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14000dac3
cmp dword [rcx + 0xd8], 0
jne 0x14000dac3
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14001ce30
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14000da28
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret