joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002740
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rbp, r9
mov rcx, qword [rcx]
mov rsi, r8
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x18000277c
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi], 0xffffffffffffffff
xor r8d, r8d
mov r14d, 2
mov ecx, r14d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x1800027a5
call fcn.180002050
jmp 0x180002878
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0x7530
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1006
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
cmp qword [rbx + 0x18], 0x10
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
jb 0x1800027e6
mov rcx, qword [rbx]
jmp 0x1800027e9
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x180002830
cmp qword [rbx + 0x18], 0x10
jb 0x1800027fe
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
je 0x18000279b
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x3c]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.18008b7d0
movzx eax, word [rbx + 0x10]
mov word [rsp + 0x38], ax
jmp 0x18000283a
mov word [rsp + 0x38], r14w
mov dword [rsp + 0x3c], eax
movzx ecx, word [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x38]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x18000279b
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.180002890
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180072920
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180002bb0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rdi
lea rdx, str.TYPE_I__r_n
mov rdi, rcx
mov qword [rsp + 0x38], socket
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], 0
mov r8d, 9
mov byte [rsp + 0x20], 0
call fcn.180004a00
cmp qword [rsp + 0x38], 0x10
lea rdx, [rsp + 0x20]
mov r8d, dword [rsp + 0x30]
cmovae rdx, qword [rsp + 0x20]
xor r9d, r9d
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x180002c2b
call fcn.180002050
mov ebx, eax
jmp 0x180002c8b
mov rdx, qword [rdi + 0x30]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, 0x1f4
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x180002c58
call fcn.180002050
mov ebx, eax
test eax, eax
js 0x180002c8b
cmp eax, 1
jne 0x180002c63
jmp 0x180002c8b
movsxd rcx, eax
mov rax, qword [rdi + 0x30]
mov byte [rcx + rax], 0
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x180002c89
cmp byte [rcx], 0
je 0x180002c89
lea rdx, str._n226
call fcn.18008bc94
test rax, rax
je 0x180002c89
mov dword [rdi + 0x38], 1
xor ebx, ebx
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x180002cd0
mov rcx, qword [rsp + 0x20]
inc rax
cmp rax, 0x1000
jb 0x180002ccb
test cl, 0x1f
jne 0x180002ce5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180002ceb
sub rcx, rax
cmp rcx, 8
jb 0x180002cf1
cmp rcx, 0x27
ja 0x180002cf7
mov rcx, rax
call fcn.180072908
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180072920
add rsp, 0x50
pop rbx
ret
call fcn.18008d744
int3
call fcn.18008d744
int3
call fcn.18008d744
int3
call fcn.18008d744
int3
Function at 0x180002d00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
lea r8, [rcx + 0x10]
lea rdx, str.RETR
lea rcx, [rsp + 0x28]
call fcn.180003a50
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180003ba0
nop
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x180002dab
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x180002da6
test cl, 0x1f
je 0x180002d79
call fcn.18008d744
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002d88
call fcn.18008d744
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002d97
call fcn.18008d744
int3
cmp rcx, 0x27
jbe 0x180002da3
call fcn.18008d744
int3
mov rcx, rax
call fcn.180072908
mov qword [rsp + 0x40], socket
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x180002df0
call fcn.180002050
jmp 0x180002e63
xor r9d, r9d
mov r8d, 0x1f4
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x180002e1d
call fcn.180002050
mov ebx, eax
test eax, eax
js 0x180002e65
cmp eax, 1
jne 0x180002e28
jmp 0x180002e65
movsxd rcx, eax
mov rax, qword [rdi + 0x30]
mov byte [rcx + rax], 0
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.180003720
lea rdx, [0x1800b92d4]
mov rcx, rax
call fcn.180003cd0
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.180004cb0
test ebx, ebx
jne 0x180002e5b
mov ebx, 1
jmp 0x180002e65
mov rcx, rdi
call fcn.180003690
mov ebx, eax
mov rcx, qword [rsp + 0x60]
cmp rcx, 0x10
jb 0x180002ec1
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rcx, 0x1000
jb 0x180002eb9
test dl, 0x1f
je 0x180002e8c
call fcn.18008d744
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x180002e9b
call fcn.18008d744
int3
sub rdx, rax
cmp rdx, 8
jae 0x180002eaa
call fcn.18008d744
int3
cmp rdx, 0x27
jbe 0x180002eb6
call fcn.18008d744
int3
mov rdx, rax
mov rcx, rdx
call fcn.180072908
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180072920
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x180002ef0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbx, rcx
mov r8, rdx
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
lea rdx, str.REST__I64d__r_n
mov qword [r11 - 0x38], rax
lea rcx, [r11 - 0x48]
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov word [rsp + 0x50], ax
call fcn.180003c60
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x180002f45
mov rcx, qword [rbx]
lea r8d, [rax + 1]
xor r9d, r9d
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x180002f82
call fcn.180002050
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180072920
add rsp, 0x60
pop rbx
ret
mov rdx, qword [rbx + 0x30]
xor r9d, r9d
mov rcx, qword [rbx]
mov r8d, 0x1f4
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x180002fbe
call fcn.180002050
test eax, eax
js 0x180002ff1
cmp eax, 1
jne 0x180002fc9
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180072920
add rsp, 0x60
pop rbx
ret
movsxd rcx, eax
mov rax, qword [rbx + 0x30]
mov byte [rcx + rax], 0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x180002fef
cmp byte [rcx], 0
je 0x180002fef
lea rdx, str._n226
call fcn.18008bc94
test rax, rax
je 0x180002fef
mov dword [rbx + 0x38], 1
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180072920
add rsp, 0x60
pop rbx
ret
Function at 0x1800036d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
mov rcx, qword [rcx]
xor r9d, r9d
mov r8d, 0x1f4
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1800036fe
add rsp, 0x20
pop rbx
jmp fcn.180002050
movsxd rcx, eax
mov rax, qword [rbx + 0x30]
mov byte [rcx + rax], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180004e10
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, rcx
mov qword [rcx], rsi
xor r9d, r9d
mov qword [rcx + 8], rsi
xor r8d, r8d
mov qword [rcx + 0x10], rsi
xor edx, edx
mov qword [rcx + 0x40], 7
mov qword [rcx + 0x38], rsi
mov word [rcx + 0x28], si
mov qword [rcx + 0x60], 7
mov qword [rcx + 0x58], rsi
mov word [rcx + 0x48], si
mov qword [rcx + 0x80], 7
mov qword [rcx + 0x78], rsi
mov word [rcx + 0x68], si
lea rcx, str.Net__KuaiZip_
mov dword [rsp + 0x20], esi
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rcx, qword [rbx]
mov rdi, rax
test rcx, rcx
je 0x180004e8c
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rbx], rdi
mov rax, rbx
mov dword [rbx + 0x20], esi
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x90], rsi
mov rsi, qword [rsp + 0x48]
mov qword [rbx + 0x18], 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180005f30
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov esi, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.18008c000
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x180005f93
lea rdx, str.WMCache_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x180005fa9
call fcn.180002050
test eax, eax
js 0x180006056
cmp eax, 1
je 0x180006056
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180005fd4
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180005fd4
call fcn.180002050
jmp 0x180006056
lea r9, [rdi + 0x10]
mov qword [rsp + 0x278], rbx
xor r8d, r8d
lea rdx, [0x1800b94b8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180006045
mov eax, 0x4000000
mov qword [rsp + 0x30], 0
mov ecx, 0x24000000
mov dword [rdi + 0x220], esi
test esi, esi
mov edx, 0xc0000000
cmovne eax, ecx
xor r9d, r9d
mov dword [rsp + 0x28], eax
lea rcx, [rdi + 0x10]
xor r8d, r8d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x218], rax
cmp rax, 0xffffffffffffffff
jne 0x18000604c
call fcn.180002050
jmp 0x18000604e
xor eax, eax
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180072920
mov rsi, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
Function at 0x180006080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
mov esi, r8d
add rcx, 0x228
mov r14, r9
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [rdi + 0x218]
test esi, esi
jne 0x1800060c0
xor ebx, ebx
jmp 0x1800061d6
cmp rbp, 0xffffffffffffffff
je 0x1800061d1
test r14, r14
je 0x1800061d1
cmp dword [rdi + 0x220], 0
je 0x180006121
mov rax, rbx
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x1800060fc
test esi, 0x1ff
je 0x180006121
xor ebx, ebx
lea r8, [rsp + 0x68]
mov qword [rsp + 0x28], rbx
mov r9, r14
mov rdx, rbp
mov dword [rsp + 0x20], esi
mov rcx, rdi
call fcn.180001d00
mov ebx, eax
jmp 0x1800061d6
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180006143
call fcn.180002050
mov ebx, eax
jmp 0x1800061d6
xor ebx, ebx
lea r9, [rsp + 0x70]
mov r8d, esi
mov dword [rsp + 0x70], ebx
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800061d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180006189
cmp eax, 0x3e6
je 0x180006189
test eax, eax
jle 0x18000611a
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1800061d6
mov edx, esi
mov rcx, rdi
call fcn.180001c90
test eax, eax
js 0x18000611a
cmp eax, 1
je 0x18000611a
mov rdx, qword [rdi]
lea r9, [rsp + 0x70]
mov r8d, esi
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180006137
mov rdx, qword [rdi]
mov r8, rsi
mov rcx, r14
call fcn.18008b7d0
jmp 0x1800061d6
mov ebx, 0x80070057
lea rcx, [rdi + 0x228]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000b430
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x38
lea rcx, [rsp + 0x20]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r8, qword [rsp + 0x30]
lea rcx, [rdi + 0xc8]
shr r8, 1
mov eax, 0x40000000
cmp r8, rax
cmovb eax, r8d
mov edx, eax
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, rbx
lea rcx, [rdi + 0x10]
call fcn.180007af0
test eax, eax
js 0x18000b4f3
cmp eax, 1
je 0x18000b4f3
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x18000b4c4
mov rax, qword [rax + 0x88]
test rax, rax
jne 0x18000b4bb
mov eax, 0x80004005
jmp 0x18000b4e6
mov qword [rdi + 0x130], rax
jmp 0x18000b4e4
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x18000b4ee
mov rcx, qword [rax + 0x50]
test rcx, rcx
jne 0x18000b4dd
mov eax, 0x80004005
jmp 0x18000b4e6
mov qword [rdi + 0x130], rcx
xor eax, eax
test eax, eax
js 0x18000b4ee
xor eax, eax
jmp 0x18000b4f3
mov eax, 0xe0036006
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180072920
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000fdd0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x3f8]
sub rsp, 0x4e0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.18008c000
mov r8d, 0x104
lea rdx, [rbp + 0x1c0]
mov rcx, qword [0x1800f00d0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
xor esi, esi
cmp eax, 0x103
ja 0x18000fe55
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov word [rax], si
jmp 0x18000fe6b
call fcn.180002050
test eax, eax
js 0x18001005d
cmp eax, 1
je 0x18001005d
lea rdx, str.PlugFormat_
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x70]
call fcn.18008c000
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
cmp word [rbp + 0x1c0], si
jne 0x18000feb2
mov r8, rsi
jmp 0x18000feca
lea rax, [rbp + 0x1c0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x18000fec0
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x48]
call fcn.180004430
nop
mov r8d, 5
lea rdx, str..dll
lea rcx, [rsp + 0x48]
call fcn.180005bd0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180010051
movabs r14, 0x7fffffffffffffff
nop word [rax + rax]
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
cmp word [rbp + 0x1c0], 0
jne 0x18000ff52
mov r8, rsi
jmp 0x18000ff6b
lea rax, [rbp + 0x1c0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18000ff60
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x28]
call fcn.180004430
nop
cmp word [rbp - 0x64], 0
jne 0x18000ff89
mov r8, rsi
jmp 0x18000ff9c
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18000ff91
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x28]
call fcn.180005bd0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov r8d, 1
mov rcx, rdi
call fcn.18000fcf0
nop
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x180010012
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, r14
ja 0x180010041
add rax, rax
cmp rax, 0x1000
jb 0x18001000d
test cl, 0x1f
jne 0x18001003b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180010035
sub rcx, rax
cmp rcx, 8
jb 0x18001002f
cmp rcx, 0x27
ja 0x180010029
mov rcx, rax
call fcn.180072908
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180010047
jmp 0x18000ff30
call fcn.18008d744
int3
call fcn.18008d744
int3
call fcn.18008d744
int3
call fcn.18008d744
int3
call fcn.18008d744
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x48]
call fcn.180004c10
xor eax, eax
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.180072920
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180010630
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10d, 2
mov dword [rcx + 0x200], 1
mov r11d, r10d
mov dword [rcx + 0x204], 1
mov esi, r8d
mov word [rcx + 0x208], 0
mov rbp, rdx
lea r9, [0x1800d5060]
xor dil, dil
mov rax, rcx
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r11, 1
jne 0x180010680
mov rbx, rcx
nop
movzx r9d, byte [rbx]
lea rbx, [rbx + 1]
xor edx, edx
mov eax, r11d
div esi
inc r11d
movzx eax, byte [rdx + rbp]
add al, r9b
add dil, al
movzx edx, dil
movzx eax, byte [rdx + rcx]
mov byte [rbx - 1], al
mov byte [rdx + rcx], r9b
cmp r11d, 0x100
jb 0x1800106e0
lea rax, [rcx + 0x100]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r10, 1
jne 0x180010720
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180010790
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [rcx + 0x204]
mov rdi, rdx
movzx r11d, byte [rcx + 0x209]
sub rdi, r10
sub r8, r10
mov rbx, rcx
lea esi, [r10 + r9]
cmp r10d, esi
jae 0x180010844
lea r9, [r10 + r8]
sub rdi, r8
nop
movzx edx, r10b
lea r9, [r9 + 1]
inc r10d
movzx r8d, byte [rdx + rbx + 0x100]
add r11b, r8b
movzx ecx, r11b
movzx eax, byte [rcx + rbx + 0x100]
mov byte [rdx + rbx + 0x100], al
mov byte [rcx + rbx + 0x100], r8b
movzx eax, byte [rdx + rbx + 0x100]
add al, r8b
movzx ecx, al
movzx eax, byte [rcx + rbx + 0x100]
xor al, byte [rdi + r9 - 1]
mov byte [r9 - 1], al
cmp r10d, esi
jb 0x1800107d0
mov dword [rbx + 0x204], r10d
mov byte [rbx + 0x209], r11b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 0x204], r10d
mov byte [rcx + 0x209], r11b
ret
Function at 0x180010870
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx]
test rcx, rcx
je 0x18001088f
call fcn.18007294c
mov qword [rdi], rbx
lea rdx, [0x1800ece24]
mov ecx, 0x400
call fcn.180072944
mov qword [rdi], rax
test rax, rax
je 0x18001094f
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.18008c000
mov rdx, rbx
nop
mov eax, ebx
shr eax, 1
test bl, 1
je 0x1800108ce
xor eax, 0xedb88320
test al, 1
je 0x1800108db
shr eax, 1
xor eax, 0xedb88320
jmp 0x1800108dd
shr eax, 1
test al, 1
je 0x1800108ea
shr eax, 1
xor eax, 0xedb88320
jmp 0x1800108ec
shr eax, 1
test al, 1
je 0x1800108f9
shr eax, 1
xor eax, 0xedb88320
jmp 0x1800108fb
shr eax, 1
test al, 1
je 0x180010908
shr eax, 1
xor eax, 0xedb88320
jmp 0x18001090a
shr eax, 1
test al, 1
je 0x180010917
shr eax, 1
xor eax, 0xedb88320
jmp 0x180010919
shr eax, 1
test al, 1
je 0x180010926
shr eax, 1
xor eax, 0xedb88320
jmp 0x180010928
shr eax, 1
test al, 1
je 0x180010935
shr eax, 1
xor eax, 0xedb88320
jmp 0x180010937
shr eax, 1
mov rcx, qword [rdi]
inc ebx
mov dword [rdx + rcx], eax
add rdx, 4
cmp ebx, 0x100
jl 0x1800108c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800156d0
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0xd0]
xor edi, edi
mov r12, r9
mov dword [r8], edi
mov rsi, r8
mov qword [rsp + 0x30], rdi
mov r14, rdx
mov dword [rsp + 0x28], edi
lea r8d, [rdi + 1]
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180015866
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r14], eax
cmp eax, 0xffffffff
je 0x180015866
xor eax, eax
mov byte [rsp + 0x40], dil
lea r8, [rsp + 0x50]
mov qword [rsp + 0x41], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x49], eax
mov rcx, rbx
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov qword [rsp + 0x20], r12
call fcn.1800159e0
test eax, eax
js 0x18001586b
cmp eax, 1
je 0x18001586b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rbp
lea edx, [rdi + 0x10]
lea rcx, [rsp + 0x40]
or rbx, 0xffffffffffffffff
call fcn.1800155e0
mov dword [rsi], eax
test eax, eax
jne 0x18001586d
movzx eax, word [rsp + 0x40]
cmp ax, word [0x1800d64f4]
jne 0x1800157ef
movzx eax, byte [rsp + 0x42]
cmp al, byte [0x1800d64f6]
jne 0x1800157ef
mov dword [rsi], 5
jmp 0x18001586d
mov eax, dword [rsp + 0x40]
cmp eax, dword [0x1800d5460]
jne 0x180015811
movzx eax, word [rsp + 0x44]
cmp ax, word [0x1800d5464]
jne 0x180015811
mov dword [rsi], 4
jmp 0x18001586d
mov rax, qword [rsp + 0x40]
cmp rax, qword [0x1800d5450]
jne 0x180015835
mov rax, qword [rsp + 0x48]
cmp rax, qword [0x1800d5458]
jne 0x180015835
mov dword [rsi], 6
jmp 0x18001586d
mov eax, dword [rsp + 0x50]
cmp eax, dword [0x1800d5448]
jne 0x180015849
mov dword [rsi], 2
jmp 0x18001586d
cmp dword [rsp + 0xd8], edi
je 0x180015862
mov r8, rbp
mov rdx, rsi
mov rcx, r15
call fcn.1800158a0
jmp 0x18001586b
mov dword [rsi], edi
jmp 0x18001587c
call fcn.180002050
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x18001587c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180072920
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret