joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800148b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x20]
test rax, rax
je 0x18001490b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1800b2500]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180014900
lea rcx, [rsp + 0x20]
call rax
jmp 0x18001490b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
mov qword [rsp + 0x1c0], rdi
cmp ax, 9
je 0x180014929
cmp ax, 6
je 0x180014929
mov dil, 1
jmp 0x18001492c
xor dil, dil
lea rcx, [rsp + 0x50]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180014a55
mov eax, dword [rsp + 0x84]
sub eax, 5
je 0x1800149fe
sub eax, 1
je 0x1800149a8
cmp eax, 4
jne 0x180014a55
cmp dword [rsp + 0x88], ebx
jne 0x180014a55
cmp byte [rsp + 0x19a], 1
jne 0x180014a55
mov ebx, 0x100
mov eax, 0x80
test dil, dil
cmovne ebx, eax
jmp 0x180014a55
mov eax, dword [rsp + 0x88]
sub eax, 1
je 0x1800149e2
sub eax, 1
je 0x1800149c2
cmp eax, 1
jne 0x180014a55
cmp byte [rsp + 0x19a], 1
jne 0x180014a55
mov ebx, 0x40
mov eax, reloc.WLDAP32.dll_Ordinal_32
test dil, dil
cmovne ebx, eax
jmp 0x180014a55
cmp byte [rsp + 0x19a], 1
jne 0x180014a55
mov ebx, reloc.WS2_32.dll_recv
mov eax, 8
test dil, dil
cmovne ebx, eax
jmp 0x180014a55
mov eax, dword [rsp + 0x88]
sub eax, 1
je 0x180014a50
cmp eax, 1
jne 0x180014a55
cmp byte [rsp + 0x19a], al
jne 0x180014a20
cmp word [rsp + 0x50], 9
je 0x180014a55
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x180014a3e
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x180014a55
mov ebx, 4
mov eax, 2
test dil, dil
cmovne ebx, eax
jmp 0x180014a55
mov ebx, 1
mov ax, bx
mov rdi, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x1b0
pop rbx
ret
Function at 0x180016330
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rdx
mov rsi, rcx
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1800163e9
xor ebp, ebp
nop
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x7c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.180011740
nop
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180016240
nop
cmp qword [rsp + 0x40], 8
jb 0x1800163d8
mov rcx, qword [rsp + 0x28]
call fcn.18003b7f8
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180016380
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.18003c690
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800184b0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rdx
xor bl, bl
mov byte [rsp + 0x20], bl
xor eax, eax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x28], eax
xor edx, edx
lea r8d, [rax + 0x2c]
lea rcx, [rsp + 0x2c]
call fcn.18003bb80
test rdi, rdi
jne 0x1800184e7
xor al, al
jmp 0x180018564
movsx ecx, byte [rdi]
call fcn.18004f1c0
test eax, eax
jne 0x1800184f7
mov al, 1
jmp 0x180018564
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x18001855b
mov rdx, qword [rsp + 0x78]
mov rax, rdx
test rax, rax
je 0x180018552
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x18001854c
mov ecx, dword [rcx + 4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rdi
call fcn.180043eb8
mov bl, 1
mov byte [rsp + 0x20], bl
mov rdx, qword [rsp + 0x78]
jmp 0x180018552
mov rax, qword [rax + 0x28]
jmp 0x180018518
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x180018562
mov al, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180018ba0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx r13d, dl
mov rsi, rcx
mov rax, qword [rcx]
mov r8d, 0x4b0
lea rdx, [rcx + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
mov r12d, eax
lea ecx, [rax - 1]
cmp ecx, 0x4af
ja 0x180018d50
cmp byte [rsi + 8], 0
jbe 0x180018c14
mov r8d, eax
lea rdx, [rsi + 0x40]
mov rcx, rsi
call fcn.180018690
mov edi, dword [rsi + 0x3c]
movzx ebx, word [rsi + 0x3a]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea r8, [rsi + 0x1a]
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180043eb8
mov word [rsp + 0x60], bx
call fcn.18003db34
mov r11d, eax
mov eax, 0x10624dd3
imul r11d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x3e8
sub r11d, edx
mov eax, 0x162e
add r11w, ax
mov word [rsp + 0x62], r11w
mov dword [rsp + 0x64], edi
xor eax, eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], eax
xor ebx, ebx
mov qword [rsp + 0x88], rbx
test r13b, r13b
je 0x180018cec
mov dword [rsp + 0x20], 0x4b0
lea r9, [rsi + 0x40]
mov r8d, r12d
lea rdx, [rsi + 0x40]
lea rcx, [rsp + 0x40]
call fcn.180019510
mov ebx, eax
test eax, eax
jle 0x180018d39
mov r9, qword [rsi]
mov r8d, eax
lea rdx, [rsi + 0x40]
mov rcx, rsi
call qword [r9 + Ordinal_26]
mov ebx, eax
jmp 0x180018d39
lea rcx, [rsp + 0x40]
call fcn.1800195f0
test al, al
jne 0x180018cff
or ebx, 0xffffffff
jmp 0x180018d39
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, r12d
lea rdx, [rsi + 0x40]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
setne bl
dec ebx
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x180018d4c
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
jmp 0x180018d53
or eax, 0xffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18003c690
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180019510
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
call fcn.1800195f0
test al, al
jne 0x180019541
or eax, 0xffffffff
jmp 0x1800195d1
mov rcx, qword [rdi + 0x48]
lea rax, [rdi + 0x28]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x180019539
xor eax, eax
test rbp, rbp
je 0x1800195d1
mov esi, dword [rsp + 0x70]
test esi, esi
jle 0x1800195d1
xor ebx, ebx
cmp dword [rdi + 0x24], eax
jle 0x1800195d1
mov qword [rsp + 0x50], r12
lea r12, [rdi + 0x38]
mov rcx, qword [rdi + 0x48]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, esi
mov rdx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x1800195cc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, dword [rdi + 0x24]
jl 0x180019591
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800195f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x48], 0
mov rbx, rcx
je 0x180019608
mov al, 1
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x48], rdi
mov edi, 2
lea r8d, [rdi + 0xf]
mov edx, edi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rbx + 0x48], rax
test rax, rax
je 0x1800196c6
mov eax, dword [rbx + 0x24]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1005
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800196b4
mov rcx, qword [rbx + 0x48]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1006
mov dword [rsp + 0x20], 8
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800196b4
mov rcx, rbx
mov word [rbx + 0x28], di
call qword [sym.imp.WS2_32.dll_inet_addr]
movzx ecx, word [rbx + 0x20]
mov dword [rbx + 0x2c], eax
call qword [sym.imp.WS2_32.dll_htons]
mov rdi, qword [rsp + 0x48]
mov word [rbx + 0x2a], ax
mov al, 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x48], 0
xor al, al
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x180019be0
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x6b0
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
xor eax, eax
mov rbx, rdx
xor edi, edi
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
mov qword [rsp + 0x52], rax
mov qword [rsp + 0x5a], rax
mov word [rsp + 0x62], ax
mov word [rsp + 0x70], di
call fcn.18003bb80
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8d, [rdi + 3]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180092c9c
lea rcx, [rsp + 0x492]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x490], di
call fcn.18003bb80
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x280], di
call fcn.18003bb80
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x280]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180019cfb
mov r8d, dword [rsp + 0x40]
lea rdx, str._08X
mov rcx, rbx
call fcn.18003cfe0
jmp 0x180019d21
lea rcx, [0x1800b2400]
sub rbx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rbx + rcx - 2], ax
test ax, ax
jne 0x180019d10
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.18003c690
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x6b0
pop rdi
ret
Function at 0x18001aff0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.18003bb80
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bx
call fcn.18003bb80
lea r8d, [rbx + 0x2b]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.ClodlySoft_]
lea rcx, [rsp + 0x20]
mov qword [rdi - 2], rax
mov rax, qword [0x1800b27d8]
mov qword [rdi + 6], rax
mov rax, qword [0x1800b27e0]
mov qword [rdi + 0xe], rax
movzx eax, word [0x1800b27e8]
mov word [rdi + 0x16], ax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001b0b7
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rsp + rbx + 0x20]
add rbx, 2
mov word [rsp + rbx + 0x22e], ax
test ax, ax
jne 0x18001b0b7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
mov rax, qword [str.cloudysoft.ini]
lea rcx, [rsp + 0x20]
mov qword [rdi - 2], rax
mov rax, qword [0x1800b27f8]
mov qword [rdi + 6], rax
mov rax, qword [0x1800b2800]
mov qword [rdi + 0xe], rax
mov eax, dword [0x1800b2808]
mov dword [rdi + 0x16], eax
movzx eax, word [0x1800b280c]
mov word [rdi + 0x1a], ax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001b1b7
mov r8, qword [rsi]
lea r9, [rsp + 0x230]
lea rdx, str.OID1
lea rcx, str.Globals
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r8, qword [rsi]
lea r9, [rsp + 0x230]
lea rdx, str.OID2
lea rcx, str.Globals
add r8, 0x208
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r8, qword [rsi]
lea r9, [rsp + 0x230]
lea rdx, str.OID3
lea rcx, str.Globals
add r8, 0x410
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r8, qword [rsi]
lea r9, [rsp + 0x230]
lea rdx, str.OID4
lea rcx, str.Globals
add r8, 0x618
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18003c690
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001b1e0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x70]
mov rbx, rcx
lea rdx, str.software
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001b36a
xor ecx, ecx
lea rax, [rsp + 0x68]
lea rdx, str.ClodlySoft
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18001b36a
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x68]
lea rdx, str.OID1
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
add rcx, 0x208
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbx]
lea rdx, str.OID2
add rcx, 0x208
lea eax, [rax + rax + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
add rcx, 0x410
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbx]
lea rdx, str.OID3
add rcx, 0x410
lea eax, [rax + rax + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
add rcx, 0x618
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbx]
lea rdx, str.OID4
add rcx, 0x618
lea eax, [rax + rax + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rbx
ret
Function at 0x18001b370
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs rax, 0x3030303030303030
xor r9d, r9d
mov r10, rdx
mov qword [rsp], rax
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rax
mov word [rsp + 0x28], ax
mov byte [rsp + 0x2a], al
mov rdi, r9
mov ecx, 6
nop
cmp ecx, 9
jg 0x18001b3cb
lea r8d, [rcx + 0x30]
jmp 0x18001b3eb
mov eax, 0x66666667
mov r8d, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
add r8d, 0x30
mov word [rsp + rdi*2], r8w
inc rdi
inc ecx
cmp rdi, 0xa
jl 0x18001b3c0
mov edi, reloc.WS2_32.dll_recvfrom
mov ecx, Ordinal_79
cmp ecx, 0x5a
mov r8d, ecx
jle 0x18001b42a
mov eax, 0xb40b40b5
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x5b
sub r8d, edx
add r8d, 0x41
mov word [rsp + rdi*2], r8w
inc rdi
inc ecx
cmp rdi, 0x2b
jl 0x18001b405
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp]
repne scasw ax, word [rdi]
mov rdi, r10
not rcx
lea r8, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18001b4a6
mov rdx, r10
nop word [rax + rax]
movzx eax, word [rdx]
sub eax, 0x30
movsxd rcx, eax
cmp rcx, r8
jae 0x18001b485
movzx eax, word [rsp + rcx*2]
mov word [rdx], ax
or rcx, 0xffffffffffffffff
xor eax, eax
inc r9d
mov rdi, r10
add rdx, 2
repne scasw ax, word [rdi]
mov eax, r9d
not rcx
dec rcx
cmp rax, rcx
jb 0x18001b470
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x70
pop rdi
ret
Function at 0x18001c3b0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rcx
add rcx, 0x210
xor edi, edi
call fcn.18001c7b0
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, VarUI4FromDisp
call fcn.18003bb80
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x18001c41b
mov rcx, rsi
call fcn.18001b950
jmp 0x18001c442
mov qword [rsp + 0x168], rbx
mov ebx, edi
test edi, edi
jne 0x18001c43a
mov rcx, rsi
call fcn.18001bd70
inc ebx
cmp ebx, 0xa
mov edi, eax
jl 0x18001c425
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsi + 0x230]
movabs rax, 0x4bda12f684bda13
sub rcx, qword [rsi + 0x228]
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rax, rdx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18003c690
lea r11, [rsp + 0x150]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001c490
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13, [rcx + 0x210]
mov r15, rdx
mov rdi, qword [r13 + 0x18]
cmp rdi, qword [r13 + 0x20]
jbe 0x18001c4c5
call fcn.18003d5e8
mov rax, qword [r13]
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rbp, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
nop dword [rax]
mov rdi, qword [r13 + 0x20]
cmp qword [r13 + 0x18], rdi
jbe 0x18001c4ff
call fcn.18003d5e8
test rbp, rbp
je 0x18001c50a
cmp rbp, qword [r13]
je 0x18001c50f
call fcn.18003d5e8
cmp r12, rdi
lea rdi, [r15 + 0xa8]
je 0x18001c666
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1800b1bc4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rbp, rbp
jne 0x18001c544
call fcn.18003d5e8
xor r11d, r11d
jmp 0x18001c548
mov r11, qword [rbp]
cmp r12, qword [r11 + 0x20]
jb 0x18001c553
call fcn.18003d5e8
lea rsi, [r14 + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1800b1bc4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rbx, [r15 + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1800b1bc4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rbp, rbp
jne 0x18001c599
call fcn.18003d5e8
xor r11d, r11d
jmp 0x18001c59d
mov r11, qword [rbp]
cmp r12, qword [r11 + 0x20]
jb 0x18001c5a8
call fcn.18003d5e8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1800b1bc4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rbp, rbp
jne 0x18001c5cd
call fcn.18003d5e8
xor r11d, r11d
jmp 0x18001c5d1
mov r11, qword [rbp]
cmp r12, qword [r11 + 0x20]
jb 0x18001c5dc
call fcn.18003d5e8
sub rsi, rdi
nop
movzx ecx, byte [rdi]
movzx eax, byte [rdi + rsi]
sub ecx, eax
jne 0x18001c5f2
inc rdi
test eax, eax
jne 0x18001c5e0
test ecx, ecx
jne 0x18001c636
test rbp, rbp
jne 0x18001c604
call fcn.18003d5e8
xor edx, edx
jmp 0x18001c608
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x18001c613
call fcn.18003d5e8
mov rdx, r14
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x18001c632
inc rbx
test eax, eax
jne 0x18001c620
test ecx, ecx
je 0x18001c686
test rbp, rbp
jne 0x18001c644
call fcn.18003d5e8
xor edx, edx
jmp 0x18001c648
mov rdx, qword [rbp]
cmp r12, qword [rdx + 0x20]
jb 0x18001c653
call fcn.18003d5e8
add r12, 0x1b0
add r14, 0x1b0
jmp 0x18001c4f0
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x18001c686
mov rdx, r15
mov rcx, r13
call fcn.18001c6b0
mov al, 1
jmp 0x18001c688
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001ee90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x4e0
mov qword [rsp + 0x4c8], 0xfffffffffffffffe
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.18001e6b0
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x78]
call fcn.180023ba0
nop
mov rdx, qword [rsp + 0x4f0]
lea rcx, [rsp + 0x50]
call fcn.18001f220
lea rcx, [rsp + 0x90]
call fcn.180023ba0
nop
mov edx, 0x400
mov rcx, qword [rsp + 0x4f8]
call fcn.18001eac0
mov qword [rsp + 0x38], rax
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x18001ef46
call fcn.18001e750
mov dword [rsp + 0x4b0], eax
jmp 0x18001f0f1
mov r8, qword [rsp + 0x508]
mov rdx, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
jne 0x18001ef85
call fcn.18001e750
mov dword [rsp + 0x4b0], eax
jmp 0x18001f0f1
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x4b8], rax
cmp qword [rsp + 0x4b8], 0
jne 0x18001efbc
call fcn.18001e750
mov dword [rsp + 0x4b0], eax
jmp 0x18001f0f1
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
add eax, 1
cmp eax, dword [rsp + 0x60]
jae 0x18001f01c
mov dword [rsp + 0x4c0], 0x8007000e
lea rcx, [rsp + 0x90]
call fcn.180023810
nop
lea rcx, [rsp + 0x78]
call fcn.180023470
mov eax, dword [rsp + 0x4c0]
jmp 0x18001f131
mov eax, dword [rsp + 0x60]
add eax, 1
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.180023840
nop
lea rcx, [rsp + 0x90]
call fcn.180023920
test rax, rax
jne 0x18001f055
mov dword [rsp + 0x4b0], 0x8007000e
jmp 0x18001f0f1
lea rcx, [rsp + 0x90]
call fcn.180023920
mov rbx, rax
call fcn.18001e6b0
mov ecx, eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x4a0], eax
cmp dword [rsp + 0x4a0], 0
jne 0x18001f0aa
call fcn.18001e750
mov dword [rsp + 0x4b0], eax
jmp 0x18001f0f1
mov ebx, dword [rsp + 0x4a0]
lea rcx, [rsp + 0x90]
call fcn.180023920
mov r11, rax
xor eax, eax
mov word [r11 + rbx*2], ax
lea rcx, [rsp + 0x90]
call fcn.180023920
mov r8d, dword [rsp + 0x510]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18001f250
mov dword [rsp + 0x4b0], eax
cmp qword [rsp + 0x48], 0
je 0x18001f104
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x4b0]
mov dword [rsp + 0x4c4], eax
lea rcx, [rsp + 0x90]
call fcn.180023810
nop
lea rcx, [rsp + 0x78]
call fcn.180023470
mov eax, dword [rsp + 0x4c4]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x4e0
pop rbx
ret