joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400279c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x14016d7d4], 0
lea rdi, [0x14016d7d0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140027a98
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400279f0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x140027ad2
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
mov ecx, eax
shr ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
sub r9d, 1
jne 0x140027ab0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x140027b13
nop
cmp r9b, 0x23
jne 0x140027af3
cmp byte [r8], r9b
jne 0x140027af3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
mov ecx, eax
inc r8
shr ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
test r9b, r9b
jne 0x140027ae0
not eax
pop rdi
ret
Function at 0x14003e240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x14003e48e
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, 0x100
movss xmm8, dword [0x1400dc250]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14003e2fc
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x14003e31b
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14003e436
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14003e370
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x14003e373
mov edx, dword [rax + rsi]
mov rcx, r14
call fcn.1400395a0
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.14003bea0
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x14003e360
mov dword [rsp + 0xe8], r13d
mov r11d, 0x100
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x14003e2b0
mov eax, dword [rsp + 0xe8]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret
Function at 0x140073300
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14007312c
Function at 0x180001dd0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x258
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
jmp 0x180001dfe
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
je 0x180001e42
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x260]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
mov byte [rax], cl
jmp 0x180001df1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov byte [rax], 0
mov dword [rsp + 0x20], 0
jmp 0x180001e69
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x180001ef7
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
cmp eax, 0x5c
je 0x180001ea1
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
cmp eax, 0x2f
jne 0x180001ef2
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x260]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x180001ed7
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x180001ee4
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0x5c
jmp 0x180001e5f
add rsp, 0x258
ret
Function at 0x180001f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, 0x88
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov dword [rsp], 0
jmp 0x180001fba
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x14]
cmp dword [rsp], eax
jae 0x180002086
cmp dword [rsp], 0xffff
ja 0x180002086
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x38], rax
je 0x180002001
jmp 0x180001fb2
mov eax, dword [rsp + 0x78]
dec eax
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jle 0x180002014
jmp 0x180001fb2
mov dword [rsp + 4], 0
jmp 0x180002028
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 4], eax
jae 0x18000207f
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + rax*2]
cmp dword [rsp], eax
je 0x18000204a
jmp 0x18000201e
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x10], eax
cmp qword [rsp + 0x70], 0
je 0x18000206c
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp]
mov dword [rax], ecx
mov eax, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
jmp 0x180002088
jmp 0x180002086
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800056f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov r9, qword [rsp + 0xd8]
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x20]
lea rdx, [0x180012218]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, qword [rsp + 0xd8]
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [rsp + 0x20]
add rsp, 0xb8
ret

Function at 0x180005780
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x18]
mov ecx, dword [rcx + 0x3c]
add ecx, eax
mov eax, ecx
mov eax, eax
add rax, 0x18
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp + 4], 0
jmp 0x180005804
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x10]
add rax, 0x28
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
cmp dword [rsp + 4], eax
jge 0x18000588a
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0xc], ecx
jbe 0x180005827
mov byte [rsp], 0
jmp 0x180005847
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x10]
add eax, dword [rcx + 8]
cmp eax, dword [rsp + 0x48]
ja 0x180005843
mov byte [rsp], 0
jmp 0x180005847
mov byte [rsp], 1
movzx eax, byte [rsp]
test eax, eax
jne 0x180005851
jmp 0x1800057ec
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0xc]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x48], eax
jb 0x180005877
xor eax, eax
jmp 0x18000588c
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x14]
add eax, dword [rsp + 0x48]
jmp 0x18000588c
xor eax, eax
add rsp, 0x38
ret
Function at 0x180007300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, dword [rsp + 0x28]
and eax, 0xff
mov ecx, dword [rsp + 0x28]
shr ecx, 8
and ecx, 0xff
imul eax, ecx
mov byte [rsp + 2], al
mov dword [rsp + 4], 0
jmp 0x180007343
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 4], eax
jae 0x1800073d7
mov eax, dword [rsp + 4]
and eax, 0x7e
movzx ecx, byte [rsp + 2]
imul eax, ecx
add eax, dword [rsp + 4]
mov byte [rsp + 1], al
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov byte [rsp], al
mov eax, dword [rsp + 4]
and eax, 1
test eax, eax
je 0x180007394
movzx eax, byte [rsp]
movzx ecx, byte [rsp + 1]
add eax, ecx
mov dword [rsp + 8], eax
jmp 0x1800073a3
movzx eax, byte [rsp]
movzx ecx, byte [rsp + 1]
sub eax, ecx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 8]
mov byte [rsp], al
movzx eax, byte [rsp]
movzx ecx, byte [rsp + 2]
xor eax, ecx
not eax
movzx ecx, byte [rsp + 0x30]
sub eax, ecx
mov byte [rsp], al
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx edx, byte [rsp]
mov byte [rcx + rax], dl
jmp 0x180007339
add rsp, 0x18
ret
Function at 0x18000b1a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18000b1fd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
jmp 0x18000b234
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x18000b243
xor al, al
jmp 0x18000b2c6
mov dword [rsp + 0x44], 0
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
mov r8b, 0x20
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.18000f5c0
cmp dword [rsp + 0x40], 0
je 0x18000b29a
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jne 0x18000b2b9
mov dword [rsp + 0x48], 1
jmp 0x18000b2c1
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
add rsp, 0x68
ret
Function at 0x18000b9f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18000ba23
mov byte [rsp + 0x20], 0
jmp 0x18000ba54
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18000ba4f
mov byte [rsp + 0x20], 0
jmp 0x18000ba54
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x18000ba61
xor al, al
jmp 0x18000bad8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x18000ba9d
mov dword [rsp + 0x24], 1
jmp 0x18000baa5
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
test eax, eax
je 0x18000bac4
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.180006830
jmp 0x18000bad8
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.180006830
add rsp, 0x58
ret

Function at 0x18000bc00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x60], 0
jne 0x18000bc27
xor eax, eax
jmp 0x18000bd09
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18000bc47
mov byte [rsp + 0x20], 0
jmp 0x18000bc78
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18000bc73
mov byte [rsp + 0x20], 0
jmp 0x18000bc78
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x18000bc88
xor eax, eax
jmp 0x18000bd09
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x18000bcc4
mov dword [rsp + 0x24], 1
jmp 0x18000bccc
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
test eax, eax
je 0x18000bcf0
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.180006d40
jmp 0x18000bd09
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.180006910
add rsp, 0x58
ret
Function at 0x18000e5a0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1c8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x58]
call fcn.180002c60
xor r8d, r8d
lea rdx, str.HTTP_1.1_200_OK_r_n
lea rcx, [rsp + 0x30]
call fcn.18000fa30
xor r8d, r8d
lea rdx, str.Date:
lea rcx, [rsp + 0x30]
call fcn.18000f950
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.18000f950
xor r8d, r8d
lea rdx, str._r_nContent_Length:
lea rcx, [rsp + 0x30]
call fcn.18000f950
mov rax, qword [rsp + 0x1d8]
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov ecx, dword [rsp + 0x40]
call fcn.180005cf0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18000f950
xor r8d, r8d
lea rdx, str._r_nContent_Type:
lea rcx, [rsp + 0x30]
call fcn.18000f950
xor r8d, r8d
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x30]
call fcn.18000f950
xor r8d, r8d
lea rdx, str._r_nConnection:_keep_alive_r_n
lea rcx, [rsp + 0x30]
call fcn.18000f950
xor r8d, r8d
lea rdx, [0x180012268]
lea rcx, [rsp + 0x30]
call fcn.18000f950
mov rdx, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x30]
call fcn.18000fdf0
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x18000e760
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
xor r9d, r9d
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x1d0]
call sub.WS2_32.dll_send
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xffffffff
jne 0x18000e73e
mov dword [rsp + 0x48], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000dfe0
mov eax, dword [rsp + 0x48]
jmp 0x18000e778
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x28], eax
jmp 0x18000e6e0
mov dword [rsp + 0x4c], 1
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000dfe0
mov eax, dword [rsp + 0x4c]
add rsp, 0x1c8
ret
Function at 0x18000f800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18000f85d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
jmp 0x18000f894
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x18000f8a0
xor al, al
jmp 0x18000f902
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 8]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 8]
cmp dword [rsp + 0x40], eax
jne 0x18000f8f5
mov dword [rsp + 0x44], 1
jmp 0x18000f8fd
mov dword [rsp + 0x44], 0
movzx eax, byte [rsp + 0x44]
add rsp, 0x58
ret

Function at 0x18001b940
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180354331
lea rbx, [rbx + 0x15f0cc2]
jmp 0x1803a79e9
mov rbx, qword [rbx + 0xb822e]
jmp 0x1800d92c0
call 0x1e68875d1
movsx ebx, bh
lea rbx, [0x180022375]
jmp 0x180336daa
push 0x139fe77c
call fcn.180598d1f
or cl, byte gs:[rax - 0x4f]
mov ecx, 0x8ee6695e
add dword [rdi - 7], esp
imul esp, esi, 0xf967018e
jns 0x1803542e5
xor byte [rdx], cl
push rax
mov ebp, 0x9a07e967
xchg byte ds:[ebx - 0x2ebeb23f], dl
loopne 0x180354341
jno 0x180354384
invalid
mov ebp, 0x9b7803be
invalid
xchg qword [rsp], rbx
jmp 0x1803d2545
ret
Function at 0x18001e5a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18001e5cd
xor al, al
jmp 0x18001e72f
mov rax, qword [0x18003e6b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x18003e6b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x18003e6c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x18003e6c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x18003e6d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x18003e6d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x18003e6e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x18003e6e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x18003e6f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x18001e721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18001e679
mov r11d, 2
jmp 0x18001e69d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18001e693
mov r11d, 1
jmp 0x18001e69d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x18001e745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18001e6e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18001e6fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18001e70a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x18001e718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x18001e660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18001e72a