joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180078a60
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 0xc08]
sub r10d, 1
je 0x180078b08
sub r10d, 1
je 0x180078ae0
cmp r10d, 1
jne 0x180078b1f
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x180078ad1
cmp ecx, r10d
jne 0x180078b1f
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x1008], eax
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1800788e0
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x180078ad1
cmp ecx, 1
jne 0x180078b1f
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov dword [r8 + r9*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov r8d, edx
mov edx, 0xfe
call fcn.1800788e0
add rsp, 0x28
ret

Function at 0x180078b30
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 8]
sub r10d, 1
je 0x180078bc4
sub r10d, 1
je 0x180078b9f
cmp r10d, 1
jne 0x180078bd8
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x180078b93
cmp ecx, r10d
jne 0x180078bd8
xor eax, eax
mov dword [r8 + r9*4 + 8], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x408], eax
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.1800788e0
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x180078b93
cmp ecx, 1
jne 0x180078bd8
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov dword [r8 + r9*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov r8d, edx
mov edx, 0xfc
call fcn.1800788e0
add rsp, 0x28
ret
Function at 0x1800798b0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x180079a5e
push rbp
push rdi
push r13
sub rsp, 0x30
mov rbp, qword [rcx]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rsi
mov rdi, qword [rbp + 0x1a8]
mov r13, rcx
mov qword [rsp + 0x20], r12
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1800798f9
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180079907
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180079915
mov byte [rax], Ordinal_32
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r12d, ax
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r11d, ax
mov word [rsp + 0x50], ax
cmp rcx, rbx
jae 0x18007994f
mov byte [rcx], r12b
inc qword [rbx]
mov rdx, qword [rbx]
mov r12, qword [rsp + 0x20]
cmp rdx, rbx
jae 0x180079966
movzx ecx, byte [rsp + 0x59]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180079974
mov byte [rax], r11b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x180079986
movzx eax, byte [rsp + 0x51]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180079994
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1800799a2
mov byte [rax], 0xf0
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov edx, 0x3e
mov r9, rax
mov rcx, rbp
mov qword [rbx], rsi
sub r9, rsi
mov qword [rdi + 0x1ec0], rax
sub r9, 2
call fcn.180078be0
mov rcx, qword [r13 + 0x1a8]
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
test eax, eax
jns 0x180079a0a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180063d30
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r13
call fcn.180079600
mov rcx, qword [r13 + 0x1a8]
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rdi + 0x1cbf]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x180079a56
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180063d30
add rsp, 0x30
pop r13
pop rdi
pop rbp
repz ret
Function at 0x18007a810
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x1b0]
mov rsi, qword [rcx]
mov rbx, rcx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x18007a881
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.180066a30
mov rcx, rsi
cmp rdi, 0xffffffffffffffff
jne 0x18007a8a6
lea rdx, str.Error_accept__ing_server_connect
call fcn.180063d30
lea eax, [rdi + 0x1f]
jmp 0x18007a90d
lea rdx, str.Connection_accepted_from_server_n
call fcn.180063c80
mov edx, 1
mov rcx, rdi
mov dword [rbx + 0x38c], 0
mov qword [rbx + 0x1b0], rdi
call fcn.18008a2e0
mov dword [rbx + 0x1cc], 1
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x18007a90b
mov rcx, qword [rsi + 0x280]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x18007a90b
mov rcx, rbx
call fcn.18007a6e0
mov eax, Ordinal_46
jmp 0x18007a90d
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18003c690
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18007e860
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x18007e8b2
lea rdx, str.Couldnt_set_desired_mode
call fcn.180063d30
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x18007e8c7
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.180063c80
cmp edi, 0x13
jne 0x18007e8d6
mov rcx, rsi
call fcn.18007e7d0
jmp 0x18007e906
cmp edi, 0x14
jne 0x18007e8e5
mov rcx, rsi
call fcn.18007b360
jmp 0x18007e906
cmp edi, 0x15
jne 0x18007e8f0
lea r8d, [rdi - 8]
jmp 0x18007e8f9
cmp edi, 0x16
jne 0x18007e908
lea r8d, [rdi - 8]
mov edx, 1
mov rcx, rsi
call fcn.18007da60
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18007f050
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x40
mov rbp, qword [rcx]
mov edi, dword [rcx + 0x7bc]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rbx, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x18007f0dc
test edi, edi
jne 0x18007f09a
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rbp
call fcn.180063c80
mov dword [rbx + 0x3b0], edi
inc edi
cmp edi, 2
jne 0x18007f0c3
lea rdx, str.Failed_to_do_PORT
mov rcx, rbp
call fcn.180063d30
lea eax, [rdi + 0x1c]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov edx, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x18007ab70
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rbp
call fcn.180063c80
mov dword [rbx + 0x7c8], 0
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1a8]
cmp dword [rcx + 0x18], 0
je 0x18007f133
or r8, 0xffffffffffffffff
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, rbx
or edx, r8d
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], 0
call fcn.180088670
jmp 0x18007f13d
mov dword [rbx + 0x38c], 1
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x79c], 1
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x180086460
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.180050c3c
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1800864c6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1800864c6
lea rcx, [rsp + 0x20]
call qword [fcn.180056418]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x148
ret
jmp 0x180086460

Function at 0x1800864e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.180050c3c
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1800864c6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1800864c6
lea rcx, [rsp + 0x20]
call qword [fcn.180056418]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x148
ret
jmp 0x180086460

Function at 0x18008a2e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x18008be50
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x18008be89
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.180056588
test rax, rax
je 0x18008be87
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18008bec0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x18008c00d
movzx edx, byte [rsi + 1]
movzx ecx, byte [rsi]
movzx r8d, byte [rsi + 5]
xor eax, eax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x64], cl
shl cl, 7
movzx eax, dl
shr al, 1
shl dl, 6
mov byte [rsp + 0x58], 8
or al, cl
movzx ecx, byte [rsi + 2]
mov byte [rsp + 0x59], 2
mov byte [rsp + 0x65], al
movzx eax, cl
shl cl, 5
shr al, 2
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
or al, dl
movzx edx, byte [rsi + 3]
mov byte [rsp + 0x66], al
movzx eax, dl
shl dl, 4
shr al, 3
or al, cl
movzx ecx, byte [rsi + 4]
mov byte [rsp + 0x67], al
movzx eax, cl
shl cl, 3
shr al, 4
or al, dl
mov edx, 8
mov byte [rsp + 0x68], al
movzx eax, r8b
shl r8b, 2
shr al, 5
or al, cl
movzx ecx, byte [rsi + 6]
mov byte [rsp + 0x69], al
movzx eax, cl
add cl, cl
shr al, 6
mov byte [rsp + 0x6b], cl
lea rcx, [rsp + 0x64]
or al, r8b
mov byte [rsp + 0x6a], al
call fcn.1800916b0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x18008c011
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x18008c05e
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18003c690
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18008c080
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.18008bec0
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.18008bec0
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18008bec0
Function at 0x18008c190
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rbp, r8
mov rsi, rdx
not rcx
dec rcx
mov rbx, rcx
add rcx, rcx
call qword [fcn.18003cbd0]
mov rdi, rax
test rax, rax
jne 0x18008c1d7
lea eax, [rdi + 0x1b]
jmp 0x18008c2a3
xor ecx, ecx
test rbx, rbx
je 0x18008c1f5
nop
movzx eax, byte [rcx + rsi]
mov byte [rdi + rcx*2 + 1], 0
inc rcx
mov byte [rdi + rcx*2 - 2], al
cmp rcx, rbx
jb 0x18008c1e0
lea rcx, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x18008c290
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18008c283
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [fcn.18003caf4]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18008dcf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 2
mov rsi, rdx
jne 0x18008dd3a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x18008dd2a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x18008dd82
cmp qword [rbx + 0x10], 0
jne 0x18008dd6e
mov rcx, qword [rcx + 0x10]
lea rdx, [0x1800b2534]
call fcn.1800926cc
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x18008dd6e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.180092574
mov rdi, rax
test rax, rax
jne 0x18008dda5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18008dd9c
call fcn.180051590
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180091500
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.18003cbd0]
mov rdi, rax
test rax, rax
jne 0x180091541
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x180091585
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x1800915e5
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
sub r12, 1
jne 0x1800915a0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x180091623
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1800b168c]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1800b168d]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800915f0
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x140001500
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rdx
xor esi, esi
mov edx, ecx
lea ecx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000158b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000158b
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001586
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001560
jmp 0x14000158b
mov rsi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400025b0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002f28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f72
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f74
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002248]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002238]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140063020
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14006d500
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14006d500
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140063090
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1401eb154]
mov rbx, rcx
test esi, esi
jle 0x1400631c0
mov rax, qword [0x1401eb158]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400630db
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140063165
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400630c0
mov rcx, rbx
call fcn.140063ae0
mov rdi, rax
test rax, rax
je 0x1400631e2
mov rax, qword [0x1401eb158]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140063c20
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401eb158]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400631c7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14006315e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140063170
add dword [0x1401eb154], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1401eb158]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14006315e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140063020
nop dword [rax]
xor esi, esi
jmp 0x1400630e8
mov rax, qword [0x1401eb158]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140063020
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140063020
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140063750
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1401eb1c0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401eb1a0]
test rbx, rbx
je 0x1400637ac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400637a3
test rsi, rsi
je 0x1400637a3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140063788
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]