joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140242540
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402cc0c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402e847e]
call fcn.1400c56ce
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140243820
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140242990
nop
lea rax, [0x1402422b0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140243a10
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14024261c
lea rcx, [rbp + 8]
call fcn.140243b30
nop
jmp 0x140242635
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400c2bc7
nop
lea rcx, [rbp + 8]
call fcn.1402431b0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1402aca60]
call fcn.1400c4d41
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400c39eb
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140245df0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400c58fe
movzx eax, al
test eax, eax
jne 0x140245e10
mov ecx, 7
call fcn.1400c4d91
nop
mov byte [rsp + 0x20], 0
call fcn.1400c4e8b
mov byte [rsp + 0x21], al
cmp dword [0x1402d4980], 1
jne 0x140245e34
mov ecx, 7
call fcn.1400c4d91
nop
jmp 0x140245e8c
cmp dword [0x1402d4980], 0
jne 0x140245e87
mov dword [0x1402d4980], 1
lea rdx, [0x1402547c0]
lea rcx, [0x140254490]
call fcn.1400c3941
test eax, eax
je 0x140245e68
mov eax, 0xff
jmp 0x140245f91
lea rdx, [0x140254380]
lea rcx, [section..rdata]
call fcn.1400c4e68
mov dword [0x1402d4980], 2
jmp 0x140245e8c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400c4cf6
call fcn.1400c4792
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140245ee9
mov rcx, qword [rsp + 0x30]
call fcn.1400c3478
movzx eax, al
test eax, eax
je 0x140245ee9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1402ea020]
nop
call fcn.1400c49cc
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140245f1d
mov rcx, qword [rsp + 0x38]
call fcn.1400c3478
movzx eax, al
test eax, eax
je 0x140245f1d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400c5534
nop
call fcn.140246000
mov dword [rsp + 0x28], eax
call fcn.1400c4657
movzx eax, al
test eax, eax
jne 0x140245f3c
mov ecx, dword [rsp + 0x28]
call fcn.1400c23ed
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140245f4b
call fcn.1400c55d9
nop
xor edx, edx
mov cl, 1
call fcn.1400c3365
mov eax, dword [rsp + 0x28]
jmp 0x140245f91
add rsp, 0x68
ret
Function at 0x180003e40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180003e9d
lea rbx, [0x18008f160]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003e84
cmp r10, 2
jb 0x180003e84
cmp byte [r9], r8b
jne 0x180003e84
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003e60
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180003edf
lea rbx, [0x18008f160]
cmp r8b, 0x23
jne 0x180003ec3
cmp byte [r9], r8b
jne 0x180003ec3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003eb0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180007490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x100]
mov rdi, rcx
movsxd rsi, edx
test eax, eax
jg 0x1800074d3
mov r8d, 0x78f
lea rdx, str.D:PROYECTO_FAKE_LAGPanel_Compe_Cachonimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rdi + 0x100]
movsxd rcx, eax
lea rdx, [0x18008f160]
mov rax, qword [rdi + 0x108]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, sil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rdi]
not ebx
cmp dword [rcx + 0x4084], ebx
jne 0x180007549
mov r8, rsi
mov edx, 4
mov ecx, ebx
call fcn.1800200e0
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180007560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x100]
mov rdi, rdx
mov rbx, rcx
test eax, eax
jg 0x18000759a
mov r8d, 0x78f
lea rdx, str.D:PROYECTO_FAKE_LAGPanel_Compe_Cachonimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0x100]
movss xmm2, dword [rbx + 0x120]
lea r9, [0x18008f160]
movss xmm0, dword [rdi]
movss xmm3, dword [rbx + 0x124]
subss xmm0, xmm2
movss xmm1, dword [rdi + 4]
movsxd rcx, eax
subss xmm1, xmm3
mov rax, qword [rbx + 0x108]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rdi + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movzx eax, byte [rsp + 0x20]
not r8d
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x18001e640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6000], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x18001e6c3
xor edx, edx
add rcx, 0x6008
call fcn.1800212d0
mov r8, rsi
lea rcx, [rbx + 0x6008]
mov rdx, rbp
call fcn.180004760
mov eax, dword [rbx + 0x6008]
xor edx, edx
mov r9, qword [rbx + 0x6000]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6010]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x1801e1d38]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001e6cf
add rcx, 0x6008
call fcn.180004760
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001e930
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1801e1d40]
cmp byte [rbx + 0x5f58], 0
jne 0x18001ea60
cmp dword [rbx + 0x5f80], 0
je 0x18001e97b
mov r8d, 0x33eb
lea rdx, str.D:PROYECTO_FAKE_LAGPanel_Compe_Cachonimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18001ea59
lea rdx, [0x18008e948]
call fcn.180003ef0
mov rdi, rax
test rax, rax
je 0x18001ea59
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18001ea50
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001ea50
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x18001ea50
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001ea50
cmp rsi, 0xffffffffffffffff
je 0x18001ea50
mov rcx, rsi
call fcn.180007f30
mov rbp, rax
test rax, rax
je 0x18001ea50
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x18001ea30
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call fcn.180007fe0
jmp 0x18001ea59
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18001ea46
mov rdx, rsi
mov rcx, rbp
call fcn.18001ece0
mov rcx, rbp
call fcn.180007fe0
jmp 0x18001ea59
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [rbx + 0x5f58], 1
movss xmm0, dword [rbx + 0x5f5c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18001eaef
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f5c], xmm0
jb 0x18001eaef
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x18001eae2
mov rax, qword [0x1801e1d40]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f5c], ebp
call fcn.18001ef40
lea rdx, [0x18008e94c]
mov rcx, rdi
mov rsi, rax
call fcn.180003ef0
mov rdi, rax
test rax, rax
je 0x18001eae9
mov r8, qword [rsp + 0x30]
lea edx, [rbp + 1]
mov r9, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18001eae9
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f5c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18001ec40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1801e1d40]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001eca3
mov qword [rsp], rbx
lea rbx, [0x18008f160]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001ec83
cmp byte [r8], r9b
jne 0x18001ec83
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001ec70
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f70]
not eax
mov r8, qword [r10 + 0x5f78]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001eccf
cmp dword [r8 + 8], eax
je 0x18001ecd6
add r8, 0x48
cmp r8, rcx
jne 0x18001ecc0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x180057210
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
mov r8d, 0x4d
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
call fcn.18003df80
lea rcx, [rsi + 0x20]
xor r8d, r8d
lea rdx, [0x18008942f]
call fcn.18003df80
lea rcx, [rsi + 0x40]
xor r8d, r8d
lea rdx, [0x18008942f]
call fcn.18003df80
lea rcx, [rsi + 0x60]
xor r8d, r8d
lea rdx, [0x18008942f]
call fcn.18003df80
lea rcx, [rsi + 0x80]
mov r8d, 3
lea rdx, [0x180098040]
call fcn.18003df80
lea rcx, [rsi + 0xa0]
xor r8d, r8d
lea rdx, [0x18008942f]
call fcn.18003df80
lea rcx, [rsi + 0xc0]
mov r8d, 0xf
lea rdx, str.www.example.com
call fcn.18003df80
xor r14d, r14d
mov qword [rbp - 0x40], r14
movdqa xmm0, xmmword [0x18009b820]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], r14b
xor r8d, r8d
lea rdx, [0x18008942f]
lea rcx, [rbp - 0x40]
call fcn.18003df80
nop
mov qword [rbp - 0x20], r14
movdqa xmm0, xmmword [0x18009b820]
movdqa xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], r14b
xor r8d, r8d
lea rdx, [0x18008942f]
lea rcx, [rbp - 0x20]
call fcn.18003df80
nop
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
lea rax, [rbp]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x60]
call fcn.180057070
lea rdi, [rsi + 0x160]
lea rax, [rbp - 0x60]
cmp rdi, rax
je 0x180057384
mov rbx, qword [rdi]
mov r8, qword [rbx + 8]
mov rdx, rdi
mov rcx, rdi
call fcn.1800613e0
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rdi + 8], r14
mov r8, qword [rdi]
mov rax, qword [rbp - 0x60]
mov qword [rdi], rax
mov qword [rbp - 0x60], r8
mov rax, qword [rbp - 0x58]
mov qword [rdi + 8], rax
mov qword [rbp - 0x58], r14
jmp 0x180057388
mov r8, qword [rbp - 0x60]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.1800613e0
mov edx, 0x60
mov rcx, qword [rbp - 0x60]
call fcn.180083b80
nop
lea r9, [fcn.180057400]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rbp - 0x40]
call fcn.180083bb4
mov qword [rsi + 0x170], r14
mov word [rsi + 0x151], 1
mov byte [rsi + 0x150], 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800574b0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [0x1801e1f30]
mov qword [rsp + 0x80], rdi
xor ebx, ebx
mov qword [0x1801e1f30], rbx
mov qword [0x1801e1f40], rbx
mov qword [0x1801e1f48], 0xf
lea r8d, [rbx + 0x4d]
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
mov rcx, rdi
call fcn.18003df80
nop
mov qword [0x1801e1f50], rbx
mov qword [0x1801e1f60], rbx
mov qword [0x1801e1f68], 0xf
mov qword [0x1801e1f70], rbx
mov qword [0x1801e1f80], rbx
mov qword [0x1801e1f88], 0xf
mov qword [0x1801e1f90], rbx
mov qword [0x1801e1fa0], rbx
mov qword [0x1801e1fa8], 0xf
mov qword [0x1801e1fb0], rbx
mov qword [0x1801e1fc0], rbx
mov qword [0x1801e1fc8], 0xf
lea r8d, [rbx + 3]
lea rdx, [0x180098040]
lea rcx, [0x1801e1fb0]
call fcn.18003df80
nop
mov qword [0x1801e1fd0], rbx
mov qword [0x1801e1fe0], rbx
mov qword [0x1801e1fe8], 0xf
mov qword [0x1801e1ff0], rbx
mov qword [0x1801e2000], rbx
mov qword [0x1801e2008], 0xf
lea r8d, [rbx + 0xf]
lea rdx, str.www.example.com
lea rcx, [0x1801e1ff0]
call fcn.18003df80
nop
lea rax, [0x1801e2010]
mov qword [rsp + 0x88], rax
mov qword [0x1801e2010], rbx
mov qword [0x1801e2020], rbx
mov qword [0x1801e2028], 0xf
mov qword [0x1801e2030], rbx
mov qword [0x1801e2040], rbx
mov qword [0x1801e2048], 0xf
xor r8d, r8d
lea rdx, [0x18008942f]
lea rcx, [0x1801e2030]
call fcn.18003df80
nop
mov qword [0x1801e2050], rbx
mov qword [0x1801e2060], rbx
mov qword [0x1801e2068], 0xf
xor r8d, r8d
lea rdx, [0x18008942f]
lea rcx, [0x1801e2050]
call fcn.18003df80
nop
mov qword [0x1801e2070], rbx
mov qword [0x1801e2078], rbx
lea ecx, [rbx + 0x60]
call fcn.1800837c4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1801e2070], rax
mov word [0x1801e2080], 0x101
mov byte [0x1801e2082], 1
mov qword [0x1801e2088], rbx
mov qword [rsp + 0x30], rbx
movdqa xmm0, xmmword [0x18009b820]
movdqa xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], bl
xor r8d, r8d
lea rdx, [0x18008942f]
lea rcx, [rsp + 0x30]
call fcn.18003df80
nop
mov qword [rsp + 0x50], rbx
movdqa xmm0, xmmword [0x18009b820]
movdqa xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], bl
xor r8d, r8d
lea rdx, [0x18008942f]
lea rcx, [rsp + 0x50]
call fcn.18003df80
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [0x1801e2090]
call fcn.180057070
nop
lea r9, [fcn.180057400]
lea edx, [rbx + 0x40]
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x30]
call fcn.180083bb4
mov qword [0x1801e20a0], rbx
mov dword [0x1801e20a8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x18005c630
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x440
mov r15, r8
mov r12, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov dword [rsp + 0x30], 1
lea rcx, [r9 + 0x60]
mov rdx, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rbp
je 0x18005c69e
cmp rdx, 0x10
jb 0x18005c68e
mov rcx, qword [rcx]
lea rdx, [0x1800981f4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
mov ecx, 0xffffffff
mov dword [rsp + 0x488], ecx
nop word [rax + rax]
test ecx, ecx
je 0x18005c771
lea r9, [rsp + 0x488]
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, qword [r12]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r14d, eax
mov ecx, dword [rsp + 0x488]
test ecx, ecx
je 0x18005c6ea
add dword [r15 + 0xe4], ecx
test rbp, rbp
je 0x18005c707
mov r8, rcx
mov r9, rbp
mov edx, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18005c760
mov rsi, rcx
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18005c74b
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18005c731
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x18005c760
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call fcn.18003e3d0
test r14d, r14d
je 0x18005c771
mov ecx, dword [rsp + 0x488]
jmp 0x18005c6b0
test rbp, rbp
je 0x18005c788
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, rdi
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180062830
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rdx
test rdx, rdx
jne 0x18006284c
xor eax, eax
add rsp, 0x150
pop rsi
ret
mov qword [rsp + 0x160], rbx
xor edx, edx
mov qword [rsp + 0x168], rbp
mov qword [rsp + 0x170], rdi
xor edi, edi
mov ebx, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1800628d2
nop
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1800628c0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1800628c0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1800628a0
mov rbp, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret
Function at 0x180062900
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, r9
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jg 0x18006293d
xor al, al
jmp 0x180062ada
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
call fcn.180062b00
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
cmp rbp, r14
jne 0x180062976
xor bl, bl
jmp 0x180062a96
mov r12d, r13d
sub r14, rbp
sar r14, 3
test r14, r14
je 0x180062a94
mov r15, rbp
nop dword [rax]
mov rax, qword [r15]
lea rbx, [rax + 0x60]
lea rdi, [rax + 0x2c]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov edx, ebx
mov rcx, qword [0x1801e2168]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x90]
mov rdx, rbx
mov rcx, qword [0x1801e2168]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov edx, edi
mov rcx, qword [0x1801e2168]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x90]
mov rdx, rdi
mov rcx, qword [0x1801e2168]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
mov r8d, 8
mov edx, ebx
mov rcx, qword [0x1801e2168]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
mov r8d, 8
mov edx, edi
mov rcx, qword [0x1801e2168]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r12d
lea r15, [r15 + 8]
movsxd rax, r12d
cmp rax, r14
jb 0x180062990
mov bl, 1
test rbp, rbp
je 0x180062ad7
mov rdx, qword [rsp + 0x40]
sub rdx, rbp
and rdx, 0xfffffffffffffff8
mov rax, rbp
cmp rdx, 0x1000
jb 0x180062acf
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180062acf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.180083b80
movzx eax, bl
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret