joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001d84
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
mov rbx, r9
mov r12, r8
mov r11d, edx
mov rsi, rcx
test edx, edx
je 0x180001f00
mov ecx, edx
mov eax, 0x2aaaaaab
shl ecx, 3
imul ecx
mov ecx, r11d
shl ecx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x180001dde
cmp ecx, 4
jne 0x180001de1
add edx, 2
jmp 0x180001de1
add edx, 3
inc edx
cmp dword [r9], edx
jae 0x180001df5
mov dword [r9], edx
mov eax, 0xfffffff0
jmp 0x180001f02
mov eax, 0x55555556
xor edi, edi
mov r10, r8
lea r14, [0x18003f650]
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
test ecx, ecx
jle 0x180001e8c
dec ecx
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
mov ebp, edx
lea edi, [rdx + rdx*2]
movzx edx, byte [rsi]
movzx r8d, byte [rsi + 1]
movzx r9d, byte [rsi + 2]
mov eax, edx
add edx, edx
add rsi, 3
sar rax, 2
and eax, 0x3f
mov al, byte [rax + r14]
mov byte [r10], al
mov eax, r8d
add r10, 4
sar eax, 4
lea ecx, [rax + rdx*8]
and ecx, 0x3f
mov al, byte [rcx + r14]
mov byte [r10 - 3], al
mov eax, r9d
sar eax, 6
lea ecx, [rax + r8*4]
and ecx, 0x3f
mov al, byte [rcx + r14]
mov byte [r10 - 2], al
mov eax, r9d
and eax, 0x3f
dec rbp
mov al, byte [rax + r14]
mov byte [r10 - 1], al
jne 0x180001e29
cmp edi, r11d
jge 0x180001ef4
movzx r8d, byte [rsi]
inc edi
cmp edi, r11d
jge 0x180001ea2
movzx edx, byte [rsi + 1]
jmp 0x180001ea4
xor edx, edx
mov eax, r8d
add r8d, r8d
sar rax, 2
and eax, 0x3f
mov al, byte [rax + r14]
mov byte [r10], al
mov eax, edx
sar eax, 4
lea ecx, [rax + r8*8]
and ecx, 0x3f
mov al, byte [rcx + r14]
mov byte [r10 + 1], al
cmp edi, r11d
jge 0x180001ee4
and edx, 0xf
shl edx, 2
movsxd rax, edx
mov al, byte [rax + r14]
mov byte [r10 + 2], al
jmp 0x180001ee9
mov byte [r10 + 2], 0x3d
add r10, 3
mov byte [r10], 0x3d
inc r10
mov eax, r10d
sub eax, r12d
mov dword [rbx], eax
mov byte [r10], 0
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r12
ret
Function at 0x18000208c
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x18000228f
test rdx, rdx
je 0x18000228f
mov dword [rdx + 0xf0], 0xa
mov ecx, dword [rcx]
mov r14d, 8
mov edx, r14d
call fcn.18001c77c
mov ecx, dword [rbp]
mov r12d, 0xff00ff00
mov ebx, eax
mov edx, r14d
and ebx, r12d
call fcn.18001c788
mov r13d, 0xff00ff
and eax, r13d
mov edx, r14d
or eax, ebx
mov dword [rsi], eax
mov ecx, dword [rbp + 4]
call fcn.18001c77c
mov ecx, dword [rbp + 4]
mov edx, r14d
mov ebx, eax
lea rdi, [rsi + 4]
and ebx, r12d
call fcn.18001c788
mov edx, r14d
and eax, r13d
or eax, ebx
mov dword [rdi], eax
mov ecx, dword [rbp + 8]
call fcn.18001c77c
mov ecx, dword [rbp + 8]
mov edx, r14d
mov ebx, eax
and ebx, r12d
call fcn.18001c788
mov edx, r14d
and eax, r13d
or eax, ebx
mov dword [rsi + 8], eax
mov ecx, dword [rbp + 0xc]
call fcn.18001c77c
mov ecx, dword [rbp + 0xc]
mov edx, r14d
mov ebx, eax
and ebx, r12d
call fcn.18001c788
lea r10, [0x180000000]
mov r11d, eax
mov ebp, 0xff0000
mov r12d, 0xff00
and r11d, r13d
or r11d, ebx
mov ebx, 0xff000000
mov dword [rsi + 0xc], r11d
mov ecx, r11d
mov eax, r11d
shr rax, 8
shr rcx, 0x10
movzx edx, cl
movzx ecx, al
mov eax, dword [r10 + rcx*4 + 0x3e150]
mov r9d, dword [r10 + rdx*4 + 0x3dd50]
btc r9d, 0x18
and eax, ebp
and r9d, ebx
xor r9d, eax
mov eax, r11d
shr rax, 0x18
movzx eax, byte [r10 + rax*4 + 0x3d950]
xor r9d, eax
movzx eax, r11b
mov ecx, dword [r10 + rax*4 + 0x3d550]
and ecx, r12d
xor r9d, ecx
xor r9d, dword [rsi]
mov dword [rsi + 0x10], r9d
xor r9d, dword [rdi]
mov dword [rsi + 0x14], r9d
xor r9d, dword [rsi + 8]
mov dword [rsi + 0x18], r9d
xor r9d, r11d
mov dword [rsi + 0x1c], r9d
lea r9, [0x18003d52c]
mov edx, dword [rdi + 0x18]
add rdi, 0x10
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4 + 0x3e150]
shr rax, 0x10
movzx ecx, al
and r8d, ebp
mov eax, dword [r10 + rcx*4 + 0x3dd50]
and eax, ebx
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r10 + rax*4 + 0x3d950]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r10 + rax*4 + 0x3d550]
and ecx, r12d
xor r8d, ecx
xor r8d, dword [rdi - 4]
xor r8d, dword [r9]
add r9, 4
mov dword [rdi + 0xc], r8d
xor r8d, dword [rdi]
mov dword [rdi + 0x10], r8d
mov ecx, dword [rdi + 4]
xor ecx, r8d
mov dword [rdi + 0x14], ecx
mov eax, dword [rdi + 8]
xor eax, ecx
mov dword [rdi + 0x18], eax
lea rax, [0x18003d550]
cmp r9, rax
jne 0x180002200
xor eax, eax
jmp 0x180002292
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x180002940
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r14, qword [rsp + 0xa8]
and dword [r9], 0
mov r13, qword [rsp + 0xa0]
mov r12d, edx
mov edi, edx
mov rsi, r9
mov rbx, r8
mov rbp, rcx
mov rdx, r14
test rcx, rcx
je 0x180002a7d
test rbx, rbx
je 0x180002a7d
test edi, edi
je 0x180002a7d
test r13, r13
je 0x180002a7d
test r14, r14
je 0x180002a7d
mov r15d, reloc.WS2_32.dll_recv
cmp edi, r15d
jb 0x180002a06
mov rcx, rbp
mov r8, rbx
mov r9, r15
sub rcx, rdx
sub r8, rdx
mov al, byte [rcx + rdx]
xor al, byte [rdx]
mov byte [r8 + rdx], al
inc rdx
dec r9
jne 0x1800029cb
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call fcn.1800022b4
test eax, eax
jne 0x180002a76
add dword [rsi], r15d
add edi, 0xfffffff0
mov rdx, rbx
add rbp, r15
add rbx, r15
cmp edi, r15d
jae 0x1800029bc
test edi, edi
je 0x180002a64
mov r8, rbx
sub rbp, rdx
mov rcx, rdx
sub r8, rdx
mov r9d, edi
mov al, byte [rcx + rbp]
xor al, byte [rcx]
mov byte [rcx + r8], al
inc rcx
dec r9
jne 0x180002a19
movsxd rax, edi
cmp edi, r15d
jae 0x180002a4c
mov r9d, r15d
sub rdx, rbx
lea rcx, [rax + rbx]
sub r9d, edi
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc rcx
dec r9
jne 0x180002a3f
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call fcn.1800022b4
test eax, eax
jne 0x180002a76
add dword [rsi], r15d
mov rdx, rbx
mov r8, r15
mov rcx, r14
call fcn.18001bc00
mov dword [rsi], r12d
xor eax, eax
jmp 0x180002a80
mov eax, 0xfffffffd
jmp 0x180002a80
or eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.18001bbd0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18000449c
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, str.POST
mov rbx, rcx
call fcn.180004ed0
xor r11d, r11d
mov rcx, rbx
cmp qword [rbx + 0x38], r11
jne 0x1800044d0
xor edx, edx
mov byte [rbx + 0x20], r11b
call fcn.180005b84
xor al, al
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x60], r11d
add rsp, 0x20
pop rbx
jmp fcn.180004a64

Function at 0x1800044e0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [0x18003f82c]
mov rbx, rcx
call fcn.180004ed0
lea rdx, [0x18003d357]
mov rcx, rbx
call fcn.1800045f8
and dword [rbx + 0x60], 0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180004a64

Function at 0x180004518
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, str.POST
mov rbx, rcx
call fcn.180004ed0
cmp qword [rbx + 0x38], 0
mov rcx, rbx
jne 0x180004547
xor edx, edx
mov byte [rbx + 0x20], 0
add rsp, 0x20
pop rbx
jmp fcn.180005b84
mov dword [rbx + 0x60], 1
add rsp, 0x20
pop rbx
jmp fcn.180004a64

Function at 0x180004558
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [0x18003f82c]
mov rbx, rcx
call fcn.180004ed0
lea rdx, [0x18003d357]
mov rcx, rbx
call fcn.1800045f8
mov rcx, rbx
mov dword [rbx + 0x60], 1
add rsp, 0x20
pop rbx
jmp fcn.180004a64
Function at 0x180004a64
Capabilities:
Create thread
Send data
Send data on socket
Send http request

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x60], 1
mov rbx, rcx
jne 0x180004aff
cmp qword [rcx + 0x88], 0
jne 0x180004afb
mov rax, qword [rcx + 0x80]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180004a9a
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x80]
mov byte [rbx + 0xc], 1
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, 1
mov rcx, rbx
call fcn.180005de4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rbx + 0x90]
lea r8, [0x1800049dc]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x88], rax
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
jmp 0x180004af5
cmp dword [rcx + 0x60], 0
jne 0x180004af3
add rsp, 0x30
pop rbx
jmp fcn.180004b10

Function at 0x180004b10
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xa4], 5
mov rbx, rcx
je 0x180004b2d
xor al, al
jmp 0x180004bd0
call fcn.18000537c
mov byte [rbx + 0x20], 1
test al, al
jne 0x180004b52
mov rcx, rbx
call fcn.180005718
mov byte [rbx + 0x20], 0
mov dword [rbx + 0xa0], 2
jmp 0x180004b26
mov rdx, qword [rbx + 0x50]
lea rcx, str._______________________m_szHead__n__s
call fcn.18001c6b8
mov rcx, qword [rbx + 0x50]
call fcn.18001c010
movsxd rcx, dword [rbx + 0x40]
mov rdx, qword [rbx + 0x50]
lea r8d, [rax + 1]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x180004b9d
lea rcx, str._____________n______________AHttpSocket::sendMsg_failed_________
call fcn.18001c6b8
mov rcx, rbx
call fcn.180005718
xor dil, dil
jmp 0x180004ba1
setne dil
lea rcx, str._____________n______________AHttpSocket::httpResquest_________
call fcn.18001c6b8
test dil, dil
je 0x180004b42
mov rcx, rbx
call fcn.180004d18
test al, al
je 0x180004b42
mov rcx, rbx
call fcn.180005be0
test al, al
je 0x180004b42
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180004bdc
Capabilities:
Get socket status

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x378]
sub rsp, 0x470
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x360], rax
movsxd rsi, ecx
mov eax, 1
lea r8, [rsp + 0x40]
mov dword [rbp + 0x150], eax
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x38]
lea rdx, [rbp + 0x150]
inc ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x158], rsi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x3c], 0x1f4
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
test eax, eax
jle 0x180004cea
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea rdx, [rbp + 0x150]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test ebx, ebx
je 0x180004ce3
test eax, eax
jne 0x180004ce3
mov byte [rsp + 0x30], al
xor eax, eax
lea r9, [rsp + 0x30]
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
lea rax, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1007
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x180004ce3
lea rdx, [0x18003d357]
lea rcx, [rsp + 0x30]
call fcn.18001cdd0
test eax, eax
jne 0x180004ce3
mov eax, edi
jmp 0x180004cee
mov eax, 0xfffffffe
jmp 0x180004cee
neg edi
sbb eax, eax
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180004d18
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rcx
lea rcx, str._________AHttpSocket::readHttpHead_____________
call fcn.18001c6b8
mov rcx, qword [r12 + 0x58]
test rcx, rcx
je 0x180004d6c
call fcn.18001c1bc
and qword [r12 + 0x58], 0
mov ecx, 0x19000
call fcn.18001ad70
mov rsi, rax
mov ebp, 1
mov byte [rsp + 0x20], 0
xor r13d, r13d
xor dil, dil
xor ebx, ebx
cmp rbx, 0x2800
jge 0x180004df8
mov rcx, r12
call fcn.180005e2c
test al, al
je 0x180004df8
movsxd rcx, dword [r12 + 0x40]
xor r9d, r9d
mov r8d, ebp
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x180004df5
mov al, byte [rsp + 0x20]
mov byte [rbx + rsi], al
add r13d, ebp
add rbx, rbp
cmp rbx, 4
jl 0x180004dee
cmp byte [rbx + rsi - 4], 0xd
jne 0x180004dee
cmp byte [rbx + rsi - 3], 0xa
jne 0x180004dee
cmp byte [rbx + rsi - 2], 0xd
jne 0x180004dee
movzx edi, dil
cmp byte [rbx + rsi - 1], 0xa
cmove edi, ebp
test dil, dil
je 0x180004d8b
jmp 0x180004df8
xor bpl, bpl
movsxd rdi, r13d
mov byte [rdi + rsi], 0
mov qword [rsp + 0x48], recv
and qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov rcx, rsi
call fcn.18001c010
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180003020
nop
lea eax, [r13 + 1]
movsxd rbx, eax
mov rcx, rbx
call fcn.18001ad70
mov qword [r12 + 0x58], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.18001c0d0
mov r8, rdi
mov rdx, rsi
mov rcx, qword [r12 + 0x58]
call fcn.18001bc00
mov rcx, qword [r12 + 0x58]
call fcn.180005740
mov edx, eax
lea rcx, str._________m_szResultHead________len___d
call fcn.18001c6b8
mov rcx, qword [r12 + 0x58]
call fcn.180005740
mov dword [r12 + 0x18], eax
test rsi, rsi
je 0x180004e92
mov rcx, rsi
call fcn.18001c1bc
nop
cmp qword [rsp + 0x48], 0x10
jb 0x180004ea4
mov rcx, qword [rsp + 0x30]
call fcn.18001c1c4
mov al, bpl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180005e84
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0xa4], 5
mov rdi, rcx
je 0x180005eb3
xor al, al
jmp 0x18000605a
xor bpl, bpl
cmp dword [rcx + 0x40], 0xffffffff
je 0x18000604b
mov r14d, dword [rcx + 0x18]
mov ecx, 0x400
xor esi, esi
mov ebx, ecx
mov eax, 0x19000
test r14d, r14d
cmovle r14d, eax
mov ebp, 1
cmp r14d, ecx
cmovl ebx, r14d
movsxd rcx, ebx
call fcn.18001ad70
movsxd rcx, r14d
mov r12, rax
call fcn.18001ad70
mov r13, rax
mov r15, rax
jmp 0x180005fae
movsxd rcx, dword [rdi + 0x40]
xor r9d, r9d
mov r8d, ebx
mov rdx, r12
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x180005fcc
test eax, eax
je 0x180005fc0
movsxd rbx, eax
mov rdx, r12
mov rcx, r15
mov r8, rbx
add esi, eax
call fcn.18001bc00
add dword [rdi + 0x94], ebp
mov ecx, dword [rdi + 0x94]
mov eax, 0x51eb851f
add r15, rbx
mul ecx
shr edx, 5
imul edx, edx, 0x64
cmp ecx, edx
jne 0x180005f64
xor edx, edx
mov rcx, rdi
call fcn.180005b84
pxor xmm1, xmm1
mov eax, r14d
pxor xmm0, xmm0
sub eax, esi
mov dword [rdi + 0x64], esi
mov dword [rdi + 0x6c], eax
mov eax, esi
cvtsi2sd xmm1, rax
mov eax, dword [rdi + 0x18]
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x180041b58]
cvttsd2si rax, xmm1
mov dword [rdi + 0x68], eax
cmp esi, r14d
jg 0x180005fc0
mov eax, 0x400
mov ebx, r14d
sub ebx, esi
cmp ebx, eax
cmovg ebx, eax
mov rcx, rdi
call fcn.180005e2c
test al, al
jne 0x180005f03
jmp 0x180005fd5
mov dword [rdi + 0xa0], 3
jmp 0x180005fd5
mov dword [rdi + 0xa0], ebp
xor bpl, bpl
and dword [rdi + 0x6c], 0
mov dword [rdi + 0x68], 0x64
mov dword [rdi + 0x18], esi
test r12, r12
je 0x180005ff0
mov rcx, r12
call fcn.18001c1bc
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x180006003
call fcn.18001c1bc
and qword [rdi + 0x10], 0
lea eax, [rsi + 1]
movsxd rbx, eax
mov rcx, rbx
call fcn.18001ad70
mov r8, rbx
xor edx, edx
mov rcx, rax
mov qword [rdi + 0x10], rax
call fcn.18001c0d0
mov rcx, qword [rdi + 0x10]
movsxd r8, esi
mov rdx, r13
call fcn.18001bc00
xor edx, edx
mov rcx, rdi
call fcn.180005b84
test r13, r13
je 0x180006048
mov rcx, r13
call fcn.18001c1bc
mov dword [rdi + 0x18], esi
lea rcx, str.__________
call fcn.18001c6b8
mov al, bpl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800064e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
and qword [rax - 0x18], 0
and qword [rax - 0x20], 0
and qword [rax - 0x10], 0
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x18000653d
call fcn.18001c010
test rax, rax
je 0x18000653d
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x18000653f
jmp 0x18000660f
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.180006c3c
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x18000655c
lea rcx, [rsp + 0x28]
call fcn.180006aa0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [rsi + 0x20]
mov r8, qword [rsi + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x180006593
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x180006591
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
jmp 0x18000660f
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsi + 0x10], eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180006600
cmp dword [rsi + 0x10], 0
jbe 0x180006600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov ecx, dword [rsi + 0x10]
call fcn.18001ad70
mov qword [rsi + 8], rax
mov r8d, dword [rsi + 0x10]
mov rdx, rbx
mov rcx, rax
call fcn.18001bc00
test rdi, rdi
je 0x1800065ef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x28]
call fcn.180006c3c
mov eax, 1
jmp 0x18000661b
test rdi, rdi
je 0x18000660f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x28]
call fcn.180006c3c
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180006c8c
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x20], 6
jne 0x180006cfd
cmp dword [rsp + 0x24], 3
jne 0x180006d17
lea rax, str.Microsoft_Windows_8.1
jmp 0x180006e9a
cmp dword [rsp + 0x20], 0xa
jne 0x180006d17
cmp dword [rsp + 0x24], 0
jne 0x180006d17
lea rax, str.Microsoft_Windows_10
jmp 0x180006e9a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, str.unknown_OperatingSystem.
lea rcx, [rsp + 0x60]
mov qword [rbx + 0x18], rax
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180006e9e
mov eax, dword [rsp + 0x64]
sub eax, 4
je 0x180006e58
dec eax
je 0x180006de8
dec eax
je 0x180006d90
cmp eax, 4
jne 0x180006e9e
cmp dword [rsp + 0x68], 0
jne 0x180006e9e
lea rax, str.Microsoft_Windows_10
lea rcx, str.Microsoft_Windows_Server_2016_Technical_Preview
cmp byte [rbp + 0x7a], 1
cmovne rax, rcx
jmp 0x180006e9a
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180006dd8
dec eax
je 0x180006dc8
dec eax
je 0x180006db8
dec eax
jne 0x180006e9e
lea rax, str.Microsoft_Windows_8.1
lea rcx, str.Microsoft_Windows_Server_2012_R2
jmp 0x180006d83
lea rax, str.Microsoft_Windows_8
lea rcx, str.Microsoft_Windows_Server_2012
jmp 0x180006d83
lea rax, str.Microsoft_Windows_7
lea rcx, str.Microsoft_Windows_Server_2008_R2
jmp 0x180006d83
lea rax, str.Microsoft_Windows_Vista
lea rcx, str.Microsoft_Windows_Server_2008
jmp 0x180006d83
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180006e4f
dec eax
je 0x180006e46
dec eax
jne 0x180006e9e
cmp byte [rbp + 0x7a], 1
jne 0x180006e16
cmp word [rsp + 0x30], 9
jne 0x180006e16
lea rax, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x180006e9a
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x180006e2e
lea rax, str.Microsoft_Windows_Server_2003
jmp 0x180006e9a
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x180006e9e
lea rax, str.Microsoft_Windows_Server_2003_R2
jmp 0x180006e9a
lea rax, str.Microsoft_Windows_XP
jmp 0x180006e9a
lea rax, str.Microsoft_Windows_2000
jmp 0x180006e9a
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180006e7c
cmp eax, 0xa
je 0x180006e73
cmp eax, 0x5a
jne 0x180006e9e
lea rax, str.Microsoft_Windows_Me
jmp 0x180006e9a
lea rax, str.Microsoft_Windows_98
jmp 0x180006e9a
cmp dword [rsp + 0x70], 2
jne 0x180006e8c
lea rax, str.Microsoft_Windows_NT_4.0
jmp 0x180006e9a
cmp dword [rsp + 0x70], 1
jne 0x180006e9e
lea rax, str.Microsoft_Windows_95
mov qword [rbx + 0x18], rax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18001bbd0
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret
Function at 0x180006ec0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rdx, [0x18003ff4c]
mov rcx, qword [rcx + 0x10]
call fcn.18001cdd0
lea r12, str.C:Program_Files__x86_
lea rcx, str.C:Program_Files
xor r14d, r14d
test eax, eax
cmovne r12, rcx
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x61], r14
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1800034cc
lea rdx, [rbp - 0x21]
lea rcx, [rsp + 0x20]
call fcn.180003524
nop
mov rax, qword [rbp - 0x19]
mov rsi, qword [rbp - 0x21]
sub rax, rsi
sar rax, 3
mov edi, r14d
movsxd r13, eax
test eax, eax
jle 0x180007007
mov rbx, qword [rsi + rdi*8]
mov qword [rbp + 0x17], recv
mov qword [rbp + 0xf], r14
mov byte [rbp - 1], r14b
mov rcx, rbx
call fcn.18001c010
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 1]
call fcn.180003020
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180006fdc
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x180006ff6
cmp qword [rbp + 0x17], 0x10
jb 0x180006fec
mov rcx, qword [rbp - 1]
call fcn.18001c1c4
inc rdi
cmp rdi, r13
jge 0x180007007
jmp 0x180006f7e
cmp qword [rbp + 0x17], 0x10
jb 0x180007007
mov rcx, qword [rbp - 1]
call fcn.18001c1c4
nop
test rsi, rsi
je 0x180007015
mov rcx, rsi
call fcn.18001c1c4
nop
lea rcx, [rsp + 0x20]
call fcn.1800037d4
mov rax, r12
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret