joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc52e580
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc52f660
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52ef82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc551108]
test eax, eax
je 0x2fc52f01a
lea rax, [0x2fc5510e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc551110]
mov qword [rbp - 8], rax
jmp 0x2fc52effe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52eff2
cmp qword [rbp - 0x10], 0
je 0x2fc52eff2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52efb8
lea rax, [0x2fc5510e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc52f01b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc52f120
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc52f148
mov eax, 0
jmp 0x2fc52f196
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc52f171
mov eax, 0
jmp 0x2fc52f196
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc52f191
mov eax, 0
jmp 0x2fc52f196
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52f19c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc52f21a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc52f211
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc52f211
mov rax, qword [rbp - 8]
jmp 0x2fc52f22f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc52f1e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d70a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d8180
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7aa2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d7b3a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d7b1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7b12
cmp qword [rbp - 0x10], 0
je 0x2fc4d7b12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7ad8
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d7b3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7c40
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7c68
mov eax, 0
jmp 0x2fc4d7cb6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7c91
mov eax, 0
jmp 0x2fc4d7cb6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7cb1
mov eax, 0
jmp 0x2fc4d7cb6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d6770
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d7850
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7172
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d720a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d71ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d71e2
cmp qword [rbp - 0x10], 0
je 0x2fc4d71e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d71a8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d720b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7310
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7338
mov eax, 0
jmp 0x2fc4d7386
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7361
mov eax, 0
jmp 0x2fc4d7386
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7381
mov eax, 0
jmp 0x2fc4d7386
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d738c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d740a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7401
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7401
mov rax, qword [rbp - 8]
jmp 0x2fc4d741f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d73d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40f44]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x1800019b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
xor r15d, r15d
mov r10, r9
mov rbp, rdx
mov r14, rcx
test rbx, rbx
je 0x1800019df
mov dword [rbx], r15d
mov edi, dword [rsp + 0x70]
test edi, edi
jne 0x1800019ee
xor eax, eax
jmp 0x180001b04
mov qword [rsp + 0x50], rsi
cmp rbp, 0xffffffffffffffff
je 0x180001afa
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x180001afa
test r8d, r8d
je 0x180001a4c
mov rax, qword [r9]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x180001a30
test edi, 0x1ff
je 0x180001a4c
mov qword [rsp + 0x28], rbx
mov r9, rsi
mov r8, r10
mov dword [rsp + 0x20], edi
mov rdx, rbp
call fcn.180001d00
jmp 0x180001aff
mov rdx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180001ad6
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180001aeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180001aa6
cmp eax, 0x3e6
je 0x180001aa6
test eax, eax
jle 0x180001aff
movzx eax, ax
or eax, 0x80070000
jmp 0x180001aff
mov edx, edi
mov rcx, r14
call fcn.180001c90
test eax, eax
js 0x180001aff
cmp eax, 1
je 0x180001aff
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180001add
call fcn.180002050
jmp 0x180001aff
mov rdx, qword [r14]
mov r8, rdi
mov rcx, rsi
call fcn.18008b7d0
test rbx, rbx
je 0x180001af6
mov eax, dword [rsp + 0x70]
mov dword [rbx], eax
xor eax, eax
jmp 0x180001aff
mov eax, 0x80070057
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180001b20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
xor r15d, r15d
mov r10, r9
mov rsi, rdx
mov r14, rcx
test rbx, rbx
je 0x180001b4f
mov dword [rbx], r15d
mov edi, dword [rsp + 0x70]
test edi, edi
jne 0x180001b5e
xor eax, eax
jmp 0x180001c78
mov qword [rsp + 0x50], rbp
mov rbp, qword [rsp + 0x78]
test rbp, rbp
je 0x180001c6e
cmp rsi, 0xffffffffffffffff
je 0x180001c6e
test r8d, r8d
je 0x180001bbc
mov rax, qword [r9]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x180001ba0
test edi, 0x1ff
je 0x180001bbc
mov qword [rsp + 0x28], rbx
mov r9, rbp
mov r8, r10
mov dword [rsp + 0x20], edi
mov rdx, rsi
call fcn.180001e60
jmp 0x180001c73
mov rdx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180001c58
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180001c5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180001c1a
cmp eax, 0x3e6
je 0x180001c1a
test eax, eax
jle 0x180001c73
movzx eax, ax
or eax, 0x80070000
jmp 0x180001c73
mov edx, edi
mov rcx, r14
call fcn.180001c90
test eax, eax
js 0x180001c73
cmp eax, 1
je 0x180001c73
mov rcx, qword [r14]
mov r8, rdi
mov rdx, rbp
call fcn.18008b7d0
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180001c5f
call fcn.180002050
jmp 0x180001c73
test rbx, rbx
je 0x180001c6a
mov eax, dword [rsp + 0x70]
mov dword [rbx], eax
xor eax, eax
jmp 0x180001c73
mov eax, 0x80070057
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180001d00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, qword [rsp + 0x88]
xor edi, edi
mov r13, r9
mov r15, r8
mov r14, rdx
mov r12, rcx
test rsi, rsi
je 0x180001d34
mov dword [rsi], edi
mov ebp, dword [rsp + 0x80]
test ebp, ebp
jne 0x180001d46
xor eax, eax
jmp 0x180001e08
test r13, r13
je 0x180001e59
cmp r14, 0xffffffffffffffff
je 0x180001e59
test r15, r15
je 0x180001e59
mov rcx, qword [r8]
mov rax, rcx
mov qword [rsp + 0x60], rbx
cqo
add rcx, 0x1ff
and edx, 0x1ff
lea rbx, [rdx + rax]
mov rax, rbp
and rbx, 0xfffffffffffffe00
sub rax, rbx
add rax, rcx
mov rcx, r12
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0xfffffe00
mov edx, eax
mov qword [rsp + 0x88], rax
call fcn.180001c90
test eax, eax
js 0x180001e03
cmp eax, 1
je 0x180001e03
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180001dfe
mov r8d, dword [rsp + 0x88]
lea r9, [rsp + 0x80]
mov rdx, qword [r12]
mov rcx, r14
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180001e20
call fcn.180002050
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [r15]
mov eax, dword [rsp + 0x80]
sub ecx, ebx
cmp eax, ecx
jbe 0x180001e4e
sub eax, ecx
cmp ebp, eax
cmovb eax, ebp
mov edi, eax
test eax, eax
je 0x180001e4e
mov edx, ecx
mov r8d, edi
add rdx, qword [r12]
mov rcx, r13
call fcn.18008b7d0
test rsi, rsi
je 0x180001e55
mov dword [rsi], edi
xor eax, eax
jmp 0x180001e03
mov eax, 0x80070057
jmp 0x180001e08
Function at 0x180001e60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, qword [rsp + 0x88]
xor edi, edi
mov rax, r9
mov r15, r8
mov rbp, rdx
mov r12, rcx
test rsi, rsi
je 0x180001e93
mov dword [rsi], edi
mov r14d, dword [rsp + 0x80]
test r14d, r14d
jne 0x180001eb4
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
test rax, rax
je 0x180002010
cmp rbp, 0xffffffffffffffff
je 0x180002010
test r15, r15
je 0x180002010
mov rcx, qword [r8]
mov rax, rcx
mov qword [rsp + 0x60], rbx
cqo
mov qword [rsp + 0x68], r13
and edx, 0x1ff
add rcx, 0x1ff
lea rbx, [rdx + rax]
mov rax, r14
and rbx, 0xfffffffffffffe00
sub rax, rbx
add rax, rcx
mov rcx, r12
cqo
and edx, 0x1ff
lea r13, [rdx + rax]
and r13d, 0xfffffe00
mov edx, r13d
call fcn.180001c90
test eax, eax
js 0x180001fd1
cmp eax, 1
je 0x180001fd1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180001fcc
mov rdx, qword [r12]
lea r9, [rsp + 0x88]
mov r8d, r13d
mov dword [rsp + 0x88], edi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001fcc
mov r15d, dword [r15]
mov r8, r14
mov rdx, qword [rsp + 0x78]
sub r15d, ebx
mov ecx, r15d
add rcx, qword [r12]
call fcn.18008b7d0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180001fcc
mov rdx, qword [r12]
lea r9, [rsp + 0x80]
mov r8d, r13d
mov dword [rsp + 0x80], edi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180001fed
call fcn.180002050
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
test rsi, rsi
je 0x18000200c
mov eax, dword [rsp + 0x80]
cmp eax, r15d
jbe 0x18000200a
sub eax, r15d
cmp r14d, eax
cmovb eax, r14d
mov edi, eax
mov dword [rsi], edi
xor eax, eax
jmp 0x180001fd1
mov eax, 0x80070057
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x180002070
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov qword [rcx + 0x28], send
lea rdx, [rsp + 0x20]
xor edi, edi
mov rbx, rcx
mov qword [rcx + 0x20], rdi
mov byte [rcx + 0x10], dil
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rdx, [0x1800ece24]
mov ecx, 0x1f4
call fcn.180072944
xor edx, edx
mov qword [rbx + 0x30], rax
mov r8d, 0x1f4
mov rcx, rax
call fcn.18008c000
mov rax, rbx
mov qword [rbx], 0xffffffffffffffff
mov qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx + 0x48], edi
mov qword [rbx + 0x40], 0xffffffffffffffff
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x38], edi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180072920
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rdi
ret
Function at 0x1800025b0
Capabilities:
Connect to http server
Create http request

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x290], rax
movzx r12d, word [rsp + 0x310]
mov r15, r9
mov rbx, qword [rsp + 0x318]
mov r14, r8
mov rdi, rdx
mov r13, rcx
xor ebp, ebp
lea rcx, str.NetMou
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenW]
cmp qword [r15 + 0x18], 8
mov rsi, rax
jb 0x18000261b
mov r15, qword [r15]
cmp qword [r14 + 0x18], 8
jb 0x180002625
mov r14, qword [r14]
cmp qword [rdi + 0x18], 8
jb 0x18000262f
mov rdi, qword [rdi]
mov qword [rsp + 0x38], rbp
mov r9, r14
mov dword [rsp + 0x30], 0x8000000
movzx r8d, r12w
mov dword [rsp + 0x28], 1
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rdi, rax
test rax, rax
jne 0x180002690
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x2eee
jne 0x18000267d
mov ebp, 0xe0036003
jmp 0x180002707
test eax, eax
jle 0x180002707
movzx ebp, ax
or ebp, 0x80070000
jmp 0x180002707
cmp qword [rbx + 0x18], 8
jb 0x18000269a
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WININET.dll_FtpFindFirstFileW]
mov rbx, rax
test rax, rax
jne 0x1800026c4
call fcn.180002050
mov ebp, eax
jmp 0x1800026f0
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [r13 + 0x50], rcx
jne 0x1800026e0
mov ebp, 0xe0036006
jmp 0x1800026f0
mov eax, dword [rsp + 0x58]
mov dword [r13 + 0x5c], eax
mov eax, dword [rsp + 0x54]
mov dword [r13 + 0x58], eax
test rbx, rbx
je 0x1800026fe
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rsi, rsi
je 0x180002715
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180072920
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret