joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f080
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x290
mov r13, r8
mov rbx, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add ebp, ebp
lea r9d, [rbp + 2]
movsxd rcx, r9d
call fcn.1800251fc
xor esi, esi
mov rdi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], esi
test rax, rax
je 0x18000f0f2
movsxd r8, ebp
mov rdx, r12
mov rcx, rax
mov esi, ebp
mov dword [rsp + 0x20], ebp
mov word [r8 + rax], 0
call fcn.18002525c
mov eax, esi
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
cmp word [rdi + rcx*2 - 2], 0x5c
jne 0x18000f110
cmp word [rbx], 0x5c
jne 0x18000f12d
lea rcx, [rbx + 2]
jmp 0x18000f130
cmp word [rbx], 0x5c
je 0x18000f12d
lea rdx, [0x18002cd48]
lea rcx, [rsp + 0x20]
mov r8d, 2
call fcn.180005da0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea r8d, [rax + rax]
call fcn.180005da0
mov eax, dword [rsp + 0x20]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x38]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x18000f177
lea rdx, [0x18002cd48]
lea rcx, [rsp + 0x20]
mov r8d, 2
call fcn.180005da0
lea rcx, [0x18002d248]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x18002d248]
lea rcx, [rsp + 0x20]
lea r8d, [rax + rax]
call fcn.180005da0
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000f20c
mov dword [r13], 0
nop dword [rax]
cmp word [rsp + 0x6c], 0x2e
jne 0x18000f1e0
movzx eax, word [rsp + 0x6e]
test ax, ax
je 0x18000f1e7
cmp ax, 0x2e
jne 0x18000f1e0
cmp word [rsp + 0x70], 0
je 0x18000f1e7
test byte [rsp + 0x40], 0x10
jne 0x18000f1fb
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000f1c0
jmp 0x18000f203
mov dword [r13], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test rbx, rbx
je 0x18000f219
mov rcx, rbx
call sub.KERNEL32.dll_LocalFree
lea r11, [rsp + 0x290]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x18000f240
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1800379c0]
test rax, rax
jne 0x18000f2d5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000f2b4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x1800379c0], rax
test rax, rax
jne 0x18000f2c0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1800379c0]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x18000f9e0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsxd rcx, dword [0x180033c94]
cmp qword [0x1800362a0], rax
mov rbx, rax
jne 0x18000fa0b
cmp ecx, 0x1f0
jb 0x18000fb35
lea rdx, [0x180035ca0]
mov qword [rsp + 0x58], rsi
xor esi, esi
mov qword [0x1800362a0], rax
mov word [rdx + rcx*2], si
test ecx, ecx
je 0x18000fa3b
lea rdx, [0x180033ca0]
lea rcx, [0x1800360a0]
call fcn.18000fb40
lea rdx, [0x1800360a0]
mov r8d, 0x200
mov rcx, rbx
mov dword [0x180033c94], esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x18000fa62
mov word [0x1800360a0], si
lea rdx, [0x180035ea0]
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x18000fa83
mov word [0x180035ea0], si
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x18000faa7
mov word [0x180033ca0], si
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
mov r8d, dword [rsp + 0x50]
mov rbx, rsi
xor edx, edx
mov ecx, 0x2000000
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x28], rbx
mov rdi, rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x18000fae4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000fafb
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.18001d6a0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
test eax, eax
je 0x18000fb08
mov word [0x180033ca0], si
jmp 0x18000fb1e
lea rcx, [0x180033ca0]
mov r8d, 0x2000
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
test rbx, rbx
je 0x18000fb2b
mov rcx, rbx
call sub.KERNEL32.dll_LocalFree
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x180010550
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1800379d8]
test rax, rax
jne 0x1800105e5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x1800105c4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x1800379d8], rax
test rax, rax
jne 0x1800105d0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1800379d8]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x1800109d0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037a00]
test rax, rax
jne 0x180010a65
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180010a44
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037a00], rax
test rax, rax
jne 0x180010a50
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037a00]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x1800119c0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037a40]
test rax, rax
jne 0x180011a55
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180011a34
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037a40], rax
test rax, rax
jne 0x180011a40
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037a40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180011ee0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037a58]
test rax, rax
jne 0x180011f75
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180011f54
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037a58], rax
test rax, rax
jne 0x180011f60
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037a58]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x1800122f0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037a60]
test rax, rax
jne 0x180012385
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180012364
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037a60], rax
test rax, rax
jne 0x180012370
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037a60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x180013c30
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037a80]
test rax, rax
jne 0x180013cc5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180013ca4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037a80], rax
test rax, rax
jne 0x180013cb0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037a80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180014fb0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037aa0]
test rax, rax
jne 0x180015045
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180015024
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037aa0], rax
test rax, rax
jne 0x180015030
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037aa0]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x180015c10
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, r8
xor r8d, r8d
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], r8
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], r8
mov ebx, r9d
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
mov dword [r11 - 0x48], r8d
mov qword [r11 - 0x18], r8
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180015c8d
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x180015ca0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
lea rax, [rsp + 0x40]
mov rdi, r8
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x278], 0x100
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180015d43
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x278]
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
je 0x180015d28
cmp eax, 0x103
jne 0x180015d2e
mov dword [rdi], esi
mov ebx, esi
jmp 0x180015d2e
mov dword [rdi], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x180015e60
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037ad0]
test rax, rax
jne 0x180015ef5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180015ed4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037ad0], rax
test rax, rax
jne 0x180015ee0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037ad0]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x180016c50
Capabilities:
Match known plugx module

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, qword [rcx + 0x68]
mov r13, rdx
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
test rdx, rdx
je 0x180016c85
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x180016c94
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180016ca3
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x180016cb6
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x180016cc5
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x180016cd4
call qword [sym.imp.GDI32.dll_DeleteDC]
movzx edx, word [rbx + 0x60]
lea r12, [rbp + 0x16]
mov rcx, r13
mov r8, r12
call fcn.180017620
test eax, eax
jne 0x180016dbf
movzx eax, word [rbx + 0x60]
movzx r9d, word [rbx + 0x64]
movzx r8d, word [rbx + 0x62]
lea rcx, [rbx + 0x20]
mov rdx, r13
mov qword [rsp + 0x28], r12
mov word [rsp + 0x20], ax
call fcn.180017730
test eax, eax
jne 0x180016dbf
movzx eax, word [rbx + 0x60]
movzx r9d, word [rbx + 0x64]
movzx r8d, word [rbx + 0x62]
lea rcx, [rbx + 0x40]
mov rdx, r13
mov qword [rsp + 0x28], r12
mov word [rsp + 0x20], ax
call fcn.180017730
test eax, eax
jne 0x180016dbf
movzx eax, word [rbx + 0x60]
mov word [rbp + 0x10], ax
movzx eax, word [rbx + 0x62]
mov word [rbp + 0x12], ax
movzx eax, word [rbx + 0x64]
mov word [rbp + 0x14], ax
mov rax, qword [rbx + 0x68]
mov dword [rax], 0x20190520
mov rax, qword [rbx + 0x68]
mov dword [rax + 4], 0x4000
mov rax, qword [rbx + 0x68]
mov dword [rax + 8], 6
mov rax, qword [rbx + 0x68]
mov dword [rax + 0xc], 0
cmp word [rbx + 0x60], 4
je 0x180016d94
cmp word [rbx + 0x60], 8
jne 0x180016da9
movzx ecx, byte [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [rdx + 8], eax
call fcn.180015e60
mov rdx, qword [rbx + 0x68]
mov rcx, qword [rbx + 8]
mov r8d, 0x7530
call qword [rax + 0x70]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x180016de0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], r8w
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
movzx ebx, word [rsp + 0xe0]
movzx r10d, word [rcx + 0x60]
movzx r13d, word [rsp + 0xe8]
movzx r11d, r8w
mov r15, rdx
mov eax, ebx
sub eax, r11d
mov rsi, rcx
mov dword [rsp + 0x30], r11d
inc eax
mov dword [rsp + 0xd8], eax
imul r10d, eax
add r10d, 0x1f
mov eax, 0xe000
sar r10d, 3
cdq
and r10d, 0xfffffffc
idiv r10d
cmp r9w, r13w
jae 0x180017005
movzx r10d, ax
mov dword [rsp + 0x34], r10d
movzx edx, r9w
movzx ecx, r13w
mov eax, ecx
mov ecx, r10d
sub eax, edx
cmp eax, r10d
cmovl ecx, eax
mov rax, qword [rsi + 0x68]
mov word [rax + 0x12], bx
mov word [rax + 0x10], r8w
mov word [rax + 0x14], r9w
add cx, r9w
mov ebx, 8
movzx ebp, cx
mov word [rax + 0x16], bp
movzx r12d, word [rsi + 0x60]
movzx r14d, word [rsi + 0x62]
movzx edi, word [rsi + 0x64]
imul r14d, r12d
mov eax, r12d
sub edi, edx
add r14d, 0x1f
mov dword [rsp + 0xc0], ebp
imul r12d, dword [rsp + 0xd8]
imul eax, r11d
add eax, 0x1f
dec edi
add r12d, 0x1f
sar r14d, 3
sar eax, 3
sar r12d, 3
and r14d, 0xfffffffc
and eax, 0xfffffffc
and r12d, 0xfffffffc
imul edi, r14d
add edi, eax
cmp edx, ebp
jge 0x180016f25
movsxd r13, r12d
sub ebp, edx
mov rax, qword [rsi + 0x68]
movsxd rcx, ebx
movsxd rdx, edi
lea rcx, [rcx + rax + 0x10]
add rdx, r15
mov r8, r13
call fcn.18002525c
add ebx, r12d
sub edi, r14d
dec rbp
jne 0x180016ef0
mov ebp, dword [rsp + 0xc0]
movzx r13d, word [rsp + 0xe8]
mov rax, qword [rsi + 0x68]
xor edi, edi
mov dword [rax], 0x20190520
mov rax, qword [rsi + 0x68]
mov dword [rax + 4], 0x20004001
mov rax, qword [rsi + 0x68]
mov dword [rax + 8], ebx
mov rax, qword [rsi + 0x68]
mov dword [rax + 0xc], edi
mov rax, qword [0x180037ad0]
test rax, rax
jne 0x180016fc6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x40]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x40]
lea ecx, [rdi + 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
jne 0x180016f8d
mov eax, edi
jmp 0x180016fc6
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037ad0], rax
test rax, rax
jne 0x180016fb6
mov rax, rdi
jmp 0x180016fc6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037ad0]
mov rdx, qword [rsi + 0x68]
mov rcx, qword [rsi + 8]
mov r8d, 0x7530
call qword [rax + 0x70]
test eax, eax
jne 0x180017007
movzx r9d, bp
cmp bp, r13w
jae 0x180017005
movzx r8d, word [rsp + 0xd0]
mov r11d, dword [rsp + 0x30]
movzx ebx, word [rsp + 0xe0]
mov r10d, dword [rsp + 0x34]
jmp 0x180016e5c
xor eax, eax
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800180b0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037af0]
test rax, rax
jne 0x180018145
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180018124
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037af0], rax
test rax, rax
jne 0x180018130
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037af0]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180019640
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037af8]
test rax, rax
jne 0x1800196d5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x1800196b4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037af8], rax
test rax, rax
jne 0x1800196c0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037af8]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x18001a310
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037b08]
test rax, rax
jne 0x18001a3a5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18001a384
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037b08], rax
test rax, rax
jne 0x18001a390
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037b08]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x18001ad70
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov r13, rcx
lea rdx, [rax + 0x20]
xor r14d, r14d
mov rcx, r8
mov r12, r8
mov word [rax + 0x20], r14w
call qword [sym.imp.ODBC32.dll_SQLNumResultCols]
mov rcx, r12
call qword [sym.imp.ODBC32.dll_SQLFetch]
test ax, 0xfffe
jne 0x18001af12
mov r15d, 1
nop word [rax + rax]
mov esi, r15d
cmp r15w, word [rsp + 0xc8]
jg 0x18001aeff
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r9, [rbx + 0x10]
mov r8d, 0xfffffff8
mov qword [rsp + 0x28], rax
movzx edx, si
mov rcx, r12
mov qword [rsp + 0x20], 0xf000
mov qword [rsp + 0x30], r14
call qword [sym.imp.ODBC32.dll_SQLGetData]
mov r11, qword [rsp + 0x30]
cmp r11, 0xffffffffffffffff
jne 0x18001ae45
lea rdx, str.NULL
lea rcx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
movsxd r11, eax
add r11, r11
mov qword [rsp + 0x30], r11
lea eax, [r11 + 2]
mov dword [rbx], 0x20190520
mov dword [rbx + 4], 0xc007
mov dword [rbx + 8], eax
mov rax, qword [0x180037b08]
mov dword [rbx + 0xc], r14d
test rax, rax
jne 0x18001aeda
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x40]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x40]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdi, rax
test rax, rax
jne 0x18001aea1
mov rax, r14
jmp 0x18001aeda
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037b08], rax
test rax, rax
jne 0x18001aeca
mov rax, r14
jmp 0x18001aeda
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037b08]
mov r8d, 0x7530
mov rdx, rbx
mov rcx, r13
call qword [rax + 0x70]
test eax, eax
jne 0x18001af37
movsx eax, word [rsp + 0xc8]
inc esi
cmp esi, eax
jle 0x18001adf0
mov rcx, r12
call qword [sym.imp.ODBC32.dll_SQLFetch]
test ax, 0xfffe
je 0x18001add0
mov dword [rbx], 0x20190520
mov dword [rbx + 4], 0xc007
mov qword [rbx + 8], r14
call fcn.18001a310
mov r8d, 0x7530
mov rdx, rbx
mov rcx, r13
call qword [rax + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret