joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ff20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov r15, r8
xor r8d, r8d
mov r14, rdx
mov rbp, rcx
movzx r12d, byte [rax + 0x54]
mov r13d, r12d
and r12d, 3
xor r13d, 3
cmp qword [rdx], r8
je 0x1800100d5
mov qword [rsp + 0x50], rbx
lea rdx, [0x180000000]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
nop dword [rax]
mov rax, r15
dec r15
test rax, rax
je 0x1800100c6
mov rbx, qword [r14]
movzx ecx, byte [rbx + 9]
mov eax, ecx
xor eax, 3
test r13d, eax
jne 0x1800100b0
mov rax, qword [rbx]
mov qword [r14], rax
movzx eax, byte [rbx + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x18000ffbe.12
cdqe
movzx eax, byte [rdx + rax + 0x10114]
mov ecx, dword [rdx + rax*4 + 0x100f0]
add rcx, rdx
jmp rcx
mov rdx, rbx
mov rcx, rbp
call fcn.18000e0d0
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
movzx eax, byte [rbx + 0xa]
mov esi, r8d
test al, al
je 0x180010027
lea rdi, [rbx + 0x20]
nop dword [rax]
mov rdx, qword [rdi]
test rdx, rdx
je 0x180010019
sub qword [rdx + 8], 1
jne 0x180010019
lea rax, [rdx + 0x10]
cmp qword [rdx], rax
jne 0x180010019
xor r9d, r9d
mov r8d, 0x20
mov rcx, rbp
call fcn.180014dd0
movzx eax, byte [rbx + 0xa]
inc esi
add rdi, 8
cmp esi, eax
jl 0x18000fff0
movzx r8d, al
lea r8, [r8*8 + 0x20]
jmp 0x180010096
movzx r8d, byte [rbx + 0xa]
add r8, 2
shl r8, 4
jmp 0x180010096
mov rdx, rbx
mov rcx, rbp
call fcn.180020320
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
mov rdx, rbx
mov rcx, rbp
call fcn.18001b9e0
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
mov r8, qword [rbx + 0x18]
add r8, 0x28
jmp 0x180010096
mov rdx, rbx
mov rcx, rbp
call fcn.18001c6e0
movzx r8d, byte [rbx + 0xb]
jmp 0x180010092
mov r8, qword [rbx + 0x10]
add r8, 0x19
xor r9d, r9d
mov rdx, rbx
mov rcx, rbp
call fcn.180014dd0
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
and cl, 0xf8
mov r14, rbx
or cl, r12b
mov byte [rbx + 9], cl
cmp qword [r14], 0
jne 0x18000ff70
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
cmp qword [r14], 0
cmove r14, r8
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x180011e00
Capabilities:
Read file on windows

Disassembly:
push rbx
mov eax, 0x2050
call fcn.180033690
sub rsp, rax
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rdx, [rsp + 0x20]
call fcn.1800049b0
nop
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.180005970
mov r9, rbx
mov edx, 1
mov r8d, 0x2000
mov rcx, rax
call fcn.18006555c
add qword [rsp + 0x30], rax
cmp rax, 0x2000
je 0x180011e30
lea rcx, [rsp + 0x20]
call fcn.180005b00
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.1800336f0
add rsp, 0x2050
pop rbx
ret
Function at 0x180011e90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x2050
call fcn.180033690
sub rsp, rax
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
call fcn.1800049b0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180005970
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18006555c
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.180005b00
xor eax, eax
test rbx, rbx
setne al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.1800336f0
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rdi
ret

Function at 0x1800169d0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.180016050
test rax, rax
je 0x180016a28
mov r8, qword [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_send
sub rax, rbx
mov qword [r14], r8
mov dword [r14 + 8], ecx
inc rax
jmp 0x180016baa
lea rdx, [0x180095d10]
mov rcx, rbx
call fcn.18006fa30
test rax, rax
je 0x180016a5f
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x180016ba8
cmp edi, 0x78
jne 0x180016a61
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180016d10
jmp 0x180016a6e
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18006f97c
mov rcx, qword [rsp + 0x20]
lea rbp, [0x180094580]
cmp rcx, rbx
jne 0x180016a83
xor eax, eax
jmp 0x180016aad
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180016aa5
nop dword [rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180016a90
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
jne 0x180016b92
mov edx, 0x2e
mov rcx, rbx
call fcn.18005d2d8
mov rsi, rax
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x180016ad0
cmp rcx, 0xc8
ja 0x180016ba8
test rsi, rsi
je 0x180016ba8
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180016b00
call fcn.180066e78
sub rsi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x180016b36
call fcn.180016d10
jmp 0x180016b3b
call fcn.18006f97c
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rcx, rax
jne 0x180016b4e
xor eax, eax
jmp 0x180016b8d
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180016b75
nop dword [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180016b60
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
je 0x180016ba8
lea rcx, [rsp + 0x30]
sub rax, rcx
add rax, rbx
test rax, rax
je 0x180016ba8
mov ecx, 3
movsd qword [r14], xmm0
sub rax, rbx
mov dword [r14 + 8], ecx
inc rax
jmp 0x180016baa
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800336f0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180016d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call fcn.180066e78
xor esi, esi
lea r11, [0x180094580]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x180016d7f
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x180016d70
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x180016d96
mov r12d, ebp
jmp 0x180016da0
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x180016ef8
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180016ef8
movsd xmm2, qword [0x180095d80]
lea r13, [0x180094580]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x180016dfb
test edi, edi
jne 0x180016e50
mov edi, ebp
inc rdx
jmp 0x180016de0
test byte [r8 + r13 + 1], 0x10
je 0x180016e50
test r10d, r10d
jne 0x180016e13
cmp r8b, 0x30
jne 0x180016e13
inc r14d
jmp 0x180016e44
inc r10d
cmp r10d, 0x1e
jg 0x180016e41
test byte [rcx + r13 + 1], 2
je 0x180016e29
add ecx, 0xffffffd0
jmp 0x180016e2f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x180016e44
inc r9d
test edi, edi
je 0x180016e4b
dec r9d
inc rdx
jmp 0x180016de0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x180016ef8
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x180016edf
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x180016e87
lea rdx, [r11 + 2]
jmp 0x180016e91
cmp al, 0x2b
jne 0x180016e8f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x180094580]
test byte [r8 + r11 + 1], 2
je 0x180016ef8
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x180016eb0
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x180016eeb
xorps xmm1, xmmword [0x180095d90]
mov edx, r9d
movaps xmm0, xmm1
call fcn.18006c228
jmp 0x180016efb
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001c370
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rdx
xor eax, r8d
mov r10, rcx
mov r8, rdx
shr r8, 5
inc r8
cmp rdx, r8
jb 0x18001c3ae
nop word [rax + rax]
movzx edx, byte [r10 + r9 - 1]
mov ecx, eax
shl ecx, 5
sub r9, r8
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp r9, r8
jae 0x18001c390
ret
Function at 0x18001c5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x18001c605
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.18001c120
movabs rax, 0x7fffffffffffffe7
cmp rsi, rax
jae 0x18001c66d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x50]
call fcn.18000ec10
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call fcn.18008f650
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.180014e70
int3

Function at 0x180029340
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x2058
call fcn.180033690
sub rsp, rax
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rcx, [rsp + 0x32]
mov eax, 0x23
xor edx, edx
mov r8d, 0x1006
mov word [rsp + 0x30], ax
call fcn.18008fcf0
lea rdi, [rsp + 0x2080]
call fcn.180002580
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x1040]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
mov rcx, qword [rax]
call fcn.18006472c
lea r8, [rsp + 0x1040]
mov edx, 0x1008
lea rcx, [rsp + 0x30]
call fcn.18006152c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180022930
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.1800336f0
add rsp, 0x2058
pop rdi
pop rbx
ret

Function at 0x180029580
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180029611
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x180029608
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800295f3
inc rax
test ecx, ecx
jne 0x1800295e0
test edx, edx
je 0x180029634
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1800295d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800336f0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x180029613
Function at 0x18002b5b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18002b5d4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x18002b662
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18002b630
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18002b630
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.18008f650
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002b64d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18002b655
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18002b5f1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x18002b740
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18002b679
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002b67b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002b6ad
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.18008f650
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002b73d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002b6e8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18002b71e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18006555c
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18002b73d
cmp rsi, rax
ja 0x18002b6f1
test rsi, rsi
je 0x18002b73d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18006555c
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x18002c2e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r8, [0x180093d5c]
lea rcx, [rsp + 0x20]
call fcn.1800652a4
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.180067934
mov edi, eax
xor edx, edx
mov r8d, 2
mov rcx, rsi
call fcn.180067270
mov rcx, rsi
call fcn.180067934
movsxd rbx, eax
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.180067270
add rbx, 2
mov rcx, rbx
call fcn.180073378
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.18008fcf0
mov r9, qword [rsp + 0x20]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.18006555c
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x18002c390
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180027940
nop
mov rcx, qword [rsp + 0x20]
call fcn.180064cf4
mov rdx, rdi
lea rcx, [0x1800b8b32]
call fcn.18002c1e0
mov rcx, rdi
call fcn.180064840
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x18002c403
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c3fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c420
call fcn.180033280
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800336f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1800614b4
int3
Function at 0x180034800
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x180034993
mov dword [rsp + 0x20], 0
jmp 0x180034853
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x180034993
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009b63c]
mov rcx, rax
call fcn.18008f360
test eax, eax
je 0x1800348a8
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009b664]
mov rcx, rax
call fcn.18008f360
test eax, eax
jne 0x1800348aa
jmp 0x180034848
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x1800348f9
jmp 0x1800348fe
call fcn.180034020
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x180034926
xor eax, eax
jmp 0x180034995
lea rcx, [rsp + 0x40]
call fcn.180076e90
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.1800659e0
test eax, eax
jne 0x18003498e
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.180076dc0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.180076d20
mov eax, 1
jmp 0x180034995
jmp 0x180034848
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800336f0
add rsp, 0x2c8
ret

Function at 0x1800349c0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x180034a1c
xor eax, eax
jmp 0x180034a79
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x180034a44
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180034a79
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.180034800
test eax, eax
jne 0x180034a69
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180034a79
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800336f0
add rsp, 0x150
pop rdi
ret
Function at 0x1800384f0
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp], 0
mov eax, 1
imul rax, rax, 0
movzx ecx, byte [rsp + 0x30]
mov byte [rsp + rax + 8], cl
mov dword [rsp + 4], 1
jmp 0x18003852c
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x180038579
mov eax, dword [rsp + 4]
dec eax
cdqe
movzx eax, byte [rsp + rax + 8]
shl eax, 1
movsxd rcx, dword [rsp + 4]
mov byte [rsp + rcx + 8], al
mov eax, dword [rsp + 4]
dec eax
cdqe
movzx eax, byte [rsp + rax + 8]
and eax, 0x80
test eax, eax
je 0x180038577
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 8]
xor eax, 0x1b
movsxd rcx, dword [rsp + 4]
mov byte [rsp + rcx + 8], al
jmp 0x180038522
mov dword [rsp + 4], 0
jmp 0x18003858d
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x1800385bd
movzx eax, byte [rsp + 0x28]
mov ecx, dword [rsp + 4]
sar eax, cl
and eax, 1
test eax, eax
je 0x1800385bb
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 8]
movzx ecx, byte [rsp]
xor ecx, eax
mov eax, ecx
mov byte [rsp], al
jmp 0x180038583
movzx eax, byte [rsp]
add rsp, 0x18
ret

Function at 0x180039710
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x18003c880
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
je 0x18003c8b7
mov rcx, qword [rsp + 0x50]
call fcn.18003ca30
call fcn.18003d220
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
jne 0x18003c8d6
xor eax, eax
jmp 0x18003ca18
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x50]
movsxd rcx, dword [rcx + 8]
mov rdx, qword [0x1800b9af8]
mov qword [rdx + rcx*8], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
cmp qword [rcx + rax*8], 0xffffffffffffffff
je 0x18003ca02
mov eax, 2
mov word [rsp + 0x28], ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x2a], ax
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, qword [0x1800b9af8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x18003c9c4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x18003c9c4
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
mov r8, qword [rcx + rax*8]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
call fcn.18003d290
jmp 0x18003ca02
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
mov qword [rcx + rax*8], 0xffffffffffffffff
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 0xffffffff
mov rax, qword [rsp + 0x50]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800336f0
add rsp, 0x48
ret