joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009bdd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
sub rsp, 0x40
cmp qword [rcx + 8], 0
mov rbp, rcx
mov dword [rcx + 0x4c], edx
je 0x14009bffa
mov rdx, qword [0x140143880]
xor r10d, r10d
test rdx, rdx
jne 0x14009be9e
mov rcx, qword [0x1401436b0]
mov edx, r10d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
test rcx, rcx
je 0x14009be4b
mov rbx, qword [0x1401436a8]
nop
cmp dword [rbx + 0x20], 0x2489d460
je 0x14009becf
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, rcx
jb 0x14009be30
mov dword [0x140143468], 0x12
mov byte [0x140143245], r10b
mov rdx, r10
mov qword [0x140143470], r10
mov qword [0x140143478], r10
mov r15, qword [rsp + 0x20]
xor rdx, 0x23e55482
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143880], rdx
xor rdx, 0x23e55482
jne 0x14009bfdf
mov dword [0x140143468], 0x14
mov byte [0x140143245], r10b
mov qword [0x140143470], r10
mov qword [0x140143478], r10
jmp 0x14009bfe2
mov rsi, qword [rbx + 0x10]
mov edi, r10d
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
mov r12d, dword [r13 + 0x88]
add r12, rsi
mov r15d, dword [r12 + 0x20]
mov r14d, dword [r12 + 0x18]
add r15, rsi
test r14d, r14d
je 0x14009bf58
nop dword [rax]
mov eax, edi
movsxd r8, dword [r15 + rax*4]
mov rax, r10
add r8, rsi
cmp byte [r8], al
je 0x14009bf1a
inc rax
cmp byte [rax + r8], r10b
jne 0x14009bf11
mov r11d, r10d
mov r9d, r10d
test rax, rax
je 0x14009bf51
mov rcx, r10
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r9d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r9d
mov r11d, edx
cmp rcx, rax
jb 0x14009bf30
cmp edx, 0x76c80e2
je 0x14009bf67
inc edi
cmp edi, r14d
jb 0x14009bf00
mov dword [0x140143468], 0x13
jmp 0x14009be55
cmp di, 0xffff
je 0x14009bf58
mov eax, dword [r12 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r12 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r12
jb 0x14009bfaa
mov eax, dword [r13 + 0x8c]
mov ecx, dword [r13 + 0x88]
add rax, rcx
add rax, rsi
cmp rdx, rax
jbe 0x14009bf58
cmp rdx, rsi
jb 0x14009bf58
mov eax, dword [r13 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x14009bf58
test rdx, rdx
je 0x14009bf58
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp rdx, rcx
jbe 0x14009be6d
mov dword [0x140143468], 0x15
jmp 0x14009be55
mov r10, rdx
movsxd r8, dword [rbp + 0x4c]
xor r9d, r9d
mov rcx, qword [rbp + 8]
mov edx, 0x402
add rsp, 0x40
pop rbp
jmp r10
add rsp, 0x40
pop rbp
ret
Function at 0x1400b5298
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b50c4
Function at 0x180002000
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r13
mov rsi, r9
mov r13, r8
mov ebx, edx
mov rdi, rcx
test edx, edx
je 0x1800021a8
lea ecx, [rdx*8]
mov eax, 0x2aaaaaab
imul ecx
lea ecx, [rbx*8]
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x18000204e
cmp ecx, 4
jne 0x180002051
add edx, 2
jmp 0x180002051
add edx, 3
inc edx
cmp dword [r9], edx
jae 0x18000206a
mov dword [r9], edx
mov eax, 0xfffffff0
mov rbx, qword [rsp + 0x38]
pop r13
pop rdi
pop rsi
ret
xor r11d, r11d
mov qword [rsp + 0x20], rbp
mov eax, 0x55555556
mov qword [rsp + 0x30], r14
mov r10, r8
mov ebp, r11d
imul ebx
mov eax, edx
lea r14, [0x180047640]
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
test ecx, ecx
jle 0x18000212d
dec ecx
mov eax, 0xaaaaaaab
mov qword [rsp + 0x28], r12
mul ecx
shr edx, 1
inc edx
mov r12d, edx
lea ebp, [rdx + rdx*2]
nop word [rax + rax]
movzx edx, byte [rdi]
movzx r8d, byte [rdi + 1]
movzx r9d, byte [rdi + 2]
mov eax, edx
add edx, edx
add r10, 4
sar rax, 2
add rdi, 3
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r10 - 4], al
mov eax, r8d
sar eax, 4
lea ecx, [rax + rdx*8]
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [r10 - 3], al
mov eax, r9d
sar eax, 6
lea ecx, [rax + r8*4]
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [r10 - 2], al
mov eax, r9d
and eax, 0x3f
dec r12
movzx eax, byte [rax + r14]
mov byte [r10 - 1], al
jne 0x1800020c0
mov r12, qword [rsp + 0x28]
cmp ebp, ebx
jge 0x180002192
movzx edx, byte [rdi]
inc ebp
cmp ebp, ebx
jge 0x18000213f
movzx r11d, byte [rdi + 1]
mov eax, edx
add edx, edx
sar rax, 2
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r10], al
mov eax, r11d
sar eax, 4
lea ecx, [rax + rdx*8]
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [r10 + 1], al
cmp ebp, ebx
jge 0x180002181
and r11d, 0xf
shl r11d, 2
movsxd rax, r11d
movzx eax, byte [rax + r14]
mov byte [r10 + 2], al
jmp 0x180002186
mov byte [r10 + 2], 0x3d
add r10, 3
inc r10
mov byte [r10 - 1], 0x3d
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
mov eax, r10d
sub eax, r13d
mov dword [rsi], eax
mov byte [r10], 0
xor eax, eax
mov rbx, qword [rsp + 0x38]
pop r13
pop rdi
pop rsi
ret
Function at 0x180002340
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push rbx
mov rbx, rdx
mov rdx, rcx
test rcx, rcx
je 0x18000250b
test rbx, rbx
je 0x18000250b
mov dword [rbx + 0xf0], 0xa
mov eax, dword [rcx]
lea r11, [rbx + 4]
mov r10d, eax
mov qword [rsp + 0x10], rdi
lea rdi, [0x180000000]
ror r10d, 8
and r10d, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or r10d, eax
mov dword [rbx], r10d
mov ecx, dword [rcx + 4]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov dword [r11], eax
mov ecx, dword [rdx + 8]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov dword [rbx + 8], eax
mov eax, dword [rdx + 0xc]
mov r9d, eax
ror r9d, 8
and r9d, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or r9d, eax
mov dword [rbx + 0xc], r9d
mov eax, r9d
shr rax, 0x10
movzx ecx, al
mov eax, r9d
mov r8d, dword [rdi + rcx*4 + 0x45d40]
shr rax, 8
movzx ecx, al
btc r8d, 0x18
mov eax, dword [rdi + rcx*4 + 0x46140]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, r9d
shr rax, 0x18
movzx eax, byte [rdi + rax*4 + 0x45940]
xor r8d, eax
movzx eax, r9b
mov ecx, dword [rdi + rax*4 + 0x45540]
mov eax, dword [r11]
and ecx, 0xff00
xor r8d, ecx
mov ecx, dword [rbx + 8]
xor r8d, r10d
lea r10, [0x180045540]
xor eax, r8d
mov dword [rbx + 0x10], r8d
xor ecx, eax
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x18], ecx
xor ecx, r9d
lea r9, [0x18004551c]
mov dword [rbx + 0x1c], ecx
mov edx, dword [r11 + 0x18]
add r11, 0x10
add r9, 4
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
mov r8d, dword [rdi + rcx*4 + 0x46140]
shr rax, 0x10
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [rdi + rcx*4 + 0x45d40]
and eax, 0xff000000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [rdi + rax*4 + 0x45940]
xor r8d, eax
movzx eax, dl
mov ecx, dword [rdi + rax*4 + 0x45540]
and ecx, 0xff00
xor r8d, ecx
xor r8d, dword [r11 - 4]
xor r8d, dword [r9 - 4]
mov dword [r11 + 0xc], r8d
mov eax, dword [r11]
xor eax, r8d
mov dword [r11 + 0x10], eax
mov ecx, dword [r11 + 4]
xor ecx, eax
mov dword [r11 + 0x14], ecx
xor ecx, dword [r11 + 8]
mov dword [r11 + 0x18], ecx
cmp r9, r10
jne 0x180002471
xor eax, eax
mov rdi, qword [rsp + 0x10]
pop rbx
ret
or eax, 0xffffffff
pop rbx
ret
Function at 0x180002b30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rax, qword [0x1800548e0]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov rbx, rcx
mov rbp, r9
mov rdi, r8
mov r13d, edx
mov rcx, r14
mov esi, edx
mov dword [r9], 0
test rbx, rbx
je 0x180002cc5
test r8, r8
je 0x180002cc5
test edx, edx
je 0x180002cc5
test r12, r12
je 0x180002cc5
test r14, r14
je 0x180002cc5
cmp edx, 0x10
jb 0x180002c3d
nop dword [rax + rax]
mov r8, rdi
sub rcx, rbx
mov rdx, rbx
sub r8, rbx
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
add rdx, 4
xor al, byte [rdx - 4]
mov byte [r8 + rdx - 4], al
movzx eax, byte [rcx + rdx - 3]
xor al, byte [rdx - 3]
mov byte [r8 + rdx - 3], al
movzx eax, byte [rcx + rdx - 2]
xor al, byte [rdx - 2]
mov byte [r8 + rdx - 2], al
movzx eax, byte [rcx + rdx - 1]
xor al, byte [rdx - 1]
dec r9
mov byte [r8 + rdx - 1], al
jne 0x180002bd0
mov r8, r12
mov rdx, rdi
mov rcx, rdi
call fcn.180002510
test eax, eax
jne 0x180002cbe
add dword [rbp], 0x10
add esi, 0xfffffff0
mov rcx, rdi
add rbx, 0x10
add rdi, 0x10
cmp esi, 0x10
jae 0x180002bb0
test esi, esi
je 0x180002ca8
mov r8, rcx
mov r9, rdi
mov edx, esi
sub r8, rbx
sub r9, rbx
nop
movzx eax, byte [rbx + r8]
inc rbx
xor al, byte [rbx - 1]
dec rdx
mov byte [rbx + r9 - 1], al
jne 0x180002c50
movsxd rax, esi
cmp esi, 0x10
jae 0x180002c8f
mov r9d, reloc.WS2_32.dll_recv
sub rcx, rdi
lea rdx, [rax + rdi]
sub r9d, esi
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rdx
dec r9
mov byte [rdx - 1], al
jne 0x180002c80
mov r8, r12
mov rdx, rdi
mov rcx, rdi
call fcn.180002510
test eax, eax
jne 0x180002cbe
add dword [rbp], 0x10
mov rcx, rdi
mov rax, qword [rcx]
mov qword [r14], rax
mov rax, qword [rcx + 8]
mov qword [r14 + 8], rax
mov dword [rbp], r13d
xor eax, eax
jmp 0x180002cc8
mov eax, 0xfffffffd
jmp 0x180002cc8
or eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800221a0
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180004d60
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x470
mov rax, qword [0x1800548e0]
xor rax, rsp
mov qword [rsp + 0x460], rax
movsxd rsi, ecx
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x250]
inc ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x258], rsi
mov dword [rsp + 0x250], 1
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x3c], 0x1f4
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jle 0x180004e98
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x488], rdi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea rdx, [rsp + 0x250]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test edi, edi
je 0x180004e91
test eax, eax
jne 0x180004e91
mov byte [rsp + 0x30], al
xor eax, eax
lea r9, [rsp + 0x30]
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
lea rax, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1007
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x180004e91
lea rsi, [rsp + 0x30]
lea rdi, [0x180045347]
mov ecx, 1
repe cmpsb byte [rsi], byte [rdi]
jne 0x180004e91
mov eax, ebx
mov rdi, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800221a0
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rsi
ret
mov eax, 0xfffffffe
jmp 0x180004e68
neg ebx
sbb eax, eax
jmp 0x180004e70
Function at 0x180004ea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800548e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, rcx
lea rcx, str._________AHttpSocket::readHttpHead_____________
call fcn.180022954
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x180004ef5
call fcn.180022284
mov qword [rbp + 0x58], 0
mov ecx, 0x19000
call fcn.1800212a0
mov rsi, rax
mov r13b, 1
mov byte [rsp + 0x20], 0
xor r12d, r12d
xor ebx, ebx
nop
cmp rbx, 0x2800
jge 0x180004fb4
cmp dword [rbp + 0x60], 0
je 0x180004f5a
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180004f3c
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx edi, byte [rbp + 0xc]
mov rcx, qword [rbp + 0x80]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
setne al
test al, al
je 0x180004fb4
movsxd rcx, dword [rbp + 0x40]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x180004fb1
movzx eax, byte [rsp + 0x20]
mov byte [rbx + rsi], al
inc r12d
inc rbx
cmp rbx, 4
jl 0x180004f10
cmp byte [rbx + rsi - 4], 0xd
jne 0x180004f10
cmp byte [rbx + rsi - 3], 0xa
jne 0x180004f10
cmp byte [rbx + rsi - 2], 0xd
jne 0x180004f10
cmp byte [rbx + rsi - 1], 0xa
je 0x180004fb4
jmp 0x180004f10
xor r13b, r13b
movsxd rbx, r12d
mov byte [rbx + rsi], 0
mov qword [rsp + 0x48], recv
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180003360
nop
lea eax, [r12 + 1]
movsxd rdi, eax
mov rcx, rdi
call fcn.1800212a0
mov qword [rbp + 0x58], rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180028cc0
mov r8, rbx
mov rdx, rsi
mov rcx, qword [rbp + 0x58]
call fcn.180022620
mov rcx, qword [rbp + 0x58]
call fcn.180005c80
mov edx, eax
lea rcx, str._________m_szResultHead________len___d
call fcn.180022954
mov rcx, qword [rbp + 0x58]
call fcn.180005c80
mov dword [rbp + 0x18], eax
test rsi, rsi
je 0x180005053
mov rcx, rsi
call fcn.180022284
nop
cmp qword [rsp + 0x48], 0x10
jb 0x180005065
mov rcx, qword [rsp + 0x30]
call fcn.18002228c
movzx eax, r13b
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800221a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180005a70
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x50]
mov rbx, rcx
lea rcx, str._______________________m_szHead__n__s
call fcn.180022954
mov rdx, qword [rbx + 0x50]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
xor r9d, r9d
repne scasb al, byte [rdi]
not rcx
mov r8d, ecx
movsxd rcx, dword [rbx + 0x40]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x180005ae5
lea rcx, str._____________n______________AHttpSocket::sendMsg_failed_________
call fcn.180022954
movsxd rdx, dword [rbx + 0x40]
cmp edx, 0xffffffff
je 0x180005ad8
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rbx + 0x40], 0xffffffff
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005b30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x88], 0
mov rbx, rcx
jne 0x180005be8
mov rax, qword [rcx + 0x80]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180005b60
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x80]
mov byte [rbx + 0xc], 1
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r11, qword [rbx + 0x80]
mov rcx, qword [r11 + 8]
test rcx, rcx
je 0x180005b8e
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x80]
mov dword [rbx + 0x1c], 1
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rbx + 0x90]
lea r8, [0x180004ba0]
mov qword [rsp + 0x28], r11
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x88], rax
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x180006c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov r13, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov ebp, ebx
mov qword [rsp + 0x28], rbx
mov esi, ebx
mov qword [rsp + 0x38], rbx
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x180006c9c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x180006c9c
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
jne 0x180006c9f
jmp 0x180006dbf
mov r12, rbx
mov rdx, qword [r13 + 0x18]
test rdx, rdx
je 0x180006cc1
lea rcx, [rsp + 0x28]
call fcn.180007420
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [r13 + 0x20]
mov r8, qword [r13 + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x180006cfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r12, r12
je 0x180006cf7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
jmp 0x180006d98
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r13 + 0x10], eax
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180006d89
cmp dword [r13 + 0x10], 0
jbe 0x180006d89
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov ecx, dword [r13 + 0x10]
call fcn.1800212a0
mov qword [r13 + 8], rax
mov r8d, dword [r13 + 0x10]
mov rdx, rdi
mov rcx, rax
call fcn.180022620
test r12, r12
je 0x180006d5b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
test rbx, rbx
je 0x180006d68
mov rcx, rbx
call fcn.18002228c
test rbp, rbp
je 0x180006d75
mov rcx, rbp
call fcn.18002228c
test rsi, rsi
je 0x180006d82
mov rcx, rsi
call fcn.18002228c
mov eax, 1
jmp 0x180006dc1
test r12, r12
je 0x180006d98
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
test rbx, rbx
je 0x180006da5
mov rcx, rbx
call fcn.18002228c
test rbp, rbp
je 0x180006db2
mov rcx, rbp
call fcn.18002228c
test rsi, rsi
je 0x180006dbf
mov rcx, rsi
call fcn.18002228c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x180007630
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x190
mov rax, qword [0x1800548e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call rax
mov r11d, dword [rsp + 0x24]
cmp r11d, 6
jne 0x18000769a
cmp dword [rsp + 0x20], 3
jne 0x1800076b3
lea rax, str.Microsoft_Windows_8.1
jmp 0x18000787a
cmp r11d, 0xa
jne 0x1800076b3
cmp dword [rsp + 0x20], 0
jne 0x1800076b3
lea rax, str.Microsoft_Windows_10
jmp 0x18000787a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, str.unknown_OperatingSystem.
lea rcx, [rsp + 0x60]
mov qword [rbx + 0x18], rax
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000787e
mov eax, dword [rsp + 0x64]
sub eax, 4
je 0x180007838
dec eax
je 0x1800077c4
dec eax
je 0x180007730
cmp eax, 4
jne 0x18000787e
cmp dword [rsp + 0x68], 0
jne 0x18000787e
cmp byte [rsp + 0x17a], 1
lea rax, str.Microsoft_Windows_10
lea rcx, str.Microsoft_Windows_Server_2016_Technical_Preview
cmovne rax, rcx
jmp 0x18000787a
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1800077a5
dec eax
je 0x180007786
dec eax
je 0x180007767
dec eax
jne 0x18000787e
cmp byte [rsp + 0x17a], 1
lea rax, str.Microsoft_Windows_8.1
lea rcx, str.Microsoft_Windows_Server_2012_R2
cmovne rax, rcx
jmp 0x18000787a
cmp byte [rsp + 0x17a], 1
lea rax, str.Microsoft_Windows_8
lea rcx, str.Microsoft_Windows_Server_2012
cmovne rax, rcx
jmp 0x18000787a
cmp byte [rsp + 0x17a], 1
lea rax, str.Microsoft_Windows_7
lea rcx, str.Microsoft_Windows_Server_2008_R2
cmovne rax, rcx
jmp 0x18000787a
cmp byte [rsp + 0x17a], 1
lea rax, str.Microsoft_Windows_Vista
lea rcx, str.Microsoft_Windows_Server_2008
cmovne rax, rcx
jmp 0x18000787a
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x18000782f
dec eax
je 0x180007826
dec eax
jne 0x18000787e
cmp byte [rsp + 0x17a], 1
jne 0x1800077f6
cmp word [rsp + 0x30], 9
jne 0x1800077f6
lea rax, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x18000787a
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x18000780e
lea rax, str.Microsoft_Windows_Server_2003
jmp 0x18000787a
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x18000787e
lea rax, str.Microsoft_Windows_Server_2003_R2
jmp 0x18000787a
lea rax, str.Microsoft_Windows_XP
jmp 0x18000787a
lea rax, str.Microsoft_Windows_2000
jmp 0x18000787a
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x18000785c
cmp eax, 0xa
je 0x180007853
cmp eax, 0x5a
jne 0x18000787e
lea rax, str.Microsoft_Windows_Me
jmp 0x18000787a
lea rax, str.Microsoft_Windows_98
jmp 0x18000787a
mov eax, dword [rsp + 0x70]
cmp eax, 2
jne 0x18000786e
lea rax, str.Microsoft_Windows_NT_4.0
jmp 0x18000787a
cmp eax, 1
jne 0x18000787e
lea rax, str.Microsoft_Windows_95
mov qword [rbx + 0x18], rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1800221a0
add rsp, 0x190
pop rbx
ret
Function at 0x1800078a0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1800548e0]
xor rax, rsp
mov qword [rbp + 0x90], rax
movzx eax, byte [0x180059bf8]
test al, al
jne 0x180007a8b
mov byte [rbp - 0x80], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp - 0x7f]
call fcn.180028cc0
mov r9d, 1
lea r8d, [r9 + 0x19]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x180007a84
mov qword [rsp + 0x68], recv
mov qword [rsp + 0x60], 0
mov byte [rsp + 0x50], 0
mov r8d, socket
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x50]
call fcn.180003360
nop
mov qword [rsp + 0x40], recv
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x80]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x28]
call fcn.180003360
mov r13, qword [rsp + 0x60]
lea r12, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r12, qword [rsp + 0x50]
test r13, r13
je 0x180007a42
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180007a49
cmp r13, rbx
ja 0x180007a49
sub rbx, r13
inc rbx
lea rsi, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rsi, qword [rsp + 0x28]
movsx edx, byte [r12]
mov r8, rbx
mov rcx, rsi
call fcn.180022a18
mov rdi, rax
test rax, rax
je 0x180007a49
nop dword [rax]
mov r8, r13
mov rdx, r12
mov rcx, rdi
call fcn.180036080
test eax, eax
je 0x180007a28
sub rsi, rdi
lea rbx, [rbx + rsi - 1]
lea rsi, [rdi + 1]
movsx edx, byte [r12]
mov r8, rbx
mov rcx, rsi
call fcn.180022a18
mov rdi, rax
test rax, rax
jne 0x1800079f0
jmp 0x180007a49
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, qword [rsp + 0x28]
sub rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x180007a49
mov byte [0x180059bf8], 1
cmp qword [rsp + 0x40], 0x10
jb 0x180007a5b
mov rcx, qword [rsp + 0x28]
call fcn.18002228c
mov qword [rsp + 0x40], recv
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
cmp qword [rsp + 0x68], 0x10
jb 0x180007a84
mov rcx, qword [rsp + 0x50]
call fcn.18002228c
movzx eax, byte [0x180059bf8]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1800221a0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret