joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003d9d0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x18003db63
mov dword [rsp + 0x20], 0
jmp 0x18003da23
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x18003db63
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009b934]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
je 0x18003da78
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009b948]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
jne 0x18003da7a
jmp 0x18003da18
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x18003dac9
jmp 0x18003dace
call fcn.180033f60
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x18003daf6
xor eax, eax
jmp 0x18003db65
lea rcx, [rsp + 0x40]
call fcn.180076dd0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.180065920
test eax, eax
jne 0x18003db5e
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.180076d00
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.180076c60
mov eax, 1
jmp 0x18003db65
jmp 0x18003da18
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180033630
add rsp, 0x2c8
ret

Function at 0x18003db90
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18003dbec
xor eax, eax
jmp 0x18003dc49
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x18003dc14
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18003dc49
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.18003d9d0
test eax, eax
jne 0x18003dc39
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18003dc49
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180033630
add rsp, 0x150
pop rdi
ret
Function at 0x18003dd10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x300], 0x19db
mov dword [rsp + 0x304], 0x4eb
mov dword [rsp + 0x308], 0x23dd
mov dword [rsp + 0x30c], 0xb47
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x40]
call fcn.180036bf0
nop
lea rax, [rsp + 0x30]
lea rcx, [0x18009b8d0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180037d70
mov rcx, qword [rsp + 0x340]
call fcn.18003dcb0
mov rcx, qword [rsp + 0x340]
call fcn.180076dd0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008f590
mov rcx, qword [rsp + 0x340]
call fcn.18003dc70
test eax, eax
jne 0x18003de9a
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.18008fc30
mov rdx, qword [rsp + 0x340]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [rsp + 0x340]
call fcn.180076dd0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
mov byte [rcx + rax], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008f590
mov rcx, qword [rsp + 0x340]
call fcn.18003dc70
test eax, eax
jne 0x18003de9a
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.18008fc30
nop
lea rcx, [rsp + 0x40]
call fcn.180037ba0
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.180033630
add rsp, 0x328
pop rdi
pop rsi
ret
Function at 0x180040110
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x1800402a3
mov dword [rsp + 0x20], 0
jmp 0x180040163
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x1800402a3
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009bbc4]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
je 0x1800401b8
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009bbd4]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
jne 0x1800401ba
jmp 0x180040158
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x180040209
jmp 0x18004020e
call fcn.180033f60
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x180040236
xor eax, eax
jmp 0x1800402a5
lea rcx, [rsp + 0x40]
call fcn.180076dd0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.180065920
test eax, eax
jne 0x18004029e
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.180076d00
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.180076c60
mov eax, 1
jmp 0x1800402a5
jmp 0x180040158
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180033630
add rsp, 0x2c8
ret

Function at 0x1800402d0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18004032c
xor eax, eax
jmp 0x180040389
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x180040354
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180040389
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.180040110
test eax, eax
jne 0x180040379
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180040389
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180033630
add rsp, 0x150
pop rdi
ret
Function at 0x180040f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x58]
and ax, 1
movzx eax, ax
test eax, eax
je 0x180040f80
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30c]
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30e]
imul eax, ecx
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30d]
add eax, ecx
jmp 0x18004111a
mov cl, 4
call fcn.18003d020
test eax, eax
jne 0x180040f95
mov eax, 0xfffffff6
jmp 0x18004111a
lea rdx, [0x1800b9b28]
mov rcx, qword [rsp + 0x48]
call fcn.18003ffb0
test eax, eax
jne 0x180040fb4
mov eax, 0xfffffff5
jmp 0x18004111a
mov eax, dword [0x1800b9b28]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx ecx, word [rsp + 0x20]
mov word [rax + 0x31c], cx
mov rax, qword [rsp + 0x40]
movzx ecx, word [rsp + 0x22]
mov word [rax + 0x31e], cx
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.1800431f0
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.180044f10
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30e]
test eax, eax
je 0x180041026
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30f]
test eax, eax
jne 0x180041043
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.180043260
mov eax, 0xfffffff4
jmp 0x18004111a
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.1800432e0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, 0x1388
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180041102
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x58]
or ax, 1
mov rcx, qword [rsp + 0x40]
mov word [rcx + 0x58], ax
cmp qword [0x1800b74f8], 0xffffffffffffffff
jne 0x1800410d7
mov r8, qword [rsp + 0x40]
xor edx, edx
lea rcx, [0x180041510]
call fcn.180077eb0
mov qword [0x1800b74f8], rax
mov edx, 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30c]
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30e]
imul eax, ecx
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30d]
add eax, ecx
jmp 0x18004111a
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.180043260
mov eax, 0xffffff9c
add rsp, 0x38
ret
Function at 0x180042600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x90], 0
je 0x180042684
movzx eax, byte [0x1800b74f8]
mov byte [rsp], al
mov dword [rsp + 4], 0
jmp 0x180042641
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
movzx eax, word [rsp + 0x30]
cmp dword [rsp + 4], eax
jge 0x180042676
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp]
xor eax, ecx
movsxd rcx, dword [rsp + 4]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 0x90]
mov byte [rdx + rcx], al
jmp 0x180042637
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsp + 0x30]
mov word [rax + 0x2a], cx
add rsp, 0x18
ret

Function at 0x1800431f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x180043207
jmp 0x180043252
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x10], rax
mov r8, qword [rsp + 0x30]
xor edx, edx
lea rcx, [0x1800433b0]
call fcn.180077eb0
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
jne 0x180043252
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18004323c
add rsp, 0x28
ret
Function at 0x1800440e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x180044273
mov dword [rsp + 0x20], 0
jmp 0x180044133
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x180044273
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009c490]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
je 0x180044188
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009c494]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
jne 0x18004418a
jmp 0x180044128
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x1800441d9
jmp 0x1800441de
call fcn.180033f60
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x180044206
xor eax, eax
jmp 0x180044275
lea rcx, [rsp + 0x40]
call fcn.180076dd0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.180065920
test eax, eax
jne 0x18004426e
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.180076d00
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.180076c60
mov eax, 1
jmp 0x180044275
jmp 0x180044128
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180033630
add rsp, 0x2c8
ret

Function at 0x1800442a0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1800442fc
xor eax, eax
jmp 0x180044359
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x180044324
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180044359
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.1800440e0
test eax, eax
jne 0x180044349
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180044359
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180033630
add rsp, 0x150
pop rdi
ret
Function at 0x180044420
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x300], 0x19db
mov dword [rsp + 0x304], 0x4eb
mov dword [rsp + 0x308], 0x23dd
mov dword [rsp + 0x30c], 0xb47
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x40]
call fcn.180036bf0
nop
lea rax, [rsp + 0x30]
lea rcx, [0x18009c460]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180037d70
mov rcx, qword [rsp + 0x340]
call fcn.1800443c0
mov rcx, qword [rsp + 0x340]
call fcn.180076dd0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008f590
mov rcx, qword [rsp + 0x340]
call fcn.180044380
test eax, eax
jne 0x1800445aa
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.18008fc30
mov rdx, qword [rsp + 0x340]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [rsp + 0x340]
call fcn.180076dd0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
mov byte [rcx + rax], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008f590
mov rcx, qword [rsp + 0x340]
call fcn.180044380
test eax, eax
jne 0x1800445aa
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.18008fc30
nop
lea rcx, [rsp + 0x40]
call fcn.180037ba0
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.180033630
add rsp, 0x328
pop rdi
pop rsi
ret
Function at 0x180044f10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.180044420
lea rax, [rsp + 0x30]
test rax, rax
je 0x180045013
lea rdx, [0x18009c458]
lea rcx, [rsp + 0x30]
call fcn.1800651d8
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180045013
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.1800671b0
mov rcx, qword [rsp + 0x20]
call fcn.180067874
mov rcx, qword [rsp + 0x150]
mov dword [rcx + 0x8c], eax
mov rax, qword [rsp + 0x150]
mov rax, qword [rax + 0x18]
add rax, 0x100
mov rcx, qword [rsp + 0x150]
mov qword [rcx + 0x84], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.1800671b0
mov rax, qword [rsp + 0x150]
movsxd rax, dword [rax + 0x8c]
mov r9, qword [rsp + 0x20]
mov r8, rax
mov edx, 1
mov rax, qword [rsp + 0x150]
mov rcx, qword [rax + 0x84]
call fcn.18006549c
mov rcx, qword [rsp + 0x20]
call fcn.180064c34
mov rax, qword [rsp + 0x150]
cmp qword [rax + 0x84], 0
je 0x180045032
mov rcx, qword [rsp + 0x150]
call fcn.180044cc0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180033630
add rsp, 0x140
pop rdi
ret
Function at 0x180047560
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x1800476f3
mov dword [rsp + 0x20], 0
jmp 0x1800475b3
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x1800476f3
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009c72c]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
je 0x180047608
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009c730]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
jne 0x18004760a
jmp 0x1800475a8
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x180047659
jmp 0x18004765e
call fcn.180033f60
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x180047686
xor eax, eax
jmp 0x1800476f5
lea rcx, [rsp + 0x40]
call fcn.180076dd0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.180065920
test eax, eax
jne 0x1800476ee
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.180076d00
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.180076c60
mov eax, 1
jmp 0x1800476f5
jmp 0x1800475a8
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180033630
add rsp, 0x2c8
ret

Function at 0x180047720
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18004777c
xor eax, eax
jmp 0x1800477d9
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x1800477a4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800477d9
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.180047560
test eax, eax
jne 0x1800477c9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800477d9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180033630
add rsp, 0x150
pop rdi
ret
Function at 0x1800510a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
mov eax, dword [rsp + 0x28]
bts eax, 8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
and eax, 1
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
shr eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax*2]
mov ecx, dword [rsp + 4]
neg ecx
and ecx, 0x7ff
xor eax, ecx
shr eax, 4
mov eax, eax
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4]
mov ecx, dword [rsp]
add ecx, eax
mov eax, ecx
mov dword [rsp], eax
cmp dword [rsp + 0x28], 2
jae 0x1800510c5
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x180051130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp + 4], 0
mov dword [rsp], 0x100
mov eax, dword [rsp + 0x28]
bts eax, 8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x30]
shl eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x30]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x28]
shr ecx, 8
add eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax*2]
mov ecx, dword [rsp + 0x28]
shr ecx, 7
and ecx, 1
neg ecx
and ecx, 0x7ff
xor eax, ecx
shr eax, 4
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov ecx, dword [rsp + 4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
shl eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
not eax
mov ecx, dword [rsp]
and ecx, eax
mov eax, ecx
mov dword [rsp], eax
cmp dword [rsp + 0x28], 0x10000
jb 0x180051162
mov eax, dword [rsp + 4]
add rsp, 0x18
ret